@reclaimprotocol/client 0.1.34 → 0.1.36

package/lib/types/openapi.gen.d.ts

@@ -1347,6 +1347,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/docs/agent-installation.md": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Agent installation instructions
+         * @description How to install the Reclaim MCP server in each supported coding agent, as Markdown for a coding agent to read: the exact commands or configuration per agent, how to verify the installation, and troubleshooting. It tells the agent to follow only the section for the client it runs in. Public.
+         */
+        get: operations["AgentInstallationMarkdown"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/login": {
         parameters: {
             query?: never;
@@ -2492,12 +2512,26 @@ export interface paths {
         /**
          * Register a callback subscription
          * @description Registers a destination for verification results on the organization
-         *     the presented `OrgToken` resolves to. The body is just `callbackUrl`
-         *     and `events`. At least one subscription must exist for the org before a
-         *     verification session can be created. Delivery is scoped by org: terminal
-         *     results are ECIES-encrypted to the org's eth public key when its
-         *     `canEncryptResult` is enabled (see `PUT /orgs/{orgId}/keypair`), else
-         *     delivered as plaintext.
+         *     the presented `OrgToken` resolves to. At least one subscription must
+         *     exist for the org before you can create a verification session.
+         *     Delivery is scoped by org: terminal results are ECIES-encrypted to the
+         *     org's eth public key when its `canEncryptResult` is enabled (see
+         *     `PUT /orgs/{orgId}/keypair`), else delivered as plaintext.
+         *
+         *     To receive results at a URL, send `callbackUrl` and `events`. Builder
+         *     POSTs each delivery to that URL.
+         *
+         *     To read results without a public URL during local development, send
+         *     `deliveryMode: "pull"`. Builder keeps the deliveries and you read them
+         *     with `GET /verifications/callback-events`. A pull subscription is a
+         *     90-second lease: it receives events and satisfies the session-creation
+         *     check only while the lease is unexpired. Send the same request about
+         *     every 30 seconds to renew it, and call
+         *     `POST /verifications/callback-listener/release` when you stop. Production
+         *     needs a webhook subscription. An org has at most one pull subscription.
+         *     If it already exists, Builder renews it and returns it with status 200.
+         *     If the body includes `events`, they replace the subscription's events;
+         *     if it omits them, the existing events are kept.
          */
         post: operations["CreateCallbackSubscription"];
         delete?: never;
@@ -2506,6 +2540,86 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/verifications/callback-listener/release": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Release the pull listener
+         * @description Expires the organization's pull subscription lease immediately, so it stops receiving events and no longer satisfies the session-creation check. Stored events stay readable. Call it when the coding agent stops. It succeeds when no pull subscription exists or the lease has already expired.
+         */
+        post: operations["ReleaseCallbackListener"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/verifications/callback-events": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List events from the pull subscription
+         * @description Lists the deliveries of the organization's pull subscription, oldest
+         *     first. Use it to read verification results without a public URL.
+         *     Create the pull subscription with `POST /verifications/callback-subscriptions`
+         *     and `deliveryMode: "pull"`.
+         *
+         *     Each item's `envelope` is the body that Builder POSTs to a webhook
+         *     subscription, so you handle both the same way. For a pull
+         *     subscription, `envelope.timestamp` is the time Builder created the
+         *     delivery.
+         *
+         *     To poll, pass the previous response's `next` as `after`. `next` is
+         *     always set, and equals `after` when no new events exist. Treat cursors
+         *     as opaque. A cursor read is not complete: a delivery that commits after
+         *     a later one can be missed, because the cursor has already moved past
+         *     it. The reliable path is `pending=true` plus
+         *     `POST /verifications/callback-events/acknowledge`: acknowledge each
+         *     event you handled, and read `pending=true` without `after` so anything
+         *     missed shows up on the next read.
+         *
+         *     Builder keeps result payloads for seven days. Acknowledged events stay
+         *     readable until then.
+         */
+        get: operations["ListCallbackEvents"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/verifications/callback-events/acknowledge": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Acknowledge events from the pull subscription
+         * @description Marks pull deliveries as `delivered` so `GET /verifications/callback-events` with `pending=true` stops returning them. Builder keeps the payloads until the seven-day retention limit. Ids that are unknown, belong to another organization, or are already acknowledged are ignored.
+         */
+        post: operations["AcknowledgeCallbackEvents"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/verifications/callback-subscriptions/{subscriptionId}": {
         parameters: {
             query?: never;
@@ -2541,7 +2655,8 @@ export interface paths {
         put?: never;
         /**
          * Register a callback subscription on an organization
-         * @description Registers a destination for verification results on the organization. Caller must be an active member of the org. The body is just `callbackUrl` and `events`; delivery is scoped to the org and encrypted as an ECIES ciphertext (base64url) to the org's encryption credential when set, else delivered as plaintext.
+         * @description Registers a destination for verification results on the organization. Caller must be an active member of the org. Delivery is scoped to the org and encrypted as an ECIES ciphertext (base64url) to the org's encryption credential when set, else delivered as plaintext.
+         *     Send `callbackUrl` and `events` to receive results at a URL. Send `deliveryMode: "pull"` to keep results for reading with `GET /verifications/callback-events`. A pull subscription works only while its 90-second lease is unexpired, and each repeated request renews it. An org has at most one pull subscription. If it already exists, Builder returns it with status 200.
          */
         post: operations["CreateOrgCallbackSubscription"];
         delete?: never;
@@ -2989,6 +3104,7 @@ export interface paths {
         /**
          * Submit exact proofs as a managed Builder result
          * @description Accepts exact `Proof` objects from a claimant-facing `api=2` client. Builder atomically records the first terminal outcome, checks it against the submitted status, signs the outer Builder JWS with its managed key, optionally encrypts it for matching callback subscriptions, and enqueues delivery. Retrying the same terminal outcome is idempotent. This is the only result-submission endpoint; Verification Clients never receive signing or encryption keys.
+         *     Before it accepts a `success` result, Builder verifies every proof with the same trust a default `@reclaimprotocol/client` consumer uses: Builder's attestor addresses and image digests, the session recipe's provider hashes, and the session binding. If a proof fails, Builder records the session as a terminal `error` with a `problem` whose `reasonCode` is `invalid-proof`, enqueues the `verification_error` delivery, and returns `422`. Don't retry a `422`; the session is already terminal.
          */
         post: operations["SubmitVerificationClientResult"];
         delete?: never;
@@ -5798,24 +5914,59 @@ export interface components {
              * @description The organization that owns this callback subscription.
              */
             orgId: string;
-            /** @description HTTP(S) endpoint that receives the event. It may contain `{{sessionId}}` and top-level session-context placeholders such as `{{orderId}}`. The Builder URI-encodes each value and stores the expanded URL when it creates the delivery. */
-            callbackUrl: string;
+            deliveryMode: components["schemas"]["CallbackDeliveryMode"];
+            /** @description HTTP(S) endpoint that receives the event. It may contain `{{sessionId}}` and top-level session-context placeholders such as `{{orderId}}`. The Builder URI-encodes each value and stores the expanded URL when it creates the delivery. Absent when `deliveryMode` is `pull`. */
+            callbackUrl?: string;
+            /** @description Present when `deliveryMode` is `pull`. The pull subscription receives events and satisfies the session-creation check only until this time. Renew it by repeating the create request. */
+            listenerExpiresAt?: components["schemas"]["Timestamp"];
             /** @description Events this subscription wants delivered — any subset of `VerificationEvent`. Builder terminal events are `verification_success`, `verification_rejected`, `verification_error`, `verification_cancelled`, and `session_expired`. Terminal result deliveries contain the signed result when one is available; non-terminal events deliver a plaintext notification. */
             events: components["schemas"]["VerificationEvent"][];
             createdAt: components["schemas"]["Timestamp"];
             updatedAt: components["schemas"]["Timestamp"];
         };
-        /** @description Body for `POST /verifications/callback-subscriptions`. The owning organization is resolved from the presented `OrgToken`; delivery is scoped to that org and encrypted to its credential when set. */
-        CreateCallbackSubscriptionRequest: {
+        /**
+         * @description How Builder delivers events. `webhook` POSTs each one to `callbackUrl`. `pull` keeps them for you to read with `GET /verifications/callback-events`.
+         * @enum {string}
+         */
+        CallbackDeliveryMode: "webhook" | "pull";
+        /** @description A subscription that Builder POSTs each delivery to. */
+        WebhookCallbackSubscriptionRequest: {
+            /**
+             * @description Omit it or send `webhook`.
+             * @enum {string}
+             */
+            deliveryMode?: "webhook";
             /** @description Callback URL or template. Supported placeholders are `{{sessionId}}` and top-level scalar context keys. */
             callbackUrl: string;
             events: components["schemas"]["VerificationEvent"][];
         };
-        /** @description Body for `POST /orgs/{orgId}/callback-subscriptions`. The owning organization comes from the path; bearer-authenticated and gated on org membership. Delivery is scoped to the org and encrypted to its credential when set. */
-        CreateOrgCallbackSubscriptionRequest: {
-            /** @description Callback URL or template. Supported placeholders are `{{sessionId}}` and top-level scalar context keys. */
-            callbackUrl: string;
-            events: components["schemas"]["VerificationEvent"][];
+        /** @description A subscription whose deliveries wait for you to read them. It has no URL. An org has at most one. */
+        PullCallbackSubscriptionRequest: {
+            /** @enum {string} */
+            deliveryMode: "pull";
+            /** @description Not allowed. A pull subscription has no URL. */
+            callbackUrl?: unknown;
+            /** @description Events to keep. Defaults to every event. */
+            events?: components["schemas"]["VerificationEvent"][];
+        };
+        /** @description Body for `POST /verifications/callback-subscriptions`. The owning organization is resolved from the presented `OrgToken`; delivery is scoped to that org and encrypted to its credential when set. Send `callbackUrl` for a webhook, or `deliveryMode: "pull"` for a subscription you read. */
+        CreateCallbackSubscriptionRequest: components["schemas"]["WebhookCallbackSubscriptionRequest"] | components["schemas"]["PullCallbackSubscriptionRequest"];
+        /** @description Body for `POST /orgs/{orgId}/callback-subscriptions`. The owning organization comes from the path; bearer-authenticated and gated on org membership. Delivery is scoped to the org and encrypted to its credential when set. Send `callbackUrl` for a webhook, or `deliveryMode: "pull"` for a subscription you read. */
+        CreateOrgCallbackSubscriptionRequest: components["schemas"]["WebhookCallbackSubscriptionRequest"] | components["schemas"]["PullCallbackSubscriptionRequest"];
+        /** @description One delivery waiting on the organization's pull subscription. */
+        CallbackEvent: {
+            /**
+             * Format: uuid
+             * @description Pass it to `POST /verifications/callback-events/acknowledge`.
+             */
+            id: string;
+            subscriptionId: components["schemas"]["SubscriptionID"];
+            sessionId: components["schemas"]["SessionID"];
+            event: components["schemas"]["VerificationEvent"];
+            /** @description `pending` until you acknowledge the event, then `delivered`. */
+            deliveryStatus: components["schemas"]["CallbackDeliveryStatus"];
+            createdAt: components["schemas"]["Timestamp"];
+            envelope: components["schemas"]["VerificationResultDelivery"];
         };
         /** @description Present only when the session's `mode` is `SANDBOX`. */
         SandboxLimits: {
@@ -6216,7 +6367,7 @@ export interface components {
                 signature: string;
             }[];
         };
-        /** @description The JSON envelope POSTed to a callback subscription's `callbackUrl` (see the `verificationResult` webhook). `sessionId`, `event` and `timestamp` are unauthenticated plaintext routing hints; branch on `event` for the shape of `data`. **Terminal result events** carry the signed result — an ECIES ciphertext (base64url, secp256k1 + AES-256-GCM) wrapping the signed JWS when the org has an encryption credential, else the plaintext signed JWS — act only on the signature-verified contents. **Non-terminal events** carry a plaintext, **unsigned** progress notification — advisory only; the signed terminal result is the source of truth. */
+        /** @description The JSON envelope POSTed to a callback subscription's `callbackUrl` (see the `verificationResult` webhook), and returned as `envelope` by `GET /verifications/callback-events` for a pull subscription. `sessionId`, `event` and `timestamp` are unauthenticated plaintext routing hints; branch on `event` for the shape of `data`. **Terminal result events** carry the signed result — an ECIES ciphertext (base64url, secp256k1 + AES-256-GCM) wrapping the signed JWS when the org has an encryption credential, else the plaintext signed JWS — act only on the signature-verified contents. **Non-terminal events** carry a plaintext, **unsigned** progress notification — advisory only; the signed terminal result is the source of truth. */
         VerificationResultDelivery: {
             sessionId: components["schemas"]["SessionID"];
             /** @description The event that produced this delivery. */
@@ -6230,7 +6381,18 @@ export interface components {
             /** @enum {string} */
             status: "success" | "rejected" | "error" | "cancelled";
             results: components["schemas"]["VerificationClientProviderResult"][];
-            problem?: components["schemas"]["Problem"] | null;
+            problem?: ({
+                /** @description Stable machine-readable failure code. Builder records `invalid-proof` when a submitted proof fails its verification. */
+                reasonCode?: string;
+                retryable?: boolean;
+                /** @description Builder-recorded proof failures, one per provider. Present with `reasonCode: invalid-proof`. */
+                proofs?: {
+                    providerId?: string;
+                    resolvedVersion?: string;
+                    requestIds?: string[];
+                    reason?: string;
+                }[];
+            } & components["schemas"]["Problem"]) | null;
         };
         VerificationClientProviderResult: {
             providerId: components["schemas"]["ProviderID"];
@@ -6364,8 +6526,11 @@ export interface components {
         VerificationDelivery: {
             subscriptionId: components["schemas"]["SubscriptionID"];
             event: components["schemas"]["VerificationEvent"];
-            /** Format: uri */
-            callbackUrl: string;
+            /**
+             * Format: uri
+             * @description Absent for deliveries to a pull subscription.
+             */
+            callbackUrl?: string;
             deliveryStatus: components["schemas"]["CallbackDeliveryStatus"];
             attempts: number;
             lastAttemptAt?: components["schemas"]["Timestamp"];
@@ -8515,6 +8680,27 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    AgentInstallationMarkdown: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description The guide as Markdown. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "text/markdown": string;
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     LoginPage: {
         parameters: {
             query?: {
@@ -8860,9 +9046,12 @@ export interface operations {
                 tab?: "overview" | "connect" | "integrate" | "providers" | "members" | "themes" | "settings" | "sessions" | "billing";
                 /** @description Integrate tab only. Which integration path to show: a coding agent over MCP, the client package, or plain HTTP. */
                 track?: "agent" | "sdk" | "http";
-                /** @description Integrate tab, agent track only. Which coding agent's install command to show. */
+                /**
+                 * @deprecated
+                 * @description Ignored.
+                 */
                 agent?: "claude" | "copilot" | "cursor" | "omp" | "opencode" | "codex" | "antigravity" | "others";
-                /** @description Integrate tab, agent track only. What users prove, as typed into the prompt's goal field; kept when another agent is picked. */
+                /** @description Integrate tab, agent track only. What users prove, as typed into the prompt's goal field. */
                 goal?: string;
                 /** @description Integrate tab: the providers to show in the examples in place of placeholder ids, for example when arriving from a provider page or a build page. Repeat to pass several. Dashboard tab: scopes the report to sessions that ran this provider (the first one); options come from `GET /orgs/{orgId}/providers/used`. */
                 providerId?: components["schemas"]["ProviderID"][];
@@ -10677,6 +10866,15 @@ export interface operations {
             };
         };
         responses: {
+            /** @description The org's existing pull subscription */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CallbackSubscription"];
+                };
+            };
             /** @description Subscription created */
             201: {
                 headers: {
@@ -10689,6 +10887,85 @@ export interface operations {
             default: components["responses"]["ProblemResponse"];
         };
     };
+    ReleaseCallbackListener: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Released */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    ListCallbackEvents: {
+        parameters: {
+            query?: {
+                /** @description Cursor from the `next` field of a previous response. Returns only events after it. Omit it to start from the oldest event. */
+                after?: string;
+                /** @description Maximum number of events to return. Defaults to 50. */
+                limit?: number;
+                /** @description Returns only events of this verification session. */
+                sessionId?: components["schemas"]["SessionID"];
+                /** @description When `true`, returns only events you have not acknowledged. Defaults to `false`. */
+                pending?: boolean;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Ok */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        items: components["schemas"]["CallbackEvent"][];
+                        /** @description Cursor to pass as `after` on the next request. Equals `after` when `items` is empty, and `0` when you passed no `after`. */
+                        next: string;
+                    };
+                };
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
+    AcknowledgeCallbackEvents: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The `id` of each `CallbackEvent` to acknowledge. */
+                    ids: string[];
+                };
+            };
+        };
+        responses: {
+            /** @description Acknowledged */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            default: components["responses"]["ProblemResponse"];
+        };
+    };
     DeleteCallbackSubscription: {
         parameters: {
             query?: never;
@@ -10753,6 +11030,15 @@ export interface operations {
             };
         };
         responses: {
+            /** @description The org's existing pull subscription */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["CallbackSubscription"];
+                };
+            };
             /** @description Subscription created */
             201: {
                 headers: {
@@ -11027,7 +11313,7 @@ export interface operations {
                     "application/problem+json": components["schemas"]["Problem"];
                 };
             };
-            /** @description No callback subscription exists for the organization. Register one first via `POST /verifications/callback-subscriptions` (or `POST /orgs/{orgId}/callback-subscriptions`). */
+            /** @description No callback subscription exists for the organization. Register one first via `POST /verifications/callback-subscriptions` (or `POST /orgs/{orgId}/callback-subscriptions`). A pull subscription satisfies this check only while its listener lease is unexpired. */
             409: {
                 headers: {
                     [name: string]: unknown;
@@ -11289,6 +11575,15 @@ export interface operations {
             };
             400: components["responses"]["ProblemResponse"];
             409: components["responses"]["ProblemResponse"];
+            /** @description A submitted proof failed Builder verification. Builder recorded the session as a terminal `error` and enqueued `verification_error`. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
             default: components["responses"]["ProblemResponse"];
         };
     };

package/lib/types/openapi.gen.js

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/openapi-typegen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:e2db795ab15c).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:96339e8dff91).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.

package/lib/verify-attestor-tee.d.ts

@@ -51,6 +51,18 @@ export type AttestorTeeAttestationConfig = {
      */
     expectedImageDigests?: string[];
 };
+/** How strictly `runAttestorTeeVerification` treats witnesses without a
+ *  `claimAttestation`. */
+export interface AttestorTeeVerificationOptions {
+    /**
+     * Default `true`: every witness must carry a `claimAttestation`. `false`
+     * counts a witness without one as unattested, which is how
+     * `@reclaimprotocol/js-sdk` verifies by default — its claim signature is
+     * still checked against the trusted attestors by the caller. Portal TEE
+     * proofs without a bound nonce have no envelope.
+     */
+    requireClaimAttestation?: boolean;
+}
 /** A witness's attestation kind. Required: every client sets it explicitly. */
 export declare function claimAttestationType(att: AttestorClaimAttestation): ClaimAttestationType;
 /** What `runAttestorTeeVerification` actually checked, per witness. */
@@ -58,8 +70,9 @@ export interface AttestorTeeVerificationSummary {
     /** Witnesses whose `attestation_report` was verified (and pinned, when
      *  `expectedImageDigests` was set). */
     verified: number;
-    /** Witnesses that carried no `attestation_report`. Their attestor address
-     *  and claim signature were still verified. */
+    /** Witnesses that carried no `attestation_report`, or no
+     *  `claimAttestation` when it isn't required. Their attestor address and
+     *  claim signature were still verified. */
     unattested: number;
 }
 /**
@@ -67,7 +80,8 @@ export interface AttestorTeeVerificationSummary {
  * provided proof. Throws `AttestorTeeVerificationError` on the first
  * failure.
  *
- * Each witness must carry a `claimAttestation`. For each one, this:
+ * Each witness must carry a `claimAttestation` unless
+ * `options.requireClaimAttestation` is `false`. For each one, this:
  *   1. Asserts `attestor_address` matches `witness.id`.
  *   2. Asserts `claim_signature` is present in `proof.signatures`.
  *   3. Recovers the signer of `claim_signature` from the claim data and
@@ -89,5 +103,6 @@ export interface AttestorTeeVerificationSummary {
  *
  * @param proofs - The proofs to verify.
  * @param config - Optional config; see {@link AttestorTeeAttestationConfig}.
+ * @param options - See {@link AttestorTeeVerificationOptions}.
  */
-export declare function runAttestorTeeVerification(proofs: Proof[], config?: AttestorTeeAttestationConfig): Promise<AttestorTeeVerificationSummary>;
+export declare function runAttestorTeeVerification(proofs: Proof[], config?: AttestorTeeAttestationConfig, { requireClaimAttestation }?: AttestorTeeVerificationOptions): Promise<AttestorTeeVerificationSummary>;

package/lib/verify-attestor-tee.js

@@ -165,7 +165,7 @@ function normalizeAttestorAddress(address) {
 function normalizeSignature(sig) {
     return sig.trim().toLowerCase();
 }
-async function verifyAttestorTeeForProof(proof, config, summary) {
+async function verifyAttestorTeeForProof(proof, config, requireClaimAttestation, summary) {
     if (!proof.witnesses || proof.witnesses.length === 0) {
         throw new AttestorTeeVerificationError('Proof has no witnesses');
     }
@@ -174,6 +174,10 @@ async function verifyAttestorTeeForProof(proof, config, summary) {
     const claimSignData = createSignDataForClaim(proof.claimData);
     for (const witness of proof.witnesses) {
         const att = witness.claimAttestation;
+        if (!att && !requireClaimAttestation) {
+            summary.unattested++;
+            continue;
+        }
         if (!att) {
             throw new AttestorTeeVerificationError(`Witness ${witness.id} is missing claimAttestation`);
         }
@@ -233,7 +237,8 @@ async function verifyAttestorTeeForProof(proof, config, summary) {
  * provided proof. Throws `AttestorTeeVerificationError` on the first
  * failure.
  *
- * Each witness must carry a `claimAttestation`. For each one, this:
+ * Each witness must carry a `claimAttestation` unless
+ * `options.requireClaimAttestation` is `false`. For each one, this:
  *   1. Asserts `attestor_address` matches `witness.id`.
  *   2. Asserts `claim_signature` is present in `proof.signatures`.
  *   3. Recovers the signer of `claim_signature` from the claim data and
@@ -255,8 +260,9 @@ async function verifyAttestorTeeForProof(proof, config, summary) {
  *
  * @param proofs - The proofs to verify.
  * @param config - Optional config; see {@link AttestorTeeAttestationConfig}.
+ * @param options - See {@link AttestorTeeVerificationOptions}.
  */
-export async function runAttestorTeeVerification(proofs, config = {}) {
+export async function runAttestorTeeVerification(proofs, config = {}, { requireClaimAttestation = true } = {}) {
     if (!proofs || proofs.length === 0) {
         throw new AttestorTeeVerificationError('No proofs provided for attestor TEE verification');
     }
@@ -266,7 +272,7 @@ export async function runAttestorTeeVerification(proofs, config = {}) {
     };
     try {
         for (const proof of proofs) {
-            await verifyAttestorTeeForProof(proof, config, summary);
+            await verifyAttestorTeeForProof(proof, config, requireClaimAttestation, summary);
         }
         return summary;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/client",
 	"title": "Reclaim Client",
-	"version": "0.1.34",
+	"version": "0.1.36",
 	"description": "Typed SDK/HTTP client SDK for the Reclaim Protocol — the programmatic way to use Reclaim Protocol to verify **data points** about your users (a follower count, an account balance, an order). Can be directly integrated by apps to request verification for their users using Reclaim Protocol and verify the results.",
 	"type": "module",
 	"sideEffects": false,

package/src/errors.ts

@@ -44,6 +44,58 @@ export function isProblemError(error: unknown): error is ProblemError {
 		&& isProblemErrorOutput(error.output)
 }
 
+/**
+ * Whether retrying the same request later can succeed: a network failure, a
+ * timeout, or an HTTP 5xx, 408, or 429 from Builder (a {@link ProblemError}
+ * or a plain error carrying the HTTP `status`). Everything else, such as a
+ * malformed response, won't change on retry.
+ */
+export function isTransientError(error: unknown): boolean {
+	// `fetch` rejects with a TypeError when the network fails.
+	if(error instanceof TypeError) {
+		return true
+	}
+
+	if(
+		error instanceof Error
+		&& (error.name === 'TimeoutError' || error.name === 'AbortError')
+	) {
+		return true
+	}
+
+	const status = isProblemError(error)
+		? error.output.statusCode
+		: isRecord(error) ? error.status : undefined
+	return typeof status === 'number'
+		&& (status >= 500 || status === 408 || status === 429)
+}
+
+// Errors thrown by a network step and judged transient. Tracked by identity
+// so a content check that throws, say, a TypeError is never mistaken for one.
+const TRANSIENT_ERRORS = new WeakSet<object>()
+
+/**
+ * Runs one network step, such as a JWKS fetch or a session or provider
+ * lookup, and marks a transient failure so {@link isTransientFailure} can
+ * tell it apart from a failed content check.
+ */
+export async function networkStep<T>(step: () => Promise<T> | T): Promise<T> {
+	try {
+		return await step()
+	} catch(error) {
+		if(error instanceof Error && isTransientError(error)) {
+			TRANSIENT_ERRORS.add(error)
+		}
+
+		throw error
+	}
+}
+
+/** Whether `error` came from a {@link networkStep} and a retry can succeed. */
+export function isTransientFailure(error: unknown): boolean {
+	return error instanceof Error && TRANSIENT_ERRORS.has(error)
+}
+
 /** Returns whether a value follows the RFC 9457 problem-details schema. */
 export function isProblemDetails(value: unknown): value is ProblemDetails {
 	if(!isRecord(value)) {

package/src/jwks.ts

@@ -95,7 +95,11 @@ export async function fetchReclaimJwks(
 	assertSecureJwksUrl(url)
 	const res = await fetchImpl(url)
 	if(!res.ok) {
-		throw new Error(`JWKS fetch failed for ${url}: HTTP ${res.status}`)
+		// `status` lets callers tell a temporary Builder outage from a bad URL.
+		throw Object.assign(
+			new Error(`JWKS fetch failed for ${url}: HTTP ${res.status}`),
+			{ status: res.status },
+		)
 	}
 
 	const body = (await res.json()) as Partial<ReclaimJwks>