@0xpolygonid/js-sdk 1.9.1 → 1.9.3

package/dist/node/esm/kms/key-providers/ed25519-provider.js

@@ -0,0 +1,69 @@
+import * as providerHelpers from '../provider-helpers';
+import { ed25519 } from '@noble/curves/ed25519';
+import { bytesToHex } from '../../utils';
+/**
+ * Provider for Ed25519 keys
+ * @public
+ * @class Ed25519Provider
+ * @implements IKeyProvider interface
+ */
+export class Ed25519Provider {
+    /**
+     * Creates an instance of Ed25519Provider.
+     * @param {KmsKeyType} keyType - kms key type
+     * @param {AbstractPrivateKeyStore} keyStore - key store for kms
+     */
+    constructor(keyType, _keyStore) {
+        this.keyType = keyType;
+        this._keyStore = _keyStore;
+    }
+    /**
+     * generates a ed25519 key from a seed phrase
+     * @param {Uint8Array} seed - byte array seed
+     * @returns {Promise<KmsKeyId>} kms key identifier
+     */
+    async newPrivateKeyFromSeed(seed) {
+        if (seed.length !== 32) {
+            throw new Error('Seed should be 32 bytes');
+        }
+        const publicKey = ed25519.getPublicKey(seed);
+        const kmsId = {
+            type: this.keyType,
+            id: providerHelpers.keyPath(this.keyType, bytesToHex(publicKey))
+        };
+        await this._keyStore.importKey({
+            alias: kmsId.id,
+            key: bytesToHex(seed)
+        });
+        return kmsId;
+    }
+    /**
+     * Gets public key by kmsKeyId
+     * @param {KmsKeyId} keyId - key identifier
+     * @returns {Promise<string>} Public key as a hex string
+     */
+    async publicKey(keyId) {
+        const privateKeyHex = await this.privateKey(keyId);
+        const publicKey = ed25519.getPublicKey(privateKeyHex);
+        return bytesToHex(publicKey);
+    }
+    /**
+     * signs prepared payload of size,
+     * with a key id
+     * @param {KmsKeyId} keyId  - key identifier
+     * @param {Uint8Array} data - data to sign (32 bytes)
+     * @returns {Promise<Uint8Array>} signature
+     */
+    async sign(keyId, data) {
+        const privateKeyHex = await this.privateKey(keyId);
+        return ed25519.sign(data, privateKeyHex);
+    }
+    /**
+     * Retrieves the private key for a given keyId from the key store.
+     * @param {KmsKeyId} keyId - The identifier of the key to retrieve.
+     * @returns {Promise<string>} The private key associated with the keyId.
+     */
+    async privateKey(keyId) {
+        return this._keyStore.get({ alias: keyId.id });
+    }
+}

package/dist/node/esm/kms/key-providers/index.js

@@ -1,2 +1,3 @@
 export * from './bjj-provider';
+export * from './ed25519-provider';
 export * from './sec256k1-provider';

package/dist/node/esm/kms/store/types.js

@@ -7,4 +7,5 @@ export var KmsKeyType;
 (function (KmsKeyType) {
     KmsKeyType["BabyJubJub"] = "BJJ";
     KmsKeyType["Secp256k1"] = "Secp256k1";
+    KmsKeyType["Ed25519"] = "Ed25519";
 })(KmsKeyType || (KmsKeyType = {}));

package/dist/node/esm/proof/common.js

@@ -1,5 +1,5 @@
 import { Hash, Proof, ZERO_HASH } from '@iden3/js-merkletree';
-import { buildTreeState, isValidOperation, Operators, QueryOperators, XSDNS } from '../circuits';
+import { buildTreeState, isValidOperation, Operators, QueryOperators } from '../circuits';
 import { buildFieldPath, getSerializationAttrFromContext, getFieldSlotIndex } from '../verifiable';
 import { Merklizer, Path } from '@iden3/js-jsonld-merklization';
 import { byteEncoder } from '../utils';
@@ -119,12 +119,14 @@ export const parseQueryMetadata = async (propertyQuery, ldContextJSON, credentia
             throw new Error(`field does not exist in the schema ${e.message}`);
         }
     }
-    if (propertyQuery.operatorValue) {
+    if (propertyQuery.operatorValue !== undefined) {
         if (!isValidOperation(query.datatype, propertyQuery.operator)) {
             throw new Error(`operator ${propertyQuery.operator} is not supported for datatype ${query.datatype}`);
         }
-        const datatype = propertyQuery.operator === Operators.EXISTS ? XSDNS.Boolean : query.datatype;
-        query.values = await transformQueryValueToBigInts(propertyQuery.operatorValue, datatype);
+        query.values =
+            propertyQuery.operator === Operators.EXISTS
+                ? transformExistsValue(propertyQuery.operatorValue)
+                : await transformQueryValueToBigInts(propertyQuery.operatorValue, query.datatype);
     }
     return query;
 };
@@ -144,3 +146,9 @@ export const transformQueryValueToBigInts = async (value, ldType) => {
     }
     return values;
 };
+const transformExistsValue = (value) => {
+    if (typeof value == 'boolean') {
+        return [BigInt(value)];
+    }
+    throw new Error('exists operator value must be true or false');
+};

package/dist/node/esm/proof/proof-service.js

@@ -188,10 +188,7 @@ export class ProofService {
             query.valueProof = new ValueProof();
             query.valueProof.mtp = proof;
             query.valueProof.path = queryMetadata.claimPathKey;
-            const mtEntry = await mtValue?.mtEntry();
-            if (!mtEntry) {
-                throw new Error(`can't merklize credential: no merkle tree entry found`);
-            }
+            const mtEntry = (await mtValue?.mtEntry()) ?? 0n;
             query.valueProof.value = mtEntry;
             if (!queryMetadata.fieldName) {
                 query.values = [mtEntry];

package/dist/node/esm/proof/provers/inputs-generator.js

@@ -1,6 +1,6 @@
 import { DID, Id, getUnixTimestamp } from '@iden3/js-iden3-core';
 import { ProofType } from '../../verifiable';
-import { AtomicQueryMTPV2Inputs, AtomicQueryMTPV2OnChainInputs, AtomicQuerySigV2Inputs, AtomicQuerySigV2OnChainInputs, AtomicQueryV3Inputs, AtomicQueryV3OnChainInputs, CircuitClaim, CircuitId, LinkedMultiQueryInputs, Operators, QueryOperators, ValueProof } from '../../circuits';
+import { AtomicQueryMTPV2Inputs, AtomicQueryMTPV2OnChainInputs, AtomicQuerySigV2Inputs, AtomicQuerySigV2OnChainInputs, AtomicQueryV3Inputs, AtomicQueryV3OnChainInputs, CircuitClaim, CircuitId, LinkedMultiQueryInputs, Operators, QueryOperators, ValueProof, getOperatorNameByValue } from '../../circuits';
 import { toClaimNonRevStatus, toGISTProof } from '../common';
 import { getUserDIDFromCredential } from '../../credentials';
 const allOperations = Object.values(QueryOperators);
@@ -48,6 +48,7 @@ export class InputGenerator {
             circuitInputs.claimSubjectProfileNonce = BigInt(params.credentialSubjectProfileNonce);
             circuitInputs.profileNonce = BigInt(params.authProfileNonce);
             circuitInputs.skipClaimRevocationCheck = params.skipRevocation;
+            this.checkOperatorSupport(proofReq.circuitId, query.operator);
             return circuitInputs.inputsMarshal();
         };
         this.credentialAtomicQueryMTPV2OnChainPrepareInputs = async ({ preparedCredential, identifier, proofReq, params, circuitQueries }) => {
@@ -95,6 +96,7 @@ export class InputGenerator {
             circuitInputs.claimSubjectProfileNonce = BigInt(params.credentialSubjectProfileNonce);
             circuitInputs.profileNonce = BigInt(params.authProfileNonce);
             circuitInputs.skipClaimRevocationCheck = params.skipRevocation;
+            this.checkOperatorSupport(proofReq.circuitId, query.operator);
             return circuitInputs.inputsMarshal();
         };
         this.credentialAtomicQuerySigV2PrepareInputs = async ({ preparedCredential, identifier, proofReq, params, circuitQueries }) => {
@@ -116,6 +118,7 @@ export class InputGenerator {
             query.operator = this.transformV2QueryOperator(query.operator);
             circuitInputs.query = query;
             circuitInputs.currentTimeStamp = getUnixTimestamp(new Date());
+            this.checkOperatorSupport(proofReq.circuitId, query.operator);
             return circuitInputs.inputsMarshal();
         };
         this.credentialAtomicQuerySigV2OnChainPrepareInputs = async ({ preparedCredential, identifier, proofReq, params, circuitQueries }) => {
@@ -163,6 +166,7 @@ export class InputGenerator {
             const signature = await this._identityWallet.signChallenge(params.challenge, authInfo.credential);
             circuitInputs.signature = signature;
             circuitInputs.challenge = params.challenge;
+            this.checkOperatorSupport(proofReq.circuitId, query.operator);
             return circuitInputs.inputsMarshal();
         };
         this.credentialAtomicQueryV3PrepareInputs = async ({ preparedCredential, identifier, proofReq, params, circuitQueries }) => {
@@ -212,6 +216,7 @@ export class InputGenerator {
             circuitInputs.nullifierSessionID = proofReq.params?.nullifierSessionId
                 ? BigInt(proofReq.params?.nullifierSessionId?.toString())
                 : BigInt(0);
+            this.checkOperatorSupport(proofReq.circuitId, query.operator);
             return circuitInputs.inputsMarshal();
         };
         this.credentialAtomicQueryV3OnChainPrepareInputs = async ({ preparedCredential, identifier, proofReq, params, circuitQueries }) => {
@@ -290,15 +295,19 @@ export class InputGenerator {
                 circuitInputs.treeState = authClaimData.treeState;
                 circuitInputs.signature = signature;
             }
+            this.checkOperatorSupport(proofReq.circuitId, query.operator);
             return circuitInputs.inputsMarshal();
         };
-        this.linkedMultiQuery10PrepareInputs = async ({ preparedCredential, params, circuitQueries }) => {
+        this.linkedMultiQuery10PrepareInputs = async ({ preparedCredential, params, proofReq, circuitQueries }) => {
             const circuitClaimData = await this.newCircuitClaimData(preparedCredential);
             circuitClaimData.nonRevProof = toClaimNonRevStatus(preparedCredential.revStatus);
             const circuitInputs = new LinkedMultiQueryInputs();
             circuitInputs.linkNonce = params.linkNonce ?? BigInt(0);
             circuitInputs.claim = circuitClaimData.claim;
             circuitInputs.query = circuitQueries;
+            circuitQueries.forEach((query) => {
+                this.checkOperatorSupport(proofReq.circuitId, query.operator);
+            });
             return circuitInputs.inputsMarshal();
         };
     }
@@ -383,4 +392,10 @@ export class InputGenerator {
     transformV2QueryOperator(operator) {
         return operator === Operators.SD || operator === Operators.NOOP ? Operators.EQ : operator;
     }
+    checkOperatorSupport(circuitId, operator) {
+        const supportedOperators = circuitValidator[circuitId].supportedOperations;
+        if (!supportedOperators.includes(operator)) {
+            throw new Error(`operator ${getOperatorNameByValue(operator)} is not supported by ${circuitId}`);
+        }
+    }
 }

package/dist/node/esm/proof/verifiers/pub-signals-verifier.js

@@ -1,5 +1,5 @@
 import { DID, getDateFromUnixTimestamp } from '@iden3/js-iden3-core';
-import { Path } from '@iden3/js-jsonld-merklization';
+import { getDocumentLoader, Path } from '@iden3/js-jsonld-merklization';
 import { byteEncoder, isGenesisState } from '../../utils';
 import { calculateCoreSchemaHash, ProofType } from '../../verifiable';
 import { AtomicQueryMTPV2PubSignals } from '../../circuits/atomic-query-mtp-v2';
@@ -9,7 +9,7 @@ import { AuthV2PubSignals } from '../../circuits/auth-v2';
 import { BaseConfig } from '../../circuits/common';
 import { LinkedMultiQueryPubSignals, LinkedMultiQueryInputs } from '../../circuits/linked-multi-query';
 import { CircuitId } from '../../circuits/models';
-import { checkQueryRequest, fieldValueFromVerifiablePresentation } from './query';
+import { checkQueryRequest, fieldValueFromVerifiablePresentation, validateDisclosureV2Circuit, validateEmptyCredentialSubjectV2Circuit, validateOperators, verifyFieldValueInclusionV2, validateDisclosureNativeSDSupport, validateEmptyCredentialSubjectNoopNativeSupport, verifyFieldValueInclusionNativeExistsSupport } from './query';
 import { parseQueriesMetadata } from '../common';
 import { Operators } from '../../circuits';
 import { calculateQueryHashV3 } from './query-hash';
@@ -56,7 +56,7 @@ export class PubSignalsVerifier {
                 valueArraySize: mtpv2PubSignals.getValueArrSize(),
                 isRevocationChecked: mtpv2PubSignals.isRevocationChecked
             };
-            await checkQueryRequest(query, outs, CircuitId.AtomicQueryMTPV2, this._documentLoader, verifiablePresentation, opts);
+            await this.checkQueryV2Circuits(CircuitId.AtomicQueryMTPV2, query, outs, opts, verifiablePresentation);
             // verify state
             await this.checkStateExistenceForId(mtpv2PubSignals.issuerID, mtpv2PubSignals.issuerClaimIdenState);
             if (mtpv2PubSignals.isRevocationChecked !== 0) {
@@ -85,7 +85,7 @@ export class PubSignalsVerifier {
                 valueArraySize: sigV2PubSignals.getValueArrSize(),
                 isRevocationChecked: sigV2PubSignals.isRevocationChecked
             };
-            await checkQueryRequest(query, outs, CircuitId.AtomicQuerySigV2, this._documentLoader, verifiablePresentation, opts);
+            await this.checkQueryV2Circuits(CircuitId.AtomicQuerySigV2, query, outs, opts, verifiablePresentation);
             // verify state
             await this.checkStateExistenceForId(sigV2PubSignals.issuerID, sigV2PubSignals.issuerAuthState);
             if (sigV2PubSignals.isRevocationChecked !== 0) {
@@ -111,9 +111,53 @@ export class PubSignalsVerifier {
                 merklized: v3PubSignals.merklized,
                 claimPathKey: v3PubSignals.claimPathKey,
                 valueArraySize: v3PubSignals.getValueArrSize(),
+                operatorOutput: v3PubSignals.operatorOutput,
                 isRevocationChecked: v3PubSignals.isRevocationChecked
             };
-            await checkQueryRequest(query, outs, CircuitId.AtomicQueryV3, this._documentLoader, verifiablePresentation, opts);
+            if (!query.type) {
+                throw new Error(`proof query type is undefined`);
+            }
+            const loader = this._documentLoader ?? getDocumentLoader();
+            // validate schema
+            let context;
+            try {
+                context = (await loader(query.context ?? '')).document;
+            }
+            catch (e) {
+                throw new Error(`can't load schema for request query`);
+            }
+            const queriesMetadata = await parseQueriesMetadata(query.type, JSON.stringify(context), query.credentialSubject, {
+                documentLoader: loader
+            });
+            await checkQueryRequest(query, queriesMetadata, context, outs, CircuitId.AtomicQueryV3, this._documentLoader, opts);
+            const queryMetadata = queriesMetadata[0]; // only one query is supported
+            // validate selective disclosure
+            if (queryMetadata.operator === Operators.SD) {
+                try {
+                    await validateDisclosureNativeSDSupport(queryMetadata, outs, verifiablePresentation, loader);
+                }
+                catch (e) {
+                    throw new Error(`failed to validate selective disclosure: ${e.message}`);
+                }
+            }
+            else if (!queryMetadata.fieldName && queryMetadata.operator == Operators.NOOP) {
+                try {
+                    await validateEmptyCredentialSubjectNoopNativeSupport(outs);
+                }
+                catch (e) {
+                    throw new Error(`failed to validate operators: ${e.message}`);
+                }
+            }
+            else {
+                try {
+                    await validateOperators(queryMetadata, outs);
+                }
+                catch (e) {
+                    throw new Error(`failed to validate operators: ${e.message}`);
+                }
+            }
+            // verify field inclusion / non-inclusion
+            verifyFieldValueInclusionNativeExistsSupport(outs, queryMetadata);
             const { proofType, verifierID, nullifier, nullifierSessionID, linkID } = v3PubSignals;
             switch (query.proofType) {
                 case ProofType.BJJSignature:
@@ -288,6 +332,52 @@ export class PubSignalsVerifier {
         }
         return fn(ctx);
     }
+    async checkQueryV2Circuits(circuitId, query, outs, opts, verifiablePresentation) {
+        if (!query.type) {
+            throw new Error(`proof query type is undefined`);
+        }
+        const loader = this._documentLoader ?? getDocumentLoader();
+        // validate schema
+        let context;
+        try {
+            context = (await loader(query.context ?? '')).document;
+        }
+        catch (e) {
+            throw new Error(`can't load schema for request query`);
+        }
+        const queriesMetadata = await parseQueriesMetadata(query.type, JSON.stringify(context), query.credentialSubject, {
+            documentLoader: loader
+        });
+        await checkQueryRequest(query, queriesMetadata, context, outs, circuitId, this._documentLoader, opts);
+        const queryMetadata = queriesMetadata[0]; // only one query is supported
+        // validate selective disclosure
+        if (queryMetadata.operator === Operators.SD) {
+            try {
+                await validateDisclosureV2Circuit(queryMetadata, outs, verifiablePresentation, loader);
+            }
+            catch (e) {
+                throw new Error(`failed to validate selective disclosure: ${e.message}`);
+            }
+        }
+        else if (!queryMetadata.fieldName && queryMetadata.operator == Operators.NOOP) {
+            try {
+                await validateEmptyCredentialSubjectV2Circuit(queryMetadata, outs);
+            }
+            catch (e) {
+                throw new Error(`failed to validate operators: ${e.message}`);
+            }
+        }
+        else {
+            try {
+                await validateOperators(queryMetadata, outs);
+            }
+            catch (e) {
+                throw new Error(`failed to validate operators: ${e.message}`);
+            }
+        }
+        // verify field inclusion
+        verifyFieldValueInclusionV2(outs, queryMetadata);
+    }
     async resolve(id, state) {
         const idBigInt = id.bigInt();
         const did = DID.parseFromId(id);

package/dist/node/esm/proof/verifiers/query.js

@@ -1,12 +1,11 @@
 import { DID, getDateFromUnixTimestamp } from '@iden3/js-iden3-core';
-import { getDocumentLoader, Merklizer, Path } from '@iden3/js-jsonld-merklization';
+import { Merklizer, Path } from '@iden3/js-jsonld-merklization';
 import { byteEncoder } from '../../utils';
-import { Operators } from '../../circuits/comparer';
+import { Operators, QueryOperators } from '../../circuits/comparer';
 import { calculateCoreSchemaHash, VerifiableConstants } from '../../verifiable';
-import { parseQueriesMetadata } from '../common';
 import { circuitValidator } from '../provers';
 const defaultProofGenerationDelayOpts = 24 * 60 * 60 * 1000; // 24 hours
-export async function checkQueryRequest(query, outputs, circuitId, schemaLoader, verifiablePresentation, opts) {
+export async function checkQueryRequest(query, queriesMetadata, ldContext, outputs, circuitId, schemaLoader, opts) {
     // validate issuer
     const userDID = DID.parseFromId(outputs.issuerId);
     const issuerAllowed = !query.allowedIssuers ||
@@ -14,19 +13,10 @@ export async function checkQueryRequest(query, outputs, circuitId, schemaLoader,
     if (!issuerAllowed) {
         throw new Error('issuer is not in allowed list');
     }
-    // validate schema
-    let schema;
-    try {
-        const loader = schemaLoader ?? getDocumentLoader();
-        schema = (await loader(query.context ?? '')).document;
-    }
-    catch (e) {
-        throw new Error(`can't load schema for request query`);
-    }
     if (!query.type) {
-        throw new Error(`proof query type is undefined`);
+        throw new Error('query type is missing');
     }
-    const schemaId = await Path.getTypeIDFromContext(JSON.stringify(schema), query.type, {
+    const schemaId = await Path.getTypeIDFromContext(JSON.stringify(ldContext), query.type, {
         documentLoader: schemaLoader
     });
     const schemaHash = calculateCoreSchemaHash(byteEncoder.encode(schemaId));
@@ -36,9 +26,6 @@ export async function checkQueryRequest(query, outputs, circuitId, schemaLoader,
     if (!query.skipClaimRevocationCheck && outputs.isRevocationChecked === 0) {
         throw new Error(`check revocation is required`);
     }
-    const queriesMetadata = await parseQueriesMetadata(query.type, JSON.stringify(schema), query.credentialSubject, {
-        documentLoader: schemaLoader
-    });
     const circuitValidationData = circuitValidator[circuitId];
     if (queriesMetadata.length > circuitValidationData.maxQueriesCount) {
         throw new Error(`circuit ${circuitId} supports only ${circuitValidator[circuitId].maxQueriesCount} queries`);
@@ -47,64 +34,54 @@ export async function checkQueryRequest(query, outputs, circuitId, schemaLoader,
     if (notSupportedOpIndx > -1) {
         throw new Error(`circuit ${circuitId} not support ${queriesMetadata[notSupportedOpIndx].operator} operator`);
     }
-    for (let i = 0; i < queriesMetadata.length; i++) {
-        const metadata = queriesMetadata[i];
-        if (!query.type) {
-            throw new Error(`proof query type is undefined`);
-        }
-        // validate selective disclosure
-        if (metadata.operator === Operators.SD) {
-            try {
-                await validateDisclosure(metadata, outputs, verifiablePresentation, schemaLoader);
-            }
-            catch (e) {
-                throw new Error(`failed to validate selective disclosure: ${e.message}`);
-            }
-        }
-        else if (!metadata.fieldName && metadata.operator == Operators.NOOP) {
-            try {
-                await validateEmptyCredentialSubject(metadata, outputs);
-                return;
-            }
-            catch (e) {
-                throw new Error(`failed to validate operators: ${e.message}`);
-            }
-        }
-        else {
-            try {
-                await validateOperators(metadata, outputs);
-            }
-            catch (e) {
-                throw new Error(`failed to validate operators: ${e.message}`);
-            }
+    // verify timestamp
+    let acceptedProofGenerationDelay = defaultProofGenerationDelayOpts;
+    if (opts?.acceptedProofGenerationDelay) {
+        acceptedProofGenerationDelay = opts.acceptedProofGenerationDelay;
+    }
+    const timeDiff = Date.now() - getDateFromUnixTimestamp(Number(outputs.timestamp)).getTime();
+    if (timeDiff > acceptedProofGenerationDelay) {
+        throw new Error('generated proof is outdated');
+    }
+    return;
+}
+export function verifyFieldValueInclusionV2(outputs, metadata) {
+    if (outputs.operator == QueryOperators.$noop) {
+        return;
+    }
+    if (outputs.merklized === 1) {
+        if (outputs.claimPathNotExists === 1) {
+            throw new Error(`proof doesn't contains target query key`);
         }
-        // verify claim
-        if (outputs.merklized === 1) {
-            if (outputs.claimPathNotExists === 1) {
-                throw new Error(`proof doesn't contains target query key`);
-            }
-            if (outputs.claimPathKey !== metadata.claimPathKey) {
-                throw new Error(`proof was generated for another path`);
-            }
+        if (outputs.claimPathKey !== metadata.claimPathKey) {
+            throw new Error(`proof was generated for another path`);
         }
-        else {
-            if (outputs.slotIndex !== metadata.slotIndex) {
-                throw new Error(`wrong claim slot was used in claim`);
-            }
+    }
+    else {
+        if (outputs.slotIndex !== metadata.slotIndex) {
+            throw new Error(`wrong claim slot was used in claim`);
         }
-        // verify timestamp
-        let acceptedProofGenerationDelay = defaultProofGenerationDelayOpts;
-        if (opts?.acceptedProofGenerationDelay) {
-            acceptedProofGenerationDelay = opts.acceptedProofGenerationDelay;
+    }
+}
+export function verifyFieldValueInclusionNativeExistsSupport(outputs, metadata) {
+    if (outputs.operator == Operators.NOOP) {
+        return;
+    }
+    if (outputs.operator === Operators.EXISTS && !outputs.merklized) {
+        throw new Error('$exists operator is not supported for non-merklized credential');
+    }
+    if (outputs.merklized === 1) {
+        if (outputs.claimPathKey !== metadata.claimPathKey) {
+            throw new Error(`proof was generated for another path`);
         }
-        const timeDiff = Date.now() - getDateFromUnixTimestamp(Number(outputs.timestamp)).getTime();
-        if (timeDiff > acceptedProofGenerationDelay) {
-            throw new Error('generated proof is outdated');
+    }
+    else {
+        if (outputs.slotIndex !== metadata.slotIndex) {
+            throw new Error(`wrong claim slot was used in claim`);
         }
     }
-    return;
 }
-async function validateEmptyCredentialSubject(cq, outputs) {
+export async function validateEmptyCredentialSubjectV2Circuit(cq, outputs) {
     if (outputs.operator !== Operators.EQ) {
         throw new Error('empty credentialSubject request available only for equal operation');
     }
@@ -120,7 +97,7 @@ async function validateEmptyCredentialSubject(cq, outputs) {
     }
     return;
 }
-async function validateOperators(cq, outputs) {
+export async function validateOperators(cq, outputs) {
     if (outputs.operator !== cq.operator) {
         throw new Error(`operator that was used is not equal to request`);
     }
@@ -137,7 +114,11 @@ async function validateOperators(cq, outputs) {
         }
     }
 }
-async function validateDisclosure(cq, outputs, verifiablePresentation, ldLoader) {
+export async function validateDisclosureV2Circuit(cq, outputs, verifiablePresentation, ldLoader) {
+    const bi = await fieldValueFromVerifiablePresentation(cq.fieldName, verifiablePresentation, ldLoader);
+    if (bi !== outputs.value[0]) {
+        throw new Error(`value that was used is not equal to requested in query`);
+    }
     if (outputs.operator !== Operators.EQ) {
         throw new Error(`operator for selective disclosure must be $eq`);
     }
@@ -146,9 +127,29 @@ async function validateDisclosure(cq, outputs, verifiablePresentation, ldLoader)
             throw new Error(`selective disclosure not available for array of values`);
         }
     }
+}
+export async function validateDisclosureNativeSDSupport(cq, outputs, verifiablePresentation, ldLoader) {
     const bi = await fieldValueFromVerifiablePresentation(cq.fieldName, verifiablePresentation, ldLoader);
-    if (bi !== outputs.value[0]) {
-        throw new Error(`value that was used is not equal to requested in query`);
+    if (bi !== outputs.operatorOutput) {
+        throw new Error(`operator output should be equal to disclosed value`);
+    }
+    if (outputs.operator !== Operators.SD) {
+        throw new Error(`operator for selective disclosure must be $sd`);
+    }
+    for (let index = 0; index < outputs.value.length; index++) {
+        if (outputs.value[index] !== 0n) {
+            throw new Error(`public signal values must be zero`);
+        }
+    }
+}
+export async function validateEmptyCredentialSubjectNoopNativeSupport(outputs) {
+    if (outputs.operator !== Operators.NOOP) {
+        throw new Error('empty credentialSubject request available only for $noop operation');
+    }
+    for (let index = 1; index < outputs.value.length; index++) {
+        if (outputs.value[index] !== 0n) {
+            throw new Error(`empty credentialSubject request not available for array of values`);
+        }
     }
 }
 export const fieldValueFromVerifiablePresentation = async (fieldName, verifiablePresentation, ldLoader) => {

package/dist/node/esm/storage/filters/jsonQuery.js

@@ -162,7 +162,7 @@ export class FilterQuery {
         }
         const credentialPathValue = resolvePath(credential, this.path);
         if ((credentialPathValue === null || credentialPathValue === undefined) &&
-            this.operatorFunc !== existsComparator) {
+            this.operatorFunc !== comparatorOptions.$exists) {
             return false;
         }
         if (this.isReverseParams) {

package/dist/types/circuits/comparer.d.ts

@@ -50,6 +50,7 @@ export declare const QueryOperators: {
     $sd: Operators;
     $nullify: Operators;
 };
+export declare const getOperatorNameByValue: (operator: number) => string;
 export declare const availableTypesOperators: Map<string, Operators[]>;
 /**
  * Checks if the given operation is valid for the specified datatype.

package/dist/types/kms/key-providers/ed25519-provider.d.ts

@@ -0,0 +1,44 @@
+import { IKeyProvider } from '../kms';
+import { AbstractPrivateKeyStore, KmsKeyId, KmsKeyType } from '../store';
+/**
+ * Provider for Ed25519 keys
+ * @public
+ * @class Ed25519Provider
+ * @implements IKeyProvider interface
+ */
+export declare class Ed25519Provider implements IKeyProvider {
+    readonly keyType: KmsKeyType;
+    private readonly _keyStore;
+    /**
+     * Creates an instance of Ed25519Provider.
+     * @param {KmsKeyType} keyType - kms key type
+     * @param {AbstractPrivateKeyStore} keyStore - key store for kms
+     */
+    constructor(keyType: KmsKeyType, _keyStore: AbstractPrivateKeyStore);
+    /**
+     * generates a ed25519 key from a seed phrase
+     * @param {Uint8Array} seed - byte array seed
+     * @returns {Promise<KmsKeyId>} kms key identifier
+     */
+    newPrivateKeyFromSeed(seed: Uint8Array): Promise<KmsKeyId>;
+    /**
+     * Gets public key by kmsKeyId
+     * @param {KmsKeyId} keyId - key identifier
+     * @returns {Promise<string>} Public key as a hex string
+     */
+    publicKey(keyId: KmsKeyId): Promise<string>;
+    /**
+     * signs prepared payload of size,
+     * with a key id
+     * @param {KmsKeyId} keyId  - key identifier
+     * @param {Uint8Array} data - data to sign (32 bytes)
+     * @returns {Promise<Uint8Array>} signature
+     */
+    sign(keyId: KmsKeyId, data: Uint8Array): Promise<Uint8Array>;
+    /**
+     * Retrieves the private key for a given keyId from the key store.
+     * @param {KmsKeyId} keyId - The identifier of the key to retrieve.
+     * @returns {Promise<string>} The private key associated with the keyId.
+     */
+    private privateKey;
+}

package/dist/types/kms/key-providers/index.d.ts

@@ -1,2 +1,3 @@
 export * from './bjj-provider';
+export * from './ed25519-provider';
 export * from './sec256k1-provider';

package/dist/types/kms/store/types.d.ts

@@ -5,7 +5,8 @@
  */
 export declare enum KmsKeyType {
     BabyJubJub = "BJJ",
-    Secp256k1 = "Secp256k1"
+    Secp256k1 = "Secp256k1",
+    Ed25519 = "Ed25519"
 }
 /**
  * ID of the key that describe contain key type

package/dist/types/proof/provers/inputs-generator.d.ts

@@ -48,5 +48,6 @@ export declare class InputGenerator {
     private credentialAtomicQueryV3OnChainPrepareInputs;
     private linkedMultiQuery10PrepareInputs;
     private transformV2QueryOperator;
+    private checkOperatorSupport;
 }
 export {};

package/dist/types/proof/verifiers/pub-signals-verifier.d.ts

@@ -49,6 +49,7 @@ export declare class PubSignalsVerifier {
     private authV2Verify;
     private linkedMultiQuery10Verify;
     private verifyIdOwnership;
+    private checkQueryV2Circuits;
     private resolve;
     private rootResolve;
     private checkStateExistenceForId;