@reclaimprotocol/client 0.1.35 → 0.1.36

package/README.md

@@ -750,16 +750,18 @@ including `hasNoPii`, verifier TEE (`teeAttestation.appSecret`), and
 attestor-TEE checks. The configured Builder JWKS URL supplies the
 purpose-bound result keys, its `x-reclaim-attestors` signer list, and its
 `x-reclaim-attestor-image-digests` Confidential Space image allowlist. When
-the JWKS publishes image digests, `verifyResultFull` automatically verifies
-every witness's attestor TEE `claimAttestation` — its attestor address and
-claim signature always, and its `attestation_report` when the witness carries
-one. The report is optional: production attestors sign claims without
-returning one, so a witness with only an address and a signature verifies, and
-`isAttestorTeeAttestationVerified` comes back `false` to say nothing was
-attested. If
-`proofValidation.attestorTeeAttestation.expectedImageDigests` is also set, the
-SDK uses the intersection: caller policy can narrow the published trust list,
-but can't broaden it. TEE settings preserve the same configuration objects;
+the JWKS publishes image digests, `verifyResultFull` verifies any attestor TEE
+`claimAttestation` a witness carries — its attestor address and claim
+signature, and its `attestation_report` pinned to those digests when present.
+Neither is required: like `@reclaimprotocol/js-sdk`, a witness is trusted by
+its signer being in `x-reclaim-attestors`. A portal TEE proof without a bound
+nonce has no `claimAttestation`, and production attestors sign without
+returning a report. When nothing was attested,
+`isAttestorTeeAttestationVerified` comes back `false`. Set
+`proofValidation.attestorTeeAttestation` to require a `claimAttestation` on
+every witness. If its `expectedImageDigests` is also set, the SDK uses the
+intersection: caller policy can narrow the published trust list, but can't
+broaden it. TEE settings preserve the same configuration objects;
 `verifyResultFull` does not accept injected verification hooks. The surrounding
 issuer, session, and context checks are stateless; persist accepted session IDs
 in your application to prevent replay.
@@ -808,6 +810,51 @@ try {
 A non-terminal `event` delivery is not a result and never throws. It returns
 `{ kind: 'event', … }`.
 
+#### Respond to a callback delivery
+
+Builder retries a delivery until your callback route answers 2xx, and a
+delivery that never succeeds holds back that session's later events. If
+retrying the same body can't help, answer 2xx. If the failure is temporary,
+answer 5xx.
+
+`ResultVerificationError.retryable` tells you which case you're in. It's
+`true` only when a temporary condition caused the failure:
+Builder's JWKS or provider recipe couldn't be fetched because of a network
+error, a timeout, an HTTP 5xx, or rate limiting (`jwks-fetch-failed`,
+`session-resolution-failed`, or an `invalid-proof` whose proofs all failed
+this way). It's `false` for everything about the result itself, including
+`bad-signature`, `issuer-not-trusted`, `aud-mismatch`,
+`reclaimSessionId-mismatch`, `expired`, and an `invalid-proof` with any
+genuinely invalid proof.
+
+```ts
+app.post('/reclaim/callback', async (req, res) => {
+  try {
+    const { result } = await reclaim.results.receive(req.body, {
+      orgEthPrivateKey,
+      reclaimSessionId,
+    })
+    await markVerificationComplete(result)
+    res.sendStatus(200)
+  } catch (err) {
+    if (err instanceof ResultVerificationError) {
+      await storeFailure(err.reason, err.outcome)
+      // Retrying a bad result can't help, so only ask for a retry when the
+      // failure is temporary.
+      res.sendStatus(err.retryable ? 503 : 200)
+      return
+    }
+    throw err
+  }
+})
+```
+
+`results.receive` can also throw an ordinary `Error` instead of
+`ResultVerificationError`, for example when `orgEthPrivateKey` is missing or
+doesn't match the key the result was encrypted to. Treat it as a
+configuration problem: log it and answer 5xx, so the delivery succeeds once
+you fix the key. Builder holds an undelivered result for 7 days.
+
 ### `reclaim.api` — escape hatch
 
 ```ts

package/lib/errors.d.ts

@@ -22,6 +22,21 @@ export type ProblemError = Error & {
 };
 /** Returns whether a thrown value is a Builder {@link ProblemError}. */
 export declare function isProblemError(error: unknown): error is ProblemError;
+/**
+ * Whether retrying the same request later can succeed: a network failure, a
+ * timeout, or an HTTP 5xx, 408, or 429 from Builder (a {@link ProblemError}
+ * or a plain error carrying the HTTP `status`). Everything else, such as a
+ * malformed response, won't change on retry.
+ */
+export declare function isTransientError(error: unknown): boolean;
+/**
+ * Runs one network step, such as a JWKS fetch or a session or provider
+ * lookup, and marks a transient failure so {@link isTransientFailure} can
+ * tell it apart from a failed content check.
+ */
+export declare function networkStep<T>(step: () => Promise<T> | T): Promise<T>;
+/** Whether `error` came from a {@link networkStep} and a retry can succeed. */
+export declare function isTransientFailure(error: unknown): boolean;
 /** Returns whether a value follows the RFC 9457 problem-details schema. */
 export declare function isProblemDetails(value: unknown): value is ProblemDetails;
 /** Reads an RFC 9457 response, with a status-only fallback for other bodies. */

package/lib/errors.js

@@ -14,6 +14,50 @@ export function isProblemError(error) {
     return isProblemDetails(error.data)
         && isProblemErrorOutput(error.output);
 }
+/**
+ * Whether retrying the same request later can succeed: a network failure, a
+ * timeout, or an HTTP 5xx, 408, or 429 from Builder (a {@link ProblemError}
+ * or a plain error carrying the HTTP `status`). Everything else, such as a
+ * malformed response, won't change on retry.
+ */
+export function isTransientError(error) {
+    // `fetch` rejects with a TypeError when the network fails.
+    if (error instanceof TypeError) {
+        return true;
+    }
+    if (error instanceof Error
+        && (error.name === 'TimeoutError' || error.name === 'AbortError')) {
+        return true;
+    }
+    const status = isProblemError(error)
+        ? error.output.statusCode
+        : isRecord(error) ? error.status : undefined;
+    return typeof status === 'number'
+        && (status >= 500 || status === 408 || status === 429);
+}
+// Errors thrown by a network step and judged transient. Tracked by identity
+// so a content check that throws, say, a TypeError is never mistaken for one.
+const TRANSIENT_ERRORS = new WeakSet();
+/**
+ * Runs one network step, such as a JWKS fetch or a session or provider
+ * lookup, and marks a transient failure so {@link isTransientFailure} can
+ * tell it apart from a failed content check.
+ */
+export async function networkStep(step) {
+    try {
+        return await step();
+    }
+    catch (error) {
+        if (error instanceof Error && isTransientError(error)) {
+            TRANSIENT_ERRORS.add(error);
+        }
+        throw error;
+    }
+}
+/** Whether `error` came from a {@link networkStep} and a retry can succeed. */
+export function isTransientFailure(error) {
+    return error instanceof Error && TRANSIENT_ERRORS.has(error);
+}
 /** Returns whether a value follows the RFC 9457 problem-details schema. */
 export function isProblemDetails(value) {
     if (!isRecord(value)) {

package/lib/jwks.js

@@ -47,7 +47,8 @@ export async function fetchReclaimJwks(url, fetchImpl = fetch) {
     assertSecureJwksUrl(url);
     const res = await fetchImpl(url);
     if (!res.ok) {
-        throw new Error(`JWKS fetch failed for ${url}: HTTP ${res.status}`);
+        // `status` lets callers tell a temporary Builder outage from a bad URL.
+        throw Object.assign(new Error(`JWKS fetch failed for ${url}: HTTP ${res.status}`), { status: res.status });
     }
     const body = (await res.json());
     return {

package/lib/request-proof.d.ts

@@ -25,9 +25,15 @@ export interface VerifyRequestProofOptions {
     /** Read `providerHash` from context, while still verifying signatures. */
     hasNoPii?: true;
     teeAttestation?: TeeAttestationConfig;
+    /** Require every witness to carry a `claimAttestation`, and verify any
+     *  `attestation_report` against `expectedImageDigests`. */
     attestorTeeAttestation?: AttestorTeeAttestationConfig;
     /** Explicit trusted attestor ETH addresses. */
     attestorAddresses?: string[];
+    /** Trusted attestor image digests, like `x-reclaim-attestor-image-digests`.
+     *  Pin any `attestation_report` a witness carries without requiring one,
+     *  matching `@reclaimprotocol/js-sdk`'s default. */
+    attestorImageDigests?: string[];
     /** Trusted Builder JWKS registry containing attestor-purpose keys. */
     attestorJwksUrl?: string;
     fetchImpl?: typeof fetch;
@@ -43,6 +49,10 @@ export interface VerifyRequestProofOptions {
 export interface ReclaimRequestProofOutcome {
     valid: boolean;
     reason?: string;
+    /** On failure: true when a temporary condition caused it, such as a
+     *  network error while resolving the session or provider. A retry can
+     *  succeed. */
+    transient?: boolean;
     proofHashes?: string[];
     isTeeAttestationVerified?: boolean;
     /** True when at least one witness's `attestation_report` verified; false

package/lib/request-proof.js

@@ -1,5 +1,6 @@
 import { createSignDataForClaim } from '@reclaimprotocol/attestor-core';
 import { recoverEip191Address } from "./eip191.js";
+import { isTransientFailure, networkStep } from "./errors.js";
 import { fetchReclaimJwks, trustedAttestorAddresses } from "./jwks.js";
 import { assertValidProofHashes, getHashFromProof } from "./proof-hash.js";
 import { runAttestorTeeVerification, } from "./verify-attestor-tee.js";
@@ -31,11 +32,13 @@ export async function verifyRequestProof(proofOrProofs, config) {
         let isAttestorTeeAttestationVerified;
         const attestorTeeAttestation = resolveAttestorTeeAttestation(effective.attestorTeeAttestation, trust.imageDigests);
         if (attestorTeeAttestation) {
+            // Only a caller-configured check requires an envelope on every
+            // witness; registry digests alone pin the reports that exist.
             // `verified` counts witnesses whose attestation report was checked.
             // A proof whose witnesses carry no report still passes the address
             // and signature bindings, but nothing was attested — say so rather
             // than reporting a TEE attestation that never happened.
-            const summary = await runAttestorTeeVerification(proofs, attestorTeeAttestation);
+            const summary = await runAttestorTeeVerification(proofs, attestorTeeAttestation, { requireClaimAttestation: !!effective.attestorTeeAttestation });
             isAttestorTeeAttestationVerified = summary.verified > 0;
         }
         return {
@@ -51,27 +54,30 @@ export async function verifyRequestProof(proofOrProofs, config) {
         return {
             valid: false,
             reason: failureReason(error),
+            transient: isTransientFailure(error),
         };
     }
 }
 async function resolveValidation(config, proofs) {
     let effective = config;
-    if (config.sessionId && !hasContentValidation(config)) {
-        if (!config.resolveSession) {
+    const { sessionId, resolveSession } = config;
+    if (sessionId && !hasContentValidation(config)) {
+        if (!resolveSession) {
             throw new Error('session-resolver-required');
         }
         effective = {
             ...config,
-            ...await config.resolveSession(config.sessionId, proofs),
+            ...await networkStep(() => resolveSession(sessionId, proofs)),
         };
     }
     return effective;
 }
 async function resolveAttestorTrust(config) {
     const addresses = config.attestorAddresses?.map(normalized) ?? [];
-    const imageDigests = [];
-    if (config.attestorJwksUrl) {
-        const registry = await fetchReclaimJwks(config.attestorJwksUrl, config.fetchImpl);
+    const imageDigests = config.attestorImageDigests?.map(normalized) ?? [];
+    const { attestorJwksUrl, fetchImpl } = config;
+    if (attestorJwksUrl) {
+        const registry = await networkStep(() => (fetchReclaimJwks(attestorJwksUrl, fetchImpl)));
         addresses.push(...(registry['x-reclaim-attestors'] ?? []), ...trustedAttestorAddresses(registry.keys));
         imageDigests.push(...(registry['x-reclaim-attestor-image-digests'] ?? []));
     }
@@ -131,11 +137,12 @@ async function assertContent(proofs, config) {
         assertValidProofHashes(proofs, config.hashes, config.hasNoPii);
         return;
     }
-    if (config.providerId) {
-        if (!config.resolveProvider) {
+    const { providerId, providerVersion, allowedTags, resolveProvider } = config;
+    if (providerId) {
+        if (!resolveProvider) {
             throw new Error('provider-resolver-required');
         }
-        const candidates = await config.resolveProvider(config.providerId, config.providerVersion, config.allowedTags, proofs);
+        const candidates = await networkStep(() => (resolveProvider(providerId, providerVersion, allowedTags, proofs)));
         if (!candidates.length) {
             throw new Error('provider-not-found');
         }

package/lib/result.d.ts

@@ -132,6 +132,9 @@ export interface ResultProofOutcome {
     proof?: ReclaimRequestProof;
     proofValid: boolean;
     reason?: string;
+    /** On failure: true when a temporary condition caused it, such as a
+     *  network error while resolving the provider. */
+    transient?: boolean;
     /** @deprecated Use `attestorAddresses`; retained for compatibility. */
     attestorAddress?: string;
     /** Every attestor address declared by the proof. */
@@ -157,11 +160,17 @@ export interface VerifyResultFullOutcome extends VerifyResultOutcome {
 }
 export interface ResultVerificationFailure extends VerifyResultFullOutcome {
     reason: string;
+    /** True when a temporary condition caused the failure. Set by the
+     *  verifier; read it as {@link ResultVerificationError.retryable}. */
+    retryable?: boolean;
 }
 /**
  * Thrown by {@link verifyResult} / {@link verifyResultFull} (and therefore
  * `reclaim.results.verify`/`receive`) when a result fails verification. Carries
- * the full invalid outcome so callers can inspect it in a `catch`:
+ * the full invalid outcome so callers can inspect it in a `catch`.
+ *
+ * In a callback handler, answer 2xx when `retryable` is `false` (Builder
+ * retrying the same delivery can't help) and 5xx when it's `true`:
  *
  *   try {
  *     const { result } = await reclaim.results.receive(body, {
@@ -172,6 +181,7 @@ export interface ResultVerificationFailure extends VerifyResultFullOutcome {
  *     if (err instanceof ResultVerificationError) {
  *       // for example, 'expired', { payload, … }
  *       console.error(err.reason, err.outcome)
+ *       res.sendStatus(err.retryable ? 503 : 200)
  *     }
  *   }
  */
@@ -182,6 +192,15 @@ export declare class ResultVerificationError extends Error {
     /** The full (invalid) outcome: `payload`, `reclaimSessionId`, and per-proof
      *  detail (`proofs`) when verification got that far. */
     readonly outcome: ResultVerificationFailure;
+    /**
+     * Whether a retry can succeed. `true` only for a temporary condition on
+     * the verifier's side: Builder's JWKS or recipe couldn't be fetched
+     * (network error, timeout, 5xx, 429). `false` when the result itself is
+     * wrong (signature, issuer, audience, session, expiry, invalid proof), so
+     * redelivering the same body fails the same way. Respond 5xx to a
+     * callback only when `true`.
+     */
+    readonly retryable: boolean;
     constructor(outcome: ResultVerificationFailure);
 }
 /**

package/lib/result.js

@@ -13,6 +13,7 @@
 import { sha256 } from '@noble/hashes/sha2.js';
 import { decrypt as eciesDecrypt, encrypt as eciesEncrypt } from 'eciesjs';
 import { b64url, base64urlToBytes, hexToBytes, stripTrailingSlashes, } from "./encoding.js";
+import { isTransientError } from "./errors.js";
 import { fetchReclaimJwks, jwkToUncompressedPublicKey, selectVerificationResultKey, } from "./jwks.js";
 import { getHashFromProof } from "./proof-hash.js";
 import { proofHashesFromBuilderRecipe, } from "./proof-recipe.js";
@@ -145,7 +146,10 @@ export function verifyJwsSignature(jws, signerPublicKey) {
 /**
  * Thrown by {@link verifyResult} / {@link verifyResultFull} (and therefore
  * `reclaim.results.verify`/`receive`) when a result fails verification. Carries
- * the full invalid outcome so callers can inspect it in a `catch`:
+ * the full invalid outcome so callers can inspect it in a `catch`.
+ *
+ * In a callback handler, answer 2xx when `retryable` is `false` (Builder
+ * retrying the same delivery can't help) and 5xx when it's `true`:
  *
  *   try {
  *     const { result } = await reclaim.results.receive(body, {
@@ -156,6 +160,7 @@ export function verifyJwsSignature(jws, signerPublicKey) {
  *     if (err instanceof ResultVerificationError) {
  *       // for example, 'expired', { payload, … }
  *       console.error(err.reason, err.outcome)
+ *       res.sendStatus(err.retryable ? 503 : 200)
  *     }
  *   }
  */
@@ -165,6 +170,7 @@ export class ResultVerificationError extends Error {
         this.name = 'ResultVerificationError';
         this.reason = outcome.reason;
         this.outcome = outcome;
+        this.retryable = outcome.retryable ?? false;
     }
 }
 /**
@@ -230,8 +236,10 @@ export async function verifyResultFull(jws, opts = {}) {
             jwksAttestorImageDigests =
                 registry['x-reclaim-attestor-image-digests'] ?? [];
         }
-        catch {
-            return fail('jwks-fetch-failed');
+        catch (error) {
+            return fail('jwks-fetch-failed', {
+                retryable: isTransientError(error),
+            });
         }
         const jwk = selectVerificationResultKey(keys, String(header.kid ?? ''));
         if (!jwk) {
@@ -348,7 +356,12 @@ export async function verifyResultFull(jws, opts = {}) {
         else if (configuredImageDigests?.length) {
             expectedImageDigests = configuredImageDigests;
         }
-        const attestorTeeAttestation = expectedImageDigests.length
+        // A caller-configured check requires a `claimAttestation` on every
+        // witness. Registry digests alone only pin the attestor reports that
+        // are present, as `@reclaimprotocol/js-sdk` does by default — a portal
+        // TEE proof without a bound nonce carries no envelope.
+        const attestorTeeAttestation = configuredAttestorTee
+            && expectedImageDigests.length
             ? { ...configuredAttestorTee, expectedImageDigests }
             : configuredAttestorTee;
         const commonValidation = {
@@ -360,6 +373,9 @@ export async function verifyResultFull(jws, opts = {}) {
             ...(attestorTeeAttestation
                 ? { attestorTeeAttestation }
                 : {}),
+            ...(expectedImageDigests.length
+                ? { attestorImageDigests: expectedImageDigests }
+                : {}),
             ...(expectedSessionId
                 ? {
                     expectedSessionId,
@@ -375,7 +391,12 @@ export async function verifyResultFull(jws, opts = {}) {
         }
     }
     if (!proofs.every((p) => p.proofValid)) {
-        return fail('invalid-proof', { proofs });
+        // Retry only when every failure is transient; one genuinely invalid
+        // proof makes redelivery pointless.
+        return fail('invalid-proof', {
+            proofs,
+            retryable: proofs.every((p) => p.proofValid || p.transient),
+        });
     }
     return { payload, reclaimSessionId, proofs };
     async function verifyRequestProofGroup(group, validation) {
@@ -403,6 +424,7 @@ export async function verifyResultFull(jws, opts = {}) {
         for (const { outcomeIndex } of group) {
             proofs[outcomeIndex].proofValid = false;
             proofs[outcomeIndex].reason = requestProofOutcome.reason;
+            proofs[outcomeIndex].transient = requestProofOutcome.transient;
         }
     }
     async function verifyByResolvedRecipes(common, expectedSessionId) {
@@ -412,8 +434,11 @@ export async function verifyResultFull(jws, opts = {}) {
                 const resolved = await opts.resolveSession(expectedSessionId);
                 recipes = resolved.recipes;
             }
-            catch {
-                return fail('session-resolution-failed', { proofs });
+            catch (error) {
+                return fail('session-resolution-failed', {
+                    proofs,
+                    retryable: isTransientError(error),
+                });
             }
         }
         const groups = Map.groupBy(proofGroups, proofGroupKey);

package/lib/routes.gen.js

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/mcp-tools-gen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:de7373741e35).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:96339e8dff91).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.

package/lib/types/openapi.gen.d.ts

@@ -3104,6 +3104,7 @@ export interface paths {
         /**
          * Submit exact proofs as a managed Builder result
          * @description Accepts exact `Proof` objects from a claimant-facing `api=2` client. Builder atomically records the first terminal outcome, checks it against the submitted status, signs the outer Builder JWS with its managed key, optionally encrypts it for matching callback subscriptions, and enqueues delivery. Retrying the same terminal outcome is idempotent. This is the only result-submission endpoint; Verification Clients never receive signing or encryption keys.
+         *     Before it accepts a `success` result, Builder verifies every proof with the same trust a default `@reclaimprotocol/client` consumer uses: Builder's attestor addresses and image digests, the session recipe's provider hashes, and the session binding. If a proof fails, Builder records the session as a terminal `error` with a `problem` whose `reasonCode` is `invalid-proof`, enqueues the `verification_error` delivery, and returns `422`. Don't retry a `422`; the session is already terminal.
          */
         post: operations["SubmitVerificationClientResult"];
         delete?: never;
@@ -6380,7 +6381,18 @@ export interface components {
             /** @enum {string} */
             status: "success" | "rejected" | "error" | "cancelled";
             results: components["schemas"]["VerificationClientProviderResult"][];
-            problem?: components["schemas"]["Problem"] | null;
+            problem?: ({
+                /** @description Stable machine-readable failure code. Builder records `invalid-proof` when a submitted proof fails its verification. */
+                reasonCode?: string;
+                retryable?: boolean;
+                /** @description Builder-recorded proof failures, one per provider. Present with `reasonCode: invalid-proof`. */
+                proofs?: {
+                    providerId?: string;
+                    resolvedVersion?: string;
+                    requestIds?: string[];
+                    reason?: string;
+                }[];
+            } & components["schemas"]["Problem"]) | null;
         };
         VerificationClientProviderResult: {
             providerId: components["schemas"]["ProviderID"];
@@ -11563,6 +11575,15 @@ export interface operations {
             };
             400: components["responses"]["ProblemResponse"];
             409: components["responses"]["ProblemResponse"];
+            /** @description A submitted proof failed Builder verification. Builder recorded the session as a terminal `error` and enqueued `verification_error`. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
             default: components["responses"]["ProblemResponse"];
         };
     };

package/lib/types/openapi.gen.js

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/openapi-typegen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:de7373741e35).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:96339e8dff91).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.

package/lib/verify-attestor-tee.d.ts

@@ -51,6 +51,18 @@ export type AttestorTeeAttestationConfig = {
      */
     expectedImageDigests?: string[];
 };
+/** How strictly `runAttestorTeeVerification` treats witnesses without a
+ *  `claimAttestation`. */
+export interface AttestorTeeVerificationOptions {
+    /**
+     * Default `true`: every witness must carry a `claimAttestation`. `false`
+     * counts a witness without one as unattested, which is how
+     * `@reclaimprotocol/js-sdk` verifies by default — its claim signature is
+     * still checked against the trusted attestors by the caller. Portal TEE
+     * proofs without a bound nonce have no envelope.
+     */
+    requireClaimAttestation?: boolean;
+}
 /** A witness's attestation kind. Required: every client sets it explicitly. */
 export declare function claimAttestationType(att: AttestorClaimAttestation): ClaimAttestationType;
 /** What `runAttestorTeeVerification` actually checked, per witness. */
@@ -58,8 +70,9 @@ export interface AttestorTeeVerificationSummary {
     /** Witnesses whose `attestation_report` was verified (and pinned, when
      *  `expectedImageDigests` was set). */
     verified: number;
-    /** Witnesses that carried no `attestation_report`. Their attestor address
-     *  and claim signature were still verified. */
+    /** Witnesses that carried no `attestation_report`, or no
+     *  `claimAttestation` when it isn't required. Their attestor address and
+     *  claim signature were still verified. */
     unattested: number;
 }
 /**
@@ -67,7 +80,8 @@ export interface AttestorTeeVerificationSummary {
  * provided proof. Throws `AttestorTeeVerificationError` on the first
  * failure.
  *
- * Each witness must carry a `claimAttestation`. For each one, this:
+ * Each witness must carry a `claimAttestation` unless
+ * `options.requireClaimAttestation` is `false`. For each one, this:
  *   1. Asserts `attestor_address` matches `witness.id`.
  *   2. Asserts `claim_signature` is present in `proof.signatures`.
  *   3. Recovers the signer of `claim_signature` from the claim data and
@@ -89,5 +103,6 @@ export interface AttestorTeeVerificationSummary {
  *
  * @param proofs - The proofs to verify.
  * @param config - Optional config; see {@link AttestorTeeAttestationConfig}.
+ * @param options - See {@link AttestorTeeVerificationOptions}.
  */
-export declare function runAttestorTeeVerification(proofs: Proof[], config?: AttestorTeeAttestationConfig): Promise<AttestorTeeVerificationSummary>;
+export declare function runAttestorTeeVerification(proofs: Proof[], config?: AttestorTeeAttestationConfig, { requireClaimAttestation }?: AttestorTeeVerificationOptions): Promise<AttestorTeeVerificationSummary>;

package/lib/verify-attestor-tee.js

@@ -165,7 +165,7 @@ function normalizeAttestorAddress(address) {
 function normalizeSignature(sig) {
     return sig.trim().toLowerCase();
 }
-async function verifyAttestorTeeForProof(proof, config, summary) {
+async function verifyAttestorTeeForProof(proof, config, requireClaimAttestation, summary) {
     if (!proof.witnesses || proof.witnesses.length === 0) {
         throw new AttestorTeeVerificationError('Proof has no witnesses');
     }
@@ -174,6 +174,10 @@ async function verifyAttestorTeeForProof(proof, config, summary) {
     const claimSignData = createSignDataForClaim(proof.claimData);
     for (const witness of proof.witnesses) {
         const att = witness.claimAttestation;
+        if (!att && !requireClaimAttestation) {
+            summary.unattested++;
+            continue;
+        }
         if (!att) {
             throw new AttestorTeeVerificationError(`Witness ${witness.id} is missing claimAttestation`);
         }
@@ -233,7 +237,8 @@ async function verifyAttestorTeeForProof(proof, config, summary) {
  * provided proof. Throws `AttestorTeeVerificationError` on the first
  * failure.
  *
- * Each witness must carry a `claimAttestation`. For each one, this:
+ * Each witness must carry a `claimAttestation` unless
+ * `options.requireClaimAttestation` is `false`. For each one, this:
  *   1. Asserts `attestor_address` matches `witness.id`.
  *   2. Asserts `claim_signature` is present in `proof.signatures`.
  *   3. Recovers the signer of `claim_signature` from the claim data and
@@ -255,8 +260,9 @@ async function verifyAttestorTeeForProof(proof, config, summary) {
  *
  * @param proofs - The proofs to verify.
  * @param config - Optional config; see {@link AttestorTeeAttestationConfig}.
+ * @param options - See {@link AttestorTeeVerificationOptions}.
  */
-export async function runAttestorTeeVerification(proofs, config = {}) {
+export async function runAttestorTeeVerification(proofs, config = {}, { requireClaimAttestation = true } = {}) {
     if (!proofs || proofs.length === 0) {
         throw new AttestorTeeVerificationError('No proofs provided for attestor TEE verification');
     }
@@ -266,7 +272,7 @@ export async function runAttestorTeeVerification(proofs, config = {}) {
     };
     try {
         for (const proof of proofs) {
-            await verifyAttestorTeeForProof(proof, config, summary);
+            await verifyAttestorTeeForProof(proof, config, requireClaimAttestation, summary);
         }
         return summary;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@reclaimprotocol/client",
 	"title": "Reclaim Client",
-	"version": "0.1.35",
+	"version": "0.1.36",
 	"description": "Typed SDK/HTTP client SDK for the Reclaim Protocol — the programmatic way to use Reclaim Protocol to verify **data points** about your users (a follower count, an account balance, an order). Can be directly integrated by apps to request verification for their users using Reclaim Protocol and verify the results.",
 	"type": "module",
 	"sideEffects": false,

package/src/errors.ts

@@ -44,6 +44,58 @@ export function isProblemError(error: unknown): error is ProblemError {
 		&& isProblemErrorOutput(error.output)
 }
 
+/**
+ * Whether retrying the same request later can succeed: a network failure, a
+ * timeout, or an HTTP 5xx, 408, or 429 from Builder (a {@link ProblemError}
+ * or a plain error carrying the HTTP `status`). Everything else, such as a
+ * malformed response, won't change on retry.
+ */
+export function isTransientError(error: unknown): boolean {
+	// `fetch` rejects with a TypeError when the network fails.
+	if(error instanceof TypeError) {
+		return true
+	}
+
+	if(
+		error instanceof Error
+		&& (error.name === 'TimeoutError' || error.name === 'AbortError')
+	) {
+		return true
+	}
+
+	const status = isProblemError(error)
+		? error.output.statusCode
+		: isRecord(error) ? error.status : undefined
+	return typeof status === 'number'
+		&& (status >= 500 || status === 408 || status === 429)
+}
+
+// Errors thrown by a network step and judged transient. Tracked by identity
+// so a content check that throws, say, a TypeError is never mistaken for one.
+const TRANSIENT_ERRORS = new WeakSet<object>()
+
+/**
+ * Runs one network step, such as a JWKS fetch or a session or provider
+ * lookup, and marks a transient failure so {@link isTransientFailure} can
+ * tell it apart from a failed content check.
+ */
+export async function networkStep<T>(step: () => Promise<T> | T): Promise<T> {
+	try {
+		return await step()
+	} catch(error) {
+		if(error instanceof Error && isTransientError(error)) {
+			TRANSIENT_ERRORS.add(error)
+		}
+
+		throw error
+	}
+}
+
+/** Whether `error` came from a {@link networkStep} and a retry can succeed. */
+export function isTransientFailure(error: unknown): boolean {
+	return error instanceof Error && TRANSIENT_ERRORS.has(error)
+}
+
 /** Returns whether a value follows the RFC 9457 problem-details schema. */
 export function isProblemDetails(value: unknown): value is ProblemDetails {
 	if(!isRecord(value)) {

package/src/jwks.ts

@@ -95,7 +95,11 @@ export async function fetchReclaimJwks(
 	assertSecureJwksUrl(url)
 	const res = await fetchImpl(url)
 	if(!res.ok) {
-		throw new Error(`JWKS fetch failed for ${url}: HTTP ${res.status}`)
+		// `status` lets callers tell a temporary Builder outage from a bad URL.
+		throw Object.assign(
+			new Error(`JWKS fetch failed for ${url}: HTTP ${res.status}`),
+			{ status: res.status },
+		)
 	}
 
 	const body = (await res.json()) as Partial<ReclaimJwks>

package/src/request-proof.ts

@@ -1,5 +1,6 @@
 import { createSignDataForClaim } from '@reclaimprotocol/attestor-core'
 import { recoverEip191Address } from './eip191.ts'
+import { isTransientFailure, networkStep } from './errors.ts'
 import { fetchReclaimJwks, trustedAttestorAddresses } from './jwks.ts'
 import { assertValidProofHashes, getHashFromProof } from './proof-hash.ts'
 import type {
@@ -41,9 +42,15 @@ export interface VerifyRequestProofOptions {
 	/** Read `providerHash` from context, while still verifying signatures. */
 	hasNoPii?: true
 	teeAttestation?: TeeAttestationConfig
+	/** Require every witness to carry a `claimAttestation`, and verify any
+	 *  `attestation_report` against `expectedImageDigests`. */
 	attestorTeeAttestation?: AttestorTeeAttestationConfig
 	/** Explicit trusted attestor ETH addresses. */
 	attestorAddresses?: string[]
+	/** Trusted attestor image digests, like `x-reclaim-attestor-image-digests`.
+	 *  Pin any `attestation_report` a witness carries without requiring one,
+	 *  matching `@reclaimprotocol/js-sdk`'s default. */
+	attestorImageDigests?: string[]
 	/** Trusted Builder JWKS registry containing attestor-purpose keys. */
 	attestorJwksUrl?: string
 	fetchImpl?: typeof fetch
@@ -70,6 +77,10 @@ export interface VerifyRequestProofOptions {
 export interface ReclaimRequestProofOutcome {
 	valid: boolean
 	reason?: string
+	/** On failure: true when a temporary condition caused it, such as a
+	 *  network error while resolving the session or provider. A retry can
+	 *  succeed. */
+	transient?: boolean
 	proofHashes?: string[]
 	isTeeAttestationVerified?: boolean
 	/** True when at least one witness's `attestation_report` verified; false
@@ -116,6 +127,8 @@ export async function verifyRequestProof(
 			trust.imageDigests,
 		)
 		if(attestorTeeAttestation) {
+			// Only a caller-configured check requires an envelope on every
+			// witness; registry digests alone pin the reports that exist.
 			// `verified` counts witnesses whose attestation report was checked.
 			// A proof whose witnesses carry no report still passes the address
 			// and signature bindings, but nothing was attested — say so rather
@@ -123,6 +136,7 @@ export async function verifyRequestProof(
 			const summary = await runAttestorTeeVerification(
 				proofs,
 				attestorTeeAttestation,
+				{ requireClaimAttestation: !!effective.attestorTeeAttestation },
 			)
 			isAttestorTeeAttestationVerified = summary.verified > 0
 		}
@@ -139,6 +153,7 @@ export async function verifyRequestProof(
 		return {
 			valid: false,
 			reason: failureReason(error),
+			transient: isTransientFailure(error),
 		}
 	}
 }
@@ -148,14 +163,15 @@ async function resolveValidation(
 	proofs: ReclaimRequestProof[],
 ) {
 	let effective = config
-	if(config.sessionId && !hasContentValidation(config)) {
-		if(!config.resolveSession) {
+	const { sessionId, resolveSession } = config
+	if(sessionId && !hasContentValidation(config)) {
+		if(!resolveSession) {
 			throw new Error('session-resolver-required')
 		}
 
 		effective = {
 			...config,
-			...await config.resolveSession(config.sessionId, proofs),
+			...await networkStep(() => resolveSession(sessionId, proofs)),
 		}
 	}
 
@@ -164,12 +180,12 @@ async function resolveValidation(
 
 async function resolveAttestorTrust(config: VerifyRequestProofOptions) {
 	const addresses = config.attestorAddresses?.map(normalized) ?? []
-	const imageDigests: string[] = []
-	if(config.attestorJwksUrl) {
-		const registry = await fetchReclaimJwks(
-			config.attestorJwksUrl,
-			config.fetchImpl,
-		)
+	const imageDigests = config.attestorImageDigests?.map(normalized) ?? []
+	const { attestorJwksUrl, fetchImpl } = config
+	if(attestorJwksUrl) {
+		const registry = await networkStep(() => (
+			fetchReclaimJwks(attestorJwksUrl, fetchImpl)
+		))
 		addresses.push(
 			...(registry['x-reclaim-attestors'] ?? []),
 			...trustedAttestorAddresses(registry.keys),
@@ -258,17 +274,15 @@ async function assertContent(
 		return
 	}
 
-	if(config.providerId) {
-		if(!config.resolveProvider) {
+	const { providerId, providerVersion, allowedTags, resolveProvider } = config
+	if(providerId) {
+		if(!resolveProvider) {
 			throw new Error('provider-resolver-required')
 		}
 
-		const candidates = await config.resolveProvider(
-			config.providerId,
-			config.providerVersion,
-			config.allowedTags,
-			proofs,
-		)
+		const candidates = await networkStep(() => (
+			resolveProvider(providerId, providerVersion, allowedTags, proofs)
+		))
 		if(!candidates.length) {
 			throw new Error('provider-not-found')
 		}

package/src/result.ts

@@ -20,6 +20,7 @@ import {
 	hexToBytes,
 	stripTrailingSlashes,
 } from './encoding.ts'
+import { isTransientError } from './errors.ts'
 import {
 	fetchReclaimJwks,
 	type Jwk,
@@ -303,6 +304,9 @@ export interface ResultProofOutcome {
 	proof?: ReclaimRequestProof
 	proofValid: boolean
 	reason?: string
+	/** On failure: true when a temporary condition caused it, such as a
+	 *  network error while resolving the provider. */
+	transient?: boolean
 	/** @deprecated Use `attestorAddresses`; retained for compatibility. */
 	attestorAddress?: string
 	/** Every attestor address declared by the proof. */
@@ -330,12 +334,18 @@ export interface VerifyResultFullOutcome extends VerifyResultOutcome {
 
 export interface ResultVerificationFailure extends VerifyResultFullOutcome {
 	reason: string
+	/** True when a temporary condition caused the failure. Set by the
+	 *  verifier; read it as {@link ResultVerificationError.retryable}. */
+	retryable?: boolean
 }
 
 /**
  * Thrown by {@link verifyResult} / {@link verifyResultFull} (and therefore
  * `reclaim.results.verify`/`receive`) when a result fails verification. Carries
- * the full invalid outcome so callers can inspect it in a `catch`:
+ * the full invalid outcome so callers can inspect it in a `catch`.
+ *
+ * In a callback handler, answer 2xx when `retryable` is `false` (Builder
+ * retrying the same delivery can't help) and 5xx when it's `true`:
  *
  *   try {
  *     const { result } = await reclaim.results.receive(body, {
@@ -346,6 +356,7 @@ export interface ResultVerificationFailure extends VerifyResultFullOutcome {
  *     if (err instanceof ResultVerificationError) {
  *       // for example, 'expired', { payload, … }
  *       console.error(err.reason, err.outcome)
+ *       res.sendStatus(err.retryable ? 503 : 200)
  *     }
  *   }
  */
@@ -356,12 +367,22 @@ export class ResultVerificationError extends Error {
 	/** The full (invalid) outcome: `payload`, `reclaimSessionId`, and per-proof
 	 *  detail (`proofs`) when verification got that far. */
 	readonly outcome: ResultVerificationFailure
+	/**
+	 * Whether a retry can succeed. `true` only for a temporary condition on
+	 * the verifier's side: Builder's JWKS or recipe couldn't be fetched
+	 * (network error, timeout, 5xx, 429). `false` when the result itself is
+	 * wrong (signature, issuer, audience, session, expiry, invalid proof), so
+	 * redelivering the same body fails the same way. Respond 5xx to a
+	 * callback only when `true`.
+	 */
+	readonly retryable: boolean
 
 	constructor(outcome: ResultVerificationFailure) {
 		super(`result verification failed: ${outcome.reason}`)
 		this.name = 'ResultVerificationError'
 		this.reason = outcome.reason
 		this.outcome = outcome
+		this.retryable = outcome.retryable ?? false
 	}
 }
 
@@ -446,8 +467,10 @@ export async function verifyResultFull(
 			jwksAttestorAddresses = registry['x-reclaim-attestors'] ?? []
 			jwksAttestorImageDigests =
 				registry['x-reclaim-attestor-image-digests'] ?? []
-		} catch{
-			return fail('jwks-fetch-failed')
+		} catch(error) {
+			return fail('jwks-fetch-failed', {
+				retryable: isTransientError(error),
+			})
 		}
 
 		const jwk = selectVerificationResultKey(
@@ -594,7 +617,12 @@ export async function verifyResultFull(
 			expectedImageDigests = configuredImageDigests
 		}
 
-		const attestorTeeAttestation = expectedImageDigests.length
+		// A caller-configured check requires a `claimAttestation` on every
+		// witness. Registry digests alone only pin the attestor reports that
+		// are present, as `@reclaimprotocol/js-sdk` does by default — a portal
+		// TEE proof without a bound nonce carries no envelope.
+		const attestorTeeAttestation = configuredAttestorTee
+			&& expectedImageDigests.length
 			? { ...configuredAttestorTee, expectedImageDigests }
 			: configuredAttestorTee
 		const commonValidation = {
@@ -606,6 +634,9 @@ export async function verifyResultFull(
 			...(attestorTeeAttestation
 				? { attestorTeeAttestation }
 				: {}),
+			...(expectedImageDigests.length
+				? { attestorImageDigests: expectedImageDigests }
+				: {}),
 			...(expectedSessionId
 				? {
 					expectedSessionId,
@@ -622,7 +653,12 @@ export async function verifyResultFull(
 	}
 
 	if(!proofs.every((p) => p.proofValid)) {
-		return fail('invalid-proof', { proofs })
+		// Retry only when every failure is transient; one genuinely invalid
+		// proof makes redelivery pointless.
+		return fail('invalid-proof', {
+			proofs,
+			retryable: proofs.every((p) => p.proofValid || p.transient),
+		})
 	}
 
 	return { payload, reclaimSessionId, proofs }
@@ -666,6 +702,7 @@ export async function verifyResultFull(
 		for(const { outcomeIndex } of group) {
 			proofs[outcomeIndex].proofValid = false
 			proofs[outcomeIndex].reason = requestProofOutcome.reason
+			proofs[outcomeIndex].transient = requestProofOutcome.transient
 		}
 	}
 
@@ -678,8 +715,11 @@ export async function verifyResultFull(
 			try {
 				const resolved = await opts.resolveSession(expectedSessionId)
 				recipes = resolved.recipes
-			} catch{
-				return fail('session-resolution-failed', { proofs })
+			} catch(error) {
+				return fail('session-resolution-failed', {
+					proofs,
+					retryable: isTransientError(error),
+				})
 			}
 		}
 

package/src/routes.gen.ts

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/mcp-tools-gen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:de7373741e35).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:96339e8dff91).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.

package/src/types/openapi.gen.ts

@@ -1,5 +1,5 @@
 // AUTO-GENERATED by packages/app/scripts/openapi-typegen.ts
-// from packages/app/openapi.yaml (spec v0.1.0, source sha256:de7373741e35).
+// from packages/app/openapi.yaml (spec v0.1.0, source sha256:96339e8dff91).
 // The hash catches drift the version misses (a spec can change without a
 // version bump) — do not remove it as "redundant" with the version.
 // Run `npm run openapi:gen --workspace=packages/app` to regenerate. Do not edit by hand.
@@ -3110,6 +3110,7 @@ export interface paths {
         /**
          * Submit exact proofs as a managed Builder result
          * @description Accepts exact `Proof` objects from a claimant-facing `api=2` client. Builder atomically records the first terminal outcome, checks it against the submitted status, signs the outer Builder JWS with its managed key, optionally encrypts it for matching callback subscriptions, and enqueues delivery. Retrying the same terminal outcome is idempotent. This is the only result-submission endpoint; Verification Clients never receive signing or encryption keys.
+         *     Before it accepts a `success` result, Builder verifies every proof with the same trust a default `@reclaimprotocol/client` consumer uses: Builder's attestor addresses and image digests, the session recipe's provider hashes, and the session binding. If a proof fails, Builder records the session as a terminal `error` with a `problem` whose `reasonCode` is `invalid-proof`, enqueues the `verification_error` delivery, and returns `422`. Don't retry a `422`; the session is already terminal.
          */
         post: operations["SubmitVerificationClientResult"];
         delete?: never;
@@ -6386,7 +6387,18 @@ export interface components {
             /** @enum {string} */
             status: "success" | "rejected" | "error" | "cancelled";
             results: components["schemas"]["VerificationClientProviderResult"][];
-            problem?: components["schemas"]["Problem"] | null;
+            problem?: ({
+                /** @description Stable machine-readable failure code. Builder records `invalid-proof` when a submitted proof fails its verification. */
+                reasonCode?: string;
+                retryable?: boolean;
+                /** @description Builder-recorded proof failures, one per provider. Present with `reasonCode: invalid-proof`. */
+                proofs?: {
+                    providerId?: string;
+                    resolvedVersion?: string;
+                    requestIds?: string[];
+                    reason?: string;
+                }[];
+            } & components["schemas"]["Problem"]) | null;
         };
         VerificationClientProviderResult: {
             providerId: components["schemas"]["ProviderID"];
@@ -11569,6 +11581,15 @@ export interface operations {
             };
             400: components["responses"]["ProblemResponse"];
             409: components["responses"]["ProblemResponse"];
+            /** @description A submitted proof failed Builder verification. Builder recorded the session as a terminal `error` and enqueued `verification_error`. */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/problem+json": components["schemas"]["Problem"];
+                };
+            };
             default: components["responses"]["ProblemResponse"];
         };
     };

package/src/verify-attestor-tee.ts

@@ -239,6 +239,19 @@ export type AttestorTeeAttestationConfig = {
 	expectedImageDigests?: string[]
 }
 
+/** How strictly `runAttestorTeeVerification` treats witnesses without a
+ *  `claimAttestation`. */
+export interface AttestorTeeVerificationOptions {
+	/**
+	 * Default `true`: every witness must carry a `claimAttestation`. `false`
+	 * counts a witness without one as unattested, which is how
+	 * `@reclaimprotocol/js-sdk` verifies by default — its claim signature is
+	 * still checked against the trusted attestors by the caller. Portal TEE
+	 * proofs without a bound nonce have no envelope.
+	 */
+	requireClaimAttestation?: boolean
+}
+
 /** A witness's attestation kind. Required: every client sets it explicitly. */
 export function claimAttestationType(
 	att: AttestorClaimAttestation,
@@ -251,8 +264,9 @@ export interface AttestorTeeVerificationSummary {
 	/** Witnesses whose `attestation_report` was verified (and pinned, when
 	 *  `expectedImageDigests` was set). */
 	verified: number
-	/** Witnesses that carried no `attestation_report`. Their attestor address
-	 *  and claim signature were still verified. */
+	/** Witnesses that carried no `attestation_report`, or no
+	 *  `claimAttestation` when it isn't required. Their attestor address and
+	 *  claim signature were still verified. */
 	unattested: number
 }
 
@@ -267,6 +281,7 @@ function normalizeSignature(sig: string): string {
 async function verifyAttestorTeeForProof(
 	proof: Proof,
 	config: AttestorTeeAttestationConfig,
+	requireClaimAttestation: boolean,
 	summary: AttestorTeeVerificationSummary,
 ): Promise<void> {
 	if(!proof.witnesses || proof.witnesses.length === 0) {
@@ -282,6 +297,11 @@ async function verifyAttestorTeeForProof(
 
 	for(const witness of proof.witnesses) {
 		const att: AttestorClaimAttestation | undefined = witness.claimAttestation
+		if(!att && !requireClaimAttestation) {
+			summary.unattested++
+			continue
+		}
+
 		if(!att) {
 			throw new AttestorTeeVerificationError(
 				`Witness ${witness.id} is missing claimAttestation`
@@ -368,7 +388,8 @@ async function verifyAttestorTeeForProof(
  * provided proof. Throws `AttestorTeeVerificationError` on the first
  * failure.
  *
- * Each witness must carry a `claimAttestation`. For each one, this:
+ * Each witness must carry a `claimAttestation` unless
+ * `options.requireClaimAttestation` is `false`. For each one, this:
  *   1. Asserts `attestor_address` matches `witness.id`.
  *   2. Asserts `claim_signature` is present in `proof.signatures`.
  *   3. Recovers the signer of `claim_signature` from the claim data and
@@ -390,10 +411,12 @@ async function verifyAttestorTeeForProof(
  *
  * @param proofs - The proofs to verify.
  * @param config - Optional config; see {@link AttestorTeeAttestationConfig}.
+ * @param options - See {@link AttestorTeeVerificationOptions}.
  */
 export async function runAttestorTeeVerification(
 	proofs: Proof[],
-	config: AttestorTeeAttestationConfig = {}
+	config: AttestorTeeAttestationConfig = {},
+	{ requireClaimAttestation = true }: AttestorTeeVerificationOptions = {},
 ): Promise<AttestorTeeVerificationSummary> {
 	if(!proofs || proofs.length === 0) {
 		throw new AttestorTeeVerificationError('No proofs provided for attestor TEE verification')
@@ -406,7 +429,12 @@ export async function runAttestorTeeVerification(
 
 	try {
 		for(const proof of proofs) {
-			await verifyAttestorTeeForProof(proof, config, summary)
+			await verifyAttestorTeeForProof(
+				proof,
+				config,
+				requireClaimAttestation,
+				summary,
+			)
 		}
 
 		return summary