@reclaimprotocol/client 0.1.28 → 0.1.31

package/src/types/openapi.ts

@@ -83,6 +83,8 @@ export type ProblemDetails = components['schemas']['Problem'] & {
 // `@reclaimprotocol/client` instead of reaching into the generated file.
 export type VerificationSession =
 	components['schemas']['VerificationSession']
+export type VerificationRuntimeConfig =
+	components['schemas']['VerificationRuntimeConfig']
 export type VerificationStatus = components['schemas']['VerificationStatus']
 export type VerificationEventRecord =
 	components['schemas']['VerificationEventRecord']
@@ -105,4 +107,4 @@ export type OrgTokenMeta = components['schemas']['OrgTokenMeta']
 export type Organization = components['schemas']['Organization']
 export type CreateProviderVersionRequest =
 	components['schemas']['CreateProviderVersionRequest']
-export type ProviderVersionRef = components['schemas']['ProviderVersionRef']
+export type ProviderVersionRef = components['schemas']['ProviderVersionRef']

package/src/verification-clients.ts

@@ -1,22 +1,36 @@
+import { DEFAULT_BASE_URL } from './consts.ts'
+
 /**
- * Stable names for the Verification Clients seeded by Builder.
+ * Production Verification Client URLs. Use `custom(uri)` for a separately
+ * registered client or a non-production Builder deployment.
+ *
+ * Builder resolves a session's `verificationClientUrl` by EXACT string match
+ * against the registered `uri` and 400s for anything unregistered — these
+ * constants MUST track `packages/app/src/verification/builtin-clients.ts`'s
+ * `clientUrl()` seed exactly, or a consumer passing one of these gets a
+ * failed session creation instead of a warning (see
+ * `tests/verification-clients.test.ts`, which pins all six against that
+ * seed).
  *
- * A name identifies a registry record; session creation still selects a
- * client with that deployment's exact registered URL.
+ * As of migration `20260917130000000.share-routes-uris.sql`, all six
+ * built-ins (`builder` included) share one uniform shape,
+ * `{origin}/share/{name}` — what each `/share/{name}` page actually does
+ * differs (a redirect for `builder`/`portals`, the QR/App-Clip/deep-link
+ * launcher for `verifier-app`/`reclaimBrowserExtension`, a static
+ * informational page for `inAppSdk`/`zkFetch` — see
+ * `packages/app/src/routes/SharePage.tsx`), but the registry entry is
+ * uniform. `../launch/target.ts`'s `parseFlowUrl` is what turns one of these
+ * back into a client.
  */
-export const KNOWN_VERIFICATION_CLIENTS = {
-	builder: 'builder',
-	portals: 'portals',
-	verifierApp: 'verifier-app',
-	inAppSdk: 'inapp-sdk',
-	reclaimBrowserExtension: 'reclaim-browser-extension',
-	zkFetch: 'zkfetch',
-} as const
-
-export type KnownVerificationClientName =
-	typeof KNOWN_VERIFICATION_CLIENTS[keyof typeof KNOWN_VERIFICATION_CLIENTS]
-
-/** Deployment-specific registered URLs keyed by a known client name. */
-export type KnownVerificationClientUrlMap = Partial<
-	Record<KnownVerificationClientName, string>
->
+export const VerificationClient = Object.freeze({
+	builder: `${DEFAULT_BASE_URL}/share/builder`,
+	portals: `${DEFAULT_BASE_URL}/share/portals`,
+	verifierApp: `${DEFAULT_BASE_URL}/share/verifier-app`,
+	inAppSdk: `${DEFAULT_BASE_URL}/share/inapp-sdk`,
+	reclaimBrowserExtension:
+		`${DEFAULT_BASE_URL}/share/reclaim-browser-extension`,
+	zkFetch: `${DEFAULT_BASE_URL}/share/zkfetch`,
+	custom(uri: string) {
+		return uri
+	},
+})

package/src/verify-attestor-tee.ts

@@ -7,9 +7,10 @@ import {
 	GCP_CONFIDENTIAL_SPACE_ISSUER,
 	GCP_CONFIDENTIAL_SPACE_ROOT_CA,
 } from './proof-trust-constants.ts'
-import type {
-	AttestorClaimAttestation,
-	LegacyProof as Proof
+import {
+	type AttestorClaimAttestation,
+	type ClaimAttestationType,
+	type ReclaimRequestProof as Proof
 } from './proof-types.ts'
 import { legacyErrorClass } from './proof-verification-error.ts'
 const AttestorTeeVerificationError = legacyErrorClass('AttestorTeeVerificationError')
@@ -238,6 +239,23 @@ export type AttestorTeeAttestationConfig = {
 	expectedImageDigests?: string[]
 }
 
+/** A witness's attestation kind. Required: every client sets it explicitly. */
+export function claimAttestationType(
+	att: AttestorClaimAttestation,
+): ClaimAttestationType {
+	return att.type
+}
+
+/** What `runAttestorTeeVerification` actually checked, per witness. */
+export interface AttestorTeeVerificationSummary {
+	/** Witnesses whose `attestation_report` was verified (and pinned, when
+	 *  `expectedImageDigests` was set). */
+	verified: number
+	/** Witnesses that carried no `attestation_report`. Their attestor address
+	 *  and claim signature were still verified. */
+	unattested: number
+}
+
 function normalizeAttestorAddress(address: string): string {
 	return address.trim().toLowerCase()
 }
@@ -248,13 +266,16 @@ function normalizeSignature(sig: string): string {
 
 async function verifyAttestorTeeForProof(
 	proof: Proof,
-	config: AttestorTeeAttestationConfig
+	config: AttestorTeeAttestationConfig,
+	summary: AttestorTeeVerificationSummary,
 ): Promise<void> {
 	if(!proof.witnesses || proof.witnesses.length === 0) {
 		throw new AttestorTeeVerificationError('Proof has no witnesses')
 	}
 
-	const expectedDigests = config.expectedImageDigests?.map(d => d.trim())
+	const expectedDigests = config.expectedImageDigests?.map(
+		(digest) => digest.trim().toLowerCase(),
+	)
 
 	const proofSignatures = new Set((proof.signatures || []).map(normalizeSignature))
 	const claimSignData = createSignDataForClaim(proof.claimData)
@@ -295,6 +316,28 @@ async function verifyAttestorTeeForProof(
 			)
 		}
 
+		// A `confidential-space` witness (portals) proves its runtime through
+		// `tee_attestation`, which `runTeeVerification` checks against
+		// `context.attestationNonce` — a different chain with a different nonce
+		// binding. The address and signature bindings above still applied; the
+		// attestor-report checks below are not this type's evidence.
+		if(claimAttestationType(att) === 'confidential-space') {
+			summary.unattested++
+			continue
+		}
+
+		// An attestor that signs claims without returning its own Confidential
+		// Space attestation is the common production shape — the in-app SDK
+		// (via reclaim-tee-operator-flutter) emits witnesses carrying only
+		// `attestor_address` and `claim_signature`. The bindings above are what
+		// tie the claim to a trusted attestor address; the report, when present,
+		// additionally proves that attestor ran a pinned image. Absent one,
+		// there is nothing to check and nothing to pin.
+		if(!att.attestation_report) {
+			summary.unattested++
+			continue
+		}
+
 		const result = await verifyAttestorTeeAttestation(att.attestation_report, witness.id)
 		if(!result.isVerified) {
 			throw new AttestorTeeVerificationError(
@@ -302,6 +345,8 @@ async function verifyAttestorTeeForProof(
 			)
 		}
 
+		summary.verified++
+
 		if(expectedDigests && expectedDigests.length > 0) {
 			if(!result.imageDigest) {
 				throw new AttestorTeeVerificationError(
@@ -309,7 +354,7 @@ async function verifyAttestorTeeForProof(
 				)
 			}
 
-			if(!expectedDigests.includes(result.imageDigest)) {
+			if(!expectedDigests.includes(result.imageDigest.trim().toLowerCase())) {
 				throw new AttestorTeeVerificationError(
 					`Attestor image digest ${result.imageDigest} for witness ${witness.id} is not in expectedImageDigests`
 				)
@@ -329,12 +374,18 @@ async function verifyAttestorTeeForProof(
  *   3. Recovers the signer of `claim_signature` from the claim data and
  *      asserts it equals `witness.id` (binds the signature to the
  *      attestor that the TEE attestation will cover).
+ *
+ * Steps 4 and 5 apply only to a witness that carries an
+ * `attestation_report`, which is optional — see `AttestorClaimAttestation`:
  *   4. Calls `verifyAttestorTeeAttestation` to validate the JWT against
  *      the pinned GCP Confidential Space Root CA and the attestor-key
  *      nonce.
  *   5. If `expectedImageDigests` is provided, asserts the attestation's
  *      container image digest is in the allowlist.
  *
+ * The returned summary says which witnesses were attested, so a caller can
+ * tell "every report checked out" from "there were no reports to check".
+ *
  * Node-only (uses node:crypto), like `verifyTeeAttestation`.
  *
  * @param proofs - The proofs to verify.
@@ -343,15 +394,22 @@ async function verifyAttestorTeeForProof(
 export async function runAttestorTeeVerification(
 	proofs: Proof[],
 	config: AttestorTeeAttestationConfig = {}
-): Promise<void> {
+): Promise<AttestorTeeVerificationSummary> {
 	if(!proofs || proofs.length === 0) {
 		throw new AttestorTeeVerificationError('No proofs provided for attestor TEE verification')
 	}
 
+	const summary: AttestorTeeVerificationSummary = {
+		verified: 0,
+		unattested: 0,
+	}
+
 	try {
 		for(const proof of proofs) {
-			await verifyAttestorTeeForProof(proof, config)
+			await verifyAttestorTeeForProof(proof, config, summary)
 		}
+
+		return summary
 	} catch(error) {
 		if(error instanceof AttestorTeeVerificationError) {
 			throw error

package/src/verify-tee.ts

@@ -3,7 +3,10 @@ import { keccak_256 } from '@noble/hashes/sha3.js'
 import { webcrypto } from 'node:crypto'
 import { recoverEip191Address } from './eip191.ts'
 import { GCP_CONFIDENTIAL_SPACE_ISSUER } from './proof-trust-constants.ts'
-import type { LegacyProof as Proof, TeeAttestation } from './proof-types.ts'
+import type {
+	ReclaimRequestProof as Proof,
+	TeeAttestation
+} from './proof-types.ts'
 import { legacyErrorClass } from './proof-verification-error.ts'
 import {
 	deriveLegacyTeeNonce,
@@ -352,21 +355,28 @@ function getProofVersion(teeAttestation: TeeAttestation): string | undefined {
 	return teeAttestation.proof_version ?? teeAttestation.proofVersion
 }
 
-function assertProofShape(teeAttestation: TeeAttestation) {
-	if(teeAttestation.error) {
-		throw new Error(`${teeAttestation.error.code}: ${teeAttestation.error.message}`)
+function assertProofShape(
+	teeAttestation: Record<string, unknown>,
+): asserts teeAttestation is Record<string, unknown> & TeeAttestation {
+	const reportedError = teeAttestation.error
+	if(isRecord(reportedError)) {
+		throw new Error(`${reportedError.code}: ${reportedError.message}`)
 	}
 
-	const proofVersion = getProofVersion(teeAttestation)
+	const proofVersion = teeAttestation.proof_version
+		?? teeAttestation.proofVersion
 	assert(typeof proofVersion === 'string' && SUPPORTED_PROOF_VERSIONS.includes(proofVersion), `unexpected proof version: ${proofVersion}`)
 	assert(teeAttestation.tee_provider === EXPECTED_TEE_PROVIDER, `unexpected tee provider: ${teeAttestation.tee_provider}`)
 	assert(teeAttestation.tee_technology === EXPECTED_TEE_TECHNOLOGY, `unexpected tee technology: ${teeAttestation.tee_technology}`)
 	assert(typeof teeAttestation.nonce === 'string' && teeAttestation.nonce.length > 0, 'tee attestation nonce missing')
 	assert(typeof teeAttestation.timestamp === 'string' && teeAttestation.timestamp.length > 0, 'tee attestation timestamp missing')
 	assert(!Number.isNaN(Date.parse(teeAttestation.timestamp)), 'tee attestation timestamp is invalid')
-	assert(typeof teeAttestation.workload?.image_digest === 'string' && teeAttestation.workload.image_digest.length > 0, 'workload image digest missing')
-	assert(typeof teeAttestation.verifier?.image_digest === 'string' && teeAttestation.verifier.image_digest.length > 0, 'verifier image digest missing')
-	assert(typeof teeAttestation.attestation?.token === 'string' && teeAttestation.attestation.token.length > 0, 'attestation token missing')
+	assert(isRecord(teeAttestation.workload), 'workload missing')
+	assert(typeof teeAttestation.workload.image_digest === 'string' && teeAttestation.workload.image_digest.length > 0, 'workload image digest missing')
+	assert(isRecord(teeAttestation.verifier), 'verifier missing')
+	assert(typeof teeAttestation.verifier.image_digest === 'string' && teeAttestation.verifier.image_digest.length > 0, 'verifier image digest missing')
+	assert(isRecord(teeAttestation.attestation), 'attestation missing')
+	assert(typeof teeAttestation.attestation.token === 'string' && teeAttestation.attestation.token.length > 0, 'attestation token missing')
 }
 
 async function computeDigestBinding(teeAttestation: TeeAttestation): Promise<string> {
@@ -439,28 +449,30 @@ export async function verifyTeeAttestation(
 	try {
 		const appId = legacyApplicationIdFromPrivateKey(appSecret)
 
-		let teeAttestation = proof.teeAttestation
+		let teeAttestation = teeAttestationOf(proof)
 		if(!teeAttestation) {
 			throw new Error('Missing teeAttestation in proof')
 		}
 
 		if(typeof teeAttestation === 'string') {
-			teeAttestation = JSON.parse(teeAttestation) as TeeAttestation
+			teeAttestation = JSON.parse(teeAttestation)
 		}
 
+		assert(isRecord(teeAttestation), 'TEE attestation must be an object')
 		assertProofShape(teeAttestation)
+		const supportedTeeAttestation = teeAttestation
 
 		const { parsedContext, nonceDataObj, expectedNonce } = parseProofContext(proof)
 		verifyApplicationAndSessionBinding(proof, parsedContext, nonceDataObj, appId)
 		verifyNonceMaterial(expectedNonce, nonceDataObj, appSecret)
 
 		const cleanExpectedNonce = normalizeHex(expectedNonce)
-		const cleanTeeNonce = normalizeHex(teeAttestation.nonce)
+		const cleanTeeNonce = normalizeHex(supportedTeeAttestation.nonce)
 		assert(cleanTeeNonce.length > 0, 'TEE attestation nonce is empty')
 		assert(isHex(cleanTeeNonce), 'TEE attestation nonce is not valid hex')
 		assert(cleanTeeNonce === cleanExpectedNonce, `Nonce Mismatch! Expected ${cleanExpectedNonce}, got ${cleanTeeNonce}`)
 
-		await verifyGcpClaims(teeAttestation, cleanExpectedNonce)
+		await verifyGcpClaims(supportedTeeAttestation, cleanExpectedNonce)
 
 		return { isVerified: true }
 	} catch(error) {
@@ -479,9 +491,28 @@ export async function verifyTeeAttestation(
  * @param config - TEE attestation configuration containing the app secret
  * @throws {TeeVerificationError} When TEE data is missing or verification fails
  */
+/**
+ * The TEE attestation to verify for a proof.
+ *
+ * Builder-mode proofs carry it on the witness, inside a `confidential-space`
+ * `claimAttestation`, so every verification client presents the same envelope.
+ * Legacy proofs carry it at the proof's top level. Prefer the witness copy and
+ * fall back, so both shapes verify through one path.
+ */
+export function teeAttestationOf(proof: Proof): unknown {
+	for(const witness of proof.witnesses ?? []) {
+		const att = witness.claimAttestation
+		if(att?.type === 'confidential-space' && att.tee_attestation) {
+			return att.tee_attestation
+		}
+	}
+
+	return proof.teeAttestation
+}
+
 export async function runTeeVerification(proofs: Proof[], config: TeeAttestationConfig): Promise<void> {
 	const hasTeeData = proofs.every(proof => {
-		if(proof.teeAttestation) {
+		if(teeAttestationOf(proof)) {
 			return true
 		}
 

package/lib/api-client.d.ts

@@ -1,31 +0,0 @@
-import type { IOperationArgs, IOperationId, IOperationResponse } from './types/openapi.ts';
-export type ReclaimApiClientOptions = {
-    /** Backend base URL. Defaults to the public Builder API. */
-    baseUrl?: string;
-    /** Bearer token for authenticated operations. */
-    token?: string;
-    /** Custom fetch implementation. Defaults to global `fetch`. */
-    fetch?: typeof fetch;
-    /** Extra headers merged into every request. */
-    headers?: Record<string, string>;
-    /** Error mapper for unsuccessful responses. */
-    handleErrorResponse?: (response: Response) => Promise<never>;
-};
-/**
- * Browser-safe typed HTTP client generated from the Builder OpenAPI contract.
- *
- * This transport doesn't import proof, signing, attestor, or Node-only code.
- * Validation remains in the OpenAPI schema; this client only serializes the
- * typed request and maps unsuccessful responses.
- */
-export declare class ReclaimApiClient {
-    #private;
-    readonly baseUrl: string;
-    constructor(opts?: ReclaimApiClientOptions);
-    setToken(token: string | undefined): void;
-    getToken(): string | undefined;
-    call<T extends IOperationId>(operationId: T, ...argsRest: {} extends IOperationArgs<T> ? [args?: IOperationArgs<T>] : [args: IOperationArgs<T>]): Promise<{
-        data: IOperationResponse<T>;
-        response: Response;
-    }>;
-}

package/lib/api-client.js

@@ -1,112 +0,0 @@
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _ReclaimApiClient_token, _ReclaimApiClient_fetch, _ReclaimApiClient_headers, _ReclaimApiClient_handleErrorResponse;
-import { API_DEFAULT_BASE_URL } from "./api-consts.js";
-import { throwApiProblemError } from "./api-errors.js";
-import { ROUTES } from "./routes.gen.js";
-/**
- * Browser-safe typed HTTP client generated from the Builder OpenAPI contract.
- *
- * This transport doesn't import proof, signing, attestor, or Node-only code.
- * Validation remains in the OpenAPI schema; this client only serializes the
- * typed request and maps unsuccessful responses.
- */
-export class ReclaimApiClient {
-    constructor(opts = {}) {
-        _ReclaimApiClient_token.set(this, void 0);
-        _ReclaimApiClient_fetch.set(this, void 0);
-        _ReclaimApiClient_headers.set(this, void 0);
-        _ReclaimApiClient_handleErrorResponse.set(this, void 0);
-        this.baseUrl = (opts.baseUrl || API_DEFAULT_BASE_URL).replace(/\/$/, '');
-        __classPrivateFieldSet(this, _ReclaimApiClient_token, opts.token, "f");
-        __classPrivateFieldSet(this, _ReclaimApiClient_fetch, opts.fetch || fetch, "f");
-        __classPrivateFieldSet(this, _ReclaimApiClient_headers, {
-            Accept: 'application/json',
-            ...opts.headers,
-        }, "f");
-        __classPrivateFieldSet(this, _ReclaimApiClient_handleErrorResponse, opts.handleErrorResponse
-            || throwApiProblemError, "f");
-    }
-    setToken(token) {
-        __classPrivateFieldSet(this, _ReclaimApiClient_token, token, "f");
-    }
-    getToken() {
-        return __classPrivateFieldGet(this, _ReclaimApiClient_token, "f");
-    }
-    async call(operationId, ...argsRest) {
-        const args = argsRest[0] ?? {};
-        const op = ROUTES[operationId];
-        // A browser entry point can't depend on node:assert. This guard also
-        // protects JavaScript callers that bypass the generated operation type.
-        if (!op) {
-            throw Object.assign(new Error(`Unknown operation: ${String(operationId)}`), { name: 'UnknownOperationError' });
-        }
-        let url = `${this.baseUrl}${op.path}`;
-        if (args.params) {
-            for (const [key, value] of Object.entries(args.params)) {
-                url = url.replace(`{${key}}`, String(value));
-            }
-        }
-        if (args.query && Object.keys(args.query).length > 0) {
-            const search = new URLSearchParams();
-            for (const [key, value] of Object.entries(args.query)) {
-                if (value === undefined || value === null) {
-                    continue;
-                }
-                if (Array.isArray(value)) {
-                    for (const item of value) {
-                        search.append(key, String(item));
-                    }
-                }
-                else {
-                    search.append(key, String(value));
-                }
-            }
-            url += `?${search.toString()}`;
-        }
-        const headers = {
-            ...__classPrivateFieldGet(this, _ReclaimApiClient_headers, "f"),
-            Accept: 'application/json',
-        };
-        if (__classPrivateFieldGet(this, _ReclaimApiClient_token, "f")) {
-            headers['Authorization'] = `Bearer ${__classPrivateFieldGet(this, _ReclaimApiClient_token, "f")}`;
-        }
-        // Spec-declared headers win over client defaults, but not authorization.
-        if (args.headers) {
-            for (const [key, value] of Object.entries(args.headers)) {
-                if (value === undefined || value === null) {
-                    continue;
-                }
-                headers[key] = String(value);
-            }
-        }
-        const init = {
-            method: op.method.toUpperCase(),
-            headers,
-        };
-        const method = op.method.toLowerCase();
-        if (method !== 'get' && method !== 'head') {
-            init.body = JSON.stringify(args.body ?? {});
-            headers['Content-Type'] = 'application/json';
-        }
-        const res = await __classPrivateFieldGet(this, _ReclaimApiClient_fetch, "f").call(this, url, init);
-        if (!res.ok) {
-            await __classPrivateFieldGet(this, _ReclaimApiClient_handleErrorResponse, "f").call(this, res);
-        }
-        if (res.status === 204 || res.headers.get('content-length') === '0') {
-            return { data: undefined, response: res };
-        }
-        const data = await res.json();
-        return { data, response: res };
-    }
-}
-_ReclaimApiClient_token = new WeakMap(), _ReclaimApiClient_fetch = new WeakMap(), _ReclaimApiClient_headers = new WeakMap(), _ReclaimApiClient_handleErrorResponse = new WeakMap();

package/lib/api-consts.d.ts

@@ -1,4 +0,0 @@
-/** Public Builder API origin used when a caller doesn't provide `baseUrl`. */
-export declare const API_DEFAULT_BASE_URL = "https://build.reclaimprotocol.org";
-/** Media type defined by RFC 9457 for HTTP problem details. */
-export declare const PROBLEM_CONTENT_TYPE = "application/problem+json";

package/lib/api-consts.js

@@ -1,4 +0,0 @@
-/** Public Builder API origin used when a caller doesn't provide `baseUrl`. */
-export const API_DEFAULT_BASE_URL = 'https://build.reclaimprotocol.org';
-/** Media type defined by RFC 9457 for HTTP problem details. */
-export const PROBLEM_CONTENT_TYPE = 'application/problem+json';

package/lib/api-errors.d.ts

@@ -1,13 +0,0 @@
-import type { ProblemDetails } from './types/openapi.ts';
-/** A browser-safe HTTP error with the Builder's RFC 9457 response attached. */
-export type ApiProblemError = Error & {
-    readonly name: 'ApiProblemError';
-    readonly status: number;
-    readonly problem: ProblemDetails;
-};
-/** Returns whether an unknown thrown value is an {@link ApiProblemError}. */
-export declare function isApiProblemError(error: unknown): error is ApiProblemError;
-/** Reads an RFC 9457 response, with a status-only fallback for other bodies. */
-export declare function readProblemDetails(res: Response): Promise<ProblemDetails>;
-/** Throws a browser-safe error for an unsuccessful Builder response. */
-export declare function throwApiProblemError(res: Response): Promise<never>;

package/lib/api-errors.js

@@ -1,30 +0,0 @@
-import { PROBLEM_CONTENT_TYPE } from "./api-consts.js";
-/** Returns whether an unknown thrown value is an {@link ApiProblemError}. */
-export function isApiProblemError(error) {
-    return error instanceof Error
-        && error.name === 'ApiProblemError'
-        && 'status' in error
-        && typeof error.status === 'number'
-        && 'problem' in error;
-}
-/** Reads an RFC 9457 response, with a status-only fallback for other bodies. */
-export async function readProblemDetails(res) {
-    const contentType = res.headers.get('Content-Type') || '';
-    if (contentType.includes(PROBLEM_CONTENT_TYPE)) {
-        return await res.json();
-    }
-    return {
-        type: 'about:blank',
-        status: res.status,
-        title: res.statusText,
-    };
-}
-/** Throws a browser-safe error for an unsuccessful Builder response. */
-export async function throwApiProblemError(res) {
-    const problem = await readProblemDetails(res);
-    throw Object.assign(new Error(problem.title), {
-        name: 'ApiProblemError',
-        status: res.status,
-        problem,
-    });
-}

package/lib/eip712.d.ts

@@ -1,20 +0,0 @@
-declare const TYPES: {
-    readonly CreateVerificationSession: readonly [readonly ["providerId", "string"], readonly ["version", "string"], readonly ["context", "string"], readonly ["verificationClientUrl", "string"], readonly ["timestamp", "uint256"]];
-    readonly CreateCallbackSubscription: readonly [readonly ["callbackUrl", "string"], readonly ["events", "string"], readonly ["publicKey", "string"], readonly ["address", "string"], readonly ["timestamp", "uint256"]];
-    readonly VerificationAuth: readonly [readonly ["timestamp", "uint256"]];
-};
-export type Eip712PrimaryType = keyof typeof TYPES;
-/** Deterministic JSON via RFC 8785 (JSON Canonicalization Scheme): object
- *  keys sorted recursively, no whitespace, canonical number/string forms.
- *  Both signer and verifier canonicalize `context`/`events` this way so the
- *  string fields hash identically. Single source of truth for canonical
- *  stringification in the repo — `contentHash` (result binding) uses it too;
- *  do not reimplement with sorted JSON.stringify. */
-export declare function canonicalJson(value: unknown): string;
-/** EIP-712 digest: keccak256(0x1901 ‖ domainSeparator ‖ structHash). */
-export declare function eip712Digest(primaryType: Eip712PrimaryType, message: Record<string, string | bigint>): Uint8Array<ArrayBufferLike> & Uint8Array<ArrayBuffer>;
-/** Recover the signer of a typed message, or null on failure. Used by the
- *  Builder (`packages/app`) to verify legacy typed-data signatures; the client
- *  itself no longer signs — all consumer auth is the org bearer token. */
-export declare function recoverTypedSigner(primaryType: Eip712PrimaryType, message: Record<string, string | bigint>, signature: string): string | null;
-export {};

package/lib/eip712.js

@@ -1,108 +0,0 @@
-/**
- * EIP-712 typed-data primitives for the legacy verification-session signature
- * scheme — kept for the Builder verifier (`eip712Digest` + `recoverTypedSigner`,
- * imported by `packages/app`). The consumer client no longer signs (all auth is
- * the org bearer token), so there is no `buildAuthHeaders` here anymore. The
- * typed data is tiny (only `string` / `uint256` / `address` fields), so it's
- * hashed directly with keccak-256; recovery is standard secp256k1 over the
- * digest (`prehash:false`, see ./secp.ts).
- */
-import { badData } from '@hapi/boom';
-import * as canonicalizeMod from 'canonicalize';
-import assert from 'node:assert';
-import { hexToBytes } from "./encoding.js";
-import { keccak_256, recoverAddress } from "./secp.js";
-// canonicalize ships as a CJS default export; resolve it across interop
-// modes (same dance as ajv-formats in packages/app).
-const canonicalize = (canonicalizeMod.default ??
-    canonicalizeMod);
-const DOMAIN = {
-    name: 'Reclaim Builder',
-    version: '1',
-    chainId: 1n,
-    verifyingContract: '0x0000000000000000000000000000000000000000',
-};
-const TYPES = {
-    CreateVerificationSession: [
-        ['providerId', 'string'],
-        ['version', 'string'],
-        ['context', 'string'],
-        ['verificationClientUrl', 'string'],
-        ['timestamp', 'uint256'],
-    ],
-    CreateCallbackSubscription: [
-        ['callbackUrl', 'string'],
-        ['events', 'string'],
-        ['publicKey', 'string'],
-        ['address', 'string'],
-        ['timestamp', 'uint256'],
-    ],
-    VerificationAuth: [['timestamp', 'uint256']],
-};
-/** Deterministic JSON via RFC 8785 (JSON Canonicalization Scheme): object
- *  keys sorted recursively, no whitespace, canonical number/string forms.
- *  Both signer and verifier canonicalize `context`/`events` this way so the
- *  string fields hash identically. Single source of truth for canonical
- *  stringification in the repo — `contentHash` (result binding) uses it too;
- *  do not reimplement with sorted JSON.stringify. */
-export function canonicalJson(value) {
-    const out = canonicalize(value);
-    assert(out !== undefined, badData('value is not JSON-serializable'));
-    return out;
-}
-function utf8(s) {
-    return new TextEncoder().encode(s);
-}
-function uint256(value) {
-    const out = new Uint8Array(32);
-    let v = value;
-    for (let i = 31; i >= 0 && v > 0n; i--) {
-        out[i] = Number(v & 0xffn);
-        v >>= 8n;
-    }
-    return out;
-}
-function addressWord(addr) {
-    const out = new Uint8Array(32);
-    out.set(hexToBytes(addr), 12);
-    return out;
-}
-function concat(...parts) {
-    const total = parts.reduce((n, p) => n + p.length, 0);
-    const out = new Uint8Array(total);
-    let off = 0;
-    for (const p of parts) {
-        out.set(p, off);
-        off += p.length;
-    }
-    return out;
-}
-function typeHash(primaryType) {
-    const fields = TYPES[primaryType].map(([n, t]) => `${t} ${n}`).join(',');
-    return keccak_256(utf8(`${primaryType}(${fields})`));
-}
-function encodeField(type, value) {
-    return type === 'string'
-        ? keccak_256(utf8(value))
-        : uint256(value);
-}
-function structHash(primaryType, message) {
-    const parts = [typeHash(primaryType)];
-    for (const [name, type] of TYPES[primaryType]) {
-        parts.push(encodeField(type, message[name]));
-    }
-    return keccak_256(concat(...parts));
-}
-const DOMAIN_SEPARATOR = keccak_256(concat(keccak_256(utf8('EIP712Domain(string name,string version,uint256 chainId,' +
-    'address verifyingContract)')), keccak_256(utf8(DOMAIN.name)), keccak_256(utf8(DOMAIN.version)), uint256(DOMAIN.chainId), addressWord(DOMAIN.verifyingContract)));
-/** EIP-712 digest: keccak256(0x1901 ‖ domainSeparator ‖ structHash). */
-export function eip712Digest(primaryType, message) {
-    return keccak_256(concat(Uint8Array.from([0x19, 0x01]), DOMAIN_SEPARATOR, structHash(primaryType, message)));
-}
-/** Recover the signer of a typed message, or null on failure. Used by the
- *  Builder (`packages/app`) to verify legacy typed-data signatures; the client
- *  itself no longer signs — all consumer auth is the org bearer token. */
-export function recoverTypedSigner(primaryType, message, signature) {
-    const digest = eip712Digest(primaryType, message);
-    return recoverAddress(digest, hexToBytes(signature));
-}