@reclaimprotocol/js-sdk 5.4.0 → 5.4.1

package/dist/index.js

@@ -84,7 +84,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@reclaimprotocol/js-sdk",
-      version: "5.4.0",
+      version: "5.4.1",
       description: "Designed to request proofs from the Reclaim protocol and manage the flow of claims and witness interactions.",
       main: "dist/index.js",
       types: "dist/index.d.ts",
@@ -227,6 +227,7 @@ __export(index_exports, {
   takeTemplateParametersFromProofs: () => takeTemplateParametersFromProofs,
   transformForOnchain: () => transformForOnchain,
   updateSession: () => updateSession,
+  verifyAttestorTeeAttestation: () => verifyAttestorTeeAttestation,
   verifyProof: () => verifyProof,
   verifyTeeAttestation: () => verifyTeeAttestation
 });
@@ -241,7 +242,7 @@ var RECLAIM_EXTENSION_ACTIONS = {
 };
 
 // src/Reclaim.ts
-var import_ethers6 = require("ethers");
+var import_ethers7 = require("ethers");
 var import_canonicalize3 = __toESM(require("canonicalize"));
 
 // src/utils/errors.ts
@@ -289,6 +290,7 @@ var ProofSubmissionFailedError = createErrorClass("ProofSubmissionFailedError");
 var ErrorDuringVerificationError = createErrorClass("ErrorDuringVerificationError");
 var CallbackUrlRequiredError = createErrorClass("CallbackUrlRequiredError");
 var TeeVerificationError = createErrorClass("TeeVerificationError");
+var AttestorTeeVerificationError = createErrorClass("AttestorTeeVerificationError");
 
 // src/utils/logger.ts
 var SimpleLogger = class {
@@ -563,19 +565,21 @@ function scheduleIntervalEndingTask(sessionId, intervals, onFailureCallback, tim
     }
   }, timeout);
 }
-var createVerifyProofResultSuccess = (proofs, isTeeAttestationVerified) => {
+var createVerifyProofResultSuccess = (proofs, isTeeAttestationVerified, isAttestorTeeAttestationVerified) => {
   return {
     isVerified: true,
     isTeeAttestationVerified,
+    isAttestorTeeAttestationVerified,
     error: void 0,
     data: proofs.map(createTrustedDataFromProofData),
     publicData: getPublicDataFromProofs(proofs)
   };
 };
-var createVerifyProofResultFailure = (error, isTeeAttestationVerified) => {
+var createVerifyProofResultFailure = (error, isTeeAttestationVerified, isAttestorTeeAttestationVerified) => {
   return {
     isVerified: false,
     isTeeAttestationVerified,
+    isAttestorTeeAttestationVerified,
     error,
     data: [],
     publicData: []
@@ -651,6 +655,43 @@ var constants = {
   // Chrome extension URL for Reclaim Protocol
   CHROME_EXTENSION_URL: "https://chromewebstore.google.com/detail/reclaim-extension/oafieibbbcepkmenknelhmgaoahamdeh"
 };
+var GCP_CONFIDENTIAL_SPACE_ROOT_CA = `-----BEGIN CERTIFICATE-----
+MIIGCDCCA/CgAwIBAgITYBvRy5g9aYYMh7tJS7pFwafL6jANBgkqhkiG9w0BAQsF
+ADCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcT
+DU1vdW50YWluIFZpZXcxEzARBgNVBAoTCkdvb2dsZSBMTEMxFTATBgNVBAsTDEdv
+b2dsZSBDbG91ZDEjMCEGA1UEAxMaQ29uZmlkZW50aWFsIFNwYWNlIFJvb3QgQ0Ew
+HhcNMjQwMTE5MjIxMDUwWhcNMzQwMTE2MjIxMDQ5WjCBizELMAkGA1UEBhMCVVMx
+EzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxEzAR
+BgNVBAoTCkdvb2dsZSBMTEMxFTATBgNVBAsTDEdvb2dsZSBDbG91ZDEjMCEGA1UE
+AxMaQ29uZmlkZW50aWFsIFNwYWNlIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUA
+A4ICDwAwggIKAoICAQCvRuZasczAqhMZe1ODHJ6MFLX8EYVV+RN7xiO9GpuA53iz
+l9Oxgp3NXik3FbYn+7bcIkMMSQpCr6K0jbSQCZT6d5P5PJT5DpNGYjLHkW67/fl+
+Bu7eSMb0qRCa1jS+3OhNK7t7SIaHm1XdmSRghjwoglKRuk3CGrF4Zia9RcE/p2MU
+69GyJZpqHYwTplNr3x4zF+2nJk86GywDP+sGwSPWfcmqY04VQD7ZPDEZZ/qgzdoL
+5ilE92eQnAsy+6m6LxBEHHVcFpfDtNVUIt2VMCWLBeOKUQcn5js756xblInqw/Qt
+QRR0An0yfRjBuGvmMjAwETDo5ETY/fc+nbQVYJzNQTc9EOpFFWPpw/ZjFcN9Amnd
+dxYUETFXPmBYerMez0LKNtGpfKYHHhMMTI3mj0m/V9fCbfh2YbBUnMS2Swd20YSI
+Mi/HiGaqOpGUqXMeQVw7phGTS3QYK8ZM65sC/QhIQzXdsiLDgFBitVnlIu3lIv6C
+uiHvXeSJBRlRxQ8Vu+t6J7hBdl0etWBKAu9Vti46af5cjC03dspkHR3MAUGcrLWE
+TkQ0msQAKvIAlwyQRLuQOI5D6pF+6af1Nbl+vR7sLCbDWdMqm1E9X6KyFKd6e3rn
+E9O4dkFJp35WvR2gqIAkUoa+Vq1MXLFYG4imanZKH0igrIblbawRCr3Gr24FXQID
+AQABo2MwYTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
+FgQUF+fBOE6Th1snpKuvIb6S8/mtPL4wHwYDVR0jBBgwFoAUF+fBOE6Th1snpKuv
+Ib6S8/mtPL4wDQYJKoZIhvcNAQELBQADggIBAGtCuV5eHxWcffylK9GPumaD6Yjd
+cs76KDBe3mky5ItBIrEOeZq3z47zM4dbKZHhFuoq4yAaO1MyApnG0w9wIQLBDndI
+ovtkw6j9/64aqPWpNaoB5MB0SahCUCgI83Dx9SRqGmjPI/MTMfwDLdE5EF9gFmVI
+oH62YnG2aa/sc6m/8wIK8WtTJazEI16/8GPG4ZUhwT6aR3IGGnEBPMbMd5VZQ0Hw
+VbHBKWK3UykaSCxnEg8uaNx/rhNaOWuWtos4qL00dYyGV7ZXg4fpAq7244QUgkWV
+AtVcU2SPBjDd30OFHASnenDHRzQdOtHaxLp4a4WaY3jb2V6Sn3LfE8zSy6GevxmN
+COIWW3xnPF8rwKz4ABEPqECe37zzu3W1nzZAFtdkhPBNnlWYkIusTMtU+8v6EPKp
+GIIRphpaDhtGPJQukpENOfk2728lenPycRfjxwA96UKWq0dKZC45MwBEK9Jngn8Q
+cPmpPmx7pSMkSxEX2Vos2JNaNmCKJd2VaXz8M6F2cxscRdh9TbAYAjGEEjE1nLUH
+2YHDS8Y7xYNFIDSFaJAlqGcCUbzjGhrwHGj4voTe9ZvlmngrcA/ptSuBidvsnRDw
+kNPLowCd0NqxYYSLNL7GroYCFPxoBpr+++4vsCaXalbs8iJxdU2EPqG4MB4xWKYg
+uyT5CnJulxSC5CT1
+-----END CERTIFICATE-----`;
+var ATTESTOR_NONCE_PATTERN = /^attestor_public_key:0x([0-9a-fA-F]{40})$/;
+var GCP_CONFIDENTIAL_SPACE_ISSUER = "https://confidentialcomputing.googleapis.com";
 
 // src/utils/fetch.ts
 var import_fetch_retry = __toESM(require("fetch-retry"));
@@ -1692,7 +1733,6 @@ function assertValidateProof(proofs, config) {
 // src/utils/verifyTee.ts
 var import_ethers5 = require("ethers");
 var logger9 = logger_default.logger;
-var EXPECTED_ISSUER = "https://confidentialcomputing.googleapis.com";
 var EXPECTED_HW_MODEL = "GCP_AMD_SEV";
 var EXPECTED_TEE_PROVIDER = "gcp";
 var EXPECTED_TEE_TECHNOLOGY = "amd-sev";
@@ -1979,8 +2019,8 @@ ${teeAttestation.verifier.image_digest}`
 function verifyGcpClaims(teeAttestation, expectedNonce) {
   return __async(this, null, function* () {
     var _a;
-    const claims = yield verifyJwtSignature(teeAttestation.attestation.token, EXPECTED_ISSUER);
-    assert(claims.iss === EXPECTED_ISSUER, `unexpected issuer: ${claims.iss}`);
+    const claims = yield verifyJwtSignature(teeAttestation.attestation.token, GCP_CONFIDENTIAL_SPACE_ISSUER);
+    assert(claims.iss === GCP_CONFIDENTIAL_SPACE_ISSUER, `unexpected issuer: ${claims.iss}`);
     assertAudienceClaim(claims.aud);
     assert(Array.isArray(claims.eat_nonce), "eat_nonce claim missing");
     const digestBinding = yield computeDigestBinding(teeAttestation);
@@ -2047,8 +2087,225 @@ function runTeeVerification(proofs, config) {
   });
 }
 
-// src/Reclaim.ts
+// src/utils/verifyAttestorTee.ts
+var import_crypto = __toESM(require("crypto"));
+var import_ethers6 = require("ethers");
 var logger10 = logger_default.logger;
+var BROWSER_ENVIRONMENT_ERROR2 = "Attestor TEE attestation verification is only supported in non-browser environments. Run verifyAttestorTeeAttestation on your server or API route.";
+function isBrowserEnvironment2() {
+  if (typeof window !== "undefined" || typeof document !== "undefined") {
+    return true;
+  }
+  if (typeof navigator !== "undefined" && typeof process === "undefined") {
+    return true;
+  }
+  const workerGlobalScope = globalThis.WorkerGlobalScope;
+  if (typeof workerGlobalScope !== "undefined" && typeof self !== "undefined" && self instanceof workerGlobalScope) {
+    return true;
+  }
+  return false;
+}
+function assertNonBrowserEnvironment2() {
+  if (isBrowserEnvironment2()) {
+    throw new Error(BROWSER_ENVIRONMENT_ERROR2);
+  }
+}
+var TOKEN_CLOCK_SKEW_S2 = 60;
+function decodeBase64Url2(input) {
+  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+  return Buffer.from(padded, "base64");
+}
+function normalizeAddress(address) {
+  return address.trim().toLowerCase().replace(/^0x/, "");
+}
+function verifyX5cChain(x5cChain) {
+  if (!x5cChain || x5cChain.length === 0) {
+    throw new Error("Empty x5c certificate chain");
+  }
+  const certs = x5cChain.map(
+    (b64) => new import_crypto.X509Certificate(`-----BEGIN CERTIFICATE-----
+${b64}
+-----END CERTIFICATE-----`)
+  );
+  const root = new import_crypto.X509Certificate(GCP_CONFIDENTIAL_SPACE_ROOT_CA);
+  for (let i = 0; i < certs.length - 1; i++) {
+    if (!certs[i].verify(certs[i + 1].publicKey)) {
+      throw new Error(`Certificate chain verification failed at level ${i}`);
+    }
+  }
+  const top = certs[certs.length - 1];
+  if (!top.verify(root.publicKey)) {
+    throw new Error("Certificate chain does not root to GCP Confidential Space Root CA");
+  }
+  return certs[0].publicKey;
+}
+function verifyAttestorTeeAttestation(report, expectedAttestorAddress) {
+  return __async(this, null, function* () {
+    var _a, _b, _c, _d, _e;
+    try {
+      assertNonBrowserEnvironment2();
+      if (!report || typeof report !== "string") {
+        throw new Error("attestation report is empty or not a string");
+      }
+      if (!expectedAttestorAddress || typeof expectedAttestorAddress !== "string") {
+        throw new Error("expectedAttestorAddress is required");
+      }
+      const parts = report.split(".");
+      if (parts.length !== 3) {
+        throw new Error("attestation report is not a JWT (expected 3 parts)");
+      }
+      const [headerB64, payloadB64, signatureB64] = parts;
+      const header = JSON.parse(decodeBase64Url2(headerB64).toString("utf8"));
+      const payload = JSON.parse(decodeBase64Url2(payloadB64).toString("utf8"));
+      if (header.alg !== "RS256") {
+        throw new Error(`unexpected signing algorithm: ${header.alg}`);
+      }
+      if (!Array.isArray(header.x5c) || header.x5c.length === 0) {
+        throw new Error("attestation report is missing x5c certificate chain");
+      }
+      if (payload.iss !== GCP_CONFIDENTIAL_SPACE_ISSUER) {
+        throw new Error(`unexpected issuer: ${payload.iss}`);
+      }
+      const now = Math.floor(Date.now() / 1e3);
+      if (typeof payload.nbf === "number" && now + TOKEN_CLOCK_SKEW_S2 < payload.nbf) {
+        throw new Error(`attestation not yet valid (nbf=${payload.nbf})`);
+      }
+      if (typeof payload.exp === "number" && now - TOKEN_CLOCK_SKEW_S2 > payload.exp) {
+        throw new Error(`attestation expired (exp=${payload.exp})`);
+      }
+      if (typeof payload.iat === "number" && payload.iat > now + TOKEN_CLOCK_SKEW_S2) {
+        throw new Error(`attestation issued in future (iat=${payload.iat})`);
+      }
+      const publicKey = verifyX5cChain(header.x5c);
+      const verifier = import_crypto.default.createVerify("RSA-SHA256");
+      verifier.update(`${headerB64}.${payloadB64}`);
+      if (!verifier.verify(publicKey, new Uint8Array(decodeBase64Url2(signatureB64)))) {
+        throw new Error("attestation signature verification failed");
+      }
+      if (!payload.eat_nonce) {
+        throw new Error("eat_nonce claim is missing");
+      }
+      const nonces = Array.isArray(payload.eat_nonce) ? payload.eat_nonce : [payload.eat_nonce];
+      let attestedAddress;
+      for (const n of nonces) {
+        const m = typeof n === "string" ? n.match(ATTESTOR_NONCE_PATTERN) : null;
+        if (m) {
+          attestedAddress = m[1];
+          break;
+        }
+      }
+      if (!attestedAddress) {
+        throw new Error(
+          `attestor_public_key nonce not found in eat_nonce: ${JSON.stringify(payload.eat_nonce)}`
+        );
+      }
+      if (normalizeAddress(attestedAddress) !== normalizeAddress(expectedAttestorAddress)) {
+        throw new Error(
+          `attestor address mismatch: attestation binds to 0x${attestedAddress.toLowerCase()}, expected ${expectedAttestorAddress}`
+        );
+      }
+      const imageDigest = (_e = (_b = (_a = payload.submods) == null ? void 0 : _a.container) == null ? void 0 : _b.image_digest) != null ? _e : (_d = (_c = payload.google) == null ? void 0 : _c.compute_engine) == null ? void 0 : _d.image_digest;
+      return { isVerified: true, imageDigest };
+    } catch (error) {
+      return {
+        isVerified: false,
+        error: error instanceof Error ? error.message : String(error)
+      };
+    }
+  });
+}
+function normalizeAttestorAddress(address) {
+  return address.trim().toLowerCase();
+}
+function normalizeSignature(sig) {
+  return sig.trim().toLowerCase();
+}
+function verifyAttestorTeeForProof(proof, config) {
+  return __async(this, null, function* () {
+    var _a;
+    if (!proof.witnesses || proof.witnesses.length === 0) {
+      throw new AttestorTeeVerificationError("Proof has no witnesses");
+    }
+    const expectedDigests = (_a = config.expectedImageDigests) == null ? void 0 : _a.map((d) => d.trim());
+    const proofSignatures = new Set((proof.signatures || []).map(normalizeSignature));
+    const claimSignData = createSignDataForClaim(proof.claimData);
+    for (const witness of proof.witnesses) {
+      const att = witness.claimAttestation;
+      if (!att) {
+        throw new AttestorTeeVerificationError(
+          `Witness ${witness.id} is missing claimAttestation`
+        );
+      }
+      if (normalizeAttestorAddress(att.attestor_address) !== normalizeAttestorAddress(witness.id)) {
+        throw new AttestorTeeVerificationError(
+          `claimAttestation.attestor_address ${att.attestor_address} does not match witness id ${witness.id}`
+        );
+      }
+      if (!proofSignatures.has(normalizeSignature(att.claim_signature))) {
+        throw new AttestorTeeVerificationError(
+          `claimAttestation.claim_signature for witness ${witness.id} is not present in proof.signatures`
+        );
+      }
+      let recoveredSigner;
+      try {
+        recoveredSigner = import_ethers6.ethers.verifyMessage(claimSignData, att.claim_signature);
+      } catch (error) {
+        throw new AttestorTeeVerificationError(
+          `Failed to recover signer from claimAttestation.claim_signature for witness ${witness.id}`,
+          error
+        );
+      }
+      if (normalizeAttestorAddress(recoveredSigner) !== normalizeAttestorAddress(witness.id)) {
+        throw new AttestorTeeVerificationError(
+          `claim_signature recovers to ${recoveredSigner}, expected attestor ${witness.id}`
+        );
+      }
+      const result = yield verifyAttestorTeeAttestation(att.attestation_report, witness.id);
+      if (!result.isVerified) {
+        throw new AttestorTeeVerificationError(
+          `Attestor TEE attestation verification failed for witness ${witness.id}: ${result.error}`
+        );
+      }
+      if (expectedDigests && expectedDigests.length > 0) {
+        if (!result.imageDigest) {
+          throw new AttestorTeeVerificationError(
+            `Attestor TEE attestation for witness ${witness.id} did not expose an image digest to check against expectedImageDigests`
+          );
+        }
+        if (!expectedDigests.includes(result.imageDigest)) {
+          throw new AttestorTeeVerificationError(
+            `Attestor image digest ${result.imageDigest} for witness ${witness.id} is not in expectedImageDigests`
+          );
+        }
+      }
+    }
+  });
+}
+function runAttestorTeeVerification(_0) {
+  return __async(this, arguments, function* (proofs, config = {}) {
+    if (!proofs || proofs.length === 0) {
+      throw new AttestorTeeVerificationError("No proofs provided for attestor TEE verification");
+    }
+    try {
+      for (const proof of proofs) {
+        yield verifyAttestorTeeForProof(proof, config);
+      }
+    } catch (error) {
+      logger10.error("Attestor TEE attestation verification failed:", error);
+      if (error instanceof AttestorTeeVerificationError) {
+        throw error;
+      }
+      throw new AttestorTeeVerificationError(
+        "Attestor TEE attestation verification failed",
+        error
+      );
+    }
+  });
+}
+
+// src/Reclaim.ts
+var logger11 = logger_default.logger;
 var sdkVersion = require_package().version;
 var SDK_TEE_ATTESTATION_VERSION = "v3";
 function verifyProof(proofOrProofs, config) {
@@ -2067,16 +2324,21 @@ function verifyProof(proofOrProofs, config) {
       }
       yield assertValidateProof(proofs, config);
       let isTeeAttestationVerified;
+      let isAttestorTeeAttestationVerified;
       if (config.teeAttestation && "dangerouslyDisableContentValidation" in config && config.dangerouslyDisableContentValidation) {
-        logger10.warn("teeAttestation is enabled but content validation is disabled \u2014 TEE attestation alone does not guarantee proof contents are valid");
+        logger11.warn("teeAttestation is enabled but content validation is disabled \u2014 TEE attestation alone does not guarantee proof contents are valid");
       }
       if (config.teeAttestation) {
         yield runTeeVerification(proofs, config.teeAttestation);
         isTeeAttestationVerified = true;
       }
-      return createVerifyProofResultSuccess(proofs, isTeeAttestationVerified);
+      if (config.attestorTeeAttestation) {
+        yield runAttestorTeeVerification(proofs, config.attestorTeeAttestation);
+        isAttestorTeeAttestationVerified = true;
+      }
+      return createVerifyProofResultSuccess(proofs, isTeeAttestationVerified, isAttestorTeeAttestationVerified);
     } catch (error) {
-      logger10.error("Error in validating proof:", error);
+      logger11.error("Error in validating proof:", error);
       const _error = error instanceof Error ? error : new Error(String(error));
       return createVerifyProofResultFailure(_error);
     }
@@ -2226,7 +2488,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     }
     this.options = options;
     this.sdkVersion = "js-" + sdkVersion;
-    logger10.info(`Initializing client with applicationId: ${this.applicationId}`);
+    logger11.info(`Initializing client with applicationId: ${this.applicationId}`);
   }
   /**
    * Initializes a new Reclaim proof request instance with automatic signature generation and session creation.
@@ -2285,7 +2547,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         return proofRequestInstance;
       } catch (error) {
         console.error(error);
-        logger10.info("Failed to initialize ReclaimProofRequest", error);
+        logger11.info("Failed to initialize ReclaimProofRequest", error);
         throw new InitError("Failed to initialize ReclaimProofRequest", error);
       }
     });
@@ -2374,7 +2636,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         return proofRequestInstance;
       } catch (error) {
         console.error(error);
-        logger10.info("Failed to initialize ReclaimProofRequest with signature", error);
+        logger11.info("Failed to initialize ReclaimProofRequest with signature", error);
         throw new InitError("Failed to initialize ReclaimProofRequest with signature", error);
       }
     });
@@ -2491,7 +2753,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
                 Intl.getCanonicalLocales(options.preferredLocale);
                 return true;
               } catch (error) {
-                logger10.info("Failed to canonicalize locale", error);
+                logger11.info("Failed to canonicalize locale", error);
                 return false;
               }
             }
@@ -2516,7 +2778,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         proofRequestInstance.cancelRedirectUrlOptions = cancelRedirectUrlOptions;
         return proofRequestInstance;
       } catch (error) {
-        logger10.info("Failed to parse JSON string in fromJsonString:", error);
+        logger11.info("Failed to parse JSON string in fromJsonString:", error);
         throw new InvalidParamError("Invalid JSON string provided to fromJsonString");
       }
     });
@@ -2677,9 +2939,9 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     try {
       validateModalOptions(options, "setModalOptions");
       this.modalOptions = __spreadValues(__spreadValues({}, this.modalOptions), options);
-      logger10.info("Modal options set successfully");
+      logger11.info("Modal options set successfully");
     } catch (error) {
-      logger10.info("Error setting modal options:", error);
+      logger11.info("Error setting modal options:", error);
       throw new SetParamsError("Error setting modal options", error);
     }
   }
@@ -2709,7 +2971,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       this.context = JSON.parse(canonicalStringify(__spreadProps(__spreadValues({}, context), { reclaimSessionId: this.sessionId })));
       this.applyAttestationContext();
     } catch (error) {
-      logger10.info("Error setting context", error);
+      logger11.info("Error setting context", error);
       throw new SetContextError("Error setting context", error);
     }
   }
@@ -2741,7 +3003,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       this.context = { contextAddress: address, contextMessage: message, reclaimSessionId: this.sessionId };
       this.applyAttestationContext();
     } catch (error) {
-      logger10.info("Error setting context", error);
+      logger11.info("Error setting context", error);
       throw new SetContextError("Error setting context", error);
     }
   }
@@ -2776,7 +3038,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       validateParameters(params);
       this.parameters = __spreadValues(__spreadValues({}, this.parameters), params);
     } catch (error) {
-      logger10.info("Error Setting Params:", error);
+      logger11.info("Error Setting Params:", error);
       throw new SetParamsError("Error setting params", error);
     }
   }
@@ -2800,7 +3062,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       validateFunctionParams([{ input: this.sessionId, paramName: "sessionId", isString: true }], "getAppCallbackUrl");
       return this.appCallbackUrl || `${constants.DEFAULT_RECLAIM_CALLBACK_URL}${this.sessionId}`;
     } catch (error) {
-      logger10.info("Error getting app callback url", error);
+      logger11.info("Error getting app callback url", error);
       throw new GetAppCallbackUrlError("Error getting app callback url", error);
     }
   }
@@ -2824,7 +3086,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       validateFunctionParams([{ input: this.sessionId, paramName: "sessionId", isString: true }], "getCancelCallbackUrl");
       return this.cancelCallbackUrl || `${constants.DEFAULT_RECLAIM_CANCEL_CALLBACK_URL}${this.sessionId}`;
     } catch (error) {
-      logger10.info("Error getting cancel callback url", error);
+      logger11.info("Error getting cancel callback url", error);
       throw new GetAppCallbackUrlError("Error getting cancel callback url", error);
     }
   }
@@ -2847,7 +3109,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       validateFunctionParams([{ input: this.sessionId, paramName: "sessionId", isString: true }], "getStatusUrl");
       return `${constants.DEFAULT_RECLAIM_STATUS_URL}${this.sessionId}`;
     } catch (error) {
-      logger10.info("Error fetching Status Url", error);
+      logger11.info("Error fetching Status Url", error);
       throw new GetStatusUrlError("Error fetching status url", error);
     }
   }
@@ -2917,7 +3179,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
             Intl.getCanonicalLocales(options.preferredLocale);
             return true;
           } catch (error) {
-            logger10.info("Failed to canonicalize locale", error);
+            logger11.info("Failed to canonicalize locale", error);
             return false;
           }
         }
@@ -2929,24 +3191,24 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     try {
       validateFunctionParams([{ input: signature, paramName: "signature", isString: true }], "setSignature");
       this.signature = signature;
-      logger10.info(`Signature set successfully for applicationId: ${this.applicationId}`);
+      logger11.info(`Signature set successfully for applicationId: ${this.applicationId}`);
     } catch (error) {
-      logger10.info("Error setting signature", error);
+      logger11.info("Error setting signature", error);
       throw new SetSignatureError("Error setting signature", error);
     }
   }
   generateSignature(applicationSecret) {
     return __async(this, null, function* () {
       try {
-        const wallet = new import_ethers6.ethers.Wallet(applicationSecret);
+        const wallet = new import_ethers7.ethers.Wallet(applicationSecret);
         const canonicalData = (0, import_canonicalize3.default)({ providerId: this.providerId, timestamp: this.timeStamp });
         if (!canonicalData) {
           throw new SignatureGeneratingError("Failed to canonicalize data for signing.");
         }
-        const messageHash = import_ethers6.ethers.keccak256(new TextEncoder().encode(canonicalData));
-        return yield wallet.signMessage(import_ethers6.ethers.getBytes(messageHash));
+        const messageHash = import_ethers7.ethers.keccak256(new TextEncoder().encode(canonicalData));
+        return yield wallet.signMessage(import_ethers7.ethers.getBytes(messageHash));
       } catch (err) {
-        logger10.info(`Error generating proof request for applicationId: ${this.applicationId}, providerId: ${this.providerId}, timeStamp: ${this.timeStamp}`);
+        logger11.info(`Error generating proof request for applicationId: ${this.applicationId}, providerId: ${this.providerId}, timeStamp: ${this.timeStamp}`);
         throw new SignatureGeneratingError(`Error generating signature for applicationId: ${this.applicationId}`);
       }
     });
@@ -2987,7 +3249,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     return __async(this, null, function* () {
       const newTab = preOpenedTab != null ? preOpenedTab : window.open("about:blank", "_blank");
       const link = yield createLinkWithTemplateData(templateData, this.customSharePageUrl);
-      logger10.info("Opening portal in new tab: " + link);
+      logger11.info("Opening portal in new tab: " + link);
       if (newTab) {
         this.portalTab = newTab;
         newTab.location = link;
@@ -3017,7 +3279,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       let link = yield createLinkWithTemplateData(templateData, this.customSharePageUrl);
       const separator = link.includes("?") ? "&" : "?";
       link = `${link}${separator}embedded=true`;
-      logger10.info("Embedding portal in iframe: " + link);
+      logger11.info("Embedding portal in iframe: " + link);
       this.closeEmbeddedFlow();
       const iframe = document.createElement("iframe");
       iframe.src = link;
@@ -3129,7 +3391,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       var _a, _b, _c;
       const options = __spreadValues(__spreadValues({}, (_a = this.options) == null ? void 0 : _a.launchOptions), launchOptions);
       const mode = (_b = options.verificationMode) != null ? _b : "portal";
-      logger10.info("Creating Request Url");
+      logger11.info("Creating Request Url");
       if (!this.signature) {
         throw new SignatureNotFoundError("Signature is not set.");
       }
@@ -3140,18 +3402,18 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
           const template = this.encodeTemplateData(templateData);
           if (((_c = this.options) == null ? void 0 : _c.useAppClip) && getDeviceType() === "mobile" /* MOBILE */ && getMobileDeviceType() === "ios" /* IOS */) {
             const appClipUrl = this.customAppClipUrl ? `${this.customAppClipUrl}&template=${template}` : `https://appclip.apple.com/id?p=org.reclaimprotocol.app.clip&template=${template}`;
-            logger10.info("App Clip Url created successfully: " + appClipUrl);
+            logger11.info("App Clip Url created successfully: " + appClipUrl);
             return appClipUrl;
           }
           const sharePageUrl = yield createLinkWithTemplateData(templateData, this.appSharePageUrl);
-          logger10.info("Share page Url created successfully: " + sharePageUrl);
+          logger11.info("Share page Url created successfully: " + sharePageUrl);
           return sharePageUrl;
         }
         const link = yield createLinkWithTemplateData(templateData, this.customSharePageUrl);
-        logger10.info("Request Url created successfully: " + link);
+        logger11.info("Request Url created successfully: " + link);
         return link;
       } catch (error) {
-        logger10.info("Error creating Request Url:", error);
+        logger11.info("Error creating Request Url:", error);
         throw error;
       }
     });
@@ -3210,11 +3472,11 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       try {
         const templateData = this.getTemplateData();
         this.templateData = templateData;
-        logger10.info(`Triggering Reclaim flow (mode: ${mode})`);
+        logger11.info(`Triggering Reclaim flow (mode: ${mode})`);
         const deviceType = getDeviceType();
         updateSession(this.sessionId, "SESSION_STARTED" /* SESSION_STARTED */);
         if (launchOptions && "target" in launchOptions && !launchOptions.target) {
-          logger10.warn("triggerReclaimFlow: target was provided but is null/undefined \u2014 falling back to default flow. Ensure the element exists in the DOM.");
+          logger11.warn("triggerReclaimFlow: target was provided but is null/undefined \u2014 falling back to default flow. Ensure the element exists in the DOM.");
         }
         if ((launchOptions == null ? void 0 : launchOptions.target) && mode === "portal") {
           yield this.embedPortalIframe(templateData, launchOptions.target);
@@ -3227,7 +3489,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
           if ((_c = this.options) == null ? void 0 : _c.useBrowserExtension) {
             const extensionAvailable = yield this.isBrowserExtensionAvailable();
             if (extensionAvailable) {
-              logger10.info("Triggering browser extension flow");
+              logger11.info("Triggering browser extension flow");
               this.triggerBrowserExtensionFlow();
               return {
                 close: () => {
@@ -3239,16 +3501,16 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
           if (mode === "portal") {
             yield this.openPortalTab(templateData);
           } else {
-            logger10.info("Showing QR code modal with share page URL");
+            logger11.info("Showing QR code modal with share page URL");
             yield this.showQRCodeModal();
           }
         } else if (deviceType === "mobile" /* MOBILE */) {
           if (mode === "app") {
             if (((_d = this.options) == null ? void 0 : _d.useAppClip) && getMobileDeviceType() === "ios" /* IOS */) {
-              logger10.info("Redirecting to iOS app clip");
+              logger11.info("Redirecting to iOS app clip");
               this.redirectToAppClip();
             } else {
-              logger10.info("Redirecting to share page");
+              logger11.info("Redirecting to share page");
               yield this.redirectToInstantApp(options);
             }
           } else {
@@ -3265,7 +3527,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
           tab: (_e = this.portalTab) != null ? _e : void 0
         };
       } catch (error) {
-        logger10.info("Error triggering Reclaim flow:", error);
+        logger11.info("Error triggering Reclaim flow:", error);
         throw error;
       }
     });
@@ -3313,7 +3575,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
           window.postMessage(message, "*");
         });
       } catch (error) {
-        logger10.info("Error checking Reclaim extension installed:", error);
+        logger11.info("Error checking Reclaim extension installed:", error);
         return false;
       }
     });
@@ -3326,7 +3588,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       extensionID: this.extensionID
     };
     window.postMessage(message, "*");
-    logger10.info("Browser extension flow triggered");
+    logger11.info("Browser extension flow triggered");
   }
   showQRCodeModal() {
     return __async(this, null, function* () {
@@ -3335,7 +3597,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         this.modal = new QRCodeModal(this.modalOptions);
         yield this.modal.show(requestUrl);
       } catch (error) {
-        logger10.info("Error showing QR code modal:", error);
+        logger11.info("Error showing QR code modal:", error);
         throw error;
       }
     });
@@ -3346,7 +3608,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       try {
         const template = this.encodeTemplateData(this.templateData);
         let instantAppUrl = this.buildSharePageUrl(template);
-        logger10.info("Redirecting to Android instant app: " + instantAppUrl);
+        logger11.info("Redirecting to Android instant app: " + instantAppUrl);
         const isDeferredDeeplinksFlowEnabled = (_a = options.canUseDeferredDeepLinksFlow) != null ? _a : false;
         if (isDeferredDeeplinksFlowEnabled) {
           instantAppUrl = instantAppUrl.replace("/verifier", "/link");
@@ -3396,7 +3658,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         }
         window.location.href = instantAppUrl;
       } catch (error) {
-        logger10.info("Error redirecting to instant app:", error);
+        logger11.info("Error redirecting to instant app:", error);
         throw error;
       }
     });
@@ -3405,14 +3667,14 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     try {
       const template = this.encodeTemplateData(this.templateData);
       const appClipUrl = this.customAppClipUrl ? `${this.customAppClipUrl}&template=${template}` : `https://appclip.apple.com/id?p=org.reclaimprotocol.app.clip&template=${template}`;
-      logger10.info("Redirecting to iOS app clip: " + appClipUrl);
+      logger11.info("Redirecting to iOS app clip: " + appClipUrl);
       const verifierUrl = `${this.appSharePageUrl}/?template=${template}`;
       window.location.href = appClipUrl;
       setTimeout(() => {
         window.location.href = verifierUrl;
       }, 5 * 1e3);
     } catch (error) {
-      logger10.info("Error redirecting to app clip:", error);
+      logger11.info("Error redirecting to app clip:", error);
       throw error;
     }
   }
@@ -3493,13 +3755,13 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     return __async(this, arguments, function* ({ onSuccess, onError, verificationConfig }) {
       if (!this.sessionId) {
         const message = "Session can't be started due to undefined value of sessionId";
-        logger10.info(message);
+        logger11.info(message);
         throw new SessionNotStartedError(message);
       }
-      logger10.info("Starting session");
+      logger11.info("Starting session");
       const sessionUpdatePollingInterval = 3 * 1e3;
       const interval = setInterval(() => __async(this, null, function* () {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _e, _f;
         try {
           const statusUrlResponse = yield fetchStatusUrl(this.sessionId);
           if (!statusUrlResponse.session) return;
@@ -3524,9 +3786,15 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
             if (statusUrlResponse.session.proofs && statusUrlResponse.session.proofs.length > 0) {
               const proofs = statusUrlResponse.session.proofs;
               if (this.claimCreationType === "createClaim" /* STANDALONE */) {
-                const result = yield verifyProof(proofs, verificationConfig != null ? verificationConfig : this.getProviderVersion());
+                const sessionProviderVersion = statusUrlResponse.session.providerVersionString;
+                const effectiveConfig = verificationConfig != null ? verificationConfig : {
+                  providerId: this.providerId,
+                  providerVersion: sessionProviderVersion || this.resolvedProviderVersion || "",
+                  allowedTags: ((_b = this.options) == null ? void 0 : _b.acceptAiProviders) ? ["ai"] : []
+                };
+                const result = yield verifyProof(proofs, effectiveConfig);
                 if (!result.isVerified) {
-                  logger10.info(`Proofs not verified: count=${proofs == null ? void 0 : proofs.length}`);
+                  logger11.info(`Proofs not verified: count=${proofs == null ? void 0 : proofs.length}`);
                   throw new ProofNotVerifiedError(`Proofs not verified: count=${proofs == null ? void 0 : proofs.length}`, result.error);
                 }
               }
@@ -3536,13 +3804,13 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
                 onSuccess(proofs);
               }
               this.clearInterval();
-              (_b = this.modal) == null ? void 0 : _b.close();
+              (_c = this.modal) == null ? void 0 : _c.close();
               this.closePortalTab();
               this.closeEmbeddedFlow();
             }
           } else {
             if (statusUrlResponse.session.statusV2 === "PROOF_SUBMISSION_FAILED" /* PROOF_SUBMISSION_FAILED */) {
-              const errorMessage = ((_c = statusUrlResponse.session.error) == null ? void 0 : _c.message) || "Proof submission failed";
+              const errorMessage = ((_d = statusUrlResponse.session.error) == null ? void 0 : _d.message) || "Proof submission failed";
               throw new ProofSubmissionFailedError(errorMessage);
             }
             if (statusUrlResponse.session.statusV2 === "PROOF_SUBMITTED" /* PROOF_SUBMITTED */ || statusUrlResponse.session.statusV2 === "AI_PROOF_SUBMITTED" /* AI_PROOF_SUBMITTED */) {
@@ -3550,7 +3818,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
                 onSuccess([]);
               }
               this.clearInterval();
-              (_d = this.modal) == null ? void 0 : _d.close();
+              (_e = this.modal) == null ? void 0 : _e.close();
               this.closePortalTab();
               this.closeEmbeddedFlow();
             }
@@ -3560,7 +3828,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
             onError(e);
           }
           this.clearInterval();
-          (_e = this.modal) == null ? void 0 : _e.close();
+          (_f = this.modal) == null ? void 0 : _f.close();
           this.closePortalTab();
           this.closeEmbeddedFlow();
         }
@@ -3584,7 +3852,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
   closeModal() {
     if (this.modal) {
       this.modal.close();
-      logger10.info("Modal closed by user");
+      logger11.info("Modal closed by user");
     }
   }
   /**
@@ -3604,7 +3872,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
 };
 
 // src/utils/signatureUtils.ts
-var import_ethers7 = require("ethers");
+var import_ethers8 = require("ethers");
 var import_canonicalize4 = __toESM(require("canonicalize"));
 function generateInitSignature(appSecret, providerId, timestamp) {
   return __async(this, null, function* () {
@@ -3614,13 +3882,13 @@ function generateInitSignature(appSecret, providerId, timestamp) {
       { input: timestamp, paramName: "timestamp", isString: true }
     ], "generateInitSignature");
     try {
-      const wallet = new import_ethers7.ethers.Wallet(appSecret);
+      const wallet = new import_ethers8.ethers.Wallet(appSecret);
       const canonicalData = (0, import_canonicalize4.default)({ providerId, timestamp });
       if (!canonicalData) {
         throw new SignatureGeneratingError("Failed to canonicalize data for signing.");
       }
-      const messageHash = import_ethers7.ethers.keccak256(new TextEncoder().encode(canonicalData));
-      return yield wallet.signMessage(import_ethers7.ethers.getBytes(messageHash));
+      const messageHash = import_ethers8.ethers.keccak256(new TextEncoder().encode(canonicalData));
+      return yield wallet.signMessage(import_ethers8.ethers.getBytes(messageHash));
     } catch (err) {
       throw new SignatureGeneratingError(
         `Error generating init signature for providerId: ${providerId}`,
@@ -3666,6 +3934,7 @@ function generateInitSignature(appSecret, providerId, timestamp) {
   takeTemplateParametersFromProofs,
   transformForOnchain,
   updateSession,
+  verifyAttestorTeeAttestation,
   verifyProof,
   verifyTeeAttestation
 });