@zkp2p/zkp2p-attestation 1.6.2 → 1.6.3

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.6.3
+
+- Bind the default global `fetch` fallback to `globalThis` so browser and extension callers that rely on SDK defaults do not hit receiver-sensitive `Illegal invocation` failures. Caller-provided `fetch` overrides are still used unchanged.
+
 ## 1.6.2
 
 - Default the production environment to `https://attestation-service.zkp2p.xyz` and bundle a production PCR8 pin for that hostname. The historical `attestation-service-preprod.zkp2p.xyz` hostname remains pinned to the same production PCR8.

package/dist/cli/verify.js

@@ -3809,11 +3809,16 @@ async function wrapCryptoFailure(promise, code, message) {
 
 // src/crypto/env.ts
 function resolveFetch(fetchOverride) {
-  const fetcher = fetchOverride ?? globalThis.fetch;
-  if (typeof fetcher !== "function") {
+  if (fetchOverride !== void 0) {
+    if (typeof fetchOverride !== "function") {
+      fail("CRYPTO_UNAVAILABLE", "fetch is unavailable; pass a fetch implementation");
+    }
+    return fetchOverride;
+  }
+  if (typeof globalThis.fetch !== "function") {
     fail("CRYPTO_UNAVAILABLE", "fetch is unavailable; pass a fetch implementation");
   }
-  return fetcher;
+  return globalThis.fetch.bind(globalThis);
 }
 function resolveSubtle(subtleOverride) {
   const subtle = subtleOverride ?? globalThis.crypto?.subtle;