@reclaimprotocol/js-sdk 5.0.0-dev.1 → 5.0.0-dev.2

package/dist/index.js

@@ -22,6 +22,18 @@ var __spreadValues = (a, b) => {
   return a;
 };
 var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __objRest = (source, exclude) => {
+  var target = {};
+  for (var prop in source)
+    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
+      target[prop] = source[prop];
+  if (source != null && __getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(source)) {
+      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
+        target[prop] = source[prop];
+    }
+  return target;
+};
 var __commonJS = (cb, mod) => function __require() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
@@ -72,7 +84,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@reclaimprotocol/js-sdk",
-      version: "5.0.0-dev.1",
+      version: "5.0.0-dev.2",
       description: "Designed to request proofs from the Reclaim protocol and manage the flow of claims and witness interactions.",
       main: "dist/index.js",
       types: "dist/index.d.ts",
@@ -148,6 +160,8 @@ var require_package = __commonJS({
         "@commitlint/config-conventional": "^17.7.0",
         "@release-it/conventional-changelog": "10.0.6",
         "@types/jest": "^30.0.0",
+        "@types/node-forge": "^1.3.14",
+        "@types/qrcode": "^1.5.5",
         "@types/qs": "^6.9.11",
         "@types/url-parse": "^1.4.11",
         "@types/uuid": "^9.0.7",
@@ -163,6 +177,8 @@ var require_package = __commonJS({
         canonicalize: "^2.0.0",
         ethers: "^6.9.1",
         "fetch-retry": "^6.0.0",
+        "node-forge": "^1.3.3",
+        qrcode: "^1.5.4",
         "url-parse": "^1.5.10",
         uuid: "^9.0.1"
       },
@@ -182,9 +198,10 @@ __export(index_exports, {
   assertVerifiedProof: () => assertVerifiedProof,
   clearDeviceCache: () => clearDeviceCache,
   createLinkWithTemplateData: () => createLinkWithTemplateData,
-  fetchProviderConfig: () => fetchProviderConfig,
+  fetchProviderConfigs: () => fetchProviderConfigs,
   fetchProviderHashRequirementsBy: () => fetchProviderHashRequirementsBy,
   fetchStatusUrl: () => fetchStatusUrl,
+  generateSpecsFromRequestSpecTemplate: () => generateSpecsFromRequestSpecTemplate,
   getAttestors: () => getAttestors,
   getDeviceType: () => getDeviceType,
   getHttpProviderClaimParamsFromProof: () => getHttpProviderClaimParamsFromProof,
@@ -197,9 +214,12 @@ __export(index_exports, {
   isHttpProviderClaimParams: () => isHttpProviderClaimParams,
   isMobileDevice: () => isMobileDevice,
   recoverSignersOfSignedClaim: () => recoverSignersOfSignedClaim,
+  takePairsWhereValueIsArray: () => takePairsWhereValueIsArray,
+  takeTemplateParametersFromProofs: () => takeTemplateParametersFromProofs,
   transformForOnchain: () => transformForOnchain,
   updateSession: () => updateSession,
-  verifyProof: () => verifyProof
+  verifyProof: () => verifyProof,
+  verifyTeeAttestation: () => verifyTeeAttestation
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -212,20 +232,20 @@ var RECLAIM_EXTENSION_ACTIONS = {
 };
 
 // src/Reclaim.ts
-var import_ethers4 = require("ethers");
+var import_ethers5 = require("ethers");
 var import_canonicalize3 = __toESM(require("canonicalize"));
 
 // src/utils/errors.ts
 function createErrorClass(name) {
   return class extends Error {
     constructor(message, innerError) {
-      const fullMessage = innerError ? `${message || ""} caused by ${innerError.name}: ${innerError.message}` : message;
+      const fullMessage = innerError ? `${message || ""} caused by ${innerError && typeof innerError === "object" && "name" in innerError ? innerError.name : "Error"}: ${innerError && typeof innerError === "object" && "message" in innerError ? innerError.message : String(innerError)}` : message;
       super(fullMessage);
       this.innerError = innerError;
       this.name = name;
       if (innerError) {
         this.stack += `
-Caused by: ${innerError.stack}`;
+Caused by: ${innerError && typeof innerError === "object" && "stack" in innerError ? innerError.stack : String(innerError)}`;
       }
     }
   };
@@ -233,6 +253,7 @@ Caused by: ${innerError.stack}`;
 var TimeoutError = createErrorClass("TimeoutError");
 var ProofNotVerifiedError = createErrorClass("ProofNotVerifiedError");
 var ProofNotValidatedError = createErrorClass("ProofNotValidatedError");
+var InvalidRequestSpecError = createErrorClass("InvalidRequestSpecError");
 var UnknownProofsNotValidatedError = createErrorClass("UnknownProofsNotValidatedError");
 var SessionNotStartedError = createErrorClass("SessionNotStartedError");
 var ProviderNotFoundError = createErrorClass("ProviderNotFoundError");
@@ -353,15 +374,13 @@ var constants = {
   get DEFAULT_ATTESTORS_URL() {
     return `${BACKEND_BASE_URL}/api/attestors`;
   },
-  DEFAULT_PROVIDER_URL(providerId, exactProviderVersionString) {
-    return `${BACKEND_BASE_URL}/api/providers/${providerId}?versionNumber=${exactProviderVersionString}`;
+  DEFAULT_PROVIDER_CONFIGS_URL(providerId, exactProviderVersionString, allowedTags) {
+    return `${BACKEND_BASE_URL}/api/providers/${providerId}/configs?versionNumber=${exactProviderVersionString || ""}&allowedTags=${(allowedTags == null ? void 0 : allowedTags.join(",")) || ""}`;
   },
   // URL for sharing Reclaim templates
   RECLAIM_SHARE_URL: "https://share.reclaimprotocol.org/verifier/?template=",
   // Chrome extension URL for Reclaim Protocol
-  CHROME_EXTENSION_URL: "https://chromewebstore.google.com/detail/reclaim-extension/oafieibbbcepkmenknelhmgaoahamdeh",
-  // QR Code API base URL
-  QR_CODE_API_URL: "https://api.qrserver.com/v1/create-qr-code/"
+  CHROME_EXTENSION_URL: "https://chromewebstore.google.com/detail/reclaim-extension/oafieibbbcepkmenknelhmgaoahamdeh"
 };
 
 // src/utils/validationUtils.ts
@@ -602,92 +621,6 @@ var http = {
   }
 };
 
-// src/witness.ts
-var import_ethers2 = require("ethers");
-function createSignDataForClaim(data) {
-  const identifier = getIdentifierFromClaimInfo(data);
-  const lines = [
-    identifier,
-    data.owner.toLowerCase(),
-    data.timestampS.toString(),
-    data.epoch.toString()
-  ];
-  return lines.join("\n");
-}
-function getIdentifierFromClaimInfo(info) {
-  let canonicalContext = info.context || "";
-  if (canonicalContext.length > 0) {
-    try {
-      const ctx = JSON.parse(canonicalContext);
-      canonicalContext = canonicalStringify(ctx);
-    } catch (e) {
-      throw new Error("unable to parse non-empty context. Must be JSON");
-    }
-  }
-  const str = `${info.provider}
-${info.parameters}
-${canonicalContext}`;
-  return import_ethers2.ethers.keccak256(strToUint8Array(str)).toLowerCase();
-}
-function hashProofClaimParams(params) {
-  const serializedParams = getProviderParamsAsCanonicalizedString(params);
-  return import_ethers2.ethers.keccak256(
-    strToUint8Array(serializedParams)
-  ).toLowerCase();
-}
-function strToUint8Array(str) {
-  return new TextEncoder().encode(str);
-}
-function getProviderParamsAsCanonicalizedString(params) {
-  var _a, _b, _c, _d, _e, _f, _g;
-  const filteredParams = {
-    url: (_a = params == null ? void 0 : params.url) != null ? _a : "",
-    // METHOD needs to be explicitly specified and absence or unknown method should cause error, but we're choosing to ignore it in this case
-    method: (_b = params == null ? void 0 : params.method) != null ? _b : "GET",
-    body: (_c = params == null ? void 0 : params.body) != null ? _c : "",
-    responseMatches: (_e = (_d = params == null ? void 0 : params.responseMatches) == null ? void 0 : _d.map((it) => {
-      var _a2, _b2;
-      return {
-        value: (_a2 = it.value) != null ? _a2 : "",
-        // This needs to be explicitly specified and absence should cause error, but we're choosing to ignore it in this case
-        type: (_b2 = it.type) != null ? _b2 : "contains",
-        invert: it.invert || void 0,
-        isOptional: it.isOptional || void 0
-      };
-    })) != null ? _e : [],
-    responseRedactions: (_g = (_f = params == null ? void 0 : params.responseRedactions) == null ? void 0 : _f.map((it) => {
-      var _a2, _b2, _c2;
-      return {
-        xPath: (_a2 = it.xPath) != null ? _a2 : "",
-        jsonPath: (_b2 = it.jsonPath) != null ? _b2 : "",
-        regex: (_c2 = it.regex) != null ? _c2 : "",
-        hash: it.hash || void 0
-      };
-    })) != null ? _g : []
-  };
-  const serializedParams = canonicalStringify(filteredParams);
-  return serializedParams;
-}
-
-// src/utils/providerUtils.ts
-function getProviderHashRequirementsFromSpec(spec) {
-  var _a;
-  return {
-    hashes: ((_a = spec == null ? void 0 : spec.requests) == null ? void 0 : _a.map(hashRequestSpec)) || []
-  };
-}
-function hashRequestSpec(request) {
-  const hash = hashProofClaimParams(__spreadProps(__spreadValues({}, request), {
-    // Body is strictly empty unless body sniff is explicitly enabled
-    body: request.bodySniff.enabled ? request.bodySniff.template : ""
-  }));
-  return {
-    value: hash,
-    required: request.required,
-    multiple: request.multiple
-  };
-}
-
 // src/utils/sessionUtils.ts
 var logger4 = logger_default.logger;
 function initSession(providerId, appId, timestamp, signature, versionNumber) {
@@ -764,17 +697,24 @@ function fetchStatusUrl(sessionId) {
     }
   });
 }
-function fetchProviderConfig(providerId, exactProviderVersionString) {
+function fetchProviderConfigs(providerId, exactProviderVersionString, allowedTags) {
   return __async(this, null, function* () {
     validateFunctionParams(
       [
-        { input: providerId, paramName: "providerId", isString: true },
-        { input: exactProviderVersionString, paramName: "exactProviderVersionString", isString: true }
+        { input: providerId, paramName: "providerId", isString: true }
       ],
-      "fetchProviderConfig"
+      "fetchProviderConfigs"
     );
+    if (exactProviderVersionString != null && exactProviderVersionString != void 0) {
+      validateFunctionParams(
+        [
+          { input: exactProviderVersionString, paramName: "exactProviderVersionString", isString: true }
+        ],
+        "fetchProviderConfigs"
+      );
+    }
     try {
-      const response = yield http.client(constants.DEFAULT_PROVIDER_URL(providerId, exactProviderVersionString), {
+      const response = yield http.client(constants.DEFAULT_PROVIDER_CONFIGS_URL(providerId, exactProviderVersionString, allowedTags), {
         method: "GET",
         headers: { "Content-Type": "application/json" }
       });
@@ -792,19 +732,116 @@ function fetchProviderConfig(providerId, exactProviderVersionString) {
     }
   });
 }
-function fetchProviderHashRequirementsBy(providerId, exactProviderVersion) {
-  return __async(this, null, function* () {
-    var _a, _b;
-    const providerResponse = yield fetchProviderConfig(providerId, exactProviderVersion);
-    const providerConfig = providerResponse.providers;
-    return getProviderHashRequirementsFromSpec({
-      requests: [...(_a = providerConfig == null ? void 0 : providerConfig.requestData) != null ? _a : [], ...(_b = providerConfig == null ? void 0 : providerConfig.allowedInjectedRequestData) != null ? _b : []]
-    });
-  });
-}
 
 // src/utils/proofUtils.ts
 var import_ethers3 = require("ethers");
+
+// src/witness.ts
+var import_ethers2 = require("ethers");
+function createSignDataForClaim(data) {
+  const identifier = getIdentifierFromClaimInfo(data);
+  const lines = [
+    identifier,
+    data.owner.toLowerCase(),
+    data.timestampS.toString(),
+    data.epoch.toString()
+  ];
+  return lines.join("\n");
+}
+function getIdentifierFromClaimInfo(info) {
+  let canonicalContext = info.context || "";
+  if (canonicalContext.length > 0) {
+    try {
+      const ctx = JSON.parse(canonicalContext);
+      canonicalContext = canonicalStringify(ctx);
+    } catch (e) {
+      throw new Error("unable to parse non-empty context. Must be JSON");
+    }
+  }
+  const str = `${info.provider}
+${info.parameters}
+${canonicalContext}`;
+  return import_ethers2.ethers.keccak256(strToUint8Array(str)).toLowerCase();
+}
+function hashProofClaimParams(params) {
+  const serializedParams = getProviderParamsAsCanonicalizedString(params);
+  if (Array.isArray(serializedParams)) {
+    return serializedParams.map(
+      (serialized) => import_ethers2.ethers.keccak256(strToUint8Array(serialized)).toLowerCase()
+    );
+  }
+  return import_ethers2.ethers.keccak256(
+    strToUint8Array(serializedParams)
+  ).toLowerCase();
+}
+function strToUint8Array(str) {
+  return new TextEncoder().encode(str);
+}
+function getProviderParamsAsCanonicalizedString(params) {
+  var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o;
+  const pairsCount = (_b = (_a = params == null ? void 0 : params.responseMatches) == null ? void 0 : _a.length) != null ? _b : 0;
+  const validCanonicalizedStrings = [];
+  const totalCombinations = 1 << pairsCount;
+  for (let i = 0; i < totalCombinations; i++) {
+    let isValidCombination = true;
+    let includedCount = 0;
+    const currentMatches = [];
+    const currentRedactions = [];
+    for (let j = 0; j < pairsCount; j++) {
+      const isIncluded = (i & 1 << j) !== 0;
+      const match = (_c = params == null ? void 0 : params.responseMatches) == null ? void 0 : _c[j];
+      const redaction = (_d = params == null ? void 0 : params.responseRedactions) == null ? void 0 : _d[j];
+      if (isIncluded) {
+        if (match) {
+          currentMatches.push({
+            value: (_e = match.value) != null ? _e : "",
+            // This needs to be explicitly specified and absence should cause error, but we're choosing to ignore it in this case
+            type: (_f = match.type) != null ? _f : "contains",
+            invert: match.invert || void 0
+          });
+        }
+        if (redaction) {
+          currentRedactions.push({
+            xPath: (_g = redaction.xPath) != null ? _g : "",
+            jsonPath: (_h = redaction.jsonPath) != null ? _h : "",
+            regex: (_i = redaction.regex) != null ? _i : "",
+            hash: redaction.hash || void 0
+          });
+        }
+        includedCount++;
+      } else {
+        if (match && !match.isOptional) {
+          isValidCombination = false;
+          break;
+        }
+      }
+    }
+    if (isValidCombination && includedCount > 0) {
+      const filteredParams = {
+        url: (_j = params == null ? void 0 : params.url) != null ? _j : "",
+        // METHOD needs to be explicitly specified and absence or unknown method should cause error, but we're choosing to ignore it in this case
+        method: (_k = params == null ? void 0 : params.method) != null ? _k : "GET",
+        body: (_l = params == null ? void 0 : params.body) != null ? _l : "",
+        responseMatches: currentMatches,
+        responseRedactions: currentRedactions
+      };
+      validCanonicalizedStrings.push(canonicalStringify(filteredParams));
+    }
+  }
+  if (validCanonicalizedStrings.length === 0) {
+    const filteredParams = {
+      url: (_m = params == null ? void 0 : params.url) != null ? _m : "",
+      method: (_n = params == null ? void 0 : params.method) != null ? _n : "GET",
+      body: (_o = params == null ? void 0 : params.body) != null ? _o : "",
+      responseMatches: [],
+      responseRedactions: []
+    };
+    return canonicalStringify(filteredParams);
+  }
+  return validCanonicalizedStrings.length === 1 ? validCanonicalizedStrings[0] : validCanonicalizedStrings;
+}
+
+// src/utils/proofUtils.ts
 var logger5 = logger_default.logger;
 function getShortenedUrl(url) {
   return __async(this, null, function* () {
@@ -881,6 +918,7 @@ function assertVerifiedProof(proof, attestors) {
 }
 
 // src/utils/modalUtils.ts
+var import_qrcode = __toESM(require("qrcode"));
 var logger6 = logger_default.logger;
 var QRCodeModal = class {
   constructor(options = {}) {
@@ -1091,17 +1129,22 @@ var QRCodeModal = class {
   generateQRCode(text, containerId) {
     return __async(this, null, function* () {
       try {
-        const qrCodeUrl = `${constants.QR_CODE_API_URL}?size=200x200&data=${encodeURIComponent(text)}`;
+        const dataUrl = yield import_qrcode.default.toDataURL(text, {
+          width: 200,
+          margin: 1,
+          color: {
+            dark: "#000000",
+            light: "#ffffff"
+          }
+        });
         const container = document.getElementById(containerId);
         const styles = this.getThemeStyles();
         if (container) {
           container.innerHTML = `
-                    <img src="${qrCodeUrl}" 
-                         alt="QR Code for Reclaim verification" 
-                         style="width: 200px; height: 200px; border-radius: 4px;"
-                         onerror="this.style.display='none'; this.nextElementSibling.style.display='block';">
+                    <img src="${dataUrl}"
+                         alt="QR Code for Reclaim verification"
+                         style="width: 200px; height: 200px; border-radius: 4px;">
                     <div style="display: none; padding: 20px; color: ${styles.textColor}; font-size: 14px;">
-                        QR code could not be loaded.<br>
                         <a href="${text}" target="_blank" style="color: ${styles.linkColor}; text-decoration: underline;">
                             Click here to open verification link
                         </a>
@@ -1329,10 +1372,123 @@ function clearDeviceCache() {
   cachedMobileType = null;
 }
 
-// src/utils/proofValidationUtils.ts
+// src/utils/providerUtils.ts
 var logger7 = logger_default.logger;
+function fetchProviderHashRequirementsBy(providerId, exactProviderVersionString, allowedTags, proofs) {
+  return __async(this, null, function* () {
+    var _a, _b;
+    const providerResponse = yield fetchProviderConfigs(providerId, exactProviderVersionString, allowedTags);
+    try {
+      const providerConfigs = providerResponse.providers;
+      if (!providerConfigs || !providerConfigs.length) {
+        throw new ProviderConfigFetchError(`No provider configs found for providerId: ${providerId}, exactProviderVersionString: ${exactProviderVersionString}`);
+      }
+      const hashRequirements = [];
+      for (const providerConfig of providerConfigs) {
+        hashRequirements.push(getProviderHashRequirementsFromSpec({
+          requests: [...(_a = providerConfig == null ? void 0 : providerConfig.requestData) != null ? _a : [], ...generateSpecsFromRequestSpecTemplate((_b = providerConfig == null ? void 0 : providerConfig.allowedInjectedRequestData) != null ? _b : [], takeTemplateParametersFromProofs(proofs))]
+        }));
+      }
+      return hashRequirements;
+    } catch (e) {
+      const errorMessage = `Failed to fetch provider hash requirements for providerId: ${providerId}, exactProviderVersionString: ${exactProviderVersionString}`;
+      logger7.info(errorMessage, e);
+      throw new ProviderConfigFetchError(`Error fetching provider hash requirements for providerId: ${providerId}, exactProviderVersionString: ${exactProviderVersionString}`);
+    }
+  });
+}
+function generateSpecsFromRequestSpecTemplate(requestSpecTemplates, templateParameters) {
+  var _a;
+  if (!requestSpecTemplates) return [];
+  const generatedRequestTemplate = [];
+  for (const template of requestSpecTemplates) {
+    const templateVariables = (_a = template.templateParams) != null ? _a : [];
+    if (!templateVariables.length) {
+      generatedRequestTemplate.push(template);
+      continue;
+    }
+    const templateParamsPairMatch = Object.entries(templateParameters).filter(([key, value]) => templateVariables.includes(key) && value.length);
+    const hasAllTemplateVariableMatch = templateParamsPairMatch.length === templateVariables.length;
+    if (!hasAllTemplateVariableMatch) {
+      throw new InvalidRequestSpecError(`Not all template variables are present for template`);
+    }
+    const templateParamsPairMatchLength = templateParamsPairMatch[0][1].length;
+    const allTemplateVariablesHaveSameLength = templateParamsPairMatch.every(([key, value]) => value.length === templateParamsPairMatchLength);
+    if (!allTemplateVariablesHaveSameLength) {
+      throw new InvalidRequestSpecError(`Not all template variables have same length for template`);
+    }
+    const getRequestSpecVariableTemplate = (key) => {
+      return `\${${key}}`;
+    };
+    for (let i = 0; i < templateParamsPairMatchLength; i++) {
+      const currentTemplateParams = {};
+      for (const [key, values] of templateParamsPairMatch) {
+        currentTemplateParams[key] = values[i];
+      }
+      const spec = __spreadProps(__spreadValues({}, template), {
+        responseMatches: template.responseMatches ? template.responseMatches.map((m) => __spreadValues({}, m)) : [],
+        responseRedactions: template.responseRedactions ? template.responseRedactions.map((r) => __spreadValues({}, r)) : []
+      });
+      for (const match of spec.responseMatches) {
+        for (const [key, value] of Object.entries(currentTemplateParams)) {
+          match.value = match.value.split(getRequestSpecVariableTemplate(key)).join(value);
+        }
+      }
+      for (const redaction of spec.responseRedactions) {
+        for (const [key, value] of Object.entries(currentTemplateParams)) {
+          redaction.jsonPath = redaction.jsonPath.split(getRequestSpecVariableTemplate(key)).join(value);
+          redaction.xPath = redaction.xPath.split(getRequestSpecVariableTemplate(key)).join(value);
+          redaction.regex = redaction.regex.split(getRequestSpecVariableTemplate(key)).join(value);
+        }
+      }
+      generatedRequestTemplate.push(spec);
+    }
+  }
+  return generatedRequestTemplate;
+}
+function takeTemplateParametersFromProofs(proofs) {
+  return takePairsWhereValueIsArray(proofs == null ? void 0 : proofs.map((it) => JSON.parse(it.claimData.context).extractedParameters).reduce((acc, it) => __spreadValues(__spreadValues({}, acc), it), {}));
+}
+function takePairsWhereValueIsArray(o) {
+  if (!o) return {};
+  const pairs = {};
+  for (const [key, value] of Object.entries(o)) {
+    if (Array.isArray(value) && value.length) {
+      pairs[key] = value;
+    } else {
+      try {
+        const parsedValue = JSON.parse(value);
+        if (Array.isArray(parsedValue) && parsedValue.length) {
+          pairs[key] = parsedValue;
+        }
+      } catch (_) {
+      }
+    }
+  }
+  return pairs;
+}
+function getProviderHashRequirementsFromSpec(spec) {
+  var _a;
+  return {
+    hashes: ((_a = spec == null ? void 0 : spec.requests) == null ? void 0 : _a.map(hashRequestSpec)) || []
+  };
+}
+function hashRequestSpec(request) {
+  const hash = hashProofClaimParams(__spreadProps(__spreadValues({}, request), {
+    // Body is strictly empty unless body sniff is explicitly enabled
+    body: request.bodySniff.enabled ? request.bodySniff.template : ""
+  }));
+  return {
+    value: hash,
+    required: request.required,
+    multiple: request.multiple
+  };
+}
+
+// src/utils/proofValidationUtils.ts
+var logger8 = logger_default.logger;
 var HASH_REQUIRED_DEFAULT = true;
-var HASH_MATCH_MULTIPLE_DEFAULT = false;
+var HASH_MATCH_MULTIPLE_DEFAULT = true;
 function assertValidProofsByHash(proofs, config) {
   var _a, _b;
   if (!config.hashes) {
@@ -1342,31 +1498,36 @@ function assertValidProofsByHash(proofs, config) {
   for (let i = 0; i < proofs.length; i++) {
     const proof = proofs[i];
     const claimParams = getHttpProviderClaimParamsFromProof(proof);
-    const computedHashOfProof = hashProofClaimParams(claimParams).toLowerCase().trim();
-    unvalidatedProofHashByIndex.set(i, computedHashOfProof);
+    const computedHashesOfProof = hashProofClaimParams(claimParams);
+    const proofHashes = Array.isArray(computedHashesOfProof) ? computedHashesOfProof.map((h) => h.toLowerCase().trim()) : [computedHashesOfProof.toLowerCase().trim()];
+    unvalidatedProofHashByIndex.set(i, proofHashes);
   }
   for (const hashRequirement of config.hashes) {
     let found = false;
-    const expectedHash = hashRequirement.value.toLowerCase().trim();
+    const expectedHashes = Array.isArray(hashRequirement.value) ? hashRequirement.value.map((h) => h.toLowerCase().trim()) : [hashRequirement.value.toLowerCase().trim()];
     const isRequired = (_a = hashRequirement.required) != null ? _a : HASH_REQUIRED_DEFAULT;
     const canMatchMultiple = (_b = hashRequirement.multiple) != null ? _b : HASH_MATCH_MULTIPLE_DEFAULT;
-    for (const [i, proofHash] of unvalidatedProofHashByIndex.entries()) {
-      if (proofHash === expectedHash) {
+    for (const [i, proofHashes] of unvalidatedProofHashByIndex.entries()) {
+      const intersection = expectedHashes.filter((eh) => proofHashes.includes(eh));
+      if (intersection.length > 0) {
         unvalidatedProofHashByIndex.delete(i);
         if (!found) {
           found = true;
         } else if (!canMatchMultiple) {
-          throw new ProofNotValidatedError(`Proof by hash '${expectedHash}' is not allowed to appear more than once`);
+          const expectedHashStr = expectedHashes.length === 1 ? expectedHashes[0] : `[${expectedHashes.join(", ")}]`;
+          throw new ProofNotValidatedError(`Proof by hash '${expectedHashStr}' is not allowed to appear more than once`);
         }
       }
     }
     if (!found && isRequired) {
-      throw new ProofNotValidatedError(`Proof by required hash '${expectedHash}' was not found`);
+      const expectedHashStr = expectedHashes.length === 1 ? expectedHashes[0] : `[${expectedHashes.join(", ")}]`;
+      throw new ProofNotValidatedError(`Proof by required hash '${expectedHashStr}' was not found`);
     }
   }
   if (unvalidatedProofHashByIndex.size > 0) {
     const contactSupport = "Please contact Reclaim Protocol Support team or mail us at support@reclaimprotocol.org.";
-    throw new UnknownProofsNotValidatedError(`Extra ${unvalidatedProofHashByIndex.size} proof(s) by hashes ${[...unvalidatedProofHashByIndex.values()].join(", ")} was found but could not be validated and indicates a security risk. ${contactSupport}`);
+    const unvalidatedHashesStrArr = [...unvalidatedProofHashByIndex.values()].map((h) => h.length === 1 ? h[0] : `[${h.join(", ")}]`);
+    throw new UnknownProofsNotValidatedError(`Extra ${unvalidatedProofHashByIndex.size} proof(s) by hashes ${unvalidatedHashesStrArr.join(", ")} was found but could not be validated and indicates a security risk. ${contactSupport}`);
   }
 }
 var allowedHttpMethods = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE"]);
@@ -1375,7 +1536,7 @@ function isHttpProviderClaimParams(claimParams) {
     return false;
   }
   const params = claimParams;
-  return typeof params.url === "string" && typeof params.method === "string" && allowedHttpMethods.has(params.method) && typeof params.body === "string" && Array.isArray(params.responseMatches) && params.responseMatches.length > 0 && Array.isArray(params.responseRedactions);
+  return typeof params.url === "string" && typeof params.method === "string" && allowedHttpMethods.has(params.method) && (params.body == null || typeof params.body === "string") && Array.isArray(params.responseMatches) && params.responseMatches.length > 0 && Array.isArray(params.responseRedactions);
 }
 function getHttpProviderClaimParamsFromProof(proof) {
   try {
@@ -1388,31 +1549,781 @@ function getHttpProviderClaimParamsFromProof(proof) {
   throw new ProofNotValidatedError("Proof has no HTTP provider params to hash");
 }
 function assertValidateProof(proofs, config) {
-  if ("dangerouslyDisableContentValidation" in config && config.dangerouslyDisableContentValidation) {
-    logger7.warn("Validation skipped because it was disabled during proof verification");
-    return;
+  return __async(this, null, function* () {
+    if ("dangerouslyDisableContentValidation" in config && config.dangerouslyDisableContentValidation) {
+      logger8.warn("Validation skipped because it was disabled during proof verification");
+      return;
+    }
+    if ("providerId" in config) {
+      if (!config.providerId || typeof config.providerId !== "string") {
+        throw new ProofNotValidatedError("Provider id is required for proof validation");
+      }
+      if (config.providerVersion && typeof config.providerVersion !== "string") {
+        throw new ProofNotValidatedError("Provider version must be a string");
+      }
+      const hashRequirementsFromProvider = yield fetchProviderHashRequirementsBy(config.providerId, config.providerVersion, config.allowedTags, proofs);
+      if (!hashRequirementsFromProvider.length) {
+        throw new ProofNotValidatedError("Could not find any provider information for the given provider id and version");
+      }
+      if (hashRequirementsFromProvider.length != 1) {
+        let lastError = null;
+        for (const hashRequirement of hashRequirementsFromProvider) {
+          try {
+            return yield assertValidateProof(proofs, hashRequirement);
+          } catch (e) {
+            lastError = e;
+          }
+        }
+        throw new ProofNotValidatedError("Could not validate proof", lastError);
+      } else {
+        return assertValidateProof(proofs, hashRequirementsFromProvider[0]);
+      }
+    }
+    const effectiveHashRequirement = ("hashes" in config && Array.isArray(config == null ? void 0 : config.hashes) ? config.hashes : []).map((it) => {
+      if (typeof it == "string") {
+        return {
+          value: it
+        };
+      } else {
+        return it;
+      }
+    });
+    return assertValidProofsByHash(proofs, {
+      hashes: effectiveHashRequirement
+    });
+  });
+}
+
+// src/utils/verifyTee.ts
+var import_node_forge = __toESM(require("node-forge"));
+var import_ethers4 = require("ethers");
+
+// src/utils/amdCerts.ts
+var AMD_CERTS = {
+  "Milan": `-----BEGIN CERTIFICATE-----
+MIIGjzCCBD6gAwIBAgIDAQEBMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAIC
+BQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBMHsxFDAS
+BgNVBAsMC0VuZ2luZWVyaW5nMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2FudGEg
+Q2xhcmExCzAJBgNVBAgMAkNBMR8wHQYDVQQKDBZBZHZhbmNlZCBNaWNybyBEZXZp
+Y2VzMRIwEAYDVQQDDAlBUkstTWlsYW4wHhcNMjIxMTE2MjI0NTI0WhcNNDcxMTE2
+MjI0NTI0WjCBgDEUMBIGA1UECwwLRW5naW5lZXJpbmcxCzAJBgNVBAYTAlVTMRQw
+EgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExHzAdBgNVBAoMFkFkdmFu
+Y2VkIE1pY3JvIERldmljZXMxFzAVBgNVBAMMDlNFVi1WTEVLLU1pbGFuMIICIjAN
+BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA1EUWkz5FTPz+uWT2hCEyisam8FRu
+XZAmS3l+rXgSCeS1Q0+1olcnFSJpiwfssfhoutJqePyicu+OhkX131PMeO/VOtH3
+upK4YNJmq36IJp7ZWIm5nK2fJNkYEHW0m/NXcIA9U2iHl5bAQ5cbGp97/FaOJ4Vm
+GoTMV658Yox/plFmZRFfRcsw2hyNhqUl1gzdpnIIgPkygUovFEgaa0IVSgGLHQhZ
+QiebNLLSVWRVReve0t94zlRIRRdrz84cckP9H9DTAUMyQaxSZbPINKbV6TPmtrwA
+V9UP1Qq418xn9I+C0SsWutP/5S1OiL8OTzQ4CvgbHOfd2F3yVv4xDBza4SelF2ig
+oDf+BF4XI/IIHJL2N5uKy3+gkSB2Xl6prohgVmqRFvBW9OTCEa32WhXu0t1Z1abE
+KDZ3LpZt9/Crg6zyPpXDLR/tLHHpSaPRj7CTzHieKMTz+Q6RrCCQcHGfaAD/ETNY
+56aHvNJRZgbzXDUJvnLr3dYyOvvn/DtKhCSimJynn7Len4ArDVQVwXRPe3hR/asC
+E2CajT7kGC1AOtUzQuIKZS2D0Qk74g297JhLHpEBlQiyjRJ+LCWZNx9uJcixGyza
+v6fiOWx4U8uWhRzHs8nvDAdcS4LW31tPlA9BeOK/BGimQTu7hM5MDFZL0C9dWK5p
+uCUJex6I2vSqvycCAwEAAaOBozCBoDAdBgNVHQ4EFgQUNuJXE6qi45/CgqkKRPtV
+LObC7pEwHwYDVR0jBBgwFoAUhawa0UP3yKxV1MUdQUir1XhK1FMwEgYDVR0TAQH/
+BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQQwOgYDVR0fBDMwMTAvoC2gK4YpaHR0
+cHM6Ly9rZHNpbnRmLmFtZC5jb20vdmxlay92MS9NaWxhbi9jcmwwRgYJKoZIhvcN
+AQEKMDmgDzANBglghkgBZQMEAgIFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQME
+AgIFAKIDAgEwowMCAQEDggIBAI7ayEXDNj1rCVnjQFb6L91NNOmEIOmi6XtopAqr
+8fj7wqXap1MY82Y0AIi1K9R7C7G1sCmY8QyEyX0zqHsoNbU2IMcSdZrIp8neT8af
+v8tPt7qoW3hZ+QQRMtgVkVVrjJZelvlB74xr5ifDcDiBd2vu/C9IqoQS4pVBKNSF
+pofzjtYKvebBBBXxeM2b901UxNgVjCY26TtHEWN9cA6cDVqDDCCL6uOeR9UOvKDS
+SqlM6nXldSj7bgK7Wh9M9587IwRvNZluXc1CDiKMZybLdSKOlyMJH9ss1GPn0eBV
+EhVjf/gttn7HrcQ9xJZVXyDtL3tkGzemrPK14NOYzmph6xr1iiedAzOVpNdPiEXn
+2lvas0P4TD9UgBh0Y7xyf2yENHiSgJT4T8Iktm/TSzuh4vqkQ72A1HdNTGjoZcfz
+KCsQJ/YuFICeaNxw5cIAGBK/o+6Ek32NPv5XtixNOhEx7GsaVRG05bq5oTt14b4h
+KYhqV1CDrX5hiVRpFFDs/sAGfgTzLdiGXLcvYAUz1tCKIT/eQS9c4/yitn4F3mCP
+d4uQB+fggMtK0qPRthpFtc2SqVCTvHnhxyXqo7GpXMsssgLgKNwaFPe2+Ld5OwPR
+6Pokji9h55m05Dxob8XtD4gW6oFLo9Icg7XqdOr9Iip5RBIPxy7rKk/ReqGs9KH7
+0YPk
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGYzCCBBKgAwIBAgIDAQAAMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAIC
+BQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBMHsxFDAS
+BgNVBAsMC0VuZ2luZWVyaW5nMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2FudGEg
+Q2xhcmExCzAJBgNVBAgMAkNBMR8wHQYDVQQKDBZBZHZhbmNlZCBNaWNybyBEZXZp
+Y2VzMRIwEAYDVQQDDAlBUkstTWlsYW4wHhcNMjAxMDIyMTcyMzA1WhcNNDUxMDIy
+MTcyMzA1WjB7MRQwEgYDVQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDAS
+BgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5j
+ZWQgTWljcm8gRGV2aWNlczESMBAGA1UEAwwJQVJLLU1pbGFuMIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEA0Ld52RJOdeiJlqK2JdsVmD7FktuotWwX1fNg
+W41XY9Xz1HEhSUmhLz9Cu9DHRlvgJSNxbeYYsnJfvyjx1MfU0V5tkKiU1EesNFta
+1kTA0szNisdYc9isqk7mXT5+KfGRbfc4V/9zRIcE8jlHN61S1ju8X93+6dxDUrG2
+SzxqJ4BhqyYmUDruPXJSX4vUc01P7j98MpqOS95rORdGHeI52Naz5m2B+O+vjsC0
+60d37jY9LFeuOP4Meri8qgfi2S5kKqg/aF6aPtuAZQVR7u3KFYXP59XmJgtcog05
+gmI0T/OitLhuzVvpZcLph0odh/1IPXqx3+MnjD97A7fXpqGd/y8KxX7jksTEzAOg
+bKAeam3lm+3yKIcTYMlsRMXPcjNbIvmsBykD//xSniusuHBkgnlENEWx1UcbQQrs
++gVDkuVPhsnzIRNgYvM48Y+7LGiJYnrmE8xcrexekBxrva2V9TJQqnN3Q53kt5vi
+Qi3+gCfmkwC0F0tirIZbLkXPrPwzZ0M9eNxhIySb2npJfgnqz55I0u33wh4r0ZNQ
+eTGfw03MBUtyuzGesGkcw+loqMaq1qR4tjGbPYxCvpCq7+OgpCCoMNit2uLo9M18
+fHz10lOMT8nWAUvRZFzteXCm+7PHdYPlmQwUw3LvenJ/ILXoQPHfbkH0CyPfhl1j
+WhJFZasCAwEAAaN+MHwwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSFrBrRQ/fI
+rFXUxR1BSKvVeErUUzAPBgNVHRMBAf8EBTADAQH/MDoGA1UdHwQzMDEwL6AtoCuG
+KWh0dHBzOi8va2RzaW50Zi5hbWQuY29tL3ZjZWsvdjEvTWlsYW4vY3JsMEYGCSqG
+SIb3DQEBCjA5oA8wDQYJYIZIAWUDBAICBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZI
+AWUDBAICBQCiAwIBMKMDAgEBA4ICAQC6m0kDp6zv4Ojfgy+zleehsx6ol0ocgVel
+ETobpx+EuCsqVFRPK1jZ1sp/lyd9+0fQ0r66n7kagRk4Ca39g66WGTJMeJdqYriw
+STjjDCKVPSesWXYPVAyDhmP5n2v+BYipZWhpvqpaiO+EGK5IBP+578QeW/sSokrK
+dHaLAxG2LhZxj9aF73fqC7OAJZ5aPonw4RE299FVarh1Tx2eT3wSgkDgutCTB1Yq
+zT5DuwvAe+co2CIVIzMDamYuSFjPN0BCgojl7V+bTou7dMsqIu/TW/rPCX9/EUcp
+KGKqPQ3P+N9r1hjEFY1plBg93t53OOo49GNI+V1zvXPLI6xIFVsh+mto2RtgEX/e
+pmMKTNN6psW88qg7c1hTWtN6MbRuQ0vm+O+/2tKBF2h8THb94OvvHHoFDpbCELlq
+HnIYhxy0YKXGyaW1NjfULxrrmxVW4wcn5E8GddmvNa6yYm8scJagEi13mhGu4Jqh
+3QU3sf8iUSUr09xQDwHtOQUVIqx4maBZPBtSMf+qUDtjXSSq8lfWcd8bLr9mdsUn
+JZJ0+tuPMKmBnSH860llKk+VpVQsgqbzDIvOLvD6W1Umq25boxCYJ+TuBoa4s+HH
+CViAvgT9kf/rBq1d+ivj6skkHxuzcxbk1xv6ZGxrteJxVH7KlX7YRdZ6eARKwLe4
+AFZEAwoKCQ==
+-----END CERTIFICATE-----`,
+  "Genoa": `-----BEGIN CERTIFICATE-----
+MIIGjzCCBD6gAwIBAgIDAgEBMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAIC
+BQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBMHsxFDAS
+BgNVBAsMC0VuZ2luZWVyaW5nMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2FudGEg
+Q2xhcmExCzAJBgNVBAgMAkNBMR8wHQYDVQQKDBZBZHZhbmNlZCBNaWNybyBEZXZp
+Y2VzMRIwEAYDVQQDDAlBUkstR2Vub2EwHhcNMjIxMTE4MjA0ODM0WhcNNDcxMTE4
+MjA0ODM0WjCBgDEUMBIGA1UECwwLRW5naW5lZXJpbmcxCzAJBgNVBAYTAlVTMRQw
+EgYDVQQHDAtTYW50YSBDbGFyYTELMAkGA1UECAwCQ0ExHzAdBgNVBAoMFkFkdmFu
+Y2VkIE1pY3JvIERldmljZXMxFzAVBgNVBAMMDlNFVi1WTEVLLUdlbm9hMIICIjAN
+BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAzL2/xihHscEpxS3+OsQZpAuNIJGS
+EQZrkoWPtqKMjjZOyXMMRHAheTm56Ei0Mb8TJZlbGDS5x/AdbowstGmpHqh2zvSv
+jZO7V4v6Ft84p71P6GXfOVEQgCuatiszfIwFrRQk/cmU7HuJadBq6XtYE+qBJMju
+s8C0WwW/IWY9j6pNbEA1SnUvVg6t89zfE+AcB5UDCKq09x7qw+rPt9pTpEch0f1b
+HdRFJlpgWGTq02ohH9bT+6au8kPpvMa3m2p8zdIIqtuuSG6srIimrpt24lsr4tLh
+QG65R/RbVJT9MsK4ULpbAUO5NwdlLwbnpLWHiUwoYrySMD8l3xRDvhPmInlXEFEo
+8lahcYllxiJJR8oqqA6x3jPFKmkfhEgaQefcn4P8nA4SScqAoLihn75iiDtU2+Zl
+kPnKgcNs5U1Le441ypen2n7BOnRyhmwyAUBGk3OcMXHsJ6KGpDJyTVCaC3fWX3ex
+4Iv4LkuKRA6O9yu3zHP23N/ubE8/YykffIjMbtBoOAzdWCn9lE4amo4VZ+8ewIut
+ZAYmC5TIQO+wWUqKYr0iAobccMnZdJjUORjVoqVQ+dLr+/1otk36gfPc0LpmhWZK
+fAXF9sgvYtQjcaR9wlGr8ySRtZ2YJWofuR7zgYFJPEXRwAnbAR/05hBmog7CMt1F
+9YKSmku6JfRecY8CAwEAAaOBozCBoDAdBgNVHQ4EFgQUhEdjn8HQNI9bN2NAKL9z
+gM6VNoowHwYDVR0jBBgwFoAUn135/g3Y81rQMxol74EpT74xqFswEgYDVR0TAQH/
+BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQQwOgYDVR0fBDMwMTAvoC2gK4YpaHR0
+cHM6Ly9rZHNpbnRmLmFtZC5jb20vdmxlay92MS9HZW5vYS9jcmwwRgYJKoZIhvcN
+AQEKMDmgDzANBglghkgBZQMEAgIFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQME
+AgIFAKIDAgEwowMCAQEDggIBALgCTyTS/ppxo42n2LOox42LvNIsn2/ZaMs2NfCj
+4f2+VN5Xs1NNdptn2nq/SKu5aKnLS5XGWCnHfMSKZ7vqHLKMa0Wxfm+4JahOItQ3
++PzbTa0EwUkq1u6oezhTHywX1PilNRc4EjWgQ6ba/z4BBxO3P10tW/C39VS0Cv8S
+N5G2bfZrPkjy6LBjGiaT4MBcsN+SM2o5QgKRG0qqn+edegHMmTPBDV2qCKbe5CBs
+a122q+F6S9hPEEiGkz/IpShnSGCaFvbEu0Uvh2dYUlrON2peZMDkevKurDXlGxTe
+hAflCiugBsNeJivx0j7B/HazAvxkLPTCkIdmQJccezF5PCgmMW0SeP4cMb5Ewzv/
+yCsTLyh13YsYBww5eW4DBREd/vCAS7F1JQUZ4twQy/jqBAJhcDyGuRnnwrRevGdW
+sb3cXBqeLCub7CKZ1n/zqSRHq8FRgoroPRpfFjSGhDVFbjj7bDzWU6WNmF/7Lpnq
+G+tIMyRc+3Y3yRAYchFNOFHyS6R2C0KTy1nRSYwBUdQtGaQ0rE3e5Mulcidh4qkI
+xpp089vzqV8JTSJsRzTOzkujOuHUYPKswJ1TvQr5S1C0gPN2qAESnCs7Nf2x82DS
+xmEqaiI7xS58pR6vZ8BeXMGPPQqgOm/oBzOypVR3iCG6MFdjsTNA6M8P7GCZe1p7
+2cko
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGYzCCBBKgAwIBAgIDAgAAMEYGCSqGSIb3DQEBCjA5oA8wDQYJYIZIAWUDBAIC
+BQChHDAaBgkqhkiG9w0BAQgwDQYJYIZIAWUDBAICBQCiAwIBMKMDAgEBMHsxFDAS
+BgNVBAsMC0VuZ2luZWVyaW5nMQswCQYDVQQGEwJVUzEUMBIGA1UEBwwLU2FudGEg
+Q2xhcmExCzAJBgNVBAgMAkNBMR8wHQYDVQQKDBZBZHZhbmNlZCBNaWNybyBEZXZp
+Y2VzMRIwEAYDVQQDDAlBUkstR2Vub2EwHhcNMjIwMTI2MTUzNDM3WhcNNDcwMTI2
+MTUzNDM3WjB7MRQwEgYDVQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDAS
+BgNVBAcMC1NhbnRhIENsYXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5j
+ZWQgTWljcm8gRGV2aWNlczESMBAGA1UEAwwJQVJLLUdlbm9hMIICIjANBgkqhkiG
+9w0BAQEFAAOCAg8AMIICCgKCAgEA3Cd95S/uFOuRIskW9vz9VDBF69NDQF79oRhL
+/L2PVQGhK3YdfEBgpF/JiwWFBsT/fXDhzA01p3LkcT/7LdjcRfKXjHl+0Qq/M4dZ
+kh6QDoUeKzNBLDcBKDDGWo3v35NyrxbA1DnkYwUKU5AAk4P94tKXLp80oxt84ahy
+HoLmc/LqsGsp+oq1Bz4PPsYLwTG4iMKVaaT90/oZ4I8oibSru92vJhlqWO27d/Rx
+c3iUMyhNeGToOvgx/iUo4gGpG61NDpkEUvIzuKcaMx8IdTpWg2DF6SwF0IgVMffn
+vtJmA68BwJNWo1E4PLJdaPfBifcJpuBFwNVQIPQEVX3aP89HJSp8YbY9lySS6PlV
+EqTBBtaQmi4ATGmMR+n2K/e+JAhU2Gj7jIpJhOkdH9firQDnmlA2SFfJ/Cc0mGNz
+W9RmIhyOUnNFoclmkRhl3/AQU5Ys9Qsan1jT/EiyT+pCpmnA+y9edvhDCbOG8F2o
+xHGRdTBkylungrkXJGYiwGrR8kaiqv7NN8QhOBMqYjcbrkEr0f8QMKklIS5ruOfq
+lLMCBw8JLB3LkjpWgtD7OpxkzSsohN47Uom86RY6lp72g8eXHP1qYrnvhzaG1S70
+vw6OkbaaC9EjiH/uHgAJQGxon7u0Q7xgoREWA/e7JcBQwLg80Hq/sbRuqesxz7wB
+WSY254cCAwEAAaN+MHwwDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBSfXfn+Ddjz
+WtAzGiXvgSlPvjGoWzAPBgNVHRMBAf8EBTADAQH/MDoGA1UdHwQzMDEwL6AtoCuG
+KWh0dHBzOi8va2RzaW50Zi5hbWQuY29tL3ZjZWsvdjEvR2Vub2EvY3JsMEYGCSqG
+SIb3DQEBCjA5oA8wDQYJYIZIAWUDBAICBQChHDAaBgkqhkiG9w0BAQgwDQYJYIZI
+AWUDBAICBQCiAwIBMKMDAgEBA4ICAQAdIlPBC7DQmvH7kjlOznFx3i21SzOPDs5L
+7SgFjMC9rR07292GQCA7Z7Ulq97JQaWeD2ofGGse5swj4OQfKfVv/zaJUFjvosZO
+nfZ63epu8MjWgBSXJg5QE/Al0zRsZsp53DBTdA+Uv/s33fexdenT1mpKYzhIg/cK
+tz4oMxq8JKWJ8Po1CXLzKcfrTphjlbkh8AVKMXeBd2SpM33B1YP4g1BOdk013kqb
+7bRHZ1iB2JHG5cMKKbwRCSAAGHLTzASgDcXr9Fp7Z3liDhGu/ci1opGmkp12QNiJ
+uBbkTU+xDZHm5X8Jm99BX7NEpzlOwIVR8ClgBDyuBkBC2ljtr3ZSaUIYj2xuyWN9
+5KFY49nWxcz90CFa3Hzmy4zMQmBe9dVyls5eL5p9bkXcgRMDTbgmVZiAf4afe8DL
+dmQcYcMFQbHhgVzMiyZHGJgcCrQmA7MkTwEIds1wx/HzMcwU4qqNBAoZV7oeIIPx
+dqFXfPqHqiRlEbRDfX1TG5NFVaeByX0GyH6jzYVuezETzruaky6fp2bl2bczxPE8
+HdS38ijiJmm9vl50RGUeOAXjSuInGR4bsRufeGPB9peTa9BcBOeTWzstqTUB/F/q
+aZCIZKr4X6TyfUuSDz/1JDAGl+lxdM0P9+lLaP9NahQjHCVf0zf1c1salVuGFk2w
+/wMz1R1BHg==
+-----END CERTIFICATE-----`
+};
+
+// src/utils/verifyTee.ts
+var crlCache = {};
+var logger9 = logger_default.logger;
+function toUint8Array(input) {
+  if (typeof Buffer !== "undefined" && typeof Buffer.isBuffer === "function" && Buffer.isBuffer(input)) {
+    return new Uint8Array(input);
   }
-  const effectiveHashRequirement = ("hashes" in config && Array.isArray(config == null ? void 0 : config.hashes) ? config.hashes : []).map((it) => {
-    if (typeof it == "string") {
-      return {
-        value: it
-      };
+  if (input instanceof Uint8Array) {
+    return new Uint8Array(input);
+  }
+  if (typeof ArrayBuffer !== "undefined" && input instanceof ArrayBuffer) {
+    return new Uint8Array(input);
+  }
+  throw new Error("Unsupported binary data type");
+}
+function uint8ArrayToBinaryString(bytes) {
+  let result = "";
+  const chunkSize = 32768;
+  for (let i = 0; i < bytes.length; i += chunkSize) {
+    const chunk = bytes.subarray(i, i + chunkSize);
+    result += String.fromCharCode(...chunk);
+  }
+  return result;
+}
+function binaryStringToUint8Array(binary) {
+  const result = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    result[i] = binary.charCodeAt(i);
+  }
+  return result;
+}
+function base64ToUint8Array(base64) {
+  if (typeof atob === "function") {
+    const binary = atob(base64);
+    return binaryStringToUint8Array(binary);
+  }
+  if (typeof Buffer !== "undefined") {
+    return new Uint8Array(Buffer.from(base64, "base64"));
+  }
+  throw new Error("Base64 decoding is not supported in this environment");
+}
+function arrayBufferToHex(buffer) {
+  const view = buffer instanceof Uint8Array ? buffer : new Uint8Array(buffer);
+  let hex = "";
+  for (let i = 0; i < view.length; i++) {
+    hex += view[i].toString(16).padStart(2, "0");
+  }
+  return hex;
+}
+function concatUint8Arrays(parts) {
+  const totalLength = parts.reduce((sum, arr) => sum + arr.length, 0);
+  const result = new Uint8Array(totalLength);
+  let offset = 0;
+  for (const arr of parts) {
+    result.set(arr, offset);
+    offset += arr.length;
+  }
+  return result;
+}
+function reverseBytes(bytes) {
+  const copy = Uint8Array.from(bytes);
+  copy.reverse();
+  return copy;
+}
+function normalizeSerial(s) {
+  let cleaned = s.toLowerCase().replace(/[^a-f0-9]/g, "");
+  while (cleaned.startsWith("0") && cleaned.length > 1) cleaned = cleaned.substring(1);
+  return cleaned;
+}
+var isNode = typeof process !== "undefined" && process.versions && process.versions.node;
+var getSubtleCrypto = () => {
+  var _a;
+  if (typeof window !== "undefined" && ((_a = window.crypto) == null ? void 0 : _a.subtle)) return window.crypto.subtle;
+  if (isNode) return require("crypto").webcrypto.subtle;
+  throw new Error("No WebCrypto subtle implementation found in this environment");
+};
+function parseCert(buffer) {
+  const bytes = toUint8Array(buffer);
+  const asn1 = import_node_forge.default.asn1.fromDer(uint8ArrayToBinaryString(bytes));
+  const certSeq = asn1.value;
+  const tbsAsn1 = certSeq[0];
+  const sigAlgAsn1 = certSeq[1];
+  const sigValueAsn1 = certSeq[2];
+  const tbsFields = tbsAsn1.value;
+  let idx = 0;
+  if (tbsFields[idx].tagClass === 128) idx++;
+  const serialAsn1 = tbsFields[idx++];
+  const serialNumber = import_node_forge.default.util.bytesToHex(serialAsn1.value);
+  idx++;
+  idx++;
+  const validityAsn1 = tbsFields[idx++];
+  idx++;
+  const spkiAsn1 = tbsFields[idx];
+  if (!validityAsn1 || !Array.isArray(validityAsn1.value) || validityAsn1.value.length < 2) {
+    throw new Error("Certificate validity window is malformed");
+  }
+  const notBeforeNode = validityAsn1.value[0];
+  const notAfterNode = validityAsn1.value[1];
+  const notBefore = notBeforeNode ? parseAsn1Time(notBeforeNode) : void 0;
+  const notAfter = notAfterNode ? parseAsn1Time(notAfterNode) : void 0;
+  const sigRaw = typeof sigValueAsn1.value === "string" ? sigValueAsn1.value : "";
+  const signature = binaryStringToUint8Array(sigRaw.substring(1));
+  const sigAlgOid = import_node_forge.default.asn1.derToOid(sigAlgAsn1.value[0].value);
+  return {
+    serialNumber: normalizeSerial(serialNumber),
+    tbsDer: binaryStringToUint8Array(import_node_forge.default.asn1.toDer(tbsAsn1).getBytes()),
+    signature,
+    sigAlgOid,
+    spkiDer: binaryStringToUint8Array(import_node_forge.default.asn1.toDer(spkiAsn1).getBytes()),
+    notBefore,
+    notAfter
+  };
+}
+function verifySignature(publicKeyPem, data, signature, sigAlgOid) {
+  return __async(this, null, function* () {
+    const cryptoSubtle = getSubtleCrypto();
+    const forgeCert = import_node_forge.default.pki.certificateFromPem(publicKeyPem);
+    const spkiBuf = binaryStringToUint8Array(import_node_forge.default.asn1.toDer(import_node_forge.default.pki.publicKeyToAsn1(forgeCert.publicKey)).getBytes());
+    let importParams;
+    let verifyParams;
+    if (sigAlgOid === "1.2.840.113549.1.1.10") {
+      importParams = { name: "RSA-PSS", hash: "SHA-384" };
+      verifyParams = { name: "RSA-PSS", saltLength: 48 };
+    } else if (sigAlgOid === "1.2.840.113549.1.1.11" || sigAlgOid === "1.2.840.113549.1.1.12" || sigAlgOid === "1.2.840.113549.1.1.5") {
+      importParams = { name: "RSASSA-PKCS1-v1_5", hash: sigAlgOid === "1.2.840.113549.1.1.12" ? "SHA-384" : "SHA-256" };
+      verifyParams = { name: "RSASSA-PKCS1-v1_5" };
+    } else if (sigAlgOid === "1.2.840.10045.4.3.3") {
+      importParams = { name: "ECDSA", namedCurve: "P-384" };
+      verifyParams = { name: "ECDSA", hash: "SHA-384" };
     } else {
-      return it;
+      importParams = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+      verifyParams = { name: "RSASSA-PKCS1-v1_5" };
+    }
+    const key = yield cryptoSubtle.importKey("spki", spkiBuf, importParams, false, ["verify"]);
+    const isValid = yield cryptoSubtle.verify(verifyParams, key, signature, data);
+    if (!isValid) throw new Error(`Signature verification failed (OID: ${sigAlgOid}, ImportParams: ${JSON.stringify(importParams)})`);
+  });
+}
+var COSIGN_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjiL30OjPuxa+GC1I7SAcBv2u2pMt
+h9WbP33IvB3eFww+C1hoW0fwdZPiq4FxBtKNiZuFpmYuFngW/nJteBu9kQ==
+-----END PUBLIC KEY-----
+`;
+function verifyTeeAttestation(proof, expectedApplicationId) {
+  return __async(this, null, function* () {
+    try {
+      let teeAttestation = proof.teeAttestation;
+      if (!teeAttestation) {
+        throw new Error("Missing teeAttestation in proof");
+      }
+      if (typeof teeAttestation === "string") {
+        teeAttestation = JSON.parse(teeAttestation);
+      }
+      let expectedNonceSignature;
+      let nonceDataObj;
+      try {
+        const context = JSON.parse(proof.claimData.context);
+        expectedNonceSignature = context.attestationNonce;
+        nonceDataObj = context.attestationNonceData;
+      } catch (e) {
+        throw new Error("Failed to parse proof context to extract attestationNonce");
+      }
+      if (!expectedNonceSignature || !nonceDataObj) {
+        throw new Error("Proof context is missing attestationNonce or attestationNonceData");
+      }
+      if (teeAttestation.nonce !== expectedNonceSignature) {
+        throw new Error(`Nonce Mismatch! Expected signature ${expectedNonceSignature}, got ${teeAttestation.nonce}`);
+      }
+      const { applicationId, sessionId, timestamp } = nonceDataObj;
+      if (expectedApplicationId && applicationId.toLowerCase() !== expectedApplicationId.toLowerCase()) {
+        throw new Error(`Application ID Mismatch! Expected ${expectedApplicationId}, but proof context contains ${applicationId}`);
+      }
+      const expectedNonceData = `${applicationId}:${sessionId}:${timestamp}`;
+      const nonceMsg = import_ethers4.ethers.getBytes(import_ethers4.ethers.keccak256(new TextEncoder().encode(expectedNonceData)));
+      const recoveredAddress = import_ethers4.ethers.verifyMessage(nonceMsg, expectedNonceSignature);
+      if (recoveredAddress.toLowerCase() !== applicationId.toLowerCase()) {
+        throw new Error(`Nonce signature verification failed: recovered ${recoveredAddress}, expected ${applicationId}`);
+      }
+      try {
+        const context = JSON.parse(proof.claimData.context);
+        const paramSessionId = context.attestationNonceData.sessionId;
+        if (!paramSessionId) {
+          throw new Error(`Proof parameters are missing proxySessionId or sessionId`);
+        }
+        if (paramSessionId.toString() !== sessionId.toString()) {
+          throw new Error(`Session ID Mismatch! Expected ${sessionId}, but proof parameters contain ${paramSessionId}`);
+        }
+        const claimTimestampMs = proof.claimData.timestampS * 1e3;
+        const nonceTimestampMs = parseInt(timestamp, 10);
+        const diffMs = Math.abs(claimTimestampMs - nonceTimestampMs);
+        const TEN_MINUTES_MS = 10 * 60 * 1e3;
+        if (diffMs > TEN_MINUTES_MS) {
+          throw new Error(`Timestamp Skew Too Large! claimData.timestampS and attestationNonce timestamp differ by ${Math.round(diffMs / 1e3)}s (limit: 600s)`);
+        }
+      } catch (e) {
+        if (e instanceof Error && (e.message.includes("Session ID Mismatch!") || e.message.includes("Timestamp Skew"))) {
+          throw e;
+        }
+        throw new Error(`Failed to cross-verify session ID: ${e.message}`);
+      }
+      const reportBuffer = base64ToUint8Array(teeAttestation.snp_report);
+      const report = parseAttestationReport(reportBuffer);
+      if (report.isDebugEnabled) {
+        throw new Error("POLICY CHECK FAILED: Debug mode is ALLOWED. Environment is compromised.");
+      }
+      const certBuffer = base64ToUint8Array(teeAttestation.vlek_cert);
+      yield verifyAMDChain(certBuffer);
+      verifyTCB(certBuffer, report);
+      yield verifyHardwareSignature(reportBuffer, certBuffer);
+      yield verifyReportData(teeAttestation, proof.claimData.context, report);
+      return true;
+    } catch (error) {
+      logger9.error("TEE attestation verification failed:", error);
+      return false;
+    }
+  });
+}
+function parseAttestationReport(buffer) {
+  if (buffer.length < 1e3) {
+    throw new Error(`Report buffer is too small: ${buffer.length} bytes`);
+  }
+  const view = new DataView(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+  const policy = view.getBigUint64(8, true);
+  const isDebugEnabled = (policy & BigInt(1) << BigInt(19)) !== BigInt(0);
+  const reported_tcb = {
+    bootloader: buffer[56],
+    tee: buffer[57],
+    snp: buffer[62],
+    microcode: buffer[63]
+  };
+  const reportData = arrayBufferToHex(buffer.subarray(80, 144));
+  return { policy, isDebugEnabled, reported_tcb, reportData };
+}
+function getExtValue(certAsn1, oidString) {
+  const tbsCert = certAsn1.value[0];
+  if (!tbsCert || !tbsCert.value) return null;
+  const extBlockWrapper = tbsCert.value.find((node) => node.tagClass === import_node_forge.default.asn1.Class.CONTEXT_SPECIFIC && node.type === 3);
+  if (!extBlockWrapper || !extBlockWrapper.value || !extBlockWrapper.value.length) return null;
+  const extSequence = extBlockWrapper.value[0];
+  for (const ext of extSequence.value) {
+    const extIdAsn1 = ext.value[0];
+    const extIdStr = import_node_forge.default.asn1.derToOid(extIdAsn1.value);
+    if (extIdStr === oidString) {
+      const extValueAsn1 = ext.value[ext.value.length - 1];
+      const rawOctetStringBytes = extValueAsn1.value;
+      try {
+        const innerAsn1 = import_node_forge.default.asn1.fromDer(import_node_forge.default.util.createBuffer(rawOctetStringBytes));
+        if (innerAsn1.type === 2) {
+          const bytes = innerAsn1.value;
+          if (typeof bytes === "string" && bytes.length > 0) {
+            return bytes.charCodeAt(bytes.length - 1);
+          } else {
+            throw new Error(`Extension ${oidString} INTEGER value is empty or invalid`);
+          }
+        } else {
+          throw new Error(`Extension ${oidString} does not contain an INTEGER, found type ${innerAsn1.type}`);
+        }
+      } catch (e) {
+        throw new Error(`Failed to strictly parse AMD TCB extension ${oidString}: ${e.message}`);
+      }
+    }
+  }
+  return null;
+}
+function verifyTCB(vlekCertBuffer, report) {
+  const certAsn1 = import_node_forge.default.asn1.fromDer(import_node_forge.default.util.createBuffer(uint8ArrayToBinaryString(vlekCertBuffer)));
+  const OID_BOOTLOADER = "1.3.6.1.4.1.3704.1.3.1";
+  const OID_TEE = "1.3.6.1.4.1.3704.1.3.2";
+  const OID_SNP = "1.3.6.1.4.1.3704.1.3.3";
+  const OID_MICROCODE = "1.3.6.1.4.1.3704.1.3.8";
+  const certTcb = {
+    bootloader: getExtValue(certAsn1, OID_BOOTLOADER),
+    tee: getExtValue(certAsn1, OID_TEE),
+    snp: getExtValue(certAsn1, OID_SNP),
+    microcode: getExtValue(certAsn1, OID_MICROCODE)
+  };
+  if (certTcb.bootloader !== null && report.reported_tcb.bootloader < certTcb.bootloader) {
+    throw new Error(`TCB Downgrade! Bootloader reported ${report.reported_tcb.bootloader}, but certificate requires ${certTcb.bootloader}`);
+  }
+  if (certTcb.tee !== null && report.reported_tcb.tee < certTcb.tee) {
+    throw new Error(`TCB Downgrade! TEE reported ${report.reported_tcb.tee}, but certificate requires ${certTcb.tee}`);
+  }
+  if (certTcb.snp !== null && report.reported_tcb.snp < certTcb.snp) {
+    throw new Error(`TCB Downgrade! SNP reported ${report.reported_tcb.snp}, but certificate requires ${certTcb.snp}`);
+  }
+  if (certTcb.microcode !== null && report.reported_tcb.microcode < certTcb.microcode) {
+    throw new Error(`TCB Downgrade! Microcode reported ${report.reported_tcb.microcode}, but certificate requires ${certTcb.microcode}`);
+  }
+}
+function parseAsn1Time(node) {
+  const s = node.value;
+  if (node.type === import_node_forge.default.asn1.Type.UTCTIME) {
+    const yr = parseInt(s.substring(0, 2), 10);
+    return new Date(Date.UTC(
+      yr >= 50 ? 1900 + yr : 2e3 + yr,
+      parseInt(s.substring(2, 4), 10) - 1,
+      parseInt(s.substring(4, 6), 10),
+      parseInt(s.substring(6, 8), 10),
+      parseInt(s.substring(8, 10), 10),
+      parseInt(s.substring(10, 12), 10)
+    ));
+  } else {
+    return new Date(Date.UTC(
+      parseInt(s.substring(0, 4), 10),
+      parseInt(s.substring(4, 6), 10) - 1,
+      parseInt(s.substring(6, 8), 10),
+      parseInt(s.substring(8, 10), 10),
+      parseInt(s.substring(10, 12), 10),
+      parseInt(s.substring(12, 14), 10)
+    ));
+  }
+}
+function verifyCRL(crlBuf, arkPem, vlekSerial) {
+  return __async(this, null, function* () {
+    const crlAsn1 = import_node_forge.default.asn1.fromDer(import_node_forge.default.util.createBuffer(uint8ArrayToBinaryString(crlBuf)));
+    if (!Array.isArray(crlAsn1.value) || crlAsn1.value.length < 3) {
+      throw new Error("CRL ASN.1 structure is invalid: expected SEQUENCE with TBSCertList, AlgorithmIdentifier, BIT STRING");
+    }
+    const tbsAsn1 = crlAsn1.value[0];
+    const sigBitsAsn1 = crlAsn1.value[2];
+    if (!Array.isArray(tbsAsn1.value)) {
+      throw new Error("CRL TBSCertList is not a valid SEQUENCE");
+    }
+    const tbsFields = tbsAsn1.value;
+    let fi = 0;
+    if (fi < tbsFields.length && tbsFields[fi].tagClass === import_node_forge.default.asn1.Class.UNIVERSAL && tbsFields[fi].type === import_node_forge.default.asn1.Type.INTEGER) {
+      fi++;
+    }
+    if (fi < tbsFields.length) fi++;
+    if (fi >= tbsFields.length) throw new Error("CRL TBSCertList missing issuer");
+    const issuerAsn1 = tbsFields[fi++];
+    if (fi >= tbsFields.length) throw new Error("CRL TBSCertList missing thisUpdate");
+    const thisUpdateAsn1 = tbsFields[fi++];
+    let nextUpdateAsn1 = null;
+    if (fi < tbsFields.length && tbsFields[fi].tagClass === import_node_forge.default.asn1.Class.UNIVERSAL && (tbsFields[fi].type === import_node_forge.default.asn1.Type.UTCTIME || tbsFields[fi].type === import_node_forge.default.asn1.Type.GENERALIZEDTIME)) {
+      nextUpdateAsn1 = tbsFields[fi++];
+    }
+    let revokedSeq = null;
+    if (fi < tbsFields.length && tbsFields[fi].tagClass === import_node_forge.default.asn1.Class.UNIVERSAL && tbsFields[fi].type === import_node_forge.default.asn1.Type.SEQUENCE) {
+      revokedSeq = tbsFields[fi];
+    }
+    const now = /* @__PURE__ */ new Date();
+    const thisUpdate = parseAsn1Time(thisUpdateAsn1);
+    if (thisUpdate > now) {
+      throw new Error(`CRL is not yet valid: thisUpdate is ${thisUpdate.toISOString()}`);
+    }
+    if (nextUpdateAsn1) {
+      const nextUpdate = parseAsn1Time(nextUpdateAsn1);
+      if (nextUpdate < now) {
+        throw new Error(`CRL has expired: nextUpdate was ${nextUpdate.toISOString()}`);
+      }
+    }
+    const crlIssuerDer = import_node_forge.default.asn1.toDer(issuerAsn1).getBytes();
+    const arkForgeCert = import_node_forge.default.pki.certificateFromPem(arkPem);
+    const arkCertAsn1 = import_node_forge.default.pki.certificateToAsn1(arkForgeCert);
+    const arkSubjectAsn1 = arkCertAsn1.value[0].value[5];
+    const arkSubjectDer = import_node_forge.default.asn1.toDer(arkSubjectAsn1).getBytes();
+    if (crlIssuerDer !== arkSubjectDer) {
+      throw new Error("CRL issuer does not match AMD ARK certificate subject \u2014 chain mismatch");
+    }
+    const tbsDerBuf = binaryStringToUint8Array(import_node_forge.default.asn1.toDer(tbsAsn1).getBytes());
+    const sigRaw = typeof sigBitsAsn1.value === "string" ? sigBitsAsn1.value : "";
+    const sigBuf = binaryStringToUint8Array(sigRaw.substring(1));
+    const cryptoSubtle = getSubtleCrypto();
+    const spkiBuf = binaryStringToUint8Array(
+      import_node_forge.default.asn1.toDer(import_node_forge.default.pki.publicKeyToAsn1(arkForgeCert.publicKey)).getBytes()
+    );
+    const arkCryptoKey = yield cryptoSubtle.importKey(
+      "spki",
+      spkiBuf,
+      { name: "RSA-PSS", hash: "SHA-384" },
+      false,
+      ["verify"]
+    );
+    const isValid = yield cryptoSubtle.verify(
+      { name: "RSA-PSS", saltLength: 48 },
+      // SHA-384 salt length is 48
+      arkCryptoKey,
+      sigBuf,
+      tbsDerBuf
+    );
+    if (!isValid) {
+      throw new Error("CRL signature is INVALID \u2014 the CRL may be tampered or forged");
+    }
+    const targetSerial = normalizeSerial(vlekSerial);
+    if (revokedSeq && Array.isArray(revokedSeq.value)) {
+      for (const entry of revokedSeq.value) {
+        if (!Array.isArray(entry.value) || entry.value.length < 2) continue;
+        const serialAsn1 = entry.value[0];
+        if (serialAsn1.type !== import_node_forge.default.asn1.Type.INTEGER || typeof serialAsn1.value !== "string") continue;
+        const serialHex = import_node_forge.default.util.bytesToHex(serialAsn1.value);
+        if (normalizeSerial(serialHex) === targetSerial) {
+          throw new Error("\u{1F6A8} VLEK Certificate is REVOKED per AMD CRL! This hardware may be compromised.");
+        }
+      }
+    }
+  });
+}
+function assertCertValidity(label, cert) {
+  const now = Date.now();
+  if (cert.notBefore && now < cert.notBefore.getTime()) {
+    throw new Error(`${label} certificate is not yet valid (notBefore: ${cert.notBefore.toISOString()})`);
+  }
+  if (cert.notAfter && now > cert.notAfter.getTime()) {
+    throw new Error(`${label} certificate expired on ${cert.notAfter.toISOString()}`);
+  }
+}
+function verifyAMDChain(vlekCertBuffer) {
+  return __async(this, null, function* () {
+    const processors = ["Milan", "Genoa"];
+    let chainVerified = false;
+    const vlek = parseCert(vlekCertBuffer);
+    assertCertValidity("VLEK", vlek);
+    for (const processor of processors) {
+      let matchedChain = false;
+      try {
+        const chainPem = AMD_CERTS[processor];
+        if (!chainPem) continue;
+        const certs = chainPem.split("-----END CERTIFICATE-----").map((c) => c.trim()).filter((c) => c.length > 0).map((c) => c + "\n-----END CERTIFICATE-----\n");
+        const askCert = import_node_forge.default.pki.certificateFromPem(certs[0]);
+        const arkCert = import_node_forge.default.pki.certificateFromPem(certs[1]);
+        const askDer = import_node_forge.default.asn1.toDer(import_node_forge.default.pki.certificateToAsn1(askCert)).getBytes();
+        const arkDer = import_node_forge.default.asn1.toDer(import_node_forge.default.pki.certificateToAsn1(arkCert)).getBytes();
+        const ask = parseCert(binaryStringToUint8Array(askDer));
+        const ark = parseCert(binaryStringToUint8Array(arkDer));
+        assertCertValidity("ASK", ask);
+        assertCertValidity("ARK", ark);
+        try {
+          yield verifySignature(certs[1], ark.tbsDer, ark.signature, ark.sigAlgOid);
+        } catch (e) {
+          throw new Error(`AMD ARK self-signature verification failed: ${e.message}`);
+        }
+        try {
+          yield verifySignature(certs[1], ask.tbsDer, ask.signature, ask.sigAlgOid);
+        } catch (e) {
+          throw new Error(`AMD ASK-by-ARK signature verification failed: ${e.message}`);
+        }
+        try {
+          yield verifySignature(certs[0], vlek.tbsDer, vlek.signature, vlek.sigAlgOid);
+        } catch (e) {
+          throw new Error(`VLEK-by-ASK signature verification failed: ${e.message}`);
+        }
+        matchedChain = true;
+        let crlBuf;
+        const now = Date.now();
+        if (crlCache[processor] && now - crlCache[processor].fetchedAt < 36e5) {
+          crlBuf = crlCache[processor].buffer;
+        } else {
+          const crlUrl = `https://kdsintf.amd.com/vlek/v1/${processor}/crl`;
+          const controller = new AbortController();
+          const timeoutId = setTimeout(() => controller.abort(), 5e3);
+          const crlResp = yield fetch(crlUrl, { signal: controller.signal });
+          clearTimeout(timeoutId);
+          if (!crlResp.ok) continue;
+          crlBuf = new Uint8Array(yield crlResp.arrayBuffer());
+          crlCache[processor] = { buffer: crlBuf, fetchedAt: now };
+        }
+        if (vlek.serialNumber && crlBuf) {
+          yield verifyCRL(crlBuf, certs[1], vlek.serialNumber);
+        }
+        chainVerified = true;
+        break;
+      } catch (e) {
+        if (matchedChain) {
+          throw e;
+        }
+        continue;
+      }
+    }
+    if (!chainVerified) {
+      throw new Error("VLEK Certificate failed verification against all known AMD Root of Trust chains!");
+    }
+  });
+}
+function verifyHardwareSignature(reportBytes, certBytes) {
+  return __async(this, null, function* () {
+    const vlek = parseCert(certBytes);
+    const sigOffset = 672;
+    const rLE = reportBytes.subarray(sigOffset, sigOffset + 72);
+    const sLE = reportBytes.subarray(sigOffset + 72, sigOffset + 144);
+    const rBE = reverseBytes(rLE);
+    const sBE = reverseBytes(sLE);
+    const signedData = reportBytes.subarray(0, 672);
+    const cryptoSubtle = getSubtleCrypto();
+    const importedKey = yield cryptoSubtle.importKey(
+      "spki",
+      vlek.spkiDer,
+      { name: "ECDSA", namedCurve: "P-384" },
+      false,
+      ["verify"]
+    );
+    const rPadding = rBE.subarray(0, rBE.length - 48);
+    const sPadding = sBE.subarray(0, sBE.length - 48);
+    if (!rPadding.every((b) => b === 0) || !sPadding.every((b) => b === 0)) {
+      throw new Error("Hardware ECDSA signature is malformed: non-zero padding bytes detected in the structural signature coordinates.");
+    }
+    const r48 = rBE.subarray(rBE.length - 48);
+    const s48 = sBE.subarray(sBE.length - 48);
+    const rawSignature = concatUint8Arrays([r48, s48]);
+    const isValid = yield cryptoSubtle.verify(
+      { name: "ECDSA", hash: { name: "SHA-384" } },
+      importedKey,
+      rawSignature,
+      signedData
+    );
+    if (!isValid) {
+      throw new Error("Hardware ECDSA signature is completely invalid!");
     }
   });
-  return assertValidProofsByHash(proofs, {
-    hashes: effectiveHashRequirement
+}
+function verifyReportData(teeAttestation, proofContext, report) {
+  return __async(this, null, function* () {
+    if (!teeAttestation.workload_digest || !teeAttestation.verifier_digest) {
+      throw new Error("POLICY CHECK FAILED: Missing workload_digest or verifier_digest in TEE attestation.");
+    }
+    const { attestationNonce: nonce } = JSON.parse(proofContext);
+    const cryptoSubtle = getSubtleCrypto();
+    const extractDigestBytes = (imageRef) => {
+      const marker = "@sha256:";
+      const idx = imageRef.lastIndexOf(marker);
+      if (idx < 0) throw new Error(`Image ref missing @sha256: digest: ${imageRef}`);
+      const hexDigest = imageRef.substring(idx + marker.length);
+      if (hexDigest.length !== 64) throw new Error(`SHA256 digest must be 64 hex chars, got ${hexDigest.length} in: ${imageRef}`);
+      const bytes = new Uint8Array(32);
+      for (let i = 0; i < 32; i++) bytes[i] = parseInt(hexDigest.substring(i * 2, i * 2 + 2), 16);
+      return bytes;
+    };
+    const importedCosignKey = yield cryptoSubtle.importKey(
+      "spki",
+      base64ToUint8Array(
+        COSIGN_PUBLIC_KEY.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", "").replace(/\s+/g, "")
+      ),
+      { name: "ECDSA", namedCurve: "P-256" },
+      true,
+      ["verify"]
+    );
+    const pubKeySpkiDer = yield cryptoSubtle.exportKey("spki", importedCosignKey);
+    const pubKeyHashBuffer = yield cryptoSubtle.digest("SHA-256", pubKeySpkiDer);
+    const pubKeyHashBytes = new Uint8Array(pubKeyHashBuffer);
+    const nonceHex = (teeAttestation.nonce || nonce).replace(/^0x/i, "");
+    const nonceBytes = new Uint8Array(nonceHex.length / 2);
+    for (let i = 0; i < nonceBytes.length; i++) nonceBytes[i] = parseInt(nonceHex.substring(i * 2, i * 2 + 2), 16);
+    const workloadBytes = extractDigestBytes(teeAttestation.workload_digest);
+    const verifierBytes = extractDigestBytes(teeAttestation.verifier_digest);
+    const domainSep = new TextEncoder().encode("POPCORN_TEE_REPORT_DATA_V1");
+    const version = new Uint8Array([1]);
+    const payload = new Uint8Array(
+      domainSep.length + version.length + workloadBytes.length + verifierBytes.length + pubKeyHashBytes.length + nonceBytes.length
+    );
+    let offset = 0;
+    for (const chunk of [domainSep, version, workloadBytes, verifierBytes, pubKeyHashBytes, nonceBytes]) {
+      payload.set(chunk, offset);
+      offset += chunk.length;
+    }
+    const hashBuffer = yield cryptoSubtle.digest("SHA-256", payload);
+    const hashHex = arrayBufferToHex(hashBuffer);
+    const expected64ByteHex = hashHex + hashHex;
+    if (report.reportData !== expected64ByteHex) {
+      throw new Error(`REPORT_DATA Mismatch! Hardware report is not bound to these image digests or nonce.
+Expected: ${expected64ByteHex}
+Got:      ${report.reportData}`);
+    }
   });
 }
 
 // src/Reclaim.ts
-var logger8 = logger_default.logger;
+var logger10 = logger_default.logger;
 var sdkVersion = require_package().version;
-function verifyProof(proofOrProofs, config) {
+function verifyProof(proofOrProofs, config, verifyTEE) {
   return __async(this, null, function* () {
+    const proofs = Array.isArray(proofOrProofs) ? proofOrProofs : [proofOrProofs];
     try {
-      const proofs = Array.isArray(proofOrProofs) ? proofOrProofs : [proofOrProofs];
       if (proofs.length === 0) {
         throw new ProofNotValidatedError("No proofs provided");
       }
@@ -1423,14 +2334,57 @@ function verifyProof(proofOrProofs, config) {
       for (const proof of proofs) {
         yield assertVerifiedProof(proof, attestors);
       }
-      assertValidateProof(proofs, config);
-      return true;
+      yield assertValidateProof(proofs, config);
+      const result = {
+        isVerified: true,
+        data: proofs.map(extractProofData)
+      };
+      if (verifyTEE) {
+        const hasTeeData = proofs.every((proof) => proof.teeAttestation || JSON.parse(proof.claimData.context).attestationNonce);
+        if (!hasTeeData) {
+          logger10.error("TEE verification requested but one or more proofs are missing TEE attestation data");
+          result.isTeeVerified = false;
+          result.isVerified = false;
+          return result;
+        }
+        try {
+          const teeResults = yield Promise.all(proofs.map((proof) => verifyTeeAttestation(proof)));
+          result.isTeeVerified = teeResults.every((r) => r === true);
+          if (!result.isTeeVerified) {
+            logger10.error("TEE attestation verification failed for one or more proofs");
+          }
+          result.isVerified = result.isVerified && result.isTeeVerified;
+        } catch (error) {
+          logger10.error("Error verifying TEE attestation:", error);
+          result.isTeeVerified = false;
+          result.isVerified = false;
+        }
+      }
+      return result;
     } catch (error) {
-      logger8.error("Error in validating proof:", error);
-      return false;
+      logger10.error("Error in validating proof:", error);
+      return {
+        isVerified: false,
+        data: []
+      };
     }
   });
 }
+function extractProofData(proof) {
+  try {
+    const context = JSON.parse(proof.claimData.context);
+    const _a = context, { extractedParameters } = _a, rest = __objRest(_a, ["extractedParameters"]);
+    return {
+      context: rest,
+      extractedParameters: extractedParameters != null ? extractedParameters : {}
+    };
+  } catch (e) {
+    return {
+      context: {},
+      extractedParameters: {}
+    };
+  }
+}
 function transformForOnchain(proof) {
   const claimInfoBuilder = /* @__PURE__ */ new Map([
     ["context", proof.claimData.context],
@@ -1529,7 +2483,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       };
       return templateData;
     };
-    var _a, _b;
+    var _a, _b, _c;
     this.providerId = providerId;
     this.timeStamp = Date.now().toString();
     this.applicationId = applicationId;
@@ -1546,34 +2500,38 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       logger_default.setLogLevel("silent");
     }
     if (options.useAppClip === void 0) {
-      options.useAppClip = true;
+      options.useAppClip = false;
     }
+    this.customSharePageUrl = (_c = (_b = options.portalUrl) != null ? _b : options.customSharePageUrl) != null ? _c : "https://portal.reclaimprotocol.org";
+    options.customSharePageUrl = this.customSharePageUrl;
     if (options == null ? void 0 : options.envUrl) {
       setBackendBaseUrl(options.envUrl);
-    } else if ((_b = options == null ? void 0 : options.customSharePageUrl) == null ? void 0 : _b.includes("eu.portal.reclaimprotocol.org")) {
-      setBackendBaseUrl("https://eu.api.reclaimprotocol.org");
+    } else if (this.customSharePageUrl) {
+      try {
+        if (new URL(this.customSharePageUrl).hostname === "eu.portal.reclaimprotocol.org") {
+          setBackendBaseUrl("https://eu.api.reclaimprotocol.org");
+        }
+      } catch (e) {
+      }
     }
     if (options.extensionID) {
       this.extensionID = options.extensionID;
     }
-    if (options == null ? void 0 : options.customSharePageUrl) {
-      this.customSharePageUrl = options.customSharePageUrl;
-    }
     if (options == null ? void 0 : options.customAppClipUrl) {
       this.customAppClipUrl = options.customAppClipUrl;
     }
     this.options = options;
     this.sdkVersion = "js-" + sdkVersion;
-    logger8.info(`Initializing client with applicationId: ${this.applicationId}`);
+    logger10.info(`Initializing client with applicationId: ${this.applicationId}`);
   }
   /**
-   * Initializes a new Reclaim proof request instance with automatic signature generation and session creation
+   * Initializes a new Reclaim proof request instance with automatic signature generation and session creation.
    *
    * @param applicationId - Your Reclaim application ID
    * @param appSecret - Your application secret key for signing requests
    * @param providerId - The ID of the provider to use for proof generation
    * @param options - Optional configuration options for the proof request
-   * @returns Promise<ReclaimProofRequest> - A fully initialized proof request instance
+   * @returns A fully initialized proof request instance
    * @throws {InitError} When initialization fails due to invalid parameters or session creation errors
    *
    * @example
@@ -1582,7 +2540,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
    *   'your-app-id',
    *   'your-app-secret',
    *   'provider-id',
-   *   { log: true, acceptAiProviders: true }
+   *   { portalUrl: 'https://portal.reclaimprotocol.org', log: true }
    * );
    * ```
    */
@@ -1635,6 +2593,11 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
               { paramName: "envUrl", input: options.envUrl, isString: true }
             ], "the constructor");
           }
+          if (options.portalUrl) {
+            validateFunctionParams([
+              { paramName: "portalUrl", input: options.portalUrl, isString: true }
+            ], "the constructor");
+          }
           if (options.customSharePageUrl) {
             validateFunctionParams([
               { paramName: "customSharePageUrl", input: options.customSharePageUrl, isString: true }
@@ -1657,7 +2620,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
                   Intl.getCanonicalLocales(options.preferredLocale);
                   return true;
                 } catch (error) {
-                  logger8.info("Failed to canonicalize locale", error);
+                  logger10.info("Failed to canonicalize locale", error);
                   return false;
                 }
               }
@@ -1671,10 +2634,21 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         proofRequestInstance.sessionId = data.sessionId;
         proofRequestInstance.resolvedProviderVersion = data.resolvedProviderVersion;
         proofRequestInstance.context.reclaimSessionId = data.sessionId;
+        if (options == null ? void 0 : options.acceptTeeAttestation) {
+          const wallet = new import_ethers5.ethers.Wallet(appSecret);
+          const nonceData = `${applicationId}:${data.sessionId}:${proofRequestInstance.timeStamp}`;
+          const nonceMsg = import_ethers5.ethers.getBytes(import_ethers5.ethers.keccak256(new TextEncoder().encode(nonceData)));
+          const nonceSignature = yield wallet.signMessage(nonceMsg);
+          proofRequestInstance.setAttestationContext(nonceSignature, {
+            applicationId,
+            sessionId: data.sessionId,
+            timestamp: proofRequestInstance.timeStamp
+          });
+        }
         return proofRequestInstance;
       } catch (error) {
         console.error(error);
-        logger8.info("Failed to initialize ReclaimProofRequest", error);
+        logger10.info("Failed to initialize ReclaimProofRequest", error);
         throw new InitError("Failed to initialize ReclaimProofRequest", error);
       }
     });
@@ -1791,7 +2765,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
                 Intl.getCanonicalLocales(options.preferredLocale);
                 return true;
               } catch (error) {
-                logger8.info("Failed to canonicalize locale", error);
+                logger10.info("Failed to canonicalize locale", error);
                 return false;
               }
             }
@@ -1800,6 +2774,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         const proofRequestInstance = new _ReclaimProofRequest(applicationId, providerId, options);
         proofRequestInstance.sessionId = sessionId;
         proofRequestInstance.context = context;
+        proofRequestInstance.setAttestationContext(context == null ? void 0 : context.attestationNonce, context == null ? void 0 : context.attestationNonceData);
         proofRequestInstance.parameters = parameters;
         proofRequestInstance.appCallbackUrl = appCallbackUrl;
         proofRequestInstance.redirectUrl = redirectUrl;
@@ -1815,7 +2790,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         proofRequestInstance.cancelRedirectUrlOptions = cancelRedirectUrlOptions;
         return proofRequestInstance;
       } catch (error) {
-        logger8.info("Failed to parse JSON string in fromJsonString:", error);
+        logger10.info("Failed to parse JSON string in fromJsonString:", error);
         throw new InvalidParamError("Invalid JSON string provided to fromJsonString");
       }
     });
@@ -1976,9 +2951,9 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     try {
       validateModalOptions(options, "setModalOptions");
       this.modalOptions = __spreadValues(__spreadValues({}, this.modalOptions), options);
-      logger8.info("Modal options set successfully");
+      logger10.info("Modal options set successfully");
     } catch (error) {
-      logger8.info("Error setting modal options:", error);
+      logger10.info("Error setting modal options:", error);
       throw new SetParamsError("Error setting modal options", error);
     }
   }
@@ -2006,8 +2981,9 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         { input: context, paramName: "context", isString: false }
       ], "setJsonContext");
       this.context = JSON.parse(canonicalStringify(__spreadProps(__spreadValues({}, context), { reclaimSessionId: this.sessionId })));
+      this.applyAttestationContext();
     } catch (error) {
-      logger8.info("Error setting context", error);
+      logger10.info("Error setting context", error);
       throw new SetContextError("Error setting context", error);
     }
   }
@@ -2037,8 +3013,9 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         { input: message, paramName: "message", isString: true }
       ], "setContext");
       this.context = { contextAddress: address, contextMessage: message, reclaimSessionId: this.sessionId };
+      this.applyAttestationContext();
     } catch (error) {
-      logger8.info("Error setting context", error);
+      logger10.info("Error setting context", error);
       throw new SetContextError("Error setting context", error);
     }
   }
@@ -2073,7 +3050,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       validateParameters(params);
       this.parameters = __spreadValues(__spreadValues({}, this.parameters), params);
     } catch (error) {
-      logger8.info("Error Setting Params:", error);
+      logger10.info("Error Setting Params:", error);
       throw new SetParamsError("Error setting params", error);
     }
   }
@@ -2097,7 +3074,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       validateFunctionParams([{ input: this.sessionId, paramName: "sessionId", isString: true }], "getAppCallbackUrl");
       return this.appCallbackUrl || `${constants.DEFAULT_RECLAIM_CALLBACK_URL}${this.sessionId}`;
     } catch (error) {
-      logger8.info("Error getting app callback url", error);
+      logger10.info("Error getting app callback url", error);
       throw new GetAppCallbackUrlError("Error getting app callback url", error);
     }
   }
@@ -2121,7 +3098,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       validateFunctionParams([{ input: this.sessionId, paramName: "sessionId", isString: true }], "getCancelCallbackUrl");
       return this.cancelCallbackUrl || `${constants.DEFAULT_RECLAIM_CANCEL_CALLBACK_URL}${this.sessionId}`;
     } catch (error) {
-      logger8.info("Error getting cancel callback url", error);
+      logger10.info("Error getting cancel callback url", error);
       throw new GetAppCallbackUrlError("Error getting cancel callback url", error);
     }
   }
@@ -2144,7 +3121,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       validateFunctionParams([{ input: this.sessionId, paramName: "sessionId", isString: true }], "getStatusUrl");
       return `${constants.DEFAULT_RECLAIM_STATUS_URL}${this.sessionId}`;
     } catch (error) {
-      logger8.info("Error fetching Status Url", error);
+      logger10.info("Error fetching Status Url", error);
       throw new GetStatusUrlError("Error fetching status url", error);
     }
   }
@@ -2174,25 +3151,25 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     try {
       validateFunctionParams([{ input: signature, paramName: "signature", isString: true }], "setSignature");
       this.signature = signature;
-      logger8.info(`Signature set successfully for applicationId: ${this.applicationId}`);
+      logger10.info(`Signature set successfully for applicationId: ${this.applicationId}`);
     } catch (error) {
-      logger8.info("Error setting signature", error);
+      logger10.info("Error setting signature", error);
       throw new SetSignatureError("Error setting signature", error);
     }
   }
   generateSignature(applicationSecret) {
     return __async(this, null, function* () {
       try {
-        const wallet = new import_ethers4.ethers.Wallet(applicationSecret);
+        const wallet = new import_ethers5.ethers.Wallet(applicationSecret);
         const canonicalData = (0, import_canonicalize3.default)({ providerId: this.providerId, timestamp: this.timeStamp });
         if (!canonicalData) {
           throw new SignatureGeneratingError("Failed to canonicalize data for signing.");
         }
-        const messageHash = import_ethers4.ethers.keccak256(new TextEncoder().encode(canonicalData));
-        return yield wallet.signMessage(import_ethers4.ethers.getBytes(messageHash));
+        const messageHash = import_ethers5.ethers.keccak256(new TextEncoder().encode(canonicalData));
+        return yield wallet.signMessage(import_ethers5.ethers.getBytes(messageHash));
       } catch (err) {
-        logger8.info(`Error generating proof request for applicationId: ${this.applicationId}, providerId: ${this.providerId}, signature: ${this.signature}, timeStamp: ${this.timeStamp}`, err);
-        throw new SignatureGeneratingError(`Error generating signature for applicationSecret: ${applicationSecret}`);
+        logger10.info(`Error generating proof request for applicationId: ${this.applicationId}, providerId: ${this.providerId}, timeStamp: ${this.timeStamp}`);
+        throw new SignatureGeneratingError(`Error generating signature for applicationId: ${this.applicationId}`);
       }
     });
   }
@@ -2202,12 +3179,25 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       this.intervals.delete(this.sessionId);
     }
   }
-  buildSharePageUrl(template) {
-    const baseUrl = "https://share.reclaimprotocol.org/verify";
-    if (this.customSharePageUrl) {
-      return `${this.customSharePageUrl}/?template=${template}`;
+  setAttestationContext(nonce, data) {
+    if (!nonce || !data) {
+      return;
     }
-    return `${baseUrl}/?template=${template}`;
+    this.attestationNonce = nonce;
+    this.attestationNonceData = data;
+    this.applyAttestationContext();
+  }
+  applyAttestationContext() {
+    if (!this.attestationNonce || !this.attestationNonceData) {
+      return;
+    }
+    this.context = __spreadProps(__spreadValues({}, this.context), {
+      attestationNonce: this.attestationNonce,
+      attestationNonceData: this.attestationNonceData
+    });
+  }
+  buildSharePageUrl(template) {
+    return `https://share.reclaimprotocol.org/verify/?template=${template}`;
   }
   /**
    * Exports the Reclaim proof verification request as a JSON string
@@ -2261,13 +3251,15 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     });
   }
   /**
-   * Generates and returns the request URL for proof verification
+   * Generates and returns the request URL for proof verification.
    *
-   * This URL can be shared with users to initiate the proof generation process.
-   * The URL format varies based on device type:
-   * - Mobile iOS: Returns App Clip URL (if useAppClip is enabled)
-   * - Mobile Android: Returns Instant App URL (if useAppClip is enabled)
-   * - Desktop/Other: Returns standard verification URL
+   * Defaults to portal mode. Pass `{ verificationMode: 'app' }` for native app flow URLs.
+   *
+   * - Portal mode (default): returns portal URL on all platforms
+   * - App mode: returns share page URL on all platforms
+   * - App mode + `useAppClip: true` on iOS: returns App Clip URL instead
+   *
+   * Falls back to `launchOptions` set at init time if not passed at call time.
    *
    * @param launchOptions - Optional launch configuration to override default behavior
    * @returns Promise<string> - The generated request URL
@@ -2275,59 +3267,58 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
    *
    * @example
    * ```typescript
-   * const requestUrl = await proofRequest.getRequestUrl();
-   * // Share this URL with users or display as QR code
+   * // Portal URL (default)
+   * const url = await proofRequest.getRequestUrl();
+   *
+   * // Native app flow URL
+   * const url = await proofRequest.getRequestUrl({ verificationMode: 'app' });
    * ```
    */
   getRequestUrl(launchOptions) {
     return __async(this, null, function* () {
       var _a, _b, _c;
       const options = launchOptions || ((_a = this.options) == null ? void 0 : _a.launchOptions) || {};
-      logger8.info("Creating Request Url");
+      const mode = (_b = options.verificationMode) != null ? _b : "portal";
+      logger10.info("Creating Request Url");
       if (!this.signature) {
         throw new SignatureNotFoundError("Signature is not set.");
       }
       try {
         const templateData = this.getTemplateData();
         yield updateSession(this.sessionId, "SESSION_STARTED" /* SESSION_STARTED */);
-        const deviceType = getDeviceType();
-        if (((_b = this.options) == null ? void 0 : _b.useAppClip) && deviceType === "mobile" /* MOBILE */) {
+        if (mode === "app") {
           let template = encodeURIComponent(JSON.stringify(templateData));
           template = replaceAll(template, "(", "%28");
           template = replaceAll(template, ")", "%29");
-          const isIos = getMobileDeviceType() === "ios" /* IOS */;
-          if (!isIos) {
-            let instantAppUrl = this.buildSharePageUrl(template);
-            const isDeferredDeeplinksFlowEnabled = (_c = options.canUseDeferredDeepLinksFlow) != null ? _c : false;
-            if (isDeferredDeeplinksFlowEnabled) {
-              instantAppUrl = instantAppUrl.replace("/verifier", "/link");
-            }
-            logger8.info("Instant App Url created successfully: " + instantAppUrl);
-            return instantAppUrl;
-          } else {
+          if (((_c = this.options) == null ? void 0 : _c.useAppClip) && getDeviceType() === "mobile" /* MOBILE */ && getMobileDeviceType() === "ios" /* IOS */) {
             const appClipUrl = this.customAppClipUrl ? `${this.customAppClipUrl}&template=${template}` : `https://appclip.apple.com/id?p=org.reclaimprotocol.app.clip&template=${template}`;
-            logger8.info("App Clip Url created successfully: " + appClipUrl);
+            logger10.info("App Clip Url created successfully: " + appClipUrl);
             return appClipUrl;
           }
-        } else {
-          const link = yield createLinkWithTemplateData(templateData, this.customSharePageUrl);
-          logger8.info("Request Url created successfully: " + link);
-          return link;
+          const sharePageUrl = yield createLinkWithTemplateData(templateData, "https://share.reclaimprotocol.org/verify");
+          logger10.info("Share page Url created successfully: " + sharePageUrl);
+          return sharePageUrl;
         }
+        const link = yield createLinkWithTemplateData(templateData, this.customSharePageUrl);
+        logger10.info("Request Url created successfully: " + link);
+        return link;
       } catch (error) {
-        logger8.info("Error creating Request Url:", error);
+        logger10.info("Error creating Request Url:", error);
         throw error;
       }
     });
   }
   /**
-   * Triggers the appropriate Reclaim verification flow based on device type and configuration
+   * Triggers the appropriate Reclaim verification flow based on device type and configuration.
+   *
+   * Defaults to portal mode (remote browser verification). Pass `{ verificationMode: 'app' }`
+   * for native app flow via the share page.
    *
-   * This method automatically detects the device type and initiates the optimal verification flow:
-   * - Desktop with browser extension: Triggers extension flow
-   * - Desktop without extension: Shows QR code modal
-   * - Mobile Android: Redirects to Instant App
-   * - Mobile iOS: Redirects to App Clip
+   * - Desktop: browser extension takes priority in both modes
+   * - Desktop portal mode (no extension): opens portal in new tab
+   * - Desktop app mode (no extension): shows QR code modal with share page URL
+   * - Mobile portal mode: opens portal in new tab
+   * - Mobile app mode: opens share page (or App Clip on iOS if `useAppClip` is `true`)
    *
    * @param launchOptions - Optional launch configuration to override default behavior
    * @returns Promise<void>
@@ -2335,45 +3326,95 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
    *
    * @example
    * ```typescript
+   * // Portal flow (default)
    * await proofRequest.triggerReclaimFlow();
-   * // The appropriate verification method will be triggered automatically
+   *
+   * // Native app flow
+   * await proofRequest.triggerReclaimFlow({ verificationMode: 'app' });
+   *
+   * // App Clip on iOS (requires useAppClip: true at init)
+   * const request = await ReclaimProofRequest.init(APP_ID, SECRET, PROVIDER, { useAppClip: true });
+   * await request.triggerReclaimFlow({ verificationMode: 'app' });
+   *
+   * // Can also set verificationMode at init time via launchOptions
+   * const request = await ReclaimProofRequest.init(APP_ID, SECRET, PROVIDER, {
+   *   launchOptions: { verificationMode: 'app' }
+   * });
+   * await request.triggerReclaimFlow(); // uses 'app' mode from init
    * ```
    */
   triggerReclaimFlow(launchOptions) {
     return __async(this, null, function* () {
-      var _a, _b;
+      var _a, _b, _c, _d, _e, _f;
       const options = launchOptions || ((_a = this.options) == null ? void 0 : _a.launchOptions) || {};
+      const mode = (_b = options.verificationMode) != null ? _b : "portal";
       if (!this.signature) {
         throw new SignatureNotFoundError("Signature is not set.");
       }
       try {
         const templateData = this.getTemplateData();
         this.templateData = templateData;
-        logger8.info("Triggering Reclaim flow");
+        logger10.info(`Triggering Reclaim flow (mode: ${mode})`);
         const deviceType = getDeviceType();
         updateSession(this.sessionId, "SESSION_STARTED" /* SESSION_STARTED */);
         if (deviceType === "desktop" /* DESKTOP */) {
           const extensionAvailable = yield this.isBrowserExtensionAvailable();
-          if (((_b = this.options) == null ? void 0 : _b.useBrowserExtension) && extensionAvailable) {
-            logger8.info("Triggering browser extension flow");
+          if (((_c = this.options) == null ? void 0 : _c.useBrowserExtension) && extensionAvailable) {
+            logger10.info("Triggering browser extension flow");
             this.triggerBrowserExtensionFlow();
             return;
+          }
+          if (mode === "portal") {
+            const portalUrl = (_d = this.customSharePageUrl) != null ? _d : "https://portal.reclaimprotocol.org";
+            const newTab = window.open("about:blank", "_blank");
+            const link = yield createLinkWithTemplateData(templateData, portalUrl);
+            logger10.info("Opening portal in new tab: " + link);
+            if (newTab) {
+              newTab.location = link;
+              setTimeout(() => {
+                try {
+                  if (newTab.location.href === "about:blank") {
+                    newTab.close();
+                    window.open(link, "_blank");
+                  }
+                } catch (_) {
+                }
+              }, 500);
+            }
           } else {
-            logger8.info("Browser extension not available, showing QR code modal");
-            yield this.showQRCodeModal();
+            logger10.info("Showing QR code modal with share page URL");
+            yield this.showQRCodeModal("app");
           }
         } else if (deviceType === "mobile" /* MOBILE */) {
-          const mobileDeviceType = getMobileDeviceType();
-          if (mobileDeviceType === "android" /* ANDROID */) {
-            logger8.info("Redirecting to Android instant app");
-            yield this.redirectToInstantApp(options);
-          } else if (mobileDeviceType === "ios" /* IOS */) {
-            logger8.info("Redirecting to iOS app clip");
-            this.redirectToAppClip();
+          if (mode === "app") {
+            if (((_e = this.options) == null ? void 0 : _e.useAppClip) && getMobileDeviceType() === "ios" /* IOS */) {
+              logger10.info("Redirecting to iOS app clip");
+              this.redirectToAppClip();
+            } else {
+              logger10.info("Redirecting to share page");
+              yield this.redirectToInstantApp(options);
+            }
+          } else {
+            const portalUrl = (_f = this.customSharePageUrl) != null ? _f : "https://portal.reclaimprotocol.org";
+            const newTab = window.open("about:blank", "_blank");
+            const link = yield createLinkWithTemplateData(templateData, portalUrl);
+            logger10.info("Opening portal on mobile: " + link);
+            if (newTab) {
+              newTab.location = link;
+              setTimeout(() => {
+                try {
+                  if (newTab.location.href === "about:blank") {
+                    newTab.close();
+                    window.open(link, "_blank");
+                  }
+                } catch (_) {
+                }
+              }, 500);
+            }
           }
         }
       } catch (error) {
-        logger8.info("Error triggering Reclaim flow:", error);
+        logger10.info("Error triggering Reclaim flow:", error);
         throw error;
       }
     });
@@ -2421,7 +3462,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
           window.postMessage(message, "*");
         });
       } catch (error) {
-        logger8.info("Error checking Reclaim extension installed:", error);
+        logger10.info("Error checking Reclaim extension installed:", error);
         return false;
       }
     });
@@ -2434,16 +3475,17 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       extensionID: this.extensionID
     };
     window.postMessage(message, "*");
-    logger8.info("Browser extension flow triggered");
+    logger10.info("Browser extension flow triggered");
   }
-  showQRCodeModal() {
+  showQRCodeModal(mode = "portal") {
     return __async(this, null, function* () {
       try {
-        const requestUrl = yield createLinkWithTemplateData(this.templateData, this.customSharePageUrl);
+        const url = mode === "app" ? "https://share.reclaimprotocol.org/verify" : this.customSharePageUrl;
+        const requestUrl = yield createLinkWithTemplateData(this.templateData, url);
         this.modal = new QRCodeModal(this.modalOptions);
         yield this.modal.show(requestUrl);
       } catch (error) {
-        logger8.info("Error showing QR code modal:", error);
+        logger10.info("Error showing QR code modal:", error);
         throw error;
       }
     });
@@ -2456,7 +3498,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         template = replaceAll(template, "(", "%28");
         template = replaceAll(template, ")", "%29");
         let instantAppUrl = this.buildSharePageUrl(template);
-        logger8.info("Redirecting to Android instant app: " + instantAppUrl);
+        logger10.info("Redirecting to Android instant app: " + instantAppUrl);
         const isDeferredDeeplinksFlowEnabled = (_a = options.canUseDeferredDeepLinksFlow) != null ? _a : false;
         if (isDeferredDeeplinksFlowEnabled) {
           instantAppUrl = instantAppUrl.replace("/verifier", "/link");
@@ -2506,7 +3548,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         }
         window.location.href = instantAppUrl;
       } catch (error) {
-        logger8.info("Error redirecting to instant app:", error);
+        logger10.info("Error redirecting to instant app:", error);
         throw error;
       }
     });
@@ -2517,29 +3559,49 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       template = replaceAll(template, "(", "%28");
       template = replaceAll(template, ")", "%29");
       const appClipUrl = this.customAppClipUrl ? `${this.customAppClipUrl}&template=${template}` : `https://appclip.apple.com/id?p=org.reclaimprotocol.app.clip&template=${template}`;
-      logger8.info("Redirecting to iOS app clip: " + appClipUrl);
+      logger10.info("Redirecting to iOS app clip: " + appClipUrl);
       const verifierUrl = `https://share.reclaimprotocol.org/verifier/?template=${template}`;
       window.location.href = appClipUrl;
       setTimeout(() => {
         window.location.href = verifierUrl;
       }, 5 * 1e3);
     } catch (error) {
-      logger8.info("Error redirecting to app clip:", error);
+      logger10.info("Error redirecting to app clip:", error);
       throw error;
     }
   }
+  /**
+   * Returns the provider id and exact version of the provider that was used in the verification session of this request. 
+   * 
+   * This can be provided as a config parameter to the `verifyProof` function to verify the proof.
+   * 
+   * See also:
+   * * `verifyProof()` - Verifies a proof against the expected provider configuration.
+   * * `getProviderHashRequirements()` - An alternative of this function to get the expected hashes for a provider version by providing providerId and exactProviderVersionString. The result can be provided in verifyProof function's `config` parameter for proof validation.
+   * * `getProviderHashRequirementsFromSpec()` - An alternative of this function to get the expected hashes from a provider spec. The result can be provided in verifyProof function's `config` parameter for proof validation.
+   */
+  getProviderVersion() {
+    var _a, _b;
+    const exactProviderVersionString = (_a = this.resolvedProviderVersion) != null ? _a : "";
+    return {
+      providerId: this.providerId,
+      providerVersion: exactProviderVersionString,
+      allowedTags: ((_b = this.options) == null ? void 0 : _b.acceptAiProviders) ? ["ai"] : []
+    };
+  }
   /**
    * Fetches the provider config that was used for this session and returns the hash requirements
    * 
    * See also:
+   * * `verifyProof()` - Verifies a proof against the expected provider configuration.
    * * `fetchProviderHashRequirementsBy()` - An alternative of this function to get the expected hashes for a provider version by providing providerId and exactProviderVersionString. The result can be provided in verifyProof function's `config` parameter for proof validation.
    * * `getProviderHashRequirementsFromSpec()` - An alternative of this function to get the expected hashes from a provider spec. The result can be provided in verifyProof function's `config` parameter for proof validation.
    *
-   * @returns A promise that resolves to a ProviderHashRequirementsConfig
+   * @returns A promise that resolves to a `ProviderHashRequirementsConfig` or `ProviderHashRequirementsConfig[]`
    */
-  getProviderHashRequirements() {
+  getProviderHashRequirements(proofs, allowedTags) {
     var _a;
-    return fetchProviderHashRequirementsBy(this.providerId, (_a = this.resolvedProviderVersion) != null ? _a : "");
+    return fetchProviderHashRequirementsBy(this.providerId, (_a = this.resolvedProviderVersion) != null ? _a : "", allowedTags, proofs);
   }
   /**
    * Starts the proof request session and monitors for proof submission
@@ -2581,16 +3643,16 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
    * ```
    */
   startSession(_0) {
-    return __async(this, arguments, function* ({ onSuccess, onError }) {
+    return __async(this, arguments, function* ({ onSuccess, onError, verificationConfig }) {
       if (!this.sessionId) {
         const message = "Session can't be started due to undefined value of sessionId";
-        logger8.info(message);
+        logger10.info(message);
         throw new SessionNotStartedError(message);
       }
-      logger8.info("Starting session");
+      logger10.info("Starting session");
       const sessionUpdatePollingInterval = 3 * 1e3;
       const interval = setInterval(() => __async(this, null, function* () {
-        var _a, _b, _c;
+        var _a, _b, _c, _d, _e;
         try {
           const statusUrlResponse = yield fetchStatusUrl(this.sessionId);
           if (!statusUrlResponse.session) return;
@@ -2602,7 +3664,8 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
             if (!this.lastFailureTime) {
               this.lastFailureTime = currentTime;
             } else if (currentTime - this.lastFailureTime >= this.FAILURE_TIMEOUT) {
-              throw new ProviderFailedError("Proof generation failed - timeout reached");
+              const errorMessage = ((_a = statusUrlResponse.session.error) == null ? void 0 : _a.message) || "Proof generation failed - timeout reached";
+              throw new ProviderFailedError(errorMessage);
             }
             return;
           }
@@ -2614,9 +3677,9 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
             if (statusUrlResponse.session.proofs && statusUrlResponse.session.proofs.length > 0) {
               const proofs = statusUrlResponse.session.proofs;
               if (this.claimCreationType === "createClaim" /* STANDALONE */) {
-                const verified = yield verifyProof(proofs, yield this.getProviderHashRequirements());
+                const { isVerified: verified } = yield verifyProof(proofs, this.getProviderVersion());
                 if (!verified) {
-                  logger8.info(`Proofs not verified: ${JSON.stringify(proofs)}`);
+                  logger10.info(`Proofs not verified: count=${proofs == null ? void 0 : proofs.length}`);
                   throw new ProofNotVerifiedError();
                 }
               }
@@ -2626,18 +3689,19 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
                 onSuccess(proofs);
               }
               this.clearInterval();
-              (_a = this.modal) == null ? void 0 : _a.close();
+              (_b = this.modal) == null ? void 0 : _b.close();
             }
           } else {
             if (statusUrlResponse.session.statusV2 === "PROOF_SUBMISSION_FAILED" /* PROOF_SUBMISSION_FAILED */) {
-              throw new ProofSubmissionFailedError();
+              const errorMessage = ((_c = statusUrlResponse.session.error) == null ? void 0 : _c.message) || "Proof submission failed";
+              throw new ProofSubmissionFailedError(errorMessage);
             }
             if (statusUrlResponse.session.statusV2 === "PROOF_SUBMITTED" /* PROOF_SUBMITTED */ || statusUrlResponse.session.statusV2 === "AI_PROOF_SUBMITTED" /* AI_PROOF_SUBMITTED */) {
               if (onSuccess) {
                 onSuccess([]);
               }
               this.clearInterval();
-              (_b = this.modal) == null ? void 0 : _b.close();
+              (_d = this.modal) == null ? void 0 : _d.close();
             }
           }
         } catch (e) {
@@ -2645,7 +3709,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
             onError(e);
           }
           this.clearInterval();
-          (_c = this.modal) == null ? void 0 : _c.close();
+          (_e = this.modal) == null ? void 0 : _e.close();
         }
       }), sessionUpdatePollingInterval);
       this.intervals.set(this.sessionId, interval);
@@ -2667,7 +3731,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
   closeModal() {
     if (this.modal) {
       this.modal.close();
-      logger8.info("Modal closed by user");
+      logger10.info("Modal closed by user");
     }
   }
   /**
@@ -2693,9 +3757,10 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
   assertVerifiedProof,
   clearDeviceCache,
   createLinkWithTemplateData,
-  fetchProviderConfig,
+  fetchProviderConfigs,
   fetchProviderHashRequirementsBy,
   fetchStatusUrl,
+  generateSpecsFromRequestSpecTemplate,
   getAttestors,
   getDeviceType,
   getHttpProviderClaimParamsFromProof,
@@ -2708,8 +3773,11 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
   isHttpProviderClaimParams,
   isMobileDevice,
   recoverSignersOfSignedClaim,
+  takePairsWhereValueIsArray,
+  takeTemplateParametersFromProofs,
   transformForOnchain,
   updateSession,
-  verifyProof
+  verifyProof,
+  verifyTeeAttestation
 });
 //# sourceMappingURL=index.js.map