@reclaimprotocol/client 0.1.29 → 0.1.32

package/src/proof-hash.ts

@@ -1,7 +1,7 @@
 import { keccak_256 } from '@noble/hashes/sha3.js'
 import { canonicalJson as canonical } from './canonical.ts'
 import { bytesToHex } from './encoding.ts'
-import type { HashRequirement, LegacyProof } from './proof-types.ts'
+import type { HashRequirement, ReclaimRequestProof } from './proof-types.ts'
 
 export interface HttpProofParams {
 	url: string
@@ -30,7 +30,7 @@ export interface ProofRequestSpec extends HttpProofParams {
 	templateParamsMode?: 'separate' | 'merge'
 }
 
-/** Exact legacy canonical HTTP-provider hashes, including optional matches. */
+/** Exact canonical HTTP-provider hashes, including optional matches. */
 export function hashProofClaimParams(params: HttpProofParams): string[] {
 	return canonicalProofParams(params).map((serialized) => (
 		'0x' + bytesToHex(keccak_256(new TextEncoder().encode(serialized)))
@@ -38,7 +38,7 @@ export function hashProofClaimParams(params: HttpProofParams): string[] {
 }
 
 export function getHashFromProof(
-	proof: LegacyProof,
+	proof: ReclaimRequestProof,
 	hasNoPii = false,
 ): string[] {
 	if(hasNoPii) {
@@ -74,7 +74,7 @@ export function hashRequestSpec(request: ProofRequestSpec): HashRequirement {
 export function hashRequirementsFromSpecs(
 	requestData: ProofRequestSpec[],
 	allowedInjectedRequestData: ProofRequestSpec[],
-	proofs: LegacyProof[],
+	proofs: ReclaimRequestProof[],
 ): HashRequirement[] {
 	const templates = expandTemplates(
 		allowedInjectedRequestData,
@@ -84,7 +84,7 @@ export function hashRequirementsFromSpecs(
 }
 
 export function assertValidProofHashes(
-	proofs: LegacyProof[],
+	proofs: ReclaimRequestProof[],
 	requirements: Array<string | HashRequirement>,
 	hasNoPii = false,
 ) {
@@ -251,7 +251,7 @@ function substitute(
 	}
 }
 
-function templateParametersFromProofs(proofs: LegacyProof[]) {
+function templateParametersFromProofs(proofs: ReclaimRequestProof[]) {
 	const combined: Record<string, unknown> = {}
 	for(const proof of proofs) {
 		for(const raw of [proof.claimData.parameters, proof.claimData.context]) {

package/src/proof-recipe.ts

@@ -3,7 +3,7 @@ import {
 	hashRequirementsFromSpecs,
 	type ProofRequestSpec,
 } from './proof-hash.ts'
-import type { LegacyProof } from './proof-types.ts'
+import type { ReclaimRequestProof } from './proof-types.ts'
 
 type RequestSelection = components['schemas']['RequestSelection']
 type RequestSelectionTemplate =
@@ -19,12 +19,12 @@ export interface BuilderProofRecipe {
 }
 
 /**
- * Derive the exact hash requirements consumed by legacy `verifyProof` from a
+ * Derive the exact hash requirements consumed by `verifyRequestProof` from a
  * resolved Builder recipe. Builder's fixed requests are required once each.
  */
 export function proofHashesFromBuilderRecipe(
 	recipe: BuilderProofRecipe,
-	proofs: LegacyProof[],
+	proofs: ReclaimRequestProof[],
 ) {
 	return hashRequirementsFromSpecs(
 		recipe.requests.map((request) => toRequestSpec(

package/src/proof-types.ts

@@ -1,16 +1,20 @@
-/** Exact legacy proof structures carried inside Builder result envelopes. */
-export interface LegacyProof {
+/** Exact proof structure for one verified request, carried inside Builder
+ *  result envelopes. Every Verification Client — the in-app SDK, the browser
+ *  extension, portals, and Builder's own client — emits this shape. */
+export interface ReclaimRequestProof {
 	identifier: string
-	claimData: LegacyClaimData
+	claimData: RequestClaimData
 	signatures: string[]
-	witnesses: LegacyWitness[]
+	witnesses: RequestWitness[]
 	extractedParameterValues: unknown
 	publicData?: unknown
 	taskId?: number
-	teeAttestation?: TeeAttestation | string
+	/** Client-specific legacy TEE data. Verification validates a supported
+	 * representation only when TEE verification is requested. */
+	teeAttestation?: unknown
 }
 
-export interface LegacyClaimData {
+export interface RequestClaimData {
 	provider: string
 	parameters: string
 	owner: string
@@ -20,16 +24,40 @@ export interface LegacyClaimData {
 	epoch: number
 }
 
-export interface LegacyWitness {
+export interface RequestWitness {
 	id: string
 	url: string
 	claimAttestation?: AttestorClaimAttestation
 }
 
+/**
+ * Which kind of attestation a witness carries.
+ *
+ * `embedded-attestor` — the in-app SDK and the browser extension. The attestor
+ * signs the claim and, on a TEE run, may also return its own
+ * `attestation_report`.
+ *
+ * `confidential-space` — portals. The browser runtime signs the claim inside a
+ * GCP Confidential Space and returns `tee_attestation`, bound to the claim
+ * through `context.attestationNonce`.
+ */
+export type ClaimAttestationType = 'embedded-attestor' | 'confidential-space'
+
 export interface AttestorClaimAttestation {
+	type: ClaimAttestationType
 	attestor_address: string
 	claim_signature: string
-	attestation_report: string
+	/** `embedded-attestor` only, and optional even then: the attestor's own GCP
+	 *  Confidential Space attestation (an RS256 JWT). Attestors in production
+	 *  sign claims without returning one, so a witness routinely carries only
+	 *  the address and the claim signature. */
+	attestation_report?: string
+	/** `confidential-space` only: the same payload legacy proofs carry in the
+	 *  proof's top-level `teeAttestation`, and typed the same way. It comes
+	 *  from an external producer and is preserved verbatim, so callers validate
+	 *  it at runtime — `verifyTeeAttestation` does — rather than trusting a
+	 *  shape the wire does not guarantee. */
+	tee_attestation?: unknown
 }
 
 export interface TeeAttestation {