@reclaimprotocol/client 0.1.29 → 0.1.32

package/lib/types/openapi.gen.js

@@ -1,3 +1,8 @@
+// AUTO-GENERATED by packages/app/scripts/openapi-typegen.ts
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:099a5bcf4fba).
+// The hash catches drift the version misses (a spec can change without a
+// version bump) — do not remove it as "redundant" with the version.
+// Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.
 /**
  * This file was auto-generated by openapi-typescript.
  * Do not make direct changes to the file.

package/lib/verification-clients.d.ts

@@ -1,17 +1,31 @@
 /**
- * Stable names for the Verification Clients seeded by Builder.
+ * Production Verification Client URLs. Use `custom(uri)` for a separately
+ * registered client or a non-production Builder deployment.
  *
- * A name identifies a registry record; session creation still selects a
- * client with that deployment's exact registered URL.
+ * Builder resolves a session's `verificationClientUrl` by EXACT string match
+ * against the registered `uri` and 400s for anything unregistered — these
+ * constants MUST track `packages/app/src/verification/builtin-clients.ts`'s
+ * `clientUrl()` seed exactly, or a consumer passing one of these gets a
+ * failed session creation instead of a warning (see
+ * `tests/verification-clients.test.ts`, which pins all six against that
+ * seed).
+ *
+ * As of migration `20260917130000000.share-routes-uris.sql`, all six
+ * built-ins (`builder` included) share one uniform shape,
+ * `{origin}/share/{name}` — what each `/share/{name}` page actually does
+ * differs (a redirect for `builder`/`portals`, the QR/App-Clip/deep-link
+ * launcher for `verifier-app`/`reclaimBrowserExtension`, a static
+ * informational page for `inAppSdk`/`zkFetch` — see
+ * `packages/app/src/routes/SharePage.tsx`), but the registry entry is
+ * uniform. `../launch/target.ts`'s `parseFlowUrl` is what turns one of these
+ * back into a client.
  */
-export declare const KNOWN_VERIFICATION_CLIENTS: {
-    readonly builder: "builder";
-    readonly portals: "portals";
-    readonly verifierApp: "verifier-app";
-    readonly inAppSdk: "inapp-sdk";
-    readonly reclaimBrowserExtension: "reclaim-browser-extension";
-    readonly zkFetch: "zkfetch";
-};
-export type KnownVerificationClientName = typeof KNOWN_VERIFICATION_CLIENTS[keyof typeof KNOWN_VERIFICATION_CLIENTS];
-/** Deployment-specific registered URLs keyed by a known client name. */
-export type KnownVerificationClientUrlMap = Partial<Record<KnownVerificationClientName, string>>;
+export declare const VerificationClient: Readonly<{
+    builder: "https://build.reclaimprotocol.org/share/builder";
+    portals: "https://build.reclaimprotocol.org/share/portals";
+    verifierApp: "https://build.reclaimprotocol.org/share/verifier-app";
+    inAppSdk: "https://build.reclaimprotocol.org/share/inapp-sdk";
+    reclaimBrowserExtension: "https://build.reclaimprotocol.org/share/reclaim-browser-extension";
+    zkFetch: "https://build.reclaimprotocol.org/share/zkfetch";
+    custom(uri: string): string;
+}>;

package/lib/verification-clients.js

@@ -1,14 +1,34 @@
+import { DEFAULT_BASE_URL } from "./consts.js";
 /**
- * Stable names for the Verification Clients seeded by Builder.
+ * Production Verification Client URLs. Use `custom(uri)` for a separately
+ * registered client or a non-production Builder deployment.
  *
- * A name identifies a registry record; session creation still selects a
- * client with that deployment's exact registered URL.
+ * Builder resolves a session's `verificationClientUrl` by EXACT string match
+ * against the registered `uri` and 400s for anything unregistered — these
+ * constants MUST track `packages/app/src/verification/builtin-clients.ts`'s
+ * `clientUrl()` seed exactly, or a consumer passing one of these gets a
+ * failed session creation instead of a warning (see
+ * `tests/verification-clients.test.ts`, which pins all six against that
+ * seed).
+ *
+ * As of migration `20260917130000000.share-routes-uris.sql`, all six
+ * built-ins (`builder` included) share one uniform shape,
+ * `{origin}/share/{name}` — what each `/share/{name}` page actually does
+ * differs (a redirect for `builder`/`portals`, the QR/App-Clip/deep-link
+ * launcher for `verifier-app`/`reclaimBrowserExtension`, a static
+ * informational page for `inAppSdk`/`zkFetch` — see
+ * `packages/app/src/routes/SharePage.tsx`), but the registry entry is
+ * uniform. `../launch/target.ts`'s `parseFlowUrl` is what turns one of these
+ * back into a client.
  */
-export const KNOWN_VERIFICATION_CLIENTS = {
-    builder: 'builder',
-    portals: 'portals',
-    verifierApp: 'verifier-app',
-    inAppSdk: 'inapp-sdk',
-    reclaimBrowserExtension: 'reclaim-browser-extension',
-    zkFetch: 'zkfetch',
-};
+export const VerificationClient = Object.freeze({
+    builder: `${DEFAULT_BASE_URL}/share/builder`,
+    portals: `${DEFAULT_BASE_URL}/share/portals`,
+    verifierApp: `${DEFAULT_BASE_URL}/share/verifier-app`,
+    inAppSdk: `${DEFAULT_BASE_URL}/share/inapp-sdk`,
+    reclaimBrowserExtension: `${DEFAULT_BASE_URL}/share/reclaim-browser-extension`,
+    zkFetch: `${DEFAULT_BASE_URL}/share/zkfetch`,
+    custom(uri) {
+        return uri;
+    },
+});

package/lib/verify-attestor-tee.d.ts

@@ -1,4 +1,4 @@
-import type { LegacyProof as Proof } from './proof-types.ts';
+import { type AttestorClaimAttestation, type ClaimAttestationType, type ReclaimRequestProof as Proof } from './proof-types.ts';
 /**
  * Result of verifying an attestor TEE attestation.
  */
@@ -51,6 +51,17 @@ export type AttestorTeeAttestationConfig = {
      */
     expectedImageDigests?: string[];
 };
+/** A witness's attestation kind. Required: every client sets it explicitly. */
+export declare function claimAttestationType(att: AttestorClaimAttestation): ClaimAttestationType;
+/** What `runAttestorTeeVerification` actually checked, per witness. */
+export interface AttestorTeeVerificationSummary {
+    /** Witnesses whose `attestation_report` was verified (and pinned, when
+     *  `expectedImageDigests` was set). */
+    verified: number;
+    /** Witnesses that carried no `attestation_report`. Their attestor address
+     *  and claim signature were still verified. */
+    unattested: number;
+}
 /**
  * Verifies the attestor's TEE attestation for every witness of every
  * provided proof. Throws `AttestorTeeVerificationError` on the first
@@ -62,15 +73,21 @@ export type AttestorTeeAttestationConfig = {
  *   3. Recovers the signer of `claim_signature` from the claim data and
  *      asserts it equals `witness.id` (binds the signature to the
  *      attestor that the TEE attestation will cover).
+ *
+ * Steps 4 and 5 apply only to a witness that carries an
+ * `attestation_report`, which is optional — see `AttestorClaimAttestation`:
  *   4. Calls `verifyAttestorTeeAttestation` to validate the JWT against
  *      the pinned GCP Confidential Space Root CA and the attestor-key
  *      nonce.
  *   5. If `expectedImageDigests` is provided, asserts the attestation's
  *      container image digest is in the allowlist.
  *
+ * The returned summary says which witnesses were attested, so a caller can
+ * tell "every report checked out" from "there were no reports to check".
+ *
  * Node-only (uses node:crypto), like `verifyTeeAttestation`.
  *
  * @param proofs - The proofs to verify.
  * @param config - Optional config; see {@link AttestorTeeAttestationConfig}.
  */
-export declare function runAttestorTeeVerification(proofs: Proof[], config?: AttestorTeeAttestationConfig): Promise<void>;
+export declare function runAttestorTeeVerification(proofs: Proof[], config?: AttestorTeeAttestationConfig): Promise<AttestorTeeVerificationSummary>;

package/lib/verify-attestor-tee.js

@@ -155,17 +155,21 @@ export async function verifyAttestorTeeAttestation(report, expectedAttestorAddre
         };
     }
 }
+/** A witness's attestation kind. Required: every client sets it explicitly. */
+export function claimAttestationType(att) {
+    return att.type;
+}
 function normalizeAttestorAddress(address) {
     return address.trim().toLowerCase();
 }
 function normalizeSignature(sig) {
     return sig.trim().toLowerCase();
 }
-async function verifyAttestorTeeForProof(proof, config) {
+async function verifyAttestorTeeForProof(proof, config, summary) {
     if (!proof.witnesses || proof.witnesses.length === 0) {
         throw new AttestorTeeVerificationError('Proof has no witnesses');
     }
-    const expectedDigests = config.expectedImageDigests?.map(d => d.trim());
+    const expectedDigests = config.expectedImageDigests?.map((digest) => digest.trim().toLowerCase());
     const proofSignatures = new Set((proof.signatures || []).map(normalizeSignature));
     const claimSignData = createSignDataForClaim(proof.claimData);
     for (const witness of proof.witnesses) {
@@ -189,15 +193,36 @@ async function verifyAttestorTeeForProof(proof, config) {
         if (normalizeAttestorAddress(recoveredSigner) !== normalizeAttestorAddress(witness.id)) {
             throw new AttestorTeeVerificationError(`claim_signature recovers to ${recoveredSigner}, expected attestor ${witness.id}`);
         }
+        // A `confidential-space` witness (portals) proves its runtime through
+        // `tee_attestation`, which `runTeeVerification` checks against
+        // `context.attestationNonce` — a different chain with a different nonce
+        // binding. The address and signature bindings above still applied; the
+        // attestor-report checks below are not this type's evidence.
+        if (claimAttestationType(att) === 'confidential-space') {
+            summary.unattested++;
+            continue;
+        }
+        // An attestor that signs claims without returning its own Confidential
+        // Space attestation is the common production shape — the in-app SDK
+        // (via reclaim-tee-operator-flutter) emits witnesses carrying only
+        // `attestor_address` and `claim_signature`. The bindings above are what
+        // tie the claim to a trusted attestor address; the report, when present,
+        // additionally proves that attestor ran a pinned image. Absent one,
+        // there is nothing to check and nothing to pin.
+        if (!att.attestation_report) {
+            summary.unattested++;
+            continue;
+        }
         const result = await verifyAttestorTeeAttestation(att.attestation_report, witness.id);
         if (!result.isVerified) {
             throw new AttestorTeeVerificationError(`Attestor TEE attestation verification failed for witness ${witness.id}: ${result.error}`);
         }
+        summary.verified++;
         if (expectedDigests && expectedDigests.length > 0) {
             if (!result.imageDigest) {
                 throw new AttestorTeeVerificationError(`Attestor TEE attestation for witness ${witness.id} did not expose an image digest to check against expectedImageDigests`);
             }
-            if (!expectedDigests.includes(result.imageDigest)) {
+            if (!expectedDigests.includes(result.imageDigest.trim().toLowerCase())) {
                 throw new AttestorTeeVerificationError(`Attestor image digest ${result.imageDigest} for witness ${witness.id} is not in expectedImageDigests`);
             }
         }
@@ -214,12 +239,18 @@ async function verifyAttestorTeeForProof(proof, config) {
  *   3. Recovers the signer of `claim_signature` from the claim data and
  *      asserts it equals `witness.id` (binds the signature to the
  *      attestor that the TEE attestation will cover).
+ *
+ * Steps 4 and 5 apply only to a witness that carries an
+ * `attestation_report`, which is optional — see `AttestorClaimAttestation`:
  *   4. Calls `verifyAttestorTeeAttestation` to validate the JWT against
  *      the pinned GCP Confidential Space Root CA and the attestor-key
  *      nonce.
  *   5. If `expectedImageDigests` is provided, asserts the attestation's
  *      container image digest is in the allowlist.
  *
+ * The returned summary says which witnesses were attested, so a caller can
+ * tell "every report checked out" from "there were no reports to check".
+ *
  * Node-only (uses node:crypto), like `verifyTeeAttestation`.
  *
  * @param proofs - The proofs to verify.
@@ -229,10 +260,15 @@ export async function runAttestorTeeVerification(proofs, config = {}) {
     if (!proofs || proofs.length === 0) {
         throw new AttestorTeeVerificationError('No proofs provided for attestor TEE verification');
     }
+    const summary = {
+        verified: 0,
+        unattested: 0,
+    };
     try {
         for (const proof of proofs) {
-            await verifyAttestorTeeForProof(proof, config);
+            await verifyAttestorTeeForProof(proof, config, summary);
         }
+        return summary;
     }
     catch (error) {
         if (error instanceof AttestorTeeVerificationError) {

package/lib/verify-tee.d.ts

@@ -1,4 +1,4 @@
-import type { LegacyProof as Proof } from './proof-types.ts';
+import type { ReclaimRequestProof as Proof } from './proof-types.ts';
 export interface TeeAttestationConfig {
     appSecret: string;
 }
@@ -29,4 +29,13 @@ export declare function verifyTeeAttestation(proof: Proof, appSecret: string): P
  * @param config - TEE attestation configuration containing the app secret
  * @throws {TeeVerificationError} When TEE data is missing or verification fails
  */
+/**
+ * The TEE attestation to verify for a proof.
+ *
+ * Builder-mode proofs carry it on the witness, inside a `confidential-space`
+ * `claimAttestation`, so every verification client presents the same envelope.
+ * Legacy proofs carry it at the proof's top level. Prefer the witness copy and
+ * fall back, so both shapes verify through one path.
+ */
+export declare function teeAttestationOf(proof: Proof): unknown;
 export declare function runTeeVerification(proofs: Proof[], config: TeeAttestationConfig): Promise<void>;

package/lib/verify-tee.js

@@ -226,19 +226,24 @@ function getProofVersion(teeAttestation) {
     return teeAttestation.proof_version ?? teeAttestation.proofVersion;
 }
 function assertProofShape(teeAttestation) {
-    if (teeAttestation.error) {
-        throw new Error(`${teeAttestation.error.code}: ${teeAttestation.error.message}`);
+    const reportedError = teeAttestation.error;
+    if (isRecord(reportedError)) {
+        throw new Error(`${reportedError.code}: ${reportedError.message}`);
     }
-    const proofVersion = getProofVersion(teeAttestation);
+    const proofVersion = teeAttestation.proof_version
+        ?? teeAttestation.proofVersion;
     assert(typeof proofVersion === 'string' && SUPPORTED_PROOF_VERSIONS.includes(proofVersion), `unexpected proof version: ${proofVersion}`);
     assert(teeAttestation.tee_provider === EXPECTED_TEE_PROVIDER, `unexpected tee provider: ${teeAttestation.tee_provider}`);
     assert(teeAttestation.tee_technology === EXPECTED_TEE_TECHNOLOGY, `unexpected tee technology: ${teeAttestation.tee_technology}`);
     assert(typeof teeAttestation.nonce === 'string' && teeAttestation.nonce.length > 0, 'tee attestation nonce missing');
     assert(typeof teeAttestation.timestamp === 'string' && teeAttestation.timestamp.length > 0, 'tee attestation timestamp missing');
     assert(!Number.isNaN(Date.parse(teeAttestation.timestamp)), 'tee attestation timestamp is invalid');
-    assert(typeof teeAttestation.workload?.image_digest === 'string' && teeAttestation.workload.image_digest.length > 0, 'workload image digest missing');
-    assert(typeof teeAttestation.verifier?.image_digest === 'string' && teeAttestation.verifier.image_digest.length > 0, 'verifier image digest missing');
-    assert(typeof teeAttestation.attestation?.token === 'string' && teeAttestation.attestation.token.length > 0, 'attestation token missing');
+    assert(isRecord(teeAttestation.workload), 'workload missing');
+    assert(typeof teeAttestation.workload.image_digest === 'string' && teeAttestation.workload.image_digest.length > 0, 'workload image digest missing');
+    assert(isRecord(teeAttestation.verifier), 'verifier missing');
+    assert(typeof teeAttestation.verifier.image_digest === 'string' && teeAttestation.verifier.image_digest.length > 0, 'verifier image digest missing');
+    assert(isRecord(teeAttestation.attestation), 'attestation missing');
+    assert(typeof teeAttestation.attestation.token === 'string' && teeAttestation.attestation.token.length > 0, 'attestation token missing');
 }
 async function computeDigestBinding(teeAttestation) {
     const proofVersion = getProofVersion(teeAttestation);
@@ -290,23 +295,25 @@ export async function verifyTeeAttestation(proof, appSecret) {
     assertNonBrowserEnvironment();
     try {
         const appId = legacyApplicationIdFromPrivateKey(appSecret);
-        let teeAttestation = proof.teeAttestation;
+        let teeAttestation = teeAttestationOf(proof);
         if (!teeAttestation) {
             throw new Error('Missing teeAttestation in proof');
         }
         if (typeof teeAttestation === 'string') {
             teeAttestation = JSON.parse(teeAttestation);
         }
+        assert(isRecord(teeAttestation), 'TEE attestation must be an object');
         assertProofShape(teeAttestation);
+        const supportedTeeAttestation = teeAttestation;
         const { parsedContext, nonceDataObj, expectedNonce } = parseProofContext(proof);
         verifyApplicationAndSessionBinding(proof, parsedContext, nonceDataObj, appId);
         verifyNonceMaterial(expectedNonce, nonceDataObj, appSecret);
         const cleanExpectedNonce = normalizeHex(expectedNonce);
-        const cleanTeeNonce = normalizeHex(teeAttestation.nonce);
+        const cleanTeeNonce = normalizeHex(supportedTeeAttestation.nonce);
         assert(cleanTeeNonce.length > 0, 'TEE attestation nonce is empty');
         assert(isHex(cleanTeeNonce), 'TEE attestation nonce is not valid hex');
         assert(cleanTeeNonce === cleanExpectedNonce, `Nonce Mismatch! Expected ${cleanExpectedNonce}, got ${cleanTeeNonce}`);
-        await verifyGcpClaims(teeAttestation, cleanExpectedNonce);
+        await verifyGcpClaims(supportedTeeAttestation, cleanExpectedNonce);
         return { isVerified: true };
     }
     catch (error) {
@@ -324,9 +331,26 @@ export async function verifyTeeAttestation(proof, appSecret) {
  * @param config - TEE attestation configuration containing the app secret
  * @throws {TeeVerificationError} When TEE data is missing or verification fails
  */
+/**
+ * The TEE attestation to verify for a proof.
+ *
+ * Builder-mode proofs carry it on the witness, inside a `confidential-space`
+ * `claimAttestation`, so every verification client presents the same envelope.
+ * Legacy proofs carry it at the proof's top level. Prefer the witness copy and
+ * fall back, so both shapes verify through one path.
+ */
+export function teeAttestationOf(proof) {
+    for (const witness of proof.witnesses ?? []) {
+        const att = witness.claimAttestation;
+        if (att?.type === 'confidential-space' && att.tee_attestation) {
+            return att.tee_attestation;
+        }
+    }
+    return proof.teeAttestation;
+}
 export async function runTeeVerification(proofs, config) {
     const hasTeeData = proofs.every(proof => {
-        if (proof.teeAttestation) {
+        if (teeAttestationOf(proof)) {
             return true;
         }
         try {

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/client",
 	"title": "Reclaim Client",
-	"version": "0.1.29",
+	"version": "0.1.32",
 	"description": "Typed SDK/HTTP client SDK for the Reclaim Protocol — the programmatic way to use Reclaim Protocol to verify **data points** about your users (a follower count, an account balance, an order). Can be directly integrated by apps to request verification for their users using Reclaim Protocol and verify the results.",
 	"type": "module",
 	"sideEffects": false,
@@ -23,6 +23,10 @@
 		"./enckeys": {
 			"types": "./lib/enckeys.d.ts",
 			"import": "./lib/enckeys.js"
+		},
+		"./launch": {
+			"types": "./lib/launch/index.d.ts",
+			"import": "./lib/launch/index.js"
 		}
 	},
 	"files": [

package/src/api.ts

@@ -7,9 +7,18 @@ export {
 	throwProblemError,
 } from './errors.ts'
 export type { ProblemError } from './errors.ts'
+export {
+	getBooleanFeatureFlag,
+	getFeatureFlag,
+	getNumberFeatureFlag,
+	getStringFeatureFlag,
+} from './feature-flags.ts'
 export {
 	DEFAULT_BASE_URL,
 	PROBLEM_CONTENT_TYPE,
 } from './consts.ts'
+export {
+	VerificationClient,
+} from './verification-clients.ts'
 export type * from './types/openapi.ts'
 export type * from './types/openapi.gen.ts'

package/src/client.ts

@@ -115,6 +115,8 @@ export class ReclaimClient {
 
 		const empty = res.status === 204
 			|| res.headers.get('content-length') === '0'
+		// Fetch exposes parsed JSON as `any`; OpenAPI owns the operation-specific
+		// response type, and callers can inspect the original Response if needed.
 		const data = (
 			empty ? undefined : await res.json()
 		) as IOperationResponse<T>

package/src/enckeys.ts

@@ -2,7 +2,7 @@
  * secp256k1 (Ethereum) encryption-key helpers for ECIES result delivery.
  *
  * The org's encryption key is its **Ethereum public key** (secp256k1). The
- * Verification Client ECIES-encrypts the signed JWS to it (see ./result.ts) and
+ * Builder ECIES-encrypts the signed JWS to it (see ./result.ts) and
  * the Consumer decrypts with the matching eth **private key**. Eth-native `0x`
  * hex is used everywhere at the edges (the format MetaMask/ethers/wallets
  * emit); the wire/DB store the public key as a secp256k1 JWK
@@ -48,7 +48,7 @@ export function loadDecryptionKey(input: DecryptionKeyInput): DecryptionKey {
 
 /**
  * Convert an uncompressed secp256k1 public key (`0x04` + 128 hex) to the public
- * JWK the API stores and the Verification Client encrypts to — so callers only
+ * JWK the API stores and Builder encrypts to — so callers only
  * ever handle eth-native hex, never a JWK. Mirrors the `x`/`y` coordinate split
  * in `jwksFromPrivateKey` (./jwks.ts).
  */

package/src/encoding.ts

@@ -55,3 +55,15 @@ export function b64url(input: Uint8Array | string): string {
 		.replace(/\//g, '_')
 		.replace(/=+$/, '')
 }
+
+/** `value` without trailing `/`s. A loop, not `/\/+$/`: that regex backtracks
+ *  quadratically on a long run of slashes followed by anything else, and
+ *  some callers get attacker-supplied input (a JWS header's `iss`). */
+export function stripTrailingSlashes(value: string): string {
+	let end = value.length
+	while(end > 0 && value.charCodeAt(end - 1) === 0x2f) {
+		end--
+	}
+
+	return value.slice(0, end)
+}

package/src/feature-flags.ts

@@ -0,0 +1,39 @@
+import type { VerificationRuntimeConfig } from './types/openapi.ts'
+
+/** Read a resolved session flag without assuming its runtime type. */
+export function getFeatureFlag(
+	config: VerificationRuntimeConfig | null | undefined,
+	key: string,
+) {
+	return config?.values[key]
+}
+
+/** Read a boolean flag, returning `fallback` for absent or mistyped values. */
+export function getBooleanFeatureFlag(
+	config: VerificationRuntimeConfig | null | undefined,
+	key: string,
+	fallback = false,
+) {
+	const value = getFeatureFlag(config, key)
+	return typeof value === 'boolean' ? value : fallback
+}
+
+/** Read a string flag, returning `fallback` for absent or mistyped values. */
+export function getStringFeatureFlag(
+	config: VerificationRuntimeConfig | null | undefined,
+	key: string,
+	fallback: string,
+) {
+	const value = getFeatureFlag(config, key)
+	return typeof value === 'string' ? value : fallback
+}
+
+/** Read a numeric flag, returning `fallback` for absent or mistyped values. */
+export function getNumberFeatureFlag(
+	config: VerificationRuntimeConfig | null | undefined,
+	key: string,
+	fallback: number,
+) {
+	const value = getFeatureFlag(config, key)
+	return typeof value === 'number' && Number.isFinite(value) ? value : fallback
+}

package/src/index.ts

@@ -46,16 +46,16 @@ export {
 	uncompressedPubkeyToJwk,
 } from './enckeys.ts'
 export {
-	createReclaim,
+	type BindSessionTeeNonceInput,
 	type CreateSessionInput,
-	type CreateSessionTeeAttestation,
-	type Reclaim,
+	type ImportReclaimVerificationConfig,
 	type ReclaimConfig,
+	type ReclaimFlowFactory,
+	ReclaimVerification,
+	type ReclaimVerificationState,
 	type ReceiveOptions,
 	type ReceivedDelivery,
-	type RegisterCallbackInput,
-	type SetKeypairInput,
-	TERMINAL_EVENTS,
+	type SessionFlow,
 } from './reclaim.ts'
 export {
 	fetchJwks,
@@ -69,19 +69,20 @@ export {
 	selectVerificationResultKey,
 	trustedAttestorAddresses,
 	validateAttestorAddresses,
+	validateAttestorImageDigests,
 } from './jwks.ts'
 export {
 	type NestedProofOutcome,
 	verifyNestedProof,
 } from './attestor-proof.ts'
 export {
-	type LegacyProof,
-	type LegacyProofOutcome,
-	type LegacyVerifyProofOptions,
 	type ProofHashRequirement,
+	type ReclaimRequestProof,
+	type ReclaimRequestProofOutcome,
+	type VerifyRequestProofOptions,
 	proofHashes,
-	verifyProof,
-} from './legacy-proof.ts'
+	verifyRequestProof,
+} from './request-proof.ts'
 export {
 	type BuilderProofRecipe,
 	proofHashesFromBuilderRecipe,
@@ -111,7 +112,5 @@ export {
 	type LegacyTeeNonceMode,
 } from './tee-binding.ts'
 export {
-	KNOWN_VERIFICATION_CLIENTS,
-	type KnownVerificationClientName,
-	type KnownVerificationClientUrlMap,
+	VerificationClient,
 } from './verification-clients.ts'