@reclaimprotocol/client 0.1.27 → 0.1.28

package/lib/api-client.d.ts

@@ -0,0 +1,31 @@
+import type { IOperationArgs, IOperationId, IOperationResponse } from './types/openapi.ts';
+export type ReclaimApiClientOptions = {
+    /** Backend base URL. Defaults to the public Builder API. */
+    baseUrl?: string;
+    /** Bearer token for authenticated operations. */
+    token?: string;
+    /** Custom fetch implementation. Defaults to global `fetch`. */
+    fetch?: typeof fetch;
+    /** Extra headers merged into every request. */
+    headers?: Record<string, string>;
+    /** Error mapper for unsuccessful responses. */
+    handleErrorResponse?: (response: Response) => Promise<never>;
+};
+/**
+ * Browser-safe typed HTTP client generated from the Builder OpenAPI contract.
+ *
+ * This transport doesn't import proof, signing, attestor, or Node-only code.
+ * Validation remains in the OpenAPI schema; this client only serializes the
+ * typed request and maps unsuccessful responses.
+ */
+export declare class ReclaimApiClient {
+    #private;
+    readonly baseUrl: string;
+    constructor(opts?: ReclaimApiClientOptions);
+    setToken(token: string | undefined): void;
+    getToken(): string | undefined;
+    call<T extends IOperationId>(operationId: T, ...argsRest: {} extends IOperationArgs<T> ? [args?: IOperationArgs<T>] : [args: IOperationArgs<T>]): Promise<{
+        data: IOperationResponse<T>;
+        response: Response;
+    }>;
+}

package/lib/api-client.js

@@ -0,0 +1,112 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _ReclaimApiClient_token, _ReclaimApiClient_fetch, _ReclaimApiClient_headers, _ReclaimApiClient_handleErrorResponse;
+import { API_DEFAULT_BASE_URL } from "./api-consts.js";
+import { throwApiProblemError } from "./api-errors.js";
+import { ROUTES } from "./routes.gen.js";
+/**
+ * Browser-safe typed HTTP client generated from the Builder OpenAPI contract.
+ *
+ * This transport doesn't import proof, signing, attestor, or Node-only code.
+ * Validation remains in the OpenAPI schema; this client only serializes the
+ * typed request and maps unsuccessful responses.
+ */
+export class ReclaimApiClient {
+    constructor(opts = {}) {
+        _ReclaimApiClient_token.set(this, void 0);
+        _ReclaimApiClient_fetch.set(this, void 0);
+        _ReclaimApiClient_headers.set(this, void 0);
+        _ReclaimApiClient_handleErrorResponse.set(this, void 0);
+        this.baseUrl = (opts.baseUrl || API_DEFAULT_BASE_URL).replace(/\/$/, '');
+        __classPrivateFieldSet(this, _ReclaimApiClient_token, opts.token, "f");
+        __classPrivateFieldSet(this, _ReclaimApiClient_fetch, opts.fetch || fetch, "f");
+        __classPrivateFieldSet(this, _ReclaimApiClient_headers, {
+            Accept: 'application/json',
+            ...opts.headers,
+        }, "f");
+        __classPrivateFieldSet(this, _ReclaimApiClient_handleErrorResponse, opts.handleErrorResponse
+            || throwApiProblemError, "f");
+    }
+    setToken(token) {
+        __classPrivateFieldSet(this, _ReclaimApiClient_token, token, "f");
+    }
+    getToken() {
+        return __classPrivateFieldGet(this, _ReclaimApiClient_token, "f");
+    }
+    async call(operationId, ...argsRest) {
+        const args = argsRest[0] ?? {};
+        const op = ROUTES[operationId];
+        // A browser entry point can't depend on node:assert. This guard also
+        // protects JavaScript callers that bypass the generated operation type.
+        if (!op) {
+            throw Object.assign(new Error(`Unknown operation: ${String(operationId)}`), { name: 'UnknownOperationError' });
+        }
+        let url = `${this.baseUrl}${op.path}`;
+        if (args.params) {
+            for (const [key, value] of Object.entries(args.params)) {
+                url = url.replace(`{${key}}`, String(value));
+            }
+        }
+        if (args.query && Object.keys(args.query).length > 0) {
+            const search = new URLSearchParams();
+            for (const [key, value] of Object.entries(args.query)) {
+                if (value === undefined || value === null) {
+                    continue;
+                }
+                if (Array.isArray(value)) {
+                    for (const item of value) {
+                        search.append(key, String(item));
+                    }
+                }
+                else {
+                    search.append(key, String(value));
+                }
+            }
+            url += `?${search.toString()}`;
+        }
+        const headers = {
+            ...__classPrivateFieldGet(this, _ReclaimApiClient_headers, "f"),
+            Accept: 'application/json',
+        };
+        if (__classPrivateFieldGet(this, _ReclaimApiClient_token, "f")) {
+            headers['Authorization'] = `Bearer ${__classPrivateFieldGet(this, _ReclaimApiClient_token, "f")}`;
+        }
+        // Spec-declared headers win over client defaults, but not authorization.
+        if (args.headers) {
+            for (const [key, value] of Object.entries(args.headers)) {
+                if (value === undefined || value === null) {
+                    continue;
+                }
+                headers[key] = String(value);
+            }
+        }
+        const init = {
+            method: op.method.toUpperCase(),
+            headers,
+        };
+        const method = op.method.toLowerCase();
+        if (method !== 'get' && method !== 'head') {
+            init.body = JSON.stringify(args.body ?? {});
+            headers['Content-Type'] = 'application/json';
+        }
+        const res = await __classPrivateFieldGet(this, _ReclaimApiClient_fetch, "f").call(this, url, init);
+        if (!res.ok) {
+            await __classPrivateFieldGet(this, _ReclaimApiClient_handleErrorResponse, "f").call(this, res);
+        }
+        if (res.status === 204 || res.headers.get('content-length') === '0') {
+            return { data: undefined, response: res };
+        }
+        const data = await res.json();
+        return { data, response: res };
+    }
+}
+_ReclaimApiClient_token = new WeakMap(), _ReclaimApiClient_fetch = new WeakMap(), _ReclaimApiClient_headers = new WeakMap(), _ReclaimApiClient_handleErrorResponse = new WeakMap();

package/lib/api-consts.d.ts

@@ -0,0 +1,4 @@
+/** Public Builder API origin used when a caller doesn't provide `baseUrl`. */
+export declare const API_DEFAULT_BASE_URL = "https://build.reclaimprotocol.org";
+/** Media type defined by RFC 9457 for HTTP problem details. */
+export declare const PROBLEM_CONTENT_TYPE = "application/problem+json";

package/lib/api-consts.js

@@ -0,0 +1,4 @@
+/** Public Builder API origin used when a caller doesn't provide `baseUrl`. */
+export const API_DEFAULT_BASE_URL = 'https://build.reclaimprotocol.org';
+/** Media type defined by RFC 9457 for HTTP problem details. */
+export const PROBLEM_CONTENT_TYPE = 'application/problem+json';

package/lib/api-errors.d.ts

@@ -0,0 +1,13 @@
+import type { ProblemDetails } from './types/openapi.ts';
+/** A browser-safe HTTP error with the Builder's RFC 9457 response attached. */
+export type ApiProblemError = Error & {
+    readonly name: 'ApiProblemError';
+    readonly status: number;
+    readonly problem: ProblemDetails;
+};
+/** Returns whether an unknown thrown value is an {@link ApiProblemError}. */
+export declare function isApiProblemError(error: unknown): error is ApiProblemError;
+/** Reads an RFC 9457 response, with a status-only fallback for other bodies. */
+export declare function readProblemDetails(res: Response): Promise<ProblemDetails>;
+/** Throws a browser-safe error for an unsuccessful Builder response. */
+export declare function throwApiProblemError(res: Response): Promise<never>;

package/lib/api-errors.js

@@ -0,0 +1,30 @@
+import { PROBLEM_CONTENT_TYPE } from "./api-consts.js";
+/** Returns whether an unknown thrown value is an {@link ApiProblemError}. */
+export function isApiProblemError(error) {
+    return error instanceof Error
+        && error.name === 'ApiProblemError'
+        && 'status' in error
+        && typeof error.status === 'number'
+        && 'problem' in error;
+}
+/** Reads an RFC 9457 response, with a status-only fallback for other bodies. */
+export async function readProblemDetails(res) {
+    const contentType = res.headers.get('Content-Type') || '';
+    if (contentType.includes(PROBLEM_CONTENT_TYPE)) {
+        return await res.json();
+    }
+    return {
+        type: 'about:blank',
+        status: res.status,
+        title: res.statusText,
+    };
+}
+/** Throws a browser-safe error for an unsuccessful Builder response. */
+export async function throwApiProblemError(res) {
+    const problem = await readProblemDetails(res);
+    throw Object.assign(new Error(problem.title), {
+        name: 'ApiProblemError',
+        status: res.status,
+        problem,
+    });
+}

package/lib/api.d.ts

@@ -0,0 +1,7 @@
+export { ReclaimClient } from './client.ts';
+export type { ReclaimClientOptions } from './client.ts';
+export { isProblemDetails, isProblemError, readProblemDetails, throwProblemError, } from './errors.ts';
+export type { ProblemError } from './errors.ts';
+export { DEFAULT_BASE_URL, PROBLEM_CONTENT_TYPE, } from './consts.ts';
+export type * from './types/openapi.ts';
+export type * from './types/openapi.gen.ts';

package/lib/api.js

@@ -0,0 +1,3 @@
+export { ReclaimClient } from "./client.js";
+export { isProblemDetails, isProblemError, readProblemDetails, throwProblemError, } from "./errors.js";
+export { DEFAULT_BASE_URL, PROBLEM_CONTENT_TYPE, } from "./consts.js";

package/lib/attestor-proof.d.ts

@@ -5,6 +5,12 @@ export interface NestedProofOutcome {
     attestorAddress?: string;
     /** Decoded claim data. */
     claim?: Record<string, unknown>;
+    /** Recovered signers, in nested JWS signature order. */
+    attestorAddresses?: string[];
+    /** Decoded protected headers, in nested JWS signature order. */
+    headers?: Record<string, unknown>[];
+    /** The raw nested signatures, in hex form. */
+    signatures?: string[];
 }
 /**
  * Verify a base64url-encoded nested attestor proof JWS: recover the attestor

package/lib/attestor-proof.js

@@ -65,45 +65,72 @@ export function verifyNestedProof(proofB64, opts = {}) {
     catch {
         return { valid: false, reason: 'proof-not-jws' };
     }
-    const sig = jws.signatures?.[0];
-    if (!jws.payload || !sig) {
+    if (!jws.payload || !jws.signatures?.length) {
         return { valid: false, reason: 'proof-malformed' };
     }
-    let header;
     let claim;
     try {
-        header = decodeJson(sig.protected);
         claim = decodeJson(jws.payload);
     }
     catch {
         return { valid: false, reason: 'proof-decode-failed' };
     }
-    let recovered;
-    try {
-        recovered = recoverEthAddress(eip191Digest(createSignData(claim)), base64urlToBytes(sig.signature));
-    }
-    catch {
-        return { valid: false, reason: 'recover-failed', claim };
+    const recoveredAddresses = [];
+    const headers = [];
+    const signatures = [];
+    let firstFailure;
+    for (const sig of jws.signatures) {
+        let header;
+        let recovered;
+        try {
+            header = decodeJson(sig.protected);
+            recovered = recoverEthAddress(eip191Digest(createSignData(claim)), base64urlToBytes(sig.signature));
+        }
+        catch {
+            firstFailure || (firstFailure = { valid: false, reason: 'recover-failed', claim });
+            continue;
+        }
+        const kid = String(header.kid ?? '').toLowerCase();
+        if (recovered.toLowerCase() !== kid) {
+            firstFailure || (firstFailure = {
+                valid: false,
+                reason: 'attestor-signature-mismatch',
+                attestorAddress: recovered,
+                claim,
+            });
+            continue;
+        }
+        recoveredAddresses.push(recovered);
+        headers.push(header);
+        signatures.push('0x' + bytesToHex(base64urlToBytes(sig.signature)));
     }
-    const kid = String(header.kid ?? '').toLowerCase();
-    if (recovered.toLowerCase() !== kid) {
+    if (!recoveredAddresses.length) {
         return {
-            valid: false,
-            reason: 'attestor-signature-mismatch',
-            attestorAddress: recovered,
+            ...(firstFailure ?? { valid: false, reason: 'recover-failed' }),
             claim,
         };
     }
     if (opts.attestorAddresses) {
         const allow = opts.attestorAddresses.map((a) => a.toLowerCase());
-        if (!allow.includes(kid)) {
+        const allowedIndex = recoveredAddresses.findIndex((a) => allow.includes(a.toLowerCase()));
+        if (allowedIndex < 0) {
             return {
                 valid: false,
                 reason: 'attestor-not-allowed',
-                attestorAddress: recovered,
+                attestorAddress: recoveredAddresses[0],
+                attestorAddresses: recoveredAddresses,
+                headers,
+                signatures,
                 claim,
             };
         }
     }
-    return { valid: true, attestorAddress: recovered, claim };
+    return {
+        valid: true,
+        attestorAddress: recoveredAddresses[0],
+        attestorAddresses: recoveredAddresses,
+        headers,
+        signatures,
+        claim,
+    };
 }

package/lib/client.d.ts

@@ -10,12 +10,7 @@ export type ReclaimClientOptions = {
     headers?: Record<string, string>;
 };
 /**
- * Core HTTP client. Shared by the SDK entrypoint, MCP server, and CLI —
- * extend behavior here rather than duplicating it across surfaces.
- *
- * Per @reclaimprotocol/app conventions, validation lives in the openapi
- * spec; this client forwards requests and maps RFC 9457 problem responses
- * to {@link ProblemError}.
+ * Browser-safe typed HTTP client generated from the Builder OpenAPI contract.
  */
 export declare class ReclaimClient {
     #private;

package/lib/client.js

@@ -10,22 +10,11 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
 var _ReclaimClient_token, _ReclaimClient_fetch, _ReclaimClient_headers;
-import { notFound } from '@hapi/boom';
-import assert from 'node:assert';
-import { DEFAULT_BASE_URL, USER_AGENT } from "./consts.js";
+import { DEFAULT_BASE_URL } from "./consts.js";
 import { throwProblemError } from "./errors.js";
-// `ROUTES` is generated from `packages/app/openapi.yaml` and is the
-// single source of method/path mapping for every operation. New
-// endpoints added to the spec are picked up by re-running
-// `npm run openapi:typegen --workspace=packages/client`.
 import { ROUTES } from "./routes.gen.js";
 /**
- * Core HTTP client. Shared by the SDK entrypoint, MCP server, and CLI —
- * extend behavior here rather than duplicating it across surfaces.
- *
- * Per @reclaimprotocol/app conventions, validation lives in the openapi
- * spec; this client forwards requests and maps RFC 9457 problem responses
- * to {@link ProblemError}.
+ * Browser-safe typed HTTP client generated from the Builder OpenAPI contract.
  */
 export class ReclaimClient {
     constructor(opts = {}) {
@@ -36,7 +25,6 @@ export class ReclaimClient {
         __classPrivateFieldSet(this, _ReclaimClient_token, opts.token, "f");
         __classPrivateFieldSet(this, _ReclaimClient_fetch, opts.fetch || fetch, "f");
         __classPrivateFieldSet(this, _ReclaimClient_headers, {
-            'User-Agent': USER_AGENT,
             Accept: 'application/json',
             ...opts.headers,
         }, "f");
@@ -48,24 +36,23 @@ export class ReclaimClient {
         return __classPrivateFieldGet(this, _ReclaimClient_token, "f");
     }
     async call(operationId, ...argsRest) {
-        const args = argsRest[0] ?? {};
+        const args = argsRest[0];
         const op = ROUTES[operationId];
-        assert(op, notFound(`Unknown operation: ${String(operationId)}`));
         let url = `${this.baseUrl}${op.path}`;
-        if (args.params) {
+        if (args?.params) {
             for (const [key, value] of Object.entries(args.params)) {
                 url = url.replace(`{${key}}`, String(value));
             }
         }
-        if (args.query && Object.keys(args.query).length > 0) {
+        if (args?.query && Object.keys(args.query).length > 0) {
             const search = new URLSearchParams();
             for (const [key, value] of Object.entries(args.query)) {
                 if (value === undefined || value === null) {
                     continue;
                 }
                 if (Array.isArray(value)) {
-                    for (const v of value) {
-                        search.append(key, String(v));
+                    for (const item of value) {
+                        search.append(key, String(item));
                     }
                 }
                 else {
@@ -81,10 +68,7 @@ export class ReclaimClient {
         if (__classPrivateFieldGet(this, _ReclaimClient_token, "f")) {
             headers['Authorization'] = `Bearer ${__classPrivateFieldGet(this, _ReclaimClient_token, "f")}`;
         }
-        // Per-request header parameters (for example, `If-Match` for optimistic
-        // concurrency). Applied last so spec-declared headers win over the
-        // client-wide defaults, but never override Authorization.
-        if (args.headers) {
+        if (args?.headers) {
             for (const [key, value] of Object.entries(args.headers)) {
                 if (value === undefined || value === null) {
                     continue;
@@ -96,23 +80,18 @@ export class ReclaimClient {
             method: op.method.toUpperCase(),
             headers,
         };
-        // Write methods always carry a JSON body (defaulting to `{}`) plus a
-        // Content-Type. Some endpoints — for example, the auth-only attach session
-        // — take an empty body, and omitting Content-Type makes the server reject
-        // the request with `415 unsupported media type`.
         const method = op.method.toLowerCase();
         if (method !== 'get' && method !== 'head') {
-            init.body = JSON.stringify(args.body ?? {});
+            init.body = JSON.stringify(args?.body ?? {});
             headers['Content-Type'] = 'application/json';
         }
         const res = await __classPrivateFieldGet(this, _ReclaimClient_fetch, "f").call(this, url, init);
         if (!res.ok) {
             await throwProblemError(res);
         }
-        if (res.status === 204 || res.headers.get('content-length') === '0') {
-            return { data: undefined, response: res };
-        }
-        const data = await res.json();
+        const empty = res.status === 204
+            || res.headers.get('content-length') === '0';
+        const data = (empty ? undefined : await res.json());
         return { data, response: res };
     }
 }

package/lib/consts.d.ts

@@ -1,3 +1,3 @@
-export declare const DEFAULT_BASE_URL: string;
+export declare const DEFAULT_BASE_URL = "https://build.reclaimprotocol.org";
 export declare const USER_AGENT = "@reclaimprotocol/client";
 export declare const PROBLEM_CONTENT_TYPE = "application/problem+json";

package/lib/consts.js

@@ -1,3 +1,3 @@
-export const DEFAULT_BASE_URL = process.env.RECLAIM_BASE_URL || 'https://build.reclaimprotocol.org';
+export const DEFAULT_BASE_URL = 'https://build.reclaimprotocol.org';
 export const USER_AGENT = '@reclaimprotocol/client';
 export const PROBLEM_CONTENT_TYPE = 'application/problem+json';

package/lib/eip191.d.ts

@@ -1,9 +1,11 @@
 /** Standard EIP-191 / personal_sign digest: keccak256 of
  *  `0x19 ‖ "Ethereum Signed Message:\n" ‖ len ‖ data`. */
-export declare function eip191Digest(data: string): Uint8Array;
+export declare function eip191Digest(data: string | Uint8Array): Uint8Array;
 /** EIP-191 personal_sign over `message` with a raw 0x-hex eth private key.
  *  Returns the standard 65-byte `r ‖ s ‖ v` hex signature that
  *  `ethers.verifyMessage(message, signature)` accepts — noble's `'recovered'`
  *  format prepends the recovery byte instead, so it's reordered to the end
  *  here (a raw `0`/`1` recovery byte is fine there, no `+27` needed). */
-export declare function signEip191(message: string, privateKeyHex: string): string;
+export declare function signEip191(message: string | Uint8Array, privateKeyHex: string): string;
+/** Recover the lowercase Ethereum address from an EIP-191 signature. */
+export declare function recoverEip191Address(message: string | Uint8Array, signatureHex: string): string;

package/lib/eip191.js

@@ -11,7 +11,7 @@ const ENC = new TextEncoder();
 /** Standard EIP-191 / personal_sign digest: keccak256 of
  *  `0x19 ‖ "Ethereum Signed Message:\n" ‖ len ‖ data`. */
 export function eip191Digest(data) {
-    const bytes = ENC.encode(data);
+    const bytes = typeof data === 'string' ? ENC.encode(data) : data;
     const prefix = ENC.encode('\x19Ethereum Signed Message:\n');
     const len = ENC.encode(String(bytes.length));
     const merged = new Uint8Array(prefix.length + len.length + bytes.length);
@@ -36,3 +36,19 @@ export function signEip191(message, privateKeyHex) {
     const rs = recovered.slice(1);
     return '0x' + bytesToHex(rs) + recovery.toString(16).padStart(2, '0');
 }
+/** Recover the lowercase Ethereum address from an EIP-191 signature. */
+export function recoverEip191Address(message, signatureHex) {
+    const signature = hexToBytes(signatureHex);
+    if (signature.length !== 65) {
+        throw new Error('EIP-191 signature must contain 65 bytes');
+    }
+    const recovery = signature[64] >= 27
+        ? signature[64] - 27
+        : signature[64];
+    const recovered = new Uint8Array(65);
+    recovered[0] = recovery;
+    recovered.set(signature.subarray(0, 64), 1);
+    const compressed = secp.recoverPublicKey(recovered, eip191Digest(message), { prehash: false });
+    const uncompressed = secp.Point.fromBytes(compressed).toBytes(false);
+    return '0x' + bytesToHex(keccak_256(uncompressed.slice(1))).slice(-40);
+}

package/lib/errors.d.ts

@@ -1,5 +1,39 @@
-import { Boom } from '@hapi/boom';
 import type { ProblemDetails } from './types/openapi.ts';
-export type { ProblemDetails } from './types/openapi.ts';
-export type ProblemError = Boom<ProblemDetails>;
-export declare function throwProblemError(res: Response): Promise<void>;
+type ProblemErrorOutput = {
+    statusCode: number;
+    headers: Record<string, string>;
+    payload: ProblemDetails & {
+        statusCode: number;
+        error: string;
+        message: string;
+    };
+};
+/**
+ * RFC 9457 error with the fields expected by Boom consumers.
+ *
+ * `@hapi/boom`'s `isBoom()` recognizes this structural contract. The client
+ * doesn't import Boom at runtime, so this error remains browser-safe.
+ */
+export type ProblemError = Error & {
+    readonly isBoom: true;
+    readonly isServer: boolean;
+    readonly data: ProblemDetails;
+    readonly output: ProblemErrorOutput;
+};
+/** Returns whether a thrown value is a Builder {@link ProblemError}. */
+export declare function isProblemError(error: unknown): error is ProblemError;
+/** Returns whether a value follows the RFC 9457 problem-details schema. */
+export declare function isProblemDetails(value: unknown): value is ProblemDetails;
+/** Reads an RFC 9457 response, with a status-only fallback for other bodies. */
+export declare function readProblemDetails(res: Response): Promise<{
+    type: string;
+    title: string;
+    status: number;
+    detail?: string;
+    instance?: string;
+    event?: string;
+    sessionId?: import("./api.ts").components["schemas"]["SessionID"];
+}>;
+/** Throws a browser-safe, Boom-compatible RFC 9457 error. */
+export declare function throwProblemError(res: Response): Promise<never>;
+export {};