@reclaimprotocol/client 0.1.0-dev.2 → 0.1.1

package/lib/reclaim.js

@@ -1,5 +1,5 @@
 import { ReclaimClient } from "./client.js";
-import { loadDecryptionKey, publicPemToJwk, } from "./enckeys.js";
+import { loadDecryptionKey, } from "./enckeys.js";
 import { decryptCallback, verifyResultFull, } from "./result.js";
 /** The three terminal events a subscription can receive. */
 export const TERMINAL_EVENTS = [
@@ -18,11 +18,9 @@ export function createReclaim(config) {
         fetch: config.fetch,
         headers: config.headers,
     });
-    // Load an X25519 decryption key on demand — `undefined` input ⇒ no key, so
+    // Load the eth decryption key on demand — `undefined` input ⇒ no key, so
     // plaintext-only consumers never touch the loader.
-    const resolveKey = (input) => (input === undefined
-        ? Promise.resolve(undefined)
-        : loadDecryptionKey(input));
+    const resolveKey = (input) => (input === undefined ? undefined : loadDecryptionKey(input));
     return {
         api: client.call.bind(client),
         sessions: {
@@ -67,26 +65,32 @@ export function createReclaim(config) {
                 });
             },
         },
-        credential: {
+        keypair: {
             async set(orgId, input) {
-                // Convert the consumer's SPKI public PEM to the JWK the API stores
-                // (PEM at the edge; JWK on the wire/DB/VC stays unchanged).
-                const publicKeyJwk = (await publicPemToJwk(input.publicKeyPem));
-                const { data } = await client.call('SetOrgCredential', {
+                // Forward the eth public key as given (hex or JWK); the API stores
+                // the secp256k1 JWK + derived address.
+                const body = {
+                    ...(input.publicKeyJwk
+                        ? { publicKeyJwk: input.publicKeyJwk }
+                        : { publicKey: input.publicKey }),
+                    canEncryptResult: input.canEncryptResult ?? false,
+                    ...(input.label ? { label: input.label } : {}),
+                };
+                const { data } = await client.call('SetOrgKeypair', {
                     params: { orgId },
-                    body: { publicKeyJwk, label: input.label },
+                    body,
                 });
                 return data;
             },
             async get(orgId) {
                 try {
-                    const { data } = await client.call('GetOrgCredential', {
+                    const { data } = await client.call('GetOrgKeypair', {
                         params: { orgId },
                     });
                     return data;
                 }
                 catch (err) {
-                    // 404 ⇒ no credential set (plaintext delivery).
+                    // 404 ⇒ keyless org (plaintext delivery).
                     if (isNotFound(err)) {
                         return undefined;
                     }
@@ -96,7 +100,7 @@ export function createReclaim(config) {
         },
         results: {
             async decrypt(body, credential) {
-                return decryptCallback(await resolveKey(credential), body);
+                return decryptCallback(resolveKey(credential), body);
             },
             verify(jws, opts) {
                 return verifyResultFull(jws, { fetchImpl: config.fetch, ...opts });
@@ -120,7 +124,7 @@ export function createReclaim(config) {
                     }
                 }
                 const { credential, ...verifyOpts } = opts ?? {};
-                const key = await resolveKey(credential);
+                const key = resolveKey(credential);
                 const jws = await decryptCallback(key, body);
                 const result = await verifyResultFull(jws, {
                     fetchImpl: config.fetch,

package/lib/result.d.ts

@@ -1,6 +1,6 @@
-import type { JWK } from 'jose';
 import type { components } from './types/openapi.gen.ts';
 import type { DecryptionKey } from './enckeys.ts';
+import { type Jwk } from './jwks.ts';
 export interface Jws {
     payload: string;
     signatures: {
@@ -24,23 +24,25 @@ export interface VerifyResultOutcome {
     reclaimSessionId?: string;
 }
 /**
- * JWE-encrypt `plaintext` for the holder of `publicJwk` (an X25519 public JWK,
- * `{kty:'OKP', crv:'X25519', x}`) as a compact JWE (`ECDH-ES + A256GCM`). Used
- * by the first-party Verification Client to encrypt the signed JWS for each
- * Consumer before submitting it to the Builder (which only relays the
- * ciphertext). Consumers never call this — they only {@link decryptCallback}.
+ * ECIES-encrypt `plaintext` for the holder of `publicJwk` (the org's secp256k1
+ * **eth** public JWK, `{kty:'EC', crv:'secp256k1', x, y}`) — `eciesjs` defaults
+ * (secp256k1 + AES-256-GCM). Used by the first-party Verification Client to
+ * encrypt the signed JWS for the Consumer before submitting it to the Builder
+ * (which only relays the ciphertext). Consumers never call this — they only
+ * {@link decryptCallback}.
  *
  * `plaintext` is bytes (e.g. `new TextEncoder().encode(JSON.stringify(jws))`);
- * returns the compact JWE string.
+ * returns the ciphertext as a base64url string (single token, never starts with
+ * `{`, so {@link decryptCallback} can tell it apart from a plaintext JWS JSON).
  */
-export declare function encryptForPublicJwk(publicJwk: JWK, plaintext: Uint8Array): Promise<string>;
+export declare function encryptForEthPublicKey(publicJwk: Jwk, plaintext: Uint8Array): Promise<string>;
 /**
  * What a consumer's callback endpoint receives — the Builder POSTs the JSON
  * `VerificationResultDelivery` envelope: plaintext `sessionId`/`event`/
- * `timestamp` routing hints. For terminal events `data` is a compact JWE
- * string wrapping the signed JWS (or the plaintext JWS JSON when the org has
- * no encryption credential). The envelope is unauthenticated; trust only the
- * decrypted+verified JWS.
+ * `timestamp` routing hints. For terminal events `data` is an ECIES ciphertext
+ * (base64url) wrapping the signed JWS (or the plaintext JWS JSON when the org
+ * has no key / `canEncryptResult` is off). The envelope is unauthenticated;
+ * trust only the decrypted+verified JWS.
  *
  * Derived from the generated spec type so it can't drift; the hint fields
  * are relaxed to optional — decryption only needs `data`.
@@ -50,10 +52,10 @@ export type DeliveryEnvelope = Partial<components['schemas']['VerificationResult
  *  JSON text, its raw body bytes — or a bare compact JWE / JWS string. */
 export type CallbackBody = DeliveryEnvelope | string | Uint8Array | ArrayBuffer;
 /**
- * Decrypt a delivered terminal callback to the signed JWS. `data` is either a
- * compact JWE (decrypted with the X25519 `privateKey`) or — when the org has no
- * encryption credential — the plaintext JWS JSON. A compact JWE has exactly
- * five dot-separated base64url segments; a JSON JWS starts with `{`.
+ * Decrypt a delivered terminal callback to the signed JWS. `data` is either an
+ * ECIES ciphertext (base64url, decrypted with the eth `privateKey` scalar) or —
+ * when the org has no key / `canEncryptResult` is off — the plaintext JWS JSON.
+ * A JSON JWS starts with `{`; anything else is the ECIES ciphertext.
  *
  * `privateKey` may be absent (plaintext delivery); an encrypted delivery with
  * no key throws a clear error.
@@ -88,6 +90,8 @@ export interface VerifyResultFullOptions {
     now?: number;
 }
 export interface ResultProofOutcome {
+    /** Which provider this proof belongs to (results grouped per provider). */
+    providerId?: string;
     requestId?: string;
     proofValid: boolean;
     reason?: string;

package/lib/result.js

@@ -11,32 +11,33 @@
  */
 import { sha256 } from '@noble/hashes/sha2.js';
 import { keccak_256 } from '@noble/hashes/sha3.js';
-import { compactDecrypt, CompactEncrypt, importJWK } from 'jose';
+import { decrypt as eciesDecrypt, encrypt as eciesEncrypt } from 'eciesjs';
 import { verifyNestedProof } from "./attestor-proof.js";
 import { canonicalJson } from "./canonical.js";
 import { b64url, base64urlToBytes, bytesToHex, hexToBytes } from "./encoding.js";
-import { fetchJwks, jwkToUncompressedPublicKey, selectKey } from "./jwks.js";
+import { fetchJwks, jwkToUncompressedPublicKey, selectKey, } from "./jwks.js";
 import { addressFromUncompressedPubkey, secp } from "./secp.js";
 /**
- * JWE-encrypt `plaintext` for the holder of `publicJwk` (an X25519 public JWK,
- * `{kty:'OKP', crv:'X25519', x}`) as a compact JWE (`ECDH-ES + A256GCM`). Used
- * by the first-party Verification Client to encrypt the signed JWS for each
- * Consumer before submitting it to the Builder (which only relays the
- * ciphertext). Consumers never call this — they only {@link decryptCallback}.
+ * ECIES-encrypt `plaintext` for the holder of `publicJwk` (the org's secp256k1
+ * **eth** public JWK, `{kty:'EC', crv:'secp256k1', x, y}`) — `eciesjs` defaults
+ * (secp256k1 + AES-256-GCM). Used by the first-party Verification Client to
+ * encrypt the signed JWS for the Consumer before submitting it to the Builder
+ * (which only relays the ciphertext). Consumers never call this — they only
+ * {@link decryptCallback}.
  *
  * `plaintext` is bytes (e.g. `new TextEncoder().encode(JSON.stringify(jws))`);
- * returns the compact JWE string.
+ * returns the ciphertext as a base64url string (single token, never starts with
+ * `{`, so {@link decryptCallback} can tell it apart from a plaintext JWS JSON).
  */
-export async function encryptForPublicJwk(publicJwk, plaintext) {
-    const key = await importJWK(publicJwk, 'ECDH-ES');
-    return new CompactEncrypt(plaintext)
-        .setProtectedHeader({ alg: 'ECDH-ES', enc: 'A256GCM' })
-        .encrypt(key);
+export async function encryptForEthPublicKey(publicJwk, plaintext) {
+    // Uncompressed `0x04`‖X‖Y bytes — what eciesjs accepts as the recipient key.
+    const pubBytes = hexToBytes(jwkToUncompressedPublicKey(publicJwk));
+    return b64url(eciesEncrypt(pubBytes, plaintext));
 }
 /** Normalize any {@link CallbackBody} to the terminal-result `data` string —
- *  either a compact JWE (`xxxx.yyyy.zzzz.aaaa.bbbb`) or the plaintext JWS JSON
- *  (`{…}`). The envelope object/text wraps it in `.data`; raw bytes are decoded
- *  to text first. */
+ *  either an ECIES ciphertext (base64url) or the plaintext JWS JSON (`{…}`).
+ *  The envelope object/text wraps it in `.data`; raw bytes are decoded to text
+ *  first. */
 function payloadFrom(body) {
     if (typeof body === 'string') {
         const s = body.trim();
@@ -60,10 +61,10 @@ function payloadFrom(body) {
     return body.data;
 }
 /**
- * Decrypt a delivered terminal callback to the signed JWS. `data` is either a
- * compact JWE (decrypted with the X25519 `privateKey`) or — when the org has no
- * encryption credential — the plaintext JWS JSON. A compact JWE has exactly
- * five dot-separated base64url segments; a JSON JWS starts with `{`.
+ * Decrypt a delivered terminal callback to the signed JWS. `data` is either an
+ * ECIES ciphertext (base64url, decrypted with the eth `privateKey` scalar) or —
+ * when the org has no key / `canEncryptResult` is off — the plaintext JWS JSON.
+ * A JSON JWS starts with `{`; anything else is the ECIES ciphertext.
  *
  * `privateKey` may be absent (plaintext delivery); an encrypted delivery with
  * no key throws a clear error.
@@ -75,13 +76,13 @@ export async function decryptCallback(privateKey, body) {
     if (trimmed.startsWith('{')) {
         return JSON.parse(trimmed);
     }
-    // Otherwise it's a compact JWE — five base64url segments.
+    // Otherwise it's an ECIES ciphertext (base64url).
     if (!privateKey) {
-        throw new Error('received an encrypted (JWE) delivery but no decryption credential was '
-            + 'configured — pass the X25519 private key (JWK/PEM): '
+        throw new Error('received an encrypted (ECIES) delivery but no decryption credential was '
+            + 'configured — pass the eth private key (0x-hex): '
             + 'results.receive(body, { credential }) or decrypt(body, credential)');
     }
-    const { plaintext } = await compactDecrypt(trimmed, privateKey);
+    const plaintext = eciesDecrypt(privateKey, base64urlToBytes(trimmed));
     return JSON.parse(new TextDecoder().decode(plaintext));
 }
 /**
@@ -228,48 +229,61 @@ export async function verifyResultFull(jws, opts = {}) {
     if (typeof payload.exp === 'number' && payload.exp < now) {
         return fail('expired');
     }
-    // 3. Per-result nested attestor proof + content_hash binding.
-    const results = Array.isArray(payload.results)
+    // 3. Per-provider, per-request nested attestor proof + content_hash binding.
+    // `results` is grouped by provider: [{ provider_id, resolved_version,
+    // requests: [...] }]. Every request across every provider must verify.
+    const providerResults = Array.isArray(payload.results)
         ? payload.results
         : [];
     const proofs = [];
-    for (const r of results) {
-        const requestId = typeof r.request_id === 'string' ? r.request_id : undefined;
-        if (typeof r.proof !== 'string') {
-            proofs.push({ requestId, proofValid: false, reason: 'proof-missing' });
-            continue;
-        }
-        const np = verifyNestedProof(r.proof, {
-            attestorAddresses: opts.attestorAddresses,
-        });
-        if (!np.valid) {
-            proofs.push({
-                requestId,
-                proofValid: false,
-                reason: np.reason,
-                attestorAddress: np.attestorAddress,
+    for (const prov of providerResults) {
+        const providerId = typeof prov.provider_id === 'string' ? prov.provider_id : undefined;
+        const requests = Array.isArray(prov.requests)
+            ? prov.requests
+            : [];
+        for (const r of requests) {
+            const requestId = typeof r.request_id === 'string' ? r.request_id : undefined;
+            if (typeof r.proof !== 'string') {
+                proofs.push({
+                    providerId, requestId, proofValid: false, reason: 'proof-missing',
+                });
+                continue;
+            }
+            const np = verifyNestedProof(r.proof, {
+                attestorAddresses: opts.attestorAddresses,
             });
-            continue;
-        }
-        if (typeof r.content_hash === 'string' &&
-            r.extracted_parameters &&
-            typeof r.extracted_parameters === 'object') {
-            const params = r.extracted_parameters;
-            if (contentHash(params).toLowerCase() !== r.content_hash.toLowerCase()) {
+            if (!np.valid) {
                 proofs.push({
+                    providerId,
                     requestId,
                     proofValid: false,
-                    reason: 'content-hash-mismatch',
+                    reason: np.reason,
                     attestorAddress: np.attestorAddress,
                 });
                 continue;
             }
+            if (typeof r.content_hash === 'string' &&
+                r.extracted_parameters &&
+                typeof r.extracted_parameters === 'object') {
+                const params = r.extracted_parameters;
+                if (contentHash(params).toLowerCase() !== r.content_hash.toLowerCase()) {
+                    proofs.push({
+                        providerId,
+                        requestId,
+                        proofValid: false,
+                        reason: 'content-hash-mismatch',
+                        attestorAddress: np.attestorAddress,
+                    });
+                    continue;
+                }
+            }
+            proofs.push({
+                providerId,
+                requestId,
+                proofValid: true,
+                attestorAddress: np.attestorAddress,
+            });
         }
-        proofs.push({
-            requestId,
-            proofValid: true,
-            attestorAddress: np.attestorAddress,
-        });
     }
     if (!proofs.every((p) => p.proofValid)) {
         return fail('invalid-proof', { proofs });

package/lib/routes.gen.d.ts

@@ -35,6 +35,10 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/admin/users";
     };
+    readonly AttachLanding: {
+        readonly method: "get";
+        readonly path: "/attach";
+    };
     readonly AttachPage: {
         readonly method: "get";
         readonly path: "/attach/{code}";
@@ -103,14 +107,14 @@ export declare const ROUTES: {
         readonly method: "delete";
         readonly path: "/orgs/{orgId}/callback-subscriptions/{subscriptionId}";
     };
-    readonly DeleteOrgCredential: {
-        readonly method: "delete";
-        readonly path: "/orgs/{orgId}/credential";
-    };
     readonly DeleteOrgIcon: {
         readonly method: "delete";
         readonly path: "/orgs/{orgId}/icon";
     };
+    readonly DeleteOrgKeypair: {
+        readonly method: "delete";
+        readonly path: "/orgs/{orgId}/keypair";
+    };
     readonly DeleteProvider: {
         readonly method: "delete";
         readonly path: "/providers/{providerId}";
@@ -123,6 +127,22 @@ export declare const ROUTES: {
         readonly method: "delete";
         readonly path: "/orgs/{orgId}/themes/{themeId}";
     };
+    readonly DiscoverResolve: {
+        readonly method: "get";
+        readonly path: "/discover/resolve";
+    };
+    readonly DiscoverTeachAgent: {
+        readonly method: "get";
+        readonly path: "/discover/teach";
+    };
+    readonly DiscoverWebsites: {
+        readonly method: "get";
+        readonly path: "/discover/websites";
+    };
+    readonly DisposeVerificationSession: {
+        readonly method: "post";
+        readonly path: "/v/{sessionId}/dispose";
+    };
     readonly Docs: {
         readonly method: "get";
         readonly path: "/docs";
@@ -151,9 +171,9 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/orgs/{orgId}/billing";
     };
-    readonly GetOrgCredential: {
+    readonly GetOrgKeypair: {
         readonly method: "get";
-        readonly path: "/orgs/{orgId}/credential";
+        readonly path: "/orgs/{orgId}/keypair";
     };
     readonly GetOrgSession: {
         readonly method: "get";
@@ -307,18 +327,38 @@ export declare const ROUTES: {
         readonly method: "get";
         readonly path: "/robots.txt";
     };
-    readonly SetOrgCredential: {
+    readonly SearchOrgMembers: {
+        readonly method: "get";
+        readonly path: "/orgs/{orgId}/members";
+    };
+    readonly SetOrgKeypair: {
         readonly method: "put";
-        readonly path: "/orgs/{orgId}/credential";
+        readonly path: "/orgs/{orgId}/keypair";
     };
     readonly SetupProviderCreate: {
         readonly method: "post";
         readonly path: "/providers/setup";
     };
+    readonly SiteBuild: {
+        readonly method: "get";
+        readonly path: "/site/{domain}/build";
+    };
+    readonly SiteBuildTry: {
+        readonly method: "post";
+        readonly path: "/site/{domain}/try";
+    };
     readonly Sitemap: {
         readonly method: "get";
         readonly path: "/sitemap.xml";
     };
+    readonly SitePage: {
+        readonly method: "get";
+        readonly path: "/site/{domain}";
+    };
+    readonly SitePanel: {
+        readonly method: "get";
+        readonly path: "/site/{domain}/panel";
+    };
     readonly SubmitProviderVersionForReview: {
         readonly method: "post";
         readonly path: "/providers/{providerId}/versions/{version}/review";
@@ -331,10 +371,6 @@ export declare const ROUTES: {
         readonly method: "post";
         readonly path: "/providers/{providerId}/transfer";
     };
-    readonly UpdateMe: {
-        readonly method: "patch";
-        readonly path: "/me";
-    };
     readonly UpdateOrg: {
         readonly method: "patch";
         readonly path: "/orgs/{orgId}";

package/lib/routes.gen.js

@@ -12,6 +12,7 @@ export const ROUTES = {
     "AdminSessions": { "method": "get", "path": "/admin/sessions" },
     "AdminThemes": { "method": "get", "path": "/admin/themes" },
     "AdminUsers": { "method": "get", "path": "/admin/users" },
+    "AttachLanding": { "method": "get", "path": "/attach" },
     "AttachPage": { "method": "get", "path": "/attach/{code}" },
     "CancelPublicListingRequest": { "method": "post", "path": "/providers/{providerId}/versions/{version}/cancel-review" },
     "ComponentsDemo": { "method": "get", "path": "/components_demo" },
@@ -29,11 +30,15 @@ export const ROUTES = {
     "DeleteOrg": { "method": "delete", "path": "/orgs/{orgId}" },
     "DeleteOrgBilling": { "method": "delete", "path": "/orgs/{orgId}/billing" },
     "DeleteOrgCallbackSubscription": { "method": "delete", "path": "/orgs/{orgId}/callback-subscriptions/{subscriptionId}" },
-    "DeleteOrgCredential": { "method": "delete", "path": "/orgs/{orgId}/credential" },
     "DeleteOrgIcon": { "method": "delete", "path": "/orgs/{orgId}/icon" },
+    "DeleteOrgKeypair": { "method": "delete", "path": "/orgs/{orgId}/keypair" },
     "DeleteProvider": { "method": "delete", "path": "/providers/{providerId}" },
     "DeleteProviderVersion": { "method": "delete", "path": "/providers/{providerId}/versions/{version}" },
     "DeleteTheme": { "method": "delete", "path": "/orgs/{orgId}/themes/{themeId}" },
+    "DiscoverResolve": { "method": "get", "path": "/discover/resolve" },
+    "DiscoverTeachAgent": { "method": "get", "path": "/discover/teach" },
+    "DiscoverWebsites": { "method": "get", "path": "/discover/websites" },
+    "DisposeVerificationSession": { "method": "post", "path": "/v/{sessionId}/dispose" },
     "Docs": { "method": "get", "path": "/docs" },
     "ExplorePreviewImage": { "method": "get", "path": "/og/explore.png" },
     "GetAttachSession": { "method": "get", "path": "/credentials/attach/sessions/{code}" },
@@ -41,7 +46,7 @@ export const ROUTES = {
     "GetMe": { "method": "get", "path": "/me" },
     "GetOrg": { "method": "get", "path": "/orgs/{orgId}" },
     "GetOrgBilling": { "method": "get", "path": "/orgs/{orgId}/billing" },
-    "GetOrgCredential": { "method": "get", "path": "/orgs/{orgId}/credential" },
+    "GetOrgKeypair": { "method": "get", "path": "/orgs/{orgId}/keypair" },
     "GetOrgSession": { "method": "get", "path": "/orgs/{orgId}/sessions/{sessionId}" },
     "GetOrgToken": { "method": "get", "path": "/orgs/{orgId}/token" },
     "GetProvider": { "method": "get", "path": "/providers/{providerId}" },
@@ -80,13 +85,17 @@ export const ROUTES = {
     "RetryCallbackDlq": { "method": "post", "path": "/verifications/callback-dlq/{dlqId}/retry" },
     "RetryVerificationCallback": { "method": "post", "path": "/verifications/sessions/{sessionId}/retry-callback" },
     "Robots": { "method": "get", "path": "/robots.txt" },
-    "SetOrgCredential": { "method": "put", "path": "/orgs/{orgId}/credential" },
+    "SearchOrgMembers": { "method": "get", "path": "/orgs/{orgId}/members" },
+    "SetOrgKeypair": { "method": "put", "path": "/orgs/{orgId}/keypair" },
     "SetupProviderCreate": { "method": "post", "path": "/providers/setup" },
+    "SiteBuild": { "method": "get", "path": "/site/{domain}/build" },
+    "SiteBuildTry": { "method": "post", "path": "/site/{domain}/try" },
     "Sitemap": { "method": "get", "path": "/sitemap.xml" },
+    "SitePage": { "method": "get", "path": "/site/{domain}" },
+    "SitePanel": { "method": "get", "path": "/site/{domain}/panel" },
     "SubmitProviderVersionForReview": { "method": "post", "path": "/providers/{providerId}/versions/{version}/review" },
     "SubmitVerificationResult": { "method": "post", "path": "/verifications/sessions/{sessionId}/result" },
     "TransferProvider": { "method": "post", "path": "/providers/{providerId}/transfer" },
-    "UpdateMe": { "method": "patch", "path": "/me" },
     "UpdateOrg": { "method": "patch", "path": "/orgs/{orgId}" },
     "UpdateOrgBilling": { "method": "put", "path": "/orgs/{orgId}/billing" },
     "UpdateOrgIcon": { "method": "put", "path": "/orgs/{orgId}/icon" },

package/lib/secp.d.ts

@@ -1,6 +1,5 @@
-import { keccak_256 } from '@noble/hashes/sha3.js';
 import * as secp from '@noble/secp256k1';
-export { keccak_256, secp };
+export { secp };
 /** Lowercase 0x ETH address from an uncompressed (65-byte) public key:
  *  keccak256 of the 64-byte X‖Y (drop the 0x04 prefix), last 20 bytes. */
 export declare function addressFromUncompressedPubkey(pub: Uint8Array): string;

package/lib/secp.js

@@ -13,7 +13,7 @@ secp.hashes.sha256 = sha256;
 secp.hashes.hmacSha256 = (key, msg) => {
     return hmac(sha256, key, msg);
 };
-export { keccak_256, secp };
+export { secp };
 /** Lowercase 0x ETH address from an uncompressed (65-byte) public key:
  *  keccak256 of the 64-byte X‖Y (drop the 0x04 prefix), last 20 bytes. */
 export function addressFromUncompressedPubkey(pub) {

package/lib/types/openapi.d.ts

@@ -80,8 +80,8 @@ export type VerificationResultDelivery = components['schemas']['VerificationResu
 export type ProviderRequiredContext = components['schemas']['ProviderRequiredContext'];
 export type Provider = components['schemas']['Provider'];
 export type ProviderVersion = components['schemas']['ProviderVersion'];
-export type OrgCredential = components['schemas']['OrgCredential'];
-export type JwkX25519Public = components['schemas']['JwkX25519Public'];
+export type OrgKeypair = components['schemas']['OrgKeypair'];
+export type JwkSecp256k1Public = components['schemas']['JwkSecp256k1Public'];
 export type OrgToken = components['schemas']['OrgToken'];
 export type OrgTokenMeta = components['schemas']['OrgTokenMeta'];
 export type Organization = components['schemas']['Organization'];