From 489ae7087472f54723814976aff700b898b85961 Mon Sep 17 00:00:00 2001 From: ozwaldorf Date: Tue, 25 Aug 2026 16:24:44 -0400 Subject: [PATCH 1/2] fix(attestation): handle default-only interop for dcap-qvl The package is CJS with a trailing module.exports, so bundlers that cannot statically detect its named exports surface it as default only. Destructuring QuoteVerifier then yielded undefined and threw inside the verify call, which surfaced as a misleading quote verification failure. --- src/internal/attestation.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/internal/attestation.ts b/src/internal/attestation.ts index ae7cd8e..fc9c927 100644 --- a/src/internal/attestation.ts +++ b/src/internal/attestation.ts @@ -189,7 +189,11 @@ export async function verifyAttestation( ); } - const { QuoteVerifier } = await import("@phala/dcap-qvl"); + const dcap = await import("@phala/dcap-qvl"); + // Package is CJS with a trailing module.exports, so some bundlers only surface it as default. + const { QuoteVerifier } = dcap.QuoteVerifier + ? dcap + : ((dcap as unknown as { default: typeof dcap }).default ?? dcap); const quoteBytes = hexToBytes(attestation.quote); From 4dfe4bcc309542a33e989bcb7faf2b01b1086cb3 Mon Sep 17 00:00:00 2001 From: ozwaldorf Date: Tue, 25 Aug 2026 16:32:29 -0400 Subject: [PATCH 2/2] chore: bump to 0.4.4 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 31ca941..921129c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@mirageprivacy/sdk", - "version": "0.4.3", + "version": "0.4.4", "description": "SDK for private transfers on Mirage", "type": "module", "main": "./dist/index.cjs",