@reclaimprotocol/agent 0.1.29 → 0.1.31

package/lib/old/flag.js

@@ -2,11 +2,8 @@
  * `USE_OLD_DEVTOOLS` — single source of truth for which backend the MCP
  * server targets.
  *
- * Defaults to OLD devtools (the system still in production) while the new
- * "builder" backend is under development. Builder mode must be opted into
- * EXPLICITLY by setting `USE_OLD_DEVTOOLS=false`. Anything else — unset,
- * empty, `true`, `1`, a typo — keeps old mode on, so a forgotten env var
- * can never silently route a developer at the half-built builder backend.
+ * Builder is the default. Only `true` or `1` explicitly selects old devtools;
+ * an unset value or typo stays on Builder.
  *
  * The actual env read lives in `../consts.ts` (the single env-access module);
  * this widely-imported path re-exports it for back-compat.

package/lib/old/instructions.d.ts

@@ -1,6 +1,6 @@
 /**
  * MCP server instructions shown to the LLM when running in OLD-devtools mode
- * (`USE_OLD_DEVTOOLS` unset or not `false`). Describes the REDUCED tool
+ * (`USE_OLD_DEVTOOLS=true` or `1`). Describes the REDUCED tool
  * surface — there are no org/credential-link/review flows and no generated
  * API tools here. Both modes' instructions load together in
  * `mcp/instructions` (alongside the topic-split authoring guide); re-exported

package/lib/old/instructions.js

@@ -1,6 +1,6 @@
 /**
  * MCP server instructions shown to the LLM when running in OLD-devtools mode
- * (`USE_OLD_DEVTOOLS` unset or not `false`). Describes the REDUCED tool
+ * (`USE_OLD_DEVTOOLS=true` or `1`). Describes the REDUCED tool
  * surface — there are no org/credential-link/review flows and no generated
  * API tools here. Both modes' instructions load together in
  * `mcp/instructions` (alongside the topic-split authoring guide); re-exported

package/lib/old/to-register.d.ts

@@ -61,9 +61,10 @@ export interface OldProviderOpts {
      *  .interceptorOptions.isDocumentRequestReplayEnabled`, is likewise always
      *  force-disabled by `providerToCreateVersionRequest`. */
     disableRequestReplay?: boolean;
-    /** Interception mechanism — `NONE` (the publish tool's default) for the
-     *  standard capture→replay flow; `HAWKEYE`/`MSWJS`/`XHOOK`/`CDP` for a
-     *  genuine live-interception provider. Old-devtools calls this
+    /** Interception mechanism. Omit it to use the backend's `HAWKEYE` default;
+     *  use `NONE` only when disabling interception after diagnosis.
+     *  `HAWKEYE`/`MSWJS`/`XHOOK`/`CDP` enable live interception. Old-devtools
+     *  calls this
      *  `injectionType`; builder's equivalent is `webSettings.clientOptions
      *  .inapp.interceptorOptions.interceptorType` (no `NONE` value there —
      *  omitting the whole object is builder's no-interception signal

package/lib/old/tools/publish.js

@@ -373,20 +373,12 @@ export function createVersionFromCaptureTool(client, attachRef) {
                 injectionType: {
                     type: 'string',
                     enum: ['NONE', 'MSWJS', 'XHOOK', 'CDP', 'HAWKEYE'],
-                    description: 'Interception mechanism for this version. Omit to leave it ' +
-                        'unset — the devtools backend\'s own column default ' +
-                        '(`HAWKEYE`) applies, which is inert and harmless for the ' +
-                        'standard capture→replay flow with no interceptor script ' +
-                        'installed. Only set `HAWKEYE`/`MSWJS`/`XHOOK` when you are ' +
-                        'ALSO supplying a `customInjection` script that calls ' +
-                        '`window.reclaimInterceptor.addResponseMiddleware(...)` for ' +
-                        'genuine live interception, or set `NONE` explicitly to be ' +
-                        'certain none is configured. Builder calls the equivalent ' +
-                        'concept `interceptorType` (no `NONE` there — omitting the ' +
-                        'whole `interceptorOptions` object is its no-interception ' +
-                        'signal instead). ' + COOKIE_ATTACHMENT_HINT +
-                        'What each value actually does: ' +
-                        'how_it_works({ topic: "interception" }).',
+                    description: 'Live-interception mechanism. Omit it for the standard flow. ' +
+                        'Use `NONE` only to confirm a suspected interception problem; ' +
+                        'if that fixes the provider, keep `NONE` and use ' +
+                        '`window.Reclaim.requestClaim(...)`. For selection rules, call ' +
+                        'how_it_works({ topic: "interception" }). ' +
+                        COOKIE_ATTACHMENT_HINT,
                 },
                 disableRequestReplay: {
                     type: 'boolean',
@@ -407,6 +399,11 @@ export function createVersionFromCaptureTool(client, attachRef) {
         assert(!(args.version && args.bump), badRequest('Pass either `version` or `bump`, not both.'));
         assert(args.providerId || (!args.version && !args.bump), badRequest('`version` and `bump` require `providerId`; new-provider ' +
             'registration starts at the backend-defined version.'));
+        assert(args.injectionType !== 'NONE'
+            || !args.customInjection?.includes('addResponseMiddleware'), badRequest('`injectionType: NONE` cannot deliver ' +
+            '`addResponseMiddleware` traffic. Use an interceptor type, or ' +
+            'keep `NONE` and replace intercepted requests with ' +
+            '`window.Reclaim.requestClaim(...)`.'));
         // `provider` / `providers` are just two spellings of the same input —
         // fold them into one array. Zero drafts is allowed ONLY when adding a
         // version to an EXISTING provider (`providerId` set): that publishes

package/lib/proof/attestor-auth.d.ts

@@ -9,5 +9,13 @@ export interface AttestorAuthentication {
 /**
  * Create legacy-compatible attestor authorization when the deployment has an
  * auth private key. An absent key intentionally means authentication is off.
+ *
+ * `expiresInSeconds` overrides the attestor library's default lifetime. A
+ * zkFetch authorization uses a very short one: the attestor validates expiry
+ * once, when it authenticates the connection, and never again for the life of
+ * that connection — so the window only has to cover the caller receiving the
+ * token and opening its socket, not the proof that follows.
  */
-export declare function createAttestorAuthentication(sessionId: string, privateKey: string | undefined): Promise<AttestorAuthentication | undefined>;
+export declare function createAttestorAuthentication(sessionId: string, privateKey: string | undefined, opts?: {
+    expiresInSeconds?: number;
+}): Promise<AttestorAuthentication | undefined>;

package/lib/proof/attestor-auth.js

@@ -2,12 +2,25 @@ import { createAuthRequest } from '@reclaimprotocol/attestor-core';
 /**
  * Create legacy-compatible attestor authorization when the deployment has an
  * auth private key. An absent key intentionally means authentication is off.
+ *
+ * `expiresInSeconds` overrides the attestor library's default lifetime. A
+ * zkFetch authorization uses a very short one: the attestor validates expiry
+ * once, when it authenticates the connection, and never again for the life of
+ * that connection — so the window only has to cover the caller receiving the
+ * token and opening its socket, not the proof that follows.
  */
-export async function createAttestorAuthentication(sessionId, privateKey) {
+export async function createAttestorAuthentication(sessionId, privateKey, opts = {}) {
     if (!privateKey?.trim()) {
         return undefined;
     }
-    const request = await createAuthRequest({ id: sessionId }, privateKey);
+    const request = await createAuthRequest({
+        id: sessionId,
+        ...(opts.expiresInSeconds === undefined
+            ? {}
+            : {
+                expiresAt: Math.floor(Date.now() / 1000) + opts.expiresInSeconds,
+            }),
+    }, privateKey);
     const token = Buffer.from(JSON.stringify({
         ...request,
         signature: Buffer.from(request.signature).toString('base64'),

package/lib/proof/attestor.d.ts

@@ -36,7 +36,7 @@ export interface RunAttestorProofOptions {
      *  want gnark's speed pin it explicitly (for example, the verify runner). */
     zkEngine?: 'gnark' | 'snarkjs' | 'stwo';
     /** Extract the structured {@link AttestorClaim} (claim + attestor signature)
-     *  onto the result for legacy Proof construction. */
+     *  onto the result for Proof construction. */
     includeAttestorClaim?: boolean;
 }
 export interface ProofResult {
@@ -47,7 +47,7 @@ export interface ProofResult {
     owner?: string;
     verified: boolean;
     error?: string;
-    /** Structured claim + signature for legacy Proof verification. Set only when
+    /** Structured claim + signature for Proof verification. Set only when
      *  `includeAttestorClaim` was requested and the claim carries signatures. */
     attestorClaim?: AttestorClaim;
     /** Set to `'missing-owner-key'` when no credential was available to

package/lib/proof/attestor.js

@@ -14,7 +14,7 @@ import "./patch-domhandler.js";
 import { agentTraceEnabled } from "../consts.js";
 import { resolveEthKey } from "../mcp/tools/authenticate/eth-key.js";
 import { installResponseDump } from "./debug-response-dump.js";
-import { buildHttpParams, ensureAttestorCrypto, parseClaim, resolveAttestorUrl } from "./proof-core.js";
+import { buildHttpParams, claimRejection, ensureAttestorCrypto, parseClaim, resolveAttestorUrl } from "./proof-core.js";
 import { ensureZkFiles } from "./zk-files.js";
 /** Trim a captured log stream to the last N entries — for shrinking the
  *  LLM-visible response while the full stream stays in the on-disk dump. */
@@ -180,6 +180,24 @@ export async function runAttestorProof(provider, secrets, opts = {}) {
             }
             return errorResult;
         }
+        // The attestor reports a rejected claim (for example, an invalid ZK proof)
+        // in the response rather than by throwing, so a returned value alone is
+        // not a proof: it needs a claim, a claim signature, and no error.
+        const rejection = claimRejection(claim);
+        if (rejection !== undefined) {
+            const rejected = {
+                proof: claim,
+                extractedValue: '',
+                extractedParameters: {},
+                verified: false,
+                error: rejection,
+                sentParams: params,
+            };
+            if (attestorLogs !== undefined) {
+                rejected.attestorLogs = attestorLogs;
+            }
+            return rejected;
+        }
         const { extractedValue, extractedParameters, identifier, owner, claimData } = parseClaim(claim);
         const result = {
             proof: claim,
@@ -194,7 +212,7 @@ export async function runAttestorProof(provider, secrets, opts = {}) {
             result.owner = owner;
         }
         // Structured claim + signature so the result JWS can carry the exact
-        // legacy Proof the Consumer verifies independently.
+        // Proof the Consumer verifies independently.
         if (opts.includeAttestorClaim) {
             const sigs = claim.signatures;
             if (claimData

package/lib/proof/pod-prover.js

@@ -27,7 +27,7 @@
  * The pod API is unauthenticated (gateway/session is the trust boundary); call
  * it over the same internal host used for CDP. Consumers verify
  * `claim_signature` with the legacy SDK's `verifyProof`, so this hands back an
- * {@link AttestorClaim} that the app places in the exact legacy `Proof` shape.
+ * {@link AttestorClaim} that the app places in the exact `Proof` shape.
  * `result_signature` is unused by consumers.
  */
 import { bytesToHex } from '@noble/hashes/utils.js';

package/lib/proof/proof-core.d.ts

@@ -29,6 +29,10 @@ export interface ParsedClaim {
     identifier?: string;
     owner?: string;
 }
+/** Why the attestor did not sign `claim`, or `undefined` when it did. The
+ *  attestor returns rejections (for example, an invalid ZK proof) as a
+ *  response with `error` set and no claim signature, not by throwing. */
+export declare function claimRejection(claim: unknown): string | undefined;
 /** Pull claimData + decoded `context.extractedParameters` (plus identifier /
  *  owner) out of a `createClaimOnAttestor` result. The full result still
  *  carries signatures the caller may need for nested-proof building. */

package/lib/proof/proof-core.js

@@ -46,6 +46,26 @@ export function buildHttpParams(provider) {
         ...(geoLocation !== undefined && { geoLocation }),
     };
 }
+/** Why the attestor did not sign `claim`, or `undefined` when it did. The
+ *  attestor returns rejections (for example, an invalid ZK proof) as a
+ *  response with `error` set and no claim signature, not by throwing. */
+export function claimRejection(claim) {
+    const response = claim;
+    const error = response?.error;
+    if (error?.message || error?.code) {
+        return typeof error.message === 'string' && error.message
+            ? error.message
+            : `attestor error code ${String(error.code)}`;
+    }
+    if (!response?.claim) {
+        return 'attestor returned no claim';
+    }
+    const signature = response.signatures?.claimSignature;
+    if (!(signature instanceof Uint8Array) || !signature.length) {
+        return 'attestor did not sign the claim';
+    }
+    return undefined;
+}
 /** Pull claimData + decoded `context.extractedParameters` (plus identifier /
  *  owner) out of a `createClaimOnAttestor` result. The full result still
  *  carries signatures the caller may need for nested-proof building. */

package/lib/provider/injection-doc.d.ts

@@ -20,6 +20,7 @@ export declare const COOKIE_ATTACHMENT_HINT: string;
 export declare const USER_SCRIPT_HINT: string;
 /** Prefixes the `allowedJsRequests` / `allowedInjectedRequestData` field. The
  *  trap it describes is silent and total — a mis-declared entry makes
- *  `verifyProof({ providerId })` reject EVERY real proof — so the warning
- *  itself stays in the schema even though its explanation moved to a topic. */
+ *  `verifyRequestProof({ providerId })` reject EVERY real proof — so the
+ *  warning itself stays in the schema even though its explanation moved to a
+ *  topic. */
 export declare const ALLOWED_REQUESTS_HINT: string;

package/lib/provider/injection-doc.js

@@ -28,16 +28,18 @@ export const USER_SCRIPT_HINT = 'Plain JavaScript injected into the provider pag
     + 'Full guide: how_it_works({ topic: "user-script" }).';
 /** Prefixes the `allowedJsRequests` / `allowedInjectedRequestData` field. The
  *  trap it describes is silent and total — a mis-declared entry makes
- *  `verifyProof({ providerId })` reject EVERY real proof — so the warning
- *  itself stays in the schema even though its explanation moved to a topic. */
+ *  `verifyRequestProof({ providerId })` reject EVERY real proof — so the
+ *  warning itself stays in the schema even though its explanation moved to a
+ *  topic. */
 export const ALLOWED_REQUESTS_HINT = '⚠️ Only populate this if you intend to gate '
-    + '`verifyProof(proof, { providerId })`: each entry feeds a client-side '
-    + 'hash-equality check and its `url` is hashed VERBATIM (no regex/template '
-    + 'resolution, even with urlType REGEX/TEMPLATE). If the real captured URL '
-    + 'carries ANY per-session part (nonce, CSRF token, cache-busting '
-    + 'timestamp), no declared spec can ever hash-match a real proof — '
-    + 'populating it then makes verifyProof reject every real proof, which is '
-    + 'worse than leaving it empty. Diff the same endpoint\'s captured URL '
-    + 'across two sessions first. Mechanics, the body-templating rules and the '
+    + '`verifyRequestProof(proof, { providerId })`: each entry feeds a '
+    + 'client-side hash-equality check and its `url` is hashed VERBATIM (no '
+    + 'regex/template resolution, even with urlType REGEX/TEMPLATE). If the '
+    + 'real captured URL carries ANY per-session part (nonce, CSRF token, '
+    + 'cache-busting timestamp), no declared spec can ever hash-match a real '
+    + 'proof — populating it then makes verifyRequestProof reject every real '
+    + 'proof, which is worse than leaving it empty. Diff the same endpoint\'s '
+    + 'captured URL across two sessions first. Mechanics, the '
+    + 'body-templating rules and the '
     + 'dangerouslyDisableContentValidation fallback: '
     + 'how_it_works({ topic: "hash-validation" }).';

package/lib/provider/matcher.js

@@ -237,42 +237,46 @@ function findJsonPath(body, target) {
         return undefined;
     }
     const candidates = normalizeCandidates(target);
-    return walk(parsed, '$', candidates);
+    const paths = [];
+    collectJsonPaths(parsed, '$', candidates, paths);
+    if (paths.length > 1) {
+        throw new Error(`target value "${target}" occurs at multiple JSON paths `
+            + `(${paths.join(', ')}) — choose a value that identifies one field`);
+    }
+    return paths[0];
 }
-function walk(node, path, candidates) {
+function collectJsonPaths(node, path, candidates, paths) {
+    // Two paths are enough to prove ambiguity and keep traversal bounded for a
+    // response containing the same primitive many times.
+    if (paths.length > 1) {
+        return;
+    }
     if (node === null || node === undefined) {
-        return undefined;
+        return;
     }
     if (typeof node === 'string' ||
         typeof node === 'number' ||
         typeof node === 'boolean') {
         const str = String(node);
         if (candidates.includes(str)) {
-            return path;
+            paths.push(path);
         }
-        return undefined;
+        return;
     }
     if (Array.isArray(node)) {
         for (const [i, element] of node.entries()) {
-            const found = walk(element, `${path}[${i}]`, candidates);
-            if (found) {
-                return found;
-            }
+            collectJsonPaths(element, `${path}[${i}]`, candidates, paths);
         }
-        return undefined;
+        return;
     }
     if (typeof node === 'object') {
         for (const [k, v] of Object.entries(node)) {
             const childPath = /^[A-Za-z_][A-Za-z0-9_]*$/.test(k)
                 ? `${path}.${k}`
                 : `${path}["${k}"]`;
-            const found = walk(v, childPath, candidates);
-            if (found) {
-                return found;
-            }
+            collectJsonPaths(v, childPath, candidates, paths);
         }
     }
-    return undefined;
 }
 // ---------------------------------------------------------------------------
 // HTML: element  →  xPath redaction + `contains "<tag …>{{v}}</tag>"`

package/lib/provider/to-version.d.ts

@@ -57,6 +57,9 @@ export interface CreateVersionOptions {
     jsUserScripts?: string;
     /** Requests the injection script may fire, as `RequestSelectionTemplate`s. */
     allowedJsRequests?: AllowedJsRequest[];
+    /** Portal-only authenticated actions exposed as
+     *  `window.Reclaim.browserRequest`. */
+    browserRequestActions?: NonNullable<CreateProviderVersionRequest['webSettings']['browserRequestActions']>;
     /** In-app interception options, mapped to
      *  `webSettings.clientOptions.inapp.interceptorOptions` — ONLY when this
      *  is explicitly passed (builder's schema has no `NONE` interceptorType;

package/lib/provider/to-version.js

@@ -104,7 +104,7 @@ function pickGeoLocation(providers) {
     return DYNAMIC_GEO;
 }
 export function providerToCreateVersionRequest(providers, initialUrl, opts = {}) {
-    const { notes, version, requiredContext: requestedContext, jsUserScripts, allowedJsRequests, interceptorOptions, } = opts;
+    const { notes, version, requiredContext: requestedContext, jsUserScripts, allowedJsRequests, browserRequestActions, interceptorOptions, } = opts;
     const requiredContext = requestedContext ?? deriveRequiredContext(providers, { allowedJsRequests, jsUserScripts });
     // Each injected request carries its template flags (default true/true per
     // RequestSelectionTemplate) on top of the shared request shape.
@@ -157,6 +157,7 @@ export function providerToCreateVersionRequest(providers, initialUrl, opts = {})
             },
             // Only set when non-empty; an empty string would store a no-op script.
             ...(script ? { jsUserScripts: script } : {}),
+            ...(browserRequestActions?.length ? { browserRequestActions } : {}),
         },
         // Derived from `{{context.<name>}}` placeholders only — a captured
         // provider's `paramValues` are extracted response parameters, not

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/agent",
 	"title": "Reclaim Agent",
-	"version": "0.1.29",
+	"version": "0.1.31",
 	"description": "Reclaim Protocol tools for AI coding agents. Reclaim lets your app verify data points about its users, such as a follower count, an account balance, or an order history. This package is the Reclaim MCP server: it gives your agent the tools to find, build, test, and fix data verification providers by capturing and replaying browser requests, drafting provider recipes, running zkTLS proofs, and publishing provider versions.",
 	"type": "module",
 	"main": "./lib/index.js",
@@ -82,8 +82,8 @@
 		"@hapi/boom": "^9.1.4",
 		"@modelcontextprotocol/sdk": "^1.29.0",
 		"@noble/hashes": "^2.2.0",
-		"@reclaimprotocol/attestor-core": "^5.0.8",
-		"@reclaimprotocol/client": "0.1.29",
+		"@reclaimprotocol/attestor-core": "^5.1.5",
+		"@reclaimprotocol/client": "0.1.31",
 		"@reclaimprotocol/tls": "^0.1.3",
 		"chrome-remote-interface": "^0.33.0",
 		"domhandler": "^6.0.0",

package/skill/SKILL.builder.md

@@ -3,7 +3,9 @@
 
 For claimant-facing Builder-client integration, result verification, or optional
 TEE binding, read topic `integration`. Keep URLs without `api=2` on the
-existing legacy path.
+existing legacy path. For an asynchronous volunteer contribution to a
+public-contribution-enabled provider, read topic `contributions` before using
+Builder.
 
 <!-- common: terminology -->
 
@@ -37,14 +39,6 @@ Multi-request provider? Run steps 5–8 once per request, then publish every
 proven draft in one call. See topic `publish`.
 
 <!-- topic: contributions -->
-## Public provider contributions
-
-For an asynchronous volunteer contribution, read
-[community-contributions.md](community-contributions.md) before using Builder.
-It defines the history-first workflow, approved-field allowlist, fixed-US
-egress, privacy boundaries, generalized recipe checks, and candidate review.
-Never modify a published version in place; create a candidate and submit it
-for review.
 
 <!-- topic: auth -->
 ## Getting authenticated
@@ -114,8 +108,18 @@ integration. Prefer Builder for new integrations.
 <!-- topic: draft -->
 ## Draft the provider
 
+## Contents
+
+- [Choose a privacy mode](#choose-a-privacy-mode)
+- [Draft and inspect the request](#draft-and-inspect-the-request)
+- [Preserve the canonical shape](#preserve-the-canonical-shape)
+
+### Choose a privacy mode
+
 <!-- common: oprf -->
 
+### Draft and inspect the request
+
 **Call `propose_provider`.** It returns a **`draftId`** — the handle for
 `replay_request` and `run_proof` — plus the secret-free `provider` and
 `secretRefs`. The recipe **and the captured secret values** live server-side
@@ -179,11 +183,22 @@ synthesizer does this for you.
 With `hash: 'oprf-raw'`, the redaction gains `"hash": "oprf-raw"`. Nothing else
 changes.
 
+### Preserve the canonical shape
+
 <!-- common: rewrite-shape-block -->
 
 <!-- topic: params -->
 ## Parameters: extracted, consumer-supplied, and secret
 
+## Contents
+
+- [Choose the parameter source](#choose-the-parameter-source)
+- [Protect secret values](#protect-secret-values)
+- [Hide internal fields from claimant UI](#hide-internal-fields-from-claimant-ui)
+- [Understand runtime resolution](#how-the-verification-client-resolves-these-at-runtime)
+
+### Choose the parameter source
+
 **Parameterize user-specific URL segments** so the provider isn't pinned to one
 user. The matcher already puts the *captured* value in `paramValues`. If the
 consumer knows a URL value before verification and the proof must be pinned to
@@ -328,8 +343,8 @@ or archive an existing version to apply provider changes.
   drives login/waits/navigation so the target request fires), or
   `allowedJsRequests` (extra requests the script may fire, for example,
   pagination). → topic `user-script`. Before populating `allowedJsRequests` for
-  a `verifyProof({ providerId })` use case, read topic `hash-validation` — a
-  session-unique URL there makes verifyProof reject every real proof.
+  a `verifyRequestProof({ providerId })` use case, read topic `hash-validation` — a
+  session-unique URL there makes verifyRequestProof reject every real proof.
 
 **3. `requiredContext` is derived for you.** The publish tool scans the recipe's
 url/body for `{{context.<name>}}` placeholders and emits a JSON Schema requiring
@@ -387,76 +402,6 @@ For client integration, result verification, or TEE binding, read topic
 `integration`.
 
 <!-- topic: integration -->
-## Integrate a Builder Verification Client
-
-**Verification sessions.** Consumers authenticate with a per-org token
-(`rorg_…`, issued in the dashboard via `POST /orgs/{orgId}/token`) and create
-sessions via `POST /verifications/sessions`. Results are ECIES-encrypted
-(secp256k1 + AES-256-GCM) to the org's eth public key when `canEncryptResult` is
-enabled (set via `PUT /orgs/{orgId}/keypair`) and delivered to the org's
-callback subscriptions; plaintext otherwise. Troubleshoot with
-`get_verification_session`, `list_verification_events`,
-`list_org_verification_sessions`.
-
-For a claimant-facing Builder-mode integration, share the returned
-`verificationUrl` (it contains the session id and `api=2`). Append client-owned
-redirect parameters only after session creation. Append `diag=1` only for a
-deliberate troubleshooting launch; it can enable logs containing personal data.
-The registered client resolves its own `x-reclaim-vc-id`; do not invent a
-client token or put callback/redirect fields in the session request. Consumers
-should verify terminal deliveries with `verifyResultFull` and the session's
-trusted issuer.
-
-An optional `themeId` on session creation selects an active theme owned by the
-organization. Omit it to snapshot the organization's most recently updated
-active theme. A theme's localized `consent` block makes supported clients show
-consent before the first provider; no block means no consent screen. Theme and
-branding data never affect proof trust.
-
-**Browser extension.** For the exact `api=2` URL, use
-`reclaimExtensionSDK.fromVerificationUrl` or `initBuilder` with the session's
-`verificationClientId`, then call `startVerification()`. The extension
-generates and persists `claimantClientId` when omitted, resolves recipes from
-bootstrap, runs them sequentially, and sends `x-reclaim-vc-id` to every bridge
-route, including session-bound `attestor-auth`. It forwards raw legacy proofs
-inside the Builder result and does not perform client-side `allowedJsRequests`
-validation. Builder recipes support dotted `{{context.key}}` templates; the
-extension forwards matching session context to claim creation. Builder mode
-skips legacy offscreen session-status calls and uses the Builder bridge for
-session lifecycle updates. It emits `verification_result_submitting` and
-`verification_result_submission_failed` when applicable. It does not send
-terminal success or error as a separate best-effort event; the results request
-makes the bridge record the matching terminal event strongly before signing
-and storing result deliveries. Missing or unknown `api` values stay on the
-existing `init` / `fromJsonString` / direct-callback path.
-
-**Builder client bridge.** In `api=2` mode, the registered client UUID is sent
-in `x-reclaim-vc-id` to these routes:
-
-| Route | Purpose |
-| --- | --- |
-| `GET /api/sdk/builder/v2/sessions/{sessionId}/bootstrap` | Load the session and resolved recipe. |
-| `PATCH /api/sdk/builder/v2/sessions/{sessionId}/claimant` | Update claimant diagnostics. |
-| `POST /api/sdk/builder/v2/sessions/{sessionId}/events` | Report canonical lower-snake-case events. |
-| `POST /api/sdk/builder/v2/sessions/{sessionId}/attestor-auth` | Request session-bound attestor authentication. Do not send a legacy app secret or provider signature. |
-| `POST /api/sdk/builder/v2/sessions/{sessionId}/results` | Submit exact legacy proof objects; the bridge records the matching terminal event strongly before signing and storing result deliveries. |
-
-The bridge preserves each legacy proof and signs only the outer Verification
-Client JWS. `verifyResultFull` validates the issuer, JWS, session, audience,
-and expiry, then passes each exact proof to `verifyProof`. Keep TEE settings in
-the legacy verifier configuration; do not add verification hooks. Treat outer
-`extracted_parameters` and `content_hash` as diagnostics, not trust inputs.
-
-**Optional TEE binding.** A consumer can pass
-`teeAttestation: { appSecret }` to `sessions.create`. The SDK derives the
-hash nonce locally with the pinned `@reclaimprotocol/js-sdk` formula, signs
-the binding payload with EIP-191, and registers it with
-`PUT /verifications/sessions/{sessionId}/tee-nonce` using the organization
-token. The private key stays in the consumer process. Bind before proof
-generation. The binding is idempotent for the same values and immutable
-afterward; this helper registers only `RECLAIM_TEE_NONCE_V1` (`v3`). Legacy
-`verifyProof` accepts the older signature nonce, but this helper does not
-generate or register it.
 
 <!-- topic: never-do -->
 ## Things to never do
@@ -491,8 +436,10 @@ turn
 document replay off and keep the interceptor (`disableRequestReplay: true`, or
 `isDocumentRequestReplayEnabled: false` on builder) — often that alone is what
 breaks the page, and it's the smallest change. Only if that doesn't help, turn
-interception off entirely (`injectionType: NONE`, or omit
-`interceptorOptions`). Full checklist and remedies: topic `interception`.
+interception off temporarily to confirm it is the cause (`injectionType: NONE`,
+or omit `interceptorOptions`). If that fixes the provider, keep interception
+off and replace intercepted claims with `window.Reclaim.requestClaim`. Full
+checklist and remedies: topic `interception`.
 
 **Proof failures / attestor errors** → topic `prove`.
 **Browser won't launch or attach** → topic `browser`.