@reclaimprotocol/js-sdk 5.4.0 → 5.4.2-dev.0

package/dist/index.js

@@ -84,10 +84,20 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@reclaimprotocol/js-sdk",
-      version: "5.4.0",
+      version: "5.4.2-dev.0",
       description: "Designed to request proofs from the Reclaim protocol and manage the flow of claims and witness interactions.",
       main: "dist/index.js",
       types: "dist/index.d.ts",
+      exports: {
+        ".": {
+          types: "./dist/index.d.ts",
+          default: "./dist/index.js"
+        },
+        "./internal": {
+          types: "./dist/internal.d.ts",
+          default: "./dist/internal.js"
+        }
+      },
       keywords: [
         "reclaim",
         "protocol",
@@ -108,7 +118,8 @@ var require_package = __commonJS({
       ],
       tsup: {
         entry: [
-          "src/index.ts"
+          "src/index.ts",
+          "src/internal.ts"
         ],
         splitting: false,
         sourcemap: true,
@@ -192,8 +203,40 @@ var require_package = __commonJS({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ApplicationError: () => ApplicationError,
+  AttestorTeeVerificationError: () => AttestorTeeVerificationError,
+  BackendServerError: () => BackendServerError,
+  CallbackUrlRequiredError: () => CallbackUrlRequiredError,
+  ErrorDuringVerificationError: () => ErrorDuringVerificationError,
+  GetAppCallbackUrlError: () => GetAppCallbackUrlError,
+  GetStatusUrlError: () => GetStatusUrlError,
+  HASH_MATCH_MULTIPLE_DEFAULT: () => HASH_MATCH_MULTIPLE_DEFAULT,
+  HASH_REQUIRED_DEFAULT: () => HASH_REQUIRED_DEFAULT,
+  InavlidParametersError: () => InavlidParametersError,
+  InitError: () => InitError,
+  InitSessionError: () => InitSessionError,
+  InvalidParamError: () => InvalidParamError,
+  InvalidRequestSpecError: () => InvalidRequestSpecError,
+  InvalidSignatureError: () => InvalidSignatureError,
+  NoProviderParamsError: () => NoProviderParamsError,
+  ProofNotValidatedError: () => ProofNotValidatedError,
+  ProofNotVerifiedError: () => ProofNotVerifiedError,
+  ProofSubmissionFailedError: () => ProofSubmissionFailedError,
+  ProviderConfigFetchError: () => ProviderConfigFetchError,
+  ProviderFailedError: () => ProviderFailedError,
+  ProviderNotFoundError: () => ProviderNotFoundError,
   ReclaimProofRequest: () => ReclaimProofRequest,
+  SessionNotStartedError: () => SessionNotStartedError,
+  SetContextError: () => SetContextError,
+  SetParamsError: () => SetParamsError,
+  SetSignatureError: () => SetSignatureError,
+  SignatureGeneratingError: () => SignatureGeneratingError,
+  SignatureNotFoundError: () => SignatureNotFoundError,
+  StatusUrlError: () => StatusUrlError,
   TeeVerificationError: () => TeeVerificationError,
+  TimeoutError: () => TimeoutError,
+  UnknownProofsNotValidatedError: () => UnknownProofsNotValidatedError,
+  UpdateSessionError: () => UpdateSessionError,
   assertValidProofsByHash: () => assertValidProofsByHash,
   assertValidateProof: () => assertValidateProof,
   assertVerifiedProof: () => assertVerifiedProof,
@@ -208,6 +251,7 @@ __export(index_exports, {
   generateSpecsFromRequestSpecTemplate: () => generateSpecsFromRequestSpecTemplate,
   getAttestors: () => getAttestors,
   getDeviceType: () => getDeviceType,
+  getHashFromProof: () => getHashFromProof,
   getHttpProviderClaimParamsFromProof: () => getHttpProviderClaimParamsFromProof,
   getIdentifierFromClaimInfo: () => getIdentifierFromClaimInfo,
   getMobileDeviceType: () => getMobileDeviceType,
@@ -227,6 +271,7 @@ __export(index_exports, {
   takeTemplateParametersFromProofs: () => takeTemplateParametersFromProofs,
   transformForOnchain: () => transformForOnchain,
   updateSession: () => updateSession,
+  verifyAttestorTeeAttestation: () => verifyAttestorTeeAttestation,
   verifyProof: () => verifyProof,
   verifyTeeAttestation: () => verifyTeeAttestation
 });
@@ -241,7 +286,7 @@ var RECLAIM_EXTENSION_ACTIONS = {
 };
 
 // src/Reclaim.ts
-var import_ethers6 = require("ethers");
+var import_ethers7 = require("ethers");
 var import_canonicalize3 = __toESM(require("canonicalize"));
 
 // src/utils/errors.ts
@@ -289,6 +334,7 @@ var ProofSubmissionFailedError = createErrorClass("ProofSubmissionFailedError");
 var ErrorDuringVerificationError = createErrorClass("ErrorDuringVerificationError");
 var CallbackUrlRequiredError = createErrorClass("CallbackUrlRequiredError");
 var TeeVerificationError = createErrorClass("TeeVerificationError");
+var AttestorTeeVerificationError = createErrorClass("AttestorTeeVerificationError");
 
 // src/utils/logger.ts
 var SimpleLogger = class {
@@ -563,19 +609,21 @@ function scheduleIntervalEndingTask(sessionId, intervals, onFailureCallback, tim
     }
   }, timeout);
 }
-var createVerifyProofResultSuccess = (proofs, isTeeAttestationVerified) => {
+var createVerifyProofResultSuccess = (proofs, isTeeAttestationVerified, isAttestorTeeAttestationVerified) => {
   return {
     isVerified: true,
     isTeeAttestationVerified,
+    isAttestorTeeAttestationVerified,
     error: void 0,
     data: proofs.map(createTrustedDataFromProofData),
     publicData: getPublicDataFromProofs(proofs)
   };
 };
-var createVerifyProofResultFailure = (error, isTeeAttestationVerified) => {
+var createVerifyProofResultFailure = (error, isTeeAttestationVerified, isAttestorTeeAttestationVerified) => {
   return {
     isVerified: false,
     isTeeAttestationVerified,
+    isAttestorTeeAttestationVerified,
     error,
     data: [],
     publicData: []
@@ -651,6 +699,43 @@ var constants = {
   // Chrome extension URL for Reclaim Protocol
   CHROME_EXTENSION_URL: "https://chromewebstore.google.com/detail/reclaim-extension/oafieibbbcepkmenknelhmgaoahamdeh"
 };
+var GCP_CONFIDENTIAL_SPACE_ROOT_CA = `-----BEGIN CERTIFICATE-----
+MIIGCDCCA/CgAwIBAgITYBvRy5g9aYYMh7tJS7pFwafL6jANBgkqhkiG9w0BAQsF
+ADCBizELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcT
+DU1vdW50YWluIFZpZXcxEzARBgNVBAoTCkdvb2dsZSBMTEMxFTATBgNVBAsTDEdv
+b2dsZSBDbG91ZDEjMCEGA1UEAxMaQ29uZmlkZW50aWFsIFNwYWNlIFJvb3QgQ0Ew
+HhcNMjQwMTE5MjIxMDUwWhcNMzQwMTE2MjIxMDQ5WjCBizELMAkGA1UEBhMCVVMx
+EzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxEzAR
+BgNVBAoTCkdvb2dsZSBMTEMxFTATBgNVBAsTDEdvb2dsZSBDbG91ZDEjMCEGA1UE
+AxMaQ29uZmlkZW50aWFsIFNwYWNlIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUA
+A4ICDwAwggIKAoICAQCvRuZasczAqhMZe1ODHJ6MFLX8EYVV+RN7xiO9GpuA53iz
+l9Oxgp3NXik3FbYn+7bcIkMMSQpCr6K0jbSQCZT6d5P5PJT5DpNGYjLHkW67/fl+
+Bu7eSMb0qRCa1jS+3OhNK7t7SIaHm1XdmSRghjwoglKRuk3CGrF4Zia9RcE/p2MU
+69GyJZpqHYwTplNr3x4zF+2nJk86GywDP+sGwSPWfcmqY04VQD7ZPDEZZ/qgzdoL
+5ilE92eQnAsy+6m6LxBEHHVcFpfDtNVUIt2VMCWLBeOKUQcn5js756xblInqw/Qt
+QRR0An0yfRjBuGvmMjAwETDo5ETY/fc+nbQVYJzNQTc9EOpFFWPpw/ZjFcN9Amnd
+dxYUETFXPmBYerMez0LKNtGpfKYHHhMMTI3mj0m/V9fCbfh2YbBUnMS2Swd20YSI
+Mi/HiGaqOpGUqXMeQVw7phGTS3QYK8ZM65sC/QhIQzXdsiLDgFBitVnlIu3lIv6C
+uiHvXeSJBRlRxQ8Vu+t6J7hBdl0etWBKAu9Vti46af5cjC03dspkHR3MAUGcrLWE
+TkQ0msQAKvIAlwyQRLuQOI5D6pF+6af1Nbl+vR7sLCbDWdMqm1E9X6KyFKd6e3rn
+E9O4dkFJp35WvR2gqIAkUoa+Vq1MXLFYG4imanZKH0igrIblbawRCr3Gr24FXQID
+AQABo2MwYTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
+FgQUF+fBOE6Th1snpKuvIb6S8/mtPL4wHwYDVR0jBBgwFoAUF+fBOE6Th1snpKuv
+Ib6S8/mtPL4wDQYJKoZIhvcNAQELBQADggIBAGtCuV5eHxWcffylK9GPumaD6Yjd
+cs76KDBe3mky5ItBIrEOeZq3z47zM4dbKZHhFuoq4yAaO1MyApnG0w9wIQLBDndI
+ovtkw6j9/64aqPWpNaoB5MB0SahCUCgI83Dx9SRqGmjPI/MTMfwDLdE5EF9gFmVI
+oH62YnG2aa/sc6m/8wIK8WtTJazEI16/8GPG4ZUhwT6aR3IGGnEBPMbMd5VZQ0Hw
+VbHBKWK3UykaSCxnEg8uaNx/rhNaOWuWtos4qL00dYyGV7ZXg4fpAq7244QUgkWV
+AtVcU2SPBjDd30OFHASnenDHRzQdOtHaxLp4a4WaY3jb2V6Sn3LfE8zSy6GevxmN
+COIWW3xnPF8rwKz4ABEPqECe37zzu3W1nzZAFtdkhPBNnlWYkIusTMtU+8v6EPKp
+GIIRphpaDhtGPJQukpENOfk2728lenPycRfjxwA96UKWq0dKZC45MwBEK9Jngn8Q
+cPmpPmx7pSMkSxEX2Vos2JNaNmCKJd2VaXz8M6F2cxscRdh9TbAYAjGEEjE1nLUH
+2YHDS8Y7xYNFIDSFaJAlqGcCUbzjGhrwHGj4voTe9ZvlmngrcA/ptSuBidvsnRDw
+kNPLowCd0NqxYYSLNL7GroYCFPxoBpr+++4vsCaXalbs8iJxdU2EPqG4MB4xWKYg
+uyT5CnJulxSC5CT1
+-----END CERTIFICATE-----`;
+var ATTESTOR_NONCE_PATTERN = /^attestor_public_key:0x([0-9a-fA-F]{40})$/;
+var GCP_CONFIDENTIAL_SPACE_ISSUER = "https://confidentialcomputing.googleapis.com";
 
 // src/utils/fetch.ts
 var import_fetch_retry = __toESM(require("fetch-retry"));
@@ -1463,6 +1548,9 @@ function generateAttestationNonce(appSecret, applicationId, sessionId, timestamp
   return import_ethers4.ethers.keccak256(import_ethers4.ethers.toUtf8Bytes(noncePayload)).replace(/^0x/i, "");
 }
 
+// src/utils/proofValidationUtils.ts
+var import_assert = __toESM(require("assert"));
+
 // src/utils/providerUtils.ts
 var logger7 = logger_default.logger;
 function fetchProviderHashRequirementsBy(providerId, exactProviderVersionString, allowedTags, proofs) {
@@ -1584,7 +1672,20 @@ function hashRequestSpec(request) {
 var logger8 = logger_default.logger;
 var HASH_REQUIRED_DEFAULT = true;
 var HASH_MATCH_MULTIPLE_DEFAULT = true;
-function assertValidProofsByHash(proofs, config) {
+function getHashFromProof(proof, piiConfig) {
+  if ((piiConfig == null ? void 0 : piiConfig.hasNoPii) === true) {
+    const contextObject = JSON.parse(proof.claimData.context);
+    (0, import_assert.default)(contextObject, "Context must be present in proof's claimData");
+    const providerHash = contextObject.providerHash;
+    (0, import_assert.default)(providerHash, "Provider hash must be present in proof's claimData.context");
+    return [providerHash];
+  }
+  const claimParams = getHttpProviderClaimParamsFromProof(proof);
+  const computedHashesOfProof = hashProofClaimParams(claimParams);
+  const proofHashes = Array.isArray(computedHashesOfProof) ? computedHashesOfProof.map((h) => h.toLowerCase().trim()) : [computedHashesOfProof.toLowerCase().trim()];
+  return proofHashes;
+}
+function assertValidProofsByHash(proofs, config, piiConfig) {
   var _a, _b;
   if (!config.hashes) {
     throw new ProofNotValidatedError("No proof hash was provided for validation");
@@ -1592,9 +1693,7 @@ function assertValidProofsByHash(proofs, config) {
   const unvalidatedProofHashByIndex = /* @__PURE__ */ new Map();
   for (let i = 0; i < proofs.length; i++) {
     const proof = proofs[i];
-    const claimParams = getHttpProviderClaimParamsFromProof(proof);
-    const computedHashesOfProof = hashProofClaimParams(claimParams);
-    const proofHashes = Array.isArray(computedHashesOfProof) ? computedHashesOfProof.map((h) => h.toLowerCase().trim()) : [computedHashesOfProof.toLowerCase().trim()];
+    const proofHashes = getHashFromProof(proof, piiConfig);
     unvalidatedProofHashByIndex.set(i, proofHashes);
   }
   for (const hashRequirement of config.hashes) {
@@ -1602,7 +1701,9 @@ function assertValidProofsByHash(proofs, config) {
     const expectedHashes = Array.isArray(hashRequirement.value) ? hashRequirement.value.map((h) => h.toLowerCase().trim()) : [hashRequirement.value.toLowerCase().trim()];
     const isRequired = (_a = hashRequirement.required) != null ? _a : HASH_REQUIRED_DEFAULT;
     const canMatchMultiple = (_b = hashRequirement.multiple) != null ? _b : HASH_MATCH_MULTIPLE_DEFAULT;
-    for (const [i, proofHashes] of unvalidatedProofHashByIndex.entries()) {
+    for (let i = 0; i < proofs.length; i++) {
+      if (!unvalidatedProofHashByIndex.has(i)) continue;
+      const proofHashes = unvalidatedProofHashByIndex.get(i);
       const intersection = expectedHashes.filter((eh) => proofHashes.includes(eh));
       if (intersection.length > 0) {
         unvalidatedProofHashByIndex.delete(i);
@@ -1643,7 +1744,7 @@ function getHttpProviderClaimParamsFromProof(proof) {
   }
   throw new ProofNotValidatedError("Proof has no HTTP provider params to hash");
 }
-function assertValidateProof(proofs, config) {
+function assertValidateProof(proofs, config, piiConfig) {
   return __async(this, null, function* () {
     if ("dangerouslyDisableContentValidation" in config && config.dangerouslyDisableContentValidation) {
       logger8.warn("Validation skipped because it was disabled during proof verification");
@@ -1664,14 +1765,14 @@ function assertValidateProof(proofs, config) {
         let lastError = null;
         for (const hashRequirement of hashRequirementsFromProvider) {
           try {
-            return yield assertValidateProof(proofs, hashRequirement);
+            return yield assertValidateProof(proofs, hashRequirement, piiConfig);
           } catch (e) {
             lastError = e;
           }
         }
         throw new ProofNotValidatedError("Could not validate proof", lastError);
       } else {
-        return assertValidateProof(proofs, hashRequirementsFromProvider[0]);
+        return assertValidateProof(proofs, hashRequirementsFromProvider[0], piiConfig);
       }
     }
     const effectiveHashRequirement = ("hashes" in config && Array.isArray(config == null ? void 0 : config.hashes) ? config.hashes : []).map((it) => {
@@ -1683,16 +1784,19 @@ function assertValidateProof(proofs, config) {
         return it;
       }
     });
-    return assertValidProofsByHash(proofs, {
-      hashes: effectiveHashRequirement
-    });
+    return assertValidProofsByHash(
+      proofs,
+      {
+        hashes: effectiveHashRequirement
+      },
+      piiConfig
+    );
   });
 }
 
 // src/utils/verifyTee.ts
 var import_ethers5 = require("ethers");
 var logger9 = logger_default.logger;
-var EXPECTED_ISSUER = "https://confidentialcomputing.googleapis.com";
 var EXPECTED_HW_MODEL = "GCP_AMD_SEV";
 var EXPECTED_TEE_PROVIDER = "gcp";
 var EXPECTED_TEE_TECHNOLOGY = "amd-sev";
@@ -1700,7 +1804,7 @@ var SUPPORTED_PROOF_VERSIONS = ["v2", "v3"];
 var TOKEN_CLOCK_SKEW_S = 60;
 var NONCE_TIMESTAMP_MAX_SKEW_MS = 10 * 60 * 1e3;
 var BROWSER_ENVIRONMENT_ERROR = "TEE attestation verification is only supported in non-browser environments. Run verifyTeeAttestation on your server or API route.";
-function assert(condition, message) {
+function assert2(condition, message) {
   if (!condition) {
     throw new Error(message);
   }
@@ -1750,7 +1854,7 @@ function decodeUtf8(bytes) {
 }
 function decodeJwt(token) {
   const parts = token.split(".");
-  assert(parts.length === 3, "attestation token is not a JWT");
+  assert2(parts.length === 3, "attestation token is not a JWT");
   return {
     header: JSON.parse(decodeUtf8(decodeBase64Url(parts[0]))),
     payload: JSON.parse(decodeUtf8(decodeBase64Url(parts[1]))),
@@ -1760,7 +1864,7 @@ function decodeJwt(token) {
 }
 function getFetch() {
   const fetchFn = globalThis.fetch;
-  assert(fetchFn, "fetch is not available in this environment");
+  assert2(fetchFn, "fetch is not available in this environment");
   return fetchFn.bind(globalThis);
 }
 function getSubtleCrypto() {
@@ -1796,19 +1900,19 @@ var cachedJwksAt = 0;
 function verifyJwtSignature(token, issuer) {
   return __async(this, null, function* () {
     const { header, payload, signingInput, signature } = decodeJwt(token);
-    assert(header.alg === "RS256", `unexpected attestation signing algorithm: ${header.alg}`);
-    assert(typeof header.kid === "string" && header.kid.length > 0, "attestation token kid is missing");
+    assert2(header.alg === "RS256", `unexpected attestation signing algorithm: ${header.alg}`);
+    assert2(typeof header.kid === "string" && header.kid.length > 0, "attestation token kid is missing");
     const isCacheFresh = cachedJwksKeys && Date.now() - cachedJwksAt < JWKS_CACHE_TTL_MS;
     if (!isCacheFresh) {
       const oidc = yield fetchJson(`${issuer}/.well-known/openid-configuration`);
-      assert(typeof (oidc == null ? void 0 : oidc.jwks_uri) === "string" && oidc.jwks_uri.length > 0, "issuer JWKS URI is missing");
+      assert2(typeof (oidc == null ? void 0 : oidc.jwks_uri) === "string" && oidc.jwks_uri.length > 0, "issuer JWKS URI is missing");
       cachedJwksUri = oidc.jwks_uri;
       const jwks = yield fetchJson(cachedJwksUri);
       cachedJwksKeys = (jwks == null ? void 0 : jwks.keys) || [];
       cachedJwksAt = Date.now();
     }
     const jwk = cachedJwksKeys.find((key) => key.kid === header.kid);
-    assert(jwk, `no JWKS key found for kid ${header.kid}`);
+    assert2(jwk, `no JWKS key found for kid ${header.kid}`);
     const cryptoKey = yield getSubtleCrypto().importKey(
       "jwk",
       jwk,
@@ -1822,7 +1926,7 @@ function verifyJwtSignature(token, issuer) {
       signature,
       new TextEncoder().encode(signingInput)
     );
-    assert(isValid, "JWT signature verification failed");
+    assert2(isValid, "JWT signature verification failed");
     return payload;
   });
 }
@@ -1843,16 +1947,16 @@ function parseProofContext(proof) {
   }
   const ctx = parsedContext;
   const expectedNonce = ctx.attestationNonce;
-  assert(typeof expectedNonce === "string" && expectedNonce.length > 0, "Proof context is missing attestationNonce");
+  assert2(typeof expectedNonce === "string" && expectedNonce.length > 0, "Proof context is missing attestationNonce");
   const nonceDataObj = ctx.attestationNonceData;
-  assert(isNonceContextData(nonceDataObj), "Proof context is missing or has invalid attestationNonceData (requires applicationId, sessionId, timestamp)");
+  assert2(isNonceContextData(nonceDataObj), "Proof context is missing or has invalid attestationNonceData (requires applicationId, sessionId, timestamp)");
   return { parsedContext: ctx, nonceDataObj, expectedNonce };
 }
 function verifyApplicationAndSessionBinding(proof, parsedContext, nonceDataObj, expectedApplicationId) {
   var _a;
   const { applicationId, sessionId, timestamp } = nonceDataObj;
   if (expectedApplicationId) {
-    assert(
+    assert2(
       applicationId.toLowerCase() === expectedApplicationId.toLowerCase(),
       `Application ID Mismatch! Expected ${expectedApplicationId}, but proof context contains ${applicationId}`
     );
@@ -1887,11 +1991,11 @@ function verifyApplicationAndSessionBinding(proof, parsedContext, nonceDataObj,
 function verifyNonceMaterial(expectedNonce, nonceDataObj, expectedAppSecret) {
   const cleanExpectedNonce = normalizeHex(expectedNonce);
   const { applicationId, sessionId, timestamp } = nonceDataObj;
-  assert(cleanExpectedNonce.length > 0, "Proof context attestationNonce is empty");
-  assert(isHex(cleanExpectedNonce), "Proof context attestationNonce is not valid hex");
+  assert2(cleanExpectedNonce.length > 0, "Proof context attestationNonce is empty");
+  assert2(isHex(cleanExpectedNonce), "Proof context attestationNonce is not valid hex");
   if (expectedAppSecret) {
     const recomputedNonce = generateAttestationNonce(expectedAppSecret, applicationId, sessionId, timestamp);
-    assert(
+    assert2(
       recomputedNonce === cleanExpectedNonce,
       "Attestation nonce verification failed: app secret, application ID, session ID, or timestamp do not match"
     );
@@ -1904,7 +2008,7 @@ function verifyNonceMaterial(expectedNonce, nonceDataObj, expectedAppSecret) {
       nonceMsg,
       expectedNonce.startsWith("0x") ? expectedNonce : `0x${expectedNonce}`
     );
-    assert(
+    assert2(
       recoveredAddress.toLowerCase() === applicationId.toLowerCase(),
       `Nonce signature verification failed: recovered ${recoveredAddress}, expected ${applicationId}`
     );
@@ -1926,12 +2030,12 @@ function assertTokenFresh(claims) {
 }
 function assertAudienceClaim(aud) {
   if (typeof aud === "string") {
-    assert(aud.length > 0, "attestation token audience is empty");
+    assert2(aud.length > 0, "attestation token audience is empty");
     return;
   }
   if (Array.isArray(aud)) {
-    assert(aud.length > 0, "attestation token audience is empty");
-    assert(aud.every((entry) => typeof entry === "string" && entry.length > 0), "attestation token audience contains invalid entries");
+    assert2(aud.length > 0, "attestation token audience is empty");
+    assert2(aud.every((entry) => typeof entry === "string" && entry.length > 0), "attestation token audience contains invalid entries");
     return;
   }
   throw new Error("attestation token audience is missing");
@@ -1946,22 +2050,22 @@ function assertProofShape(teeAttestation) {
     throw new Error(`${teeAttestation.error.code}: ${teeAttestation.error.message}`);
   }
   const proofVersion = getProofVersion(teeAttestation);
-  assert(typeof proofVersion === "string" && SUPPORTED_PROOF_VERSIONS.includes(proofVersion), `unexpected proof version: ${proofVersion}`);
-  assert(teeAttestation.tee_provider === EXPECTED_TEE_PROVIDER, `unexpected tee provider: ${teeAttestation.tee_provider}`);
-  assert(teeAttestation.tee_technology === EXPECTED_TEE_TECHNOLOGY, `unexpected tee technology: ${teeAttestation.tee_technology}`);
-  assert(typeof teeAttestation.nonce === "string" && teeAttestation.nonce.length > 0, "tee attestation nonce missing");
-  assert(typeof teeAttestation.timestamp === "string" && teeAttestation.timestamp.length > 0, "tee attestation timestamp missing");
-  assert(!Number.isNaN(Date.parse(teeAttestation.timestamp)), "tee attestation timestamp is invalid");
-  assert(typeof ((_a = teeAttestation.workload) == null ? void 0 : _a.image_digest) === "string" && teeAttestation.workload.image_digest.length > 0, "workload image digest missing");
-  assert(typeof ((_b = teeAttestation.verifier) == null ? void 0 : _b.image_digest) === "string" && teeAttestation.verifier.image_digest.length > 0, "verifier image digest missing");
-  assert(typeof ((_c = teeAttestation.attestation) == null ? void 0 : _c.token) === "string" && teeAttestation.attestation.token.length > 0, "attestation token missing");
+  assert2(typeof proofVersion === "string" && SUPPORTED_PROOF_VERSIONS.includes(proofVersion), `unexpected proof version: ${proofVersion}`);
+  assert2(teeAttestation.tee_provider === EXPECTED_TEE_PROVIDER, `unexpected tee provider: ${teeAttestation.tee_provider}`);
+  assert2(teeAttestation.tee_technology === EXPECTED_TEE_TECHNOLOGY, `unexpected tee technology: ${teeAttestation.tee_technology}`);
+  assert2(typeof teeAttestation.nonce === "string" && teeAttestation.nonce.length > 0, "tee attestation nonce missing");
+  assert2(typeof teeAttestation.timestamp === "string" && teeAttestation.timestamp.length > 0, "tee attestation timestamp missing");
+  assert2(!Number.isNaN(Date.parse(teeAttestation.timestamp)), "tee attestation timestamp is invalid");
+  assert2(typeof ((_a = teeAttestation.workload) == null ? void 0 : _a.image_digest) === "string" && teeAttestation.workload.image_digest.length > 0, "workload image digest missing");
+  assert2(typeof ((_b = teeAttestation.verifier) == null ? void 0 : _b.image_digest) === "string" && teeAttestation.verifier.image_digest.length > 0, "verifier image digest missing");
+  assert2(typeof ((_c = teeAttestation.attestation) == null ? void 0 : _c.token) === "string" && teeAttestation.attestation.token.length > 0, "attestation token missing");
 }
 function computeDigestBinding(teeAttestation) {
   return __async(this, null, function* () {
     const proofVersion = getProofVersion(teeAttestation);
     if (proofVersion === "v3") {
-      assert(typeof teeAttestation.workload.container_name === "string" && teeAttestation.workload.container_name.length > 0, "workload container name missing");
-      assert(typeof teeAttestation.verifier.container_name === "string" && teeAttestation.verifier.container_name.length > 0, "verifier container name missing");
+      assert2(typeof teeAttestation.workload.container_name === "string" && teeAttestation.workload.container_name.length > 0, "workload container name missing");
+      assert2(typeof teeAttestation.verifier.container_name === "string" && teeAttestation.verifier.container_name.length > 0, "verifier container name missing");
       return sha256Hex([
         "v3",
         `workload.container_name=${teeAttestation.workload.container_name}`,
@@ -1979,16 +2083,16 @@ ${teeAttestation.verifier.image_digest}`
 function verifyGcpClaims(teeAttestation, expectedNonce) {
   return __async(this, null, function* () {
     var _a;
-    const claims = yield verifyJwtSignature(teeAttestation.attestation.token, EXPECTED_ISSUER);
-    assert(claims.iss === EXPECTED_ISSUER, `unexpected issuer: ${claims.iss}`);
+    const claims = yield verifyJwtSignature(teeAttestation.attestation.token, GCP_CONFIDENTIAL_SPACE_ISSUER);
+    assert2(claims.iss === GCP_CONFIDENTIAL_SPACE_ISSUER, `unexpected issuer: ${claims.iss}`);
     assertAudienceClaim(claims.aud);
-    assert(Array.isArray(claims.eat_nonce), "eat_nonce claim missing");
+    assert2(Array.isArray(claims.eat_nonce), "eat_nonce claim missing");
     const digestBinding = yield computeDigestBinding(teeAttestation);
-    assert(claims.eat_nonce.includes(expectedNonce), "request nonce is not present in attestation token");
-    assert(claims.eat_nonce.includes(digestBinding), "digest-binding nonce is not present in attestation token");
-    assert(claims.hwmodel === EXPECTED_HW_MODEL, `unexpected hwmodel: ${claims.hwmodel}`);
-    assert(claims.secboot === true, "secure boot claim is not true");
-    assert((_a = claims.submods) == null ? void 0 : _a.gce, "gce submod claim missing");
+    assert2(claims.eat_nonce.includes(expectedNonce), "request nonce is not present in attestation token");
+    assert2(claims.eat_nonce.includes(digestBinding), "digest-binding nonce is not present in attestation token");
+    assert2(claims.hwmodel === EXPECTED_HW_MODEL, `unexpected hwmodel: ${claims.hwmodel}`);
+    assert2(claims.secboot === true, "secure boot claim is not true");
+    assert2((_a = claims.submods) == null ? void 0 : _a.gce, "gce submod claim missing");
     assertTokenFresh(claims);
   });
 }
@@ -2010,9 +2114,9 @@ function verifyTeeAttestation(proof, appSecret) {
       verifyNonceMaterial(expectedNonce, nonceDataObj, appSecret);
       const cleanExpectedNonce = normalizeHex(expectedNonce);
       const cleanTeeNonce = normalizeHex(teeAttestation.nonce);
-      assert(cleanTeeNonce.length > 0, "TEE attestation nonce is empty");
-      assert(isHex(cleanTeeNonce), "TEE attestation nonce is not valid hex");
-      assert(cleanTeeNonce === cleanExpectedNonce, `Nonce Mismatch! Expected ${cleanExpectedNonce}, got ${cleanTeeNonce}`);
+      assert2(cleanTeeNonce.length > 0, "TEE attestation nonce is empty");
+      assert2(isHex(cleanTeeNonce), "TEE attestation nonce is not valid hex");
+      assert2(cleanTeeNonce === cleanExpectedNonce, `Nonce Mismatch! Expected ${cleanExpectedNonce}, got ${cleanTeeNonce}`);
       yield verifyGcpClaims(teeAttestation, cleanExpectedNonce);
       return { isVerified: true };
     } catch (error) {
@@ -2047,8 +2151,225 @@ function runTeeVerification(proofs, config) {
   });
 }
 
-// src/Reclaim.ts
+// src/utils/verifyAttestorTee.ts
+var import_crypto = __toESM(require("crypto"));
+var import_ethers6 = require("ethers");
 var logger10 = logger_default.logger;
+var BROWSER_ENVIRONMENT_ERROR2 = "Attestor TEE attestation verification is only supported in non-browser environments. Run verifyAttestorTeeAttestation on your server or API route.";
+function isBrowserEnvironment2() {
+  if (typeof window !== "undefined" || typeof document !== "undefined") {
+    return true;
+  }
+  if (typeof navigator !== "undefined" && typeof process === "undefined") {
+    return true;
+  }
+  const workerGlobalScope = globalThis.WorkerGlobalScope;
+  if (typeof workerGlobalScope !== "undefined" && typeof self !== "undefined" && self instanceof workerGlobalScope) {
+    return true;
+  }
+  return false;
+}
+function assertNonBrowserEnvironment2() {
+  if (isBrowserEnvironment2()) {
+    throw new Error(BROWSER_ENVIRONMENT_ERROR2);
+  }
+}
+var TOKEN_CLOCK_SKEW_S2 = 60;
+function decodeBase64Url2(input) {
+  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+  return Buffer.from(padded, "base64");
+}
+function normalizeAddress(address) {
+  return address.trim().toLowerCase().replace(/^0x/, "");
+}
+function verifyX5cChain(x5cChain) {
+  if (!x5cChain || x5cChain.length === 0) {
+    throw new Error("Empty x5c certificate chain");
+  }
+  const certs = x5cChain.map(
+    (b64) => new import_crypto.X509Certificate(`-----BEGIN CERTIFICATE-----
+${b64}
+-----END CERTIFICATE-----`)
+  );
+  const root = new import_crypto.X509Certificate(GCP_CONFIDENTIAL_SPACE_ROOT_CA);
+  for (let i = 0; i < certs.length - 1; i++) {
+    if (!certs[i].verify(certs[i + 1].publicKey)) {
+      throw new Error(`Certificate chain verification failed at level ${i}`);
+    }
+  }
+  const top = certs[certs.length - 1];
+  if (!top.verify(root.publicKey)) {
+    throw new Error("Certificate chain does not root to GCP Confidential Space Root CA");
+  }
+  return certs[0].publicKey;
+}
+function verifyAttestorTeeAttestation(report, expectedAttestorAddress) {
+  return __async(this, null, function* () {
+    var _a, _b, _c, _d, _e;
+    try {
+      assertNonBrowserEnvironment2();
+      if (!report || typeof report !== "string") {
+        throw new Error("attestation report is empty or not a string");
+      }
+      if (!expectedAttestorAddress || typeof expectedAttestorAddress !== "string") {
+        throw new Error("expectedAttestorAddress is required");
+      }
+      const parts = report.split(".");
+      if (parts.length !== 3) {
+        throw new Error("attestation report is not a JWT (expected 3 parts)");
+      }
+      const [headerB64, payloadB64, signatureB64] = parts;
+      const header = JSON.parse(decodeBase64Url2(headerB64).toString("utf8"));
+      const payload = JSON.parse(decodeBase64Url2(payloadB64).toString("utf8"));
+      if (header.alg !== "RS256") {
+        throw new Error(`unexpected signing algorithm: ${header.alg}`);
+      }
+      if (!Array.isArray(header.x5c) || header.x5c.length === 0) {
+        throw new Error("attestation report is missing x5c certificate chain");
+      }
+      if (payload.iss !== GCP_CONFIDENTIAL_SPACE_ISSUER) {
+        throw new Error(`unexpected issuer: ${payload.iss}`);
+      }
+      const now = Math.floor(Date.now() / 1e3);
+      if (typeof payload.nbf === "number" && now + TOKEN_CLOCK_SKEW_S2 < payload.nbf) {
+        throw new Error(`attestation not yet valid (nbf=${payload.nbf})`);
+      }
+      if (typeof payload.exp === "number" && now - TOKEN_CLOCK_SKEW_S2 > payload.exp) {
+        throw new Error(`attestation expired (exp=${payload.exp})`);
+      }
+      if (typeof payload.iat === "number" && payload.iat > now + TOKEN_CLOCK_SKEW_S2) {
+        throw new Error(`attestation issued in future (iat=${payload.iat})`);
+      }
+      const publicKey = verifyX5cChain(header.x5c);
+      const verifier = import_crypto.default.createVerify("RSA-SHA256");
+      verifier.update(`${headerB64}.${payloadB64}`);
+      if (!verifier.verify(publicKey, new Uint8Array(decodeBase64Url2(signatureB64)))) {
+        throw new Error("attestation signature verification failed");
+      }
+      if (!payload.eat_nonce) {
+        throw new Error("eat_nonce claim is missing");
+      }
+      const nonces = Array.isArray(payload.eat_nonce) ? payload.eat_nonce : [payload.eat_nonce];
+      let attestedAddress;
+      for (const n of nonces) {
+        const m = typeof n === "string" ? n.match(ATTESTOR_NONCE_PATTERN) : null;
+        if (m) {
+          attestedAddress = m[1];
+          break;
+        }
+      }
+      if (!attestedAddress) {
+        throw new Error(
+          `attestor_public_key nonce not found in eat_nonce: ${JSON.stringify(payload.eat_nonce)}`
+        );
+      }
+      if (normalizeAddress(attestedAddress) !== normalizeAddress(expectedAttestorAddress)) {
+        throw new Error(
+          `attestor address mismatch: attestation binds to 0x${attestedAddress.toLowerCase()}, expected ${expectedAttestorAddress}`
+        );
+      }
+      const imageDigest = (_e = (_b = (_a = payload.submods) == null ? void 0 : _a.container) == null ? void 0 : _b.image_digest) != null ? _e : (_d = (_c = payload.google) == null ? void 0 : _c.compute_engine) == null ? void 0 : _d.image_digest;
+      return { isVerified: true, imageDigest };
+    } catch (error) {
+      return {
+        isVerified: false,
+        error: error instanceof Error ? error.message : String(error)
+      };
+    }
+  });
+}
+function normalizeAttestorAddress(address) {
+  return address.trim().toLowerCase();
+}
+function normalizeSignature(sig) {
+  return sig.trim().toLowerCase();
+}
+function verifyAttestorTeeForProof(proof, config) {
+  return __async(this, null, function* () {
+    var _a;
+    if (!proof.witnesses || proof.witnesses.length === 0) {
+      throw new AttestorTeeVerificationError("Proof has no witnesses");
+    }
+    const expectedDigests = (_a = config.expectedImageDigests) == null ? void 0 : _a.map((d) => d.trim());
+    const proofSignatures = new Set((proof.signatures || []).map(normalizeSignature));
+    const claimSignData = createSignDataForClaim(proof.claimData);
+    for (const witness of proof.witnesses) {
+      const att = witness.claimAttestation;
+      if (!att) {
+        throw new AttestorTeeVerificationError(
+          `Witness ${witness.id} is missing claimAttestation`
+        );
+      }
+      if (normalizeAttestorAddress(att.attestor_address) !== normalizeAttestorAddress(witness.id)) {
+        throw new AttestorTeeVerificationError(
+          `claimAttestation.attestor_address ${att.attestor_address} does not match witness id ${witness.id}`
+        );
+      }
+      if (!proofSignatures.has(normalizeSignature(att.claim_signature))) {
+        throw new AttestorTeeVerificationError(
+          `claimAttestation.claim_signature for witness ${witness.id} is not present in proof.signatures`
+        );
+      }
+      let recoveredSigner;
+      try {
+        recoveredSigner = import_ethers6.ethers.verifyMessage(claimSignData, att.claim_signature);
+      } catch (error) {
+        throw new AttestorTeeVerificationError(
+          `Failed to recover signer from claimAttestation.claim_signature for witness ${witness.id}`,
+          error
+        );
+      }
+      if (normalizeAttestorAddress(recoveredSigner) !== normalizeAttestorAddress(witness.id)) {
+        throw new AttestorTeeVerificationError(
+          `claim_signature recovers to ${recoveredSigner}, expected attestor ${witness.id}`
+        );
+      }
+      const result = yield verifyAttestorTeeAttestation(att.attestation_report, witness.id);
+      if (!result.isVerified) {
+        throw new AttestorTeeVerificationError(
+          `Attestor TEE attestation verification failed for witness ${witness.id}: ${result.error}`
+        );
+      }
+      if (expectedDigests && expectedDigests.length > 0) {
+        if (!result.imageDigest) {
+          throw new AttestorTeeVerificationError(
+            `Attestor TEE attestation for witness ${witness.id} did not expose an image digest to check against expectedImageDigests`
+          );
+        }
+        if (!expectedDigests.includes(result.imageDigest)) {
+          throw new AttestorTeeVerificationError(
+            `Attestor image digest ${result.imageDigest} for witness ${witness.id} is not in expectedImageDigests`
+          );
+        }
+      }
+    }
+  });
+}
+function runAttestorTeeVerification(_0) {
+  return __async(this, arguments, function* (proofs, config = {}) {
+    if (!proofs || proofs.length === 0) {
+      throw new AttestorTeeVerificationError("No proofs provided for attestor TEE verification");
+    }
+    try {
+      for (const proof of proofs) {
+        yield verifyAttestorTeeForProof(proof, config);
+      }
+    } catch (error) {
+      logger10.error("Attestor TEE attestation verification failed:", error);
+      if (error instanceof AttestorTeeVerificationError) {
+        throw error;
+      }
+      throw new AttestorTeeVerificationError(
+        "Attestor TEE attestation verification failed",
+        error
+      );
+    }
+  });
+}
+
+// src/Reclaim.ts
+var logger11 = logger_default.logger;
 var sdkVersion = require_package().version;
 var SDK_TEE_ATTESTATION_VERSION = "v3";
 function verifyProof(proofOrProofs, config) {
@@ -2061,22 +2382,30 @@ function verifyProof(proofOrProofs, config) {
       if (!config) {
         throw new ProofNotValidatedError("Verification configuration is required for `verifyProof(proof, config)`");
       }
-      const attestors = yield getAttestors();
-      for (const proof of proofs) {
-        yield assertVerifiedProof(proof, attestors);
+      if (config.hasNoPii !== true) {
+        console.info({ pii: config.hasNoPii });
+        const attestors = yield getAttestors();
+        for (const proof of proofs) {
+          yield assertVerifiedProof(proof, attestors);
+        }
       }
-      yield assertValidateProof(proofs, config);
+      yield assertValidateProof(proofs, config, { hasNoPii: config.hasNoPii });
       let isTeeAttestationVerified;
+      let isAttestorTeeAttestationVerified;
       if (config.teeAttestation && "dangerouslyDisableContentValidation" in config && config.dangerouslyDisableContentValidation) {
-        logger10.warn("teeAttestation is enabled but content validation is disabled \u2014 TEE attestation alone does not guarantee proof contents are valid");
+        logger11.warn("teeAttestation is enabled but content validation is disabled \u2014 TEE attestation alone does not guarantee proof contents are valid");
       }
       if (config.teeAttestation) {
         yield runTeeVerification(proofs, config.teeAttestation);
         isTeeAttestationVerified = true;
       }
-      return createVerifyProofResultSuccess(proofs, isTeeAttestationVerified);
+      if (config.attestorTeeAttestation) {
+        yield runAttestorTeeVerification(proofs, config.attestorTeeAttestation);
+        isAttestorTeeAttestationVerified = true;
+      }
+      return createVerifyProofResultSuccess(proofs, isTeeAttestationVerified, isAttestorTeeAttestationVerified);
     } catch (error) {
-      logger10.error("Error in validating proof:", error);
+      logger11.error("Error in validating proof:", error);
       const _error = error instanceof Error ? error : new Error(String(error));
       return createVerifyProofResultFailure(_error);
     }
@@ -2226,7 +2555,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     }
     this.options = options;
     this.sdkVersion = "js-" + sdkVersion;
-    logger10.info(`Initializing client with applicationId: ${this.applicationId}`);
+    logger11.info(`Initializing client with applicationId: ${this.applicationId}`);
   }
   /**
    * Initializes a new Reclaim proof request instance with automatic signature generation and session creation.
@@ -2285,7 +2614,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         return proofRequestInstance;
       } catch (error) {
         console.error(error);
-        logger10.info("Failed to initialize ReclaimProofRequest", error);
+        logger11.info("Failed to initialize ReclaimProofRequest", error);
         throw new InitError("Failed to initialize ReclaimProofRequest", error);
       }
     });
@@ -2374,7 +2703,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         return proofRequestInstance;
       } catch (error) {
         console.error(error);
-        logger10.info("Failed to initialize ReclaimProofRequest with signature", error);
+        logger11.info("Failed to initialize ReclaimProofRequest with signature", error);
         throw new InitError("Failed to initialize ReclaimProofRequest with signature", error);
       }
     });
@@ -2491,7 +2820,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
                 Intl.getCanonicalLocales(options.preferredLocale);
                 return true;
               } catch (error) {
-                logger10.info("Failed to canonicalize locale", error);
+                logger11.info("Failed to canonicalize locale", error);
                 return false;
               }
             }
@@ -2516,7 +2845,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         proofRequestInstance.cancelRedirectUrlOptions = cancelRedirectUrlOptions;
         return proofRequestInstance;
       } catch (error) {
-        logger10.info("Failed to parse JSON string in fromJsonString:", error);
+        logger11.info("Failed to parse JSON string in fromJsonString:", error);
         throw new InvalidParamError("Invalid JSON string provided to fromJsonString");
       }
     });
@@ -2677,9 +3006,9 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     try {
       validateModalOptions(options, "setModalOptions");
       this.modalOptions = __spreadValues(__spreadValues({}, this.modalOptions), options);
-      logger10.info("Modal options set successfully");
+      logger11.info("Modal options set successfully");
     } catch (error) {
-      logger10.info("Error setting modal options:", error);
+      logger11.info("Error setting modal options:", error);
       throw new SetParamsError("Error setting modal options", error);
     }
   }
@@ -2709,7 +3038,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       this.context = JSON.parse(canonicalStringify(__spreadProps(__spreadValues({}, context), { reclaimSessionId: this.sessionId })));
       this.applyAttestationContext();
     } catch (error) {
-      logger10.info("Error setting context", error);
+      logger11.info("Error setting context", error);
       throw new SetContextError("Error setting context", error);
     }
   }
@@ -2741,7 +3070,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       this.context = { contextAddress: address, contextMessage: message, reclaimSessionId: this.sessionId };
       this.applyAttestationContext();
     } catch (error) {
-      logger10.info("Error setting context", error);
+      logger11.info("Error setting context", error);
       throw new SetContextError("Error setting context", error);
     }
   }
@@ -2776,7 +3105,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       validateParameters(params);
       this.parameters = __spreadValues(__spreadValues({}, this.parameters), params);
     } catch (error) {
-      logger10.info("Error Setting Params:", error);
+      logger11.info("Error Setting Params:", error);
       throw new SetParamsError("Error setting params", error);
     }
   }
@@ -2800,7 +3129,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       validateFunctionParams([{ input: this.sessionId, paramName: "sessionId", isString: true }], "getAppCallbackUrl");
       return this.appCallbackUrl || `${constants.DEFAULT_RECLAIM_CALLBACK_URL}${this.sessionId}`;
     } catch (error) {
-      logger10.info("Error getting app callback url", error);
+      logger11.info("Error getting app callback url", error);
       throw new GetAppCallbackUrlError("Error getting app callback url", error);
     }
   }
@@ -2824,7 +3153,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       validateFunctionParams([{ input: this.sessionId, paramName: "sessionId", isString: true }], "getCancelCallbackUrl");
       return this.cancelCallbackUrl || `${constants.DEFAULT_RECLAIM_CANCEL_CALLBACK_URL}${this.sessionId}`;
     } catch (error) {
-      logger10.info("Error getting cancel callback url", error);
+      logger11.info("Error getting cancel callback url", error);
       throw new GetAppCallbackUrlError("Error getting cancel callback url", error);
     }
   }
@@ -2847,7 +3176,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       validateFunctionParams([{ input: this.sessionId, paramName: "sessionId", isString: true }], "getStatusUrl");
       return `${constants.DEFAULT_RECLAIM_STATUS_URL}${this.sessionId}`;
     } catch (error) {
-      logger10.info("Error fetching Status Url", error);
+      logger11.info("Error fetching Status Url", error);
       throw new GetStatusUrlError("Error fetching status url", error);
     }
   }
@@ -2917,7 +3246,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
             Intl.getCanonicalLocales(options.preferredLocale);
             return true;
           } catch (error) {
-            logger10.info("Failed to canonicalize locale", error);
+            logger11.info("Failed to canonicalize locale", error);
             return false;
           }
         }
@@ -2929,24 +3258,24 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     try {
       validateFunctionParams([{ input: signature, paramName: "signature", isString: true }], "setSignature");
       this.signature = signature;
-      logger10.info(`Signature set successfully for applicationId: ${this.applicationId}`);
+      logger11.info(`Signature set successfully for applicationId: ${this.applicationId}`);
     } catch (error) {
-      logger10.info("Error setting signature", error);
+      logger11.info("Error setting signature", error);
       throw new SetSignatureError("Error setting signature", error);
     }
   }
   generateSignature(applicationSecret) {
     return __async(this, null, function* () {
       try {
-        const wallet = new import_ethers6.ethers.Wallet(applicationSecret);
+        const wallet = new import_ethers7.ethers.Wallet(applicationSecret);
         const canonicalData = (0, import_canonicalize3.default)({ providerId: this.providerId, timestamp: this.timeStamp });
         if (!canonicalData) {
           throw new SignatureGeneratingError("Failed to canonicalize data for signing.");
         }
-        const messageHash = import_ethers6.ethers.keccak256(new TextEncoder().encode(canonicalData));
-        return yield wallet.signMessage(import_ethers6.ethers.getBytes(messageHash));
+        const messageHash = import_ethers7.ethers.keccak256(new TextEncoder().encode(canonicalData));
+        return yield wallet.signMessage(import_ethers7.ethers.getBytes(messageHash));
       } catch (err) {
-        logger10.info(`Error generating proof request for applicationId: ${this.applicationId}, providerId: ${this.providerId}, timeStamp: ${this.timeStamp}`);
+        logger11.info(`Error generating proof request for applicationId: ${this.applicationId}, providerId: ${this.providerId}, timeStamp: ${this.timeStamp}`);
         throw new SignatureGeneratingError(`Error generating signature for applicationId: ${this.applicationId}`);
       }
     });
@@ -2987,7 +3316,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     return __async(this, null, function* () {
       const newTab = preOpenedTab != null ? preOpenedTab : window.open("about:blank", "_blank");
       const link = yield createLinkWithTemplateData(templateData, this.customSharePageUrl);
-      logger10.info("Opening portal in new tab: " + link);
+      logger11.info("Opening portal in new tab: " + link);
       if (newTab) {
         this.portalTab = newTab;
         newTab.location = link;
@@ -3017,7 +3346,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       let link = yield createLinkWithTemplateData(templateData, this.customSharePageUrl);
       const separator = link.includes("?") ? "&" : "?";
       link = `${link}${separator}embedded=true`;
-      logger10.info("Embedding portal in iframe: " + link);
+      logger11.info("Embedding portal in iframe: " + link);
       this.closeEmbeddedFlow();
       const iframe = document.createElement("iframe");
       iframe.src = link;
@@ -3129,7 +3458,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       var _a, _b, _c;
       const options = __spreadValues(__spreadValues({}, (_a = this.options) == null ? void 0 : _a.launchOptions), launchOptions);
       const mode = (_b = options.verificationMode) != null ? _b : "portal";
-      logger10.info("Creating Request Url");
+      logger11.info("Creating Request Url");
       if (!this.signature) {
         throw new SignatureNotFoundError("Signature is not set.");
       }
@@ -3140,18 +3469,18 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
           const template = this.encodeTemplateData(templateData);
           if (((_c = this.options) == null ? void 0 : _c.useAppClip) && getDeviceType() === "mobile" /* MOBILE */ && getMobileDeviceType() === "ios" /* IOS */) {
             const appClipUrl = this.customAppClipUrl ? `${this.customAppClipUrl}&template=${template}` : `https://appclip.apple.com/id?p=org.reclaimprotocol.app.clip&template=${template}`;
-            logger10.info("App Clip Url created successfully: " + appClipUrl);
+            logger11.info("App Clip Url created successfully: " + appClipUrl);
             return appClipUrl;
           }
           const sharePageUrl = yield createLinkWithTemplateData(templateData, this.appSharePageUrl);
-          logger10.info("Share page Url created successfully: " + sharePageUrl);
+          logger11.info("Share page Url created successfully: " + sharePageUrl);
           return sharePageUrl;
         }
         const link = yield createLinkWithTemplateData(templateData, this.customSharePageUrl);
-        logger10.info("Request Url created successfully: " + link);
+        logger11.info("Request Url created successfully: " + link);
         return link;
       } catch (error) {
-        logger10.info("Error creating Request Url:", error);
+        logger11.info("Error creating Request Url:", error);
         throw error;
       }
     });
@@ -3210,11 +3539,11 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       try {
         const templateData = this.getTemplateData();
         this.templateData = templateData;
-        logger10.info(`Triggering Reclaim flow (mode: ${mode})`);
+        logger11.info(`Triggering Reclaim flow (mode: ${mode})`);
         const deviceType = getDeviceType();
         updateSession(this.sessionId, "SESSION_STARTED" /* SESSION_STARTED */);
         if (launchOptions && "target" in launchOptions && !launchOptions.target) {
-          logger10.warn("triggerReclaimFlow: target was provided but is null/undefined \u2014 falling back to default flow. Ensure the element exists in the DOM.");
+          logger11.warn("triggerReclaimFlow: target was provided but is null/undefined \u2014 falling back to default flow. Ensure the element exists in the DOM.");
         }
         if ((launchOptions == null ? void 0 : launchOptions.target) && mode === "portal") {
           yield this.embedPortalIframe(templateData, launchOptions.target);
@@ -3227,7 +3556,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
           if ((_c = this.options) == null ? void 0 : _c.useBrowserExtension) {
             const extensionAvailable = yield this.isBrowserExtensionAvailable();
             if (extensionAvailable) {
-              logger10.info("Triggering browser extension flow");
+              logger11.info("Triggering browser extension flow");
               this.triggerBrowserExtensionFlow();
               return {
                 close: () => {
@@ -3239,16 +3568,16 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
           if (mode === "portal") {
             yield this.openPortalTab(templateData);
           } else {
-            logger10.info("Showing QR code modal with share page URL");
+            logger11.info("Showing QR code modal with share page URL");
             yield this.showQRCodeModal();
           }
         } else if (deviceType === "mobile" /* MOBILE */) {
           if (mode === "app") {
             if (((_d = this.options) == null ? void 0 : _d.useAppClip) && getMobileDeviceType() === "ios" /* IOS */) {
-              logger10.info("Redirecting to iOS app clip");
+              logger11.info("Redirecting to iOS app clip");
               this.redirectToAppClip();
             } else {
-              logger10.info("Redirecting to share page");
+              logger11.info("Redirecting to share page");
               yield this.redirectToInstantApp(options);
             }
           } else {
@@ -3265,7 +3594,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
           tab: (_e = this.portalTab) != null ? _e : void 0
         };
       } catch (error) {
-        logger10.info("Error triggering Reclaim flow:", error);
+        logger11.info("Error triggering Reclaim flow:", error);
         throw error;
       }
     });
@@ -3313,7 +3642,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
           window.postMessage(message, "*");
         });
       } catch (error) {
-        logger10.info("Error checking Reclaim extension installed:", error);
+        logger11.info("Error checking Reclaim extension installed:", error);
         return false;
       }
     });
@@ -3326,7 +3655,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       extensionID: this.extensionID
     };
     window.postMessage(message, "*");
-    logger10.info("Browser extension flow triggered");
+    logger11.info("Browser extension flow triggered");
   }
   showQRCodeModal() {
     return __async(this, null, function* () {
@@ -3335,7 +3664,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         this.modal = new QRCodeModal(this.modalOptions);
         yield this.modal.show(requestUrl);
       } catch (error) {
-        logger10.info("Error showing QR code modal:", error);
+        logger11.info("Error showing QR code modal:", error);
         throw error;
       }
     });
@@ -3346,7 +3675,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
       try {
         const template = this.encodeTemplateData(this.templateData);
         let instantAppUrl = this.buildSharePageUrl(template);
-        logger10.info("Redirecting to Android instant app: " + instantAppUrl);
+        logger11.info("Redirecting to Android instant app: " + instantAppUrl);
         const isDeferredDeeplinksFlowEnabled = (_a = options.canUseDeferredDeepLinksFlow) != null ? _a : false;
         if (isDeferredDeeplinksFlowEnabled) {
           instantAppUrl = instantAppUrl.replace("/verifier", "/link");
@@ -3396,7 +3725,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
         }
         window.location.href = instantAppUrl;
       } catch (error) {
-        logger10.info("Error redirecting to instant app:", error);
+        logger11.info("Error redirecting to instant app:", error);
         throw error;
       }
     });
@@ -3405,14 +3734,14 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     try {
       const template = this.encodeTemplateData(this.templateData);
       const appClipUrl = this.customAppClipUrl ? `${this.customAppClipUrl}&template=${template}` : `https://appclip.apple.com/id?p=org.reclaimprotocol.app.clip&template=${template}`;
-      logger10.info("Redirecting to iOS app clip: " + appClipUrl);
+      logger11.info("Redirecting to iOS app clip: " + appClipUrl);
       const verifierUrl = `${this.appSharePageUrl}/?template=${template}`;
       window.location.href = appClipUrl;
       setTimeout(() => {
         window.location.href = verifierUrl;
       }, 5 * 1e3);
     } catch (error) {
-      logger10.info("Error redirecting to app clip:", error);
+      logger11.info("Error redirecting to app clip:", error);
       throw error;
     }
   }
@@ -3493,13 +3822,13 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
     return __async(this, arguments, function* ({ onSuccess, onError, verificationConfig }) {
       if (!this.sessionId) {
         const message = "Session can't be started due to undefined value of sessionId";
-        logger10.info(message);
+        logger11.info(message);
         throw new SessionNotStartedError(message);
       }
-      logger10.info("Starting session");
+      logger11.info("Starting session");
       const sessionUpdatePollingInterval = 3 * 1e3;
       const interval = setInterval(() => __async(this, null, function* () {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _e, _f;
         try {
           const statusUrlResponse = yield fetchStatusUrl(this.sessionId);
           if (!statusUrlResponse.session) return;
@@ -3524,9 +3853,15 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
             if (statusUrlResponse.session.proofs && statusUrlResponse.session.proofs.length > 0) {
               const proofs = statusUrlResponse.session.proofs;
               if (this.claimCreationType === "createClaim" /* STANDALONE */) {
-                const result = yield verifyProof(proofs, verificationConfig != null ? verificationConfig : this.getProviderVersion());
+                const sessionProviderVersion = statusUrlResponse.session.providerVersionString;
+                const effectiveConfig = verificationConfig != null ? verificationConfig : {
+                  providerId: this.providerId,
+                  providerVersion: sessionProviderVersion || this.resolvedProviderVersion || "",
+                  allowedTags: ((_b = this.options) == null ? void 0 : _b.acceptAiProviders) ? ["ai"] : []
+                };
+                const result = yield verifyProof(proofs, effectiveConfig);
                 if (!result.isVerified) {
-                  logger10.info(`Proofs not verified: count=${proofs == null ? void 0 : proofs.length}`);
+                  logger11.info(`Proofs not verified: count=${proofs == null ? void 0 : proofs.length}`);
                   throw new ProofNotVerifiedError(`Proofs not verified: count=${proofs == null ? void 0 : proofs.length}`, result.error);
                 }
               }
@@ -3536,13 +3871,13 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
                 onSuccess(proofs);
               }
               this.clearInterval();
-              (_b = this.modal) == null ? void 0 : _b.close();
+              (_c = this.modal) == null ? void 0 : _c.close();
               this.closePortalTab();
               this.closeEmbeddedFlow();
             }
           } else {
             if (statusUrlResponse.session.statusV2 === "PROOF_SUBMISSION_FAILED" /* PROOF_SUBMISSION_FAILED */) {
-              const errorMessage = ((_c = statusUrlResponse.session.error) == null ? void 0 : _c.message) || "Proof submission failed";
+              const errorMessage = ((_d = statusUrlResponse.session.error) == null ? void 0 : _d.message) || "Proof submission failed";
               throw new ProofSubmissionFailedError(errorMessage);
             }
             if (statusUrlResponse.session.statusV2 === "PROOF_SUBMITTED" /* PROOF_SUBMITTED */ || statusUrlResponse.session.statusV2 === "AI_PROOF_SUBMITTED" /* AI_PROOF_SUBMITTED */) {
@@ -3550,7 +3885,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
                 onSuccess([]);
               }
               this.clearInterval();
-              (_d = this.modal) == null ? void 0 : _d.close();
+              (_e = this.modal) == null ? void 0 : _e.close();
               this.closePortalTab();
               this.closeEmbeddedFlow();
             }
@@ -3560,7 +3895,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
             onError(e);
           }
           this.clearInterval();
-          (_e = this.modal) == null ? void 0 : _e.close();
+          (_f = this.modal) == null ? void 0 : _f.close();
           this.closePortalTab();
           this.closeEmbeddedFlow();
         }
@@ -3584,7 +3919,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
   closeModal() {
     if (this.modal) {
       this.modal.close();
-      logger10.info("Modal closed by user");
+      logger11.info("Modal closed by user");
     }
   }
   /**
@@ -3604,7 +3939,7 @@ var ReclaimProofRequest = class _ReclaimProofRequest {
 };
 
 // src/utils/signatureUtils.ts
-var import_ethers7 = require("ethers");
+var import_ethers8 = require("ethers");
 var import_canonicalize4 = __toESM(require("canonicalize"));
 function generateInitSignature(appSecret, providerId, timestamp) {
   return __async(this, null, function* () {
@@ -3614,13 +3949,13 @@ function generateInitSignature(appSecret, providerId, timestamp) {
       { input: timestamp, paramName: "timestamp", isString: true }
     ], "generateInitSignature");
     try {
-      const wallet = new import_ethers7.ethers.Wallet(appSecret);
+      const wallet = new import_ethers8.ethers.Wallet(appSecret);
       const canonicalData = (0, import_canonicalize4.default)({ providerId, timestamp });
       if (!canonicalData) {
         throw new SignatureGeneratingError("Failed to canonicalize data for signing.");
       }
-      const messageHash = import_ethers7.ethers.keccak256(new TextEncoder().encode(canonicalData));
-      return yield wallet.signMessage(import_ethers7.ethers.getBytes(messageHash));
+      const messageHash = import_ethers8.ethers.keccak256(new TextEncoder().encode(canonicalData));
+      return yield wallet.signMessage(import_ethers8.ethers.getBytes(messageHash));
     } catch (err) {
       throw new SignatureGeneratingError(
         `Error generating init signature for providerId: ${providerId}`,
@@ -3631,8 +3966,40 @@ function generateInitSignature(appSecret, providerId, timestamp) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ApplicationError,
+  AttestorTeeVerificationError,
+  BackendServerError,
+  CallbackUrlRequiredError,
+  ErrorDuringVerificationError,
+  GetAppCallbackUrlError,
+  GetStatusUrlError,
+  HASH_MATCH_MULTIPLE_DEFAULT,
+  HASH_REQUIRED_DEFAULT,
+  InavlidParametersError,
+  InitError,
+  InitSessionError,
+  InvalidParamError,
+  InvalidRequestSpecError,
+  InvalidSignatureError,
+  NoProviderParamsError,
+  ProofNotValidatedError,
+  ProofNotVerifiedError,
+  ProofSubmissionFailedError,
+  ProviderConfigFetchError,
+  ProviderFailedError,
+  ProviderNotFoundError,
   ReclaimProofRequest,
+  SessionNotStartedError,
+  SetContextError,
+  SetParamsError,
+  SetSignatureError,
+  SignatureGeneratingError,
+  SignatureNotFoundError,
+  StatusUrlError,
   TeeVerificationError,
+  TimeoutError,
+  UnknownProofsNotValidatedError,
+  UpdateSessionError,
   assertValidProofsByHash,
   assertValidateProof,
   assertVerifiedProof,
@@ -3647,6 +4014,7 @@ function generateInitSignature(appSecret, providerId, timestamp) {
   generateSpecsFromRequestSpecTemplate,
   getAttestors,
   getDeviceType,
+  getHashFromProof,
   getHttpProviderClaimParamsFromProof,
   getIdentifierFromClaimInfo,
   getMobileDeviceType,
@@ -3666,6 +4034,7 @@ function generateInitSignature(appSecret, providerId, timestamp) {
   takeTemplateParametersFromProofs,
   transformForOnchain,
   updateSession,
+  verifyAttestorTeeAttestation,
   verifyProof,
   verifyTeeAttestation
 });