@0xpolygonid/js-sdk 1.9.2 → 1.9.4

package/dist/node/cjs/circuits/comparer.js

@@ -3,7 +3,7 @@
  * Represents the XSD namespace and its corresponding data types.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.factoryComparer = exports.Vector = exports.Scalar = exports.isValidOperation = exports.availableTypesOperators = exports.QueryOperators = exports.Operators = exports.XSDNS = void 0;
+exports.factoryComparer = exports.Vector = exports.Scalar = exports.isValidOperation = exports.availableTypesOperators = exports.getOperatorNameByValue = exports.QueryOperators = exports.Operators = exports.XSDNS = void 0;
 var XSDNS;
 (function (XSDNS) {
     XSDNS["Boolean"] = "http://www.w3.org/2001/XMLSchema#boolean";
@@ -55,6 +55,11 @@ exports.QueryOperators = {
     $sd: Operators.SD,
     $nullify: Operators.NULLIFY
 };
+const getOperatorNameByValue = (operator) => {
+    const ops = Object.entries(exports.QueryOperators).find(([, queryOp]) => queryOp === operator);
+    return ops ? ops[0] : 'unknown';
+};
+exports.getOperatorNameByValue = getOperatorNameByValue;
 const allOperations = Object.values(exports.QueryOperators);
 exports.availableTypesOperators = new Map([
     [

package/dist/node/cjs/kms/key-providers/ed25519-provider.js

@@ -0,0 +1,96 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Ed25519Provider = void 0;
+const providerHelpers = __importStar(require("../provider-helpers"));
+const ed25519_1 = require("@noble/curves/ed25519");
+const utils_1 = require("../../utils");
+/**
+ * Provider for Ed25519 keys
+ * @public
+ * @class Ed25519Provider
+ * @implements IKeyProvider interface
+ */
+class Ed25519Provider {
+    /**
+     * Creates an instance of Ed25519Provider.
+     * @param {KmsKeyType} keyType - kms key type
+     * @param {AbstractPrivateKeyStore} keyStore - key store for kms
+     */
+    constructor(keyType, _keyStore) {
+        this.keyType = keyType;
+        this._keyStore = _keyStore;
+    }
+    /**
+     * generates a ed25519 key from a seed phrase
+     * @param {Uint8Array} seed - byte array seed
+     * @returns {Promise<KmsKeyId>} kms key identifier
+     */
+    async newPrivateKeyFromSeed(seed) {
+        if (seed.length !== 32) {
+            throw new Error('Seed should be 32 bytes');
+        }
+        const publicKey = ed25519_1.ed25519.getPublicKey(seed);
+        const kmsId = {
+            type: this.keyType,
+            id: providerHelpers.keyPath(this.keyType, (0, utils_1.bytesToHex)(publicKey))
+        };
+        await this._keyStore.importKey({
+            alias: kmsId.id,
+            key: (0, utils_1.bytesToHex)(seed)
+        });
+        return kmsId;
+    }
+    /**
+     * Gets public key by kmsKeyId
+     * @param {KmsKeyId} keyId - key identifier
+     * @returns {Promise<string>} Public key as a hex string
+     */
+    async publicKey(keyId) {
+        const privateKeyHex = await this.privateKey(keyId);
+        const publicKey = ed25519_1.ed25519.getPublicKey(privateKeyHex);
+        return (0, utils_1.bytesToHex)(publicKey);
+    }
+    /**
+     * signs prepared payload of size,
+     * with a key id
+     * @param {KmsKeyId} keyId  - key identifier
+     * @param {Uint8Array} data - data to sign (32 bytes)
+     * @returns {Promise<Uint8Array>} signature
+     */
+    async sign(keyId, data) {
+        const privateKeyHex = await this.privateKey(keyId);
+        return ed25519_1.ed25519.sign(data, privateKeyHex);
+    }
+    /**
+     * Retrieves the private key for a given keyId from the key store.
+     * @param {KmsKeyId} keyId - The identifier of the key to retrieve.
+     * @returns {Promise<string>} The private key associated with the keyId.
+     */
+    async privateKey(keyId) {
+        return this._keyStore.get({ alias: keyId.id });
+    }
+}
+exports.Ed25519Provider = Ed25519Provider;

package/dist/node/cjs/kms/key-providers/index.js

@@ -15,4 +15,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./bjj-provider"), exports);
+__exportStar(require("./ed25519-provider"), exports);
 __exportStar(require("./sec256k1-provider"), exports);

package/dist/node/cjs/kms/store/types.js

@@ -10,4 +10,5 @@ var KmsKeyType;
 (function (KmsKeyType) {
     KmsKeyType["BabyJubJub"] = "BJJ";
     KmsKeyType["Secp256k1"] = "Secp256k1";
+    KmsKeyType["Ed25519"] = "Ed25519";
 })(KmsKeyType = exports.KmsKeyType || (exports.KmsKeyType = {}));

package/dist/node/cjs/proof/provers/inputs-generator.js

@@ -51,6 +51,7 @@ class InputGenerator {
             circuitInputs.claimSubjectProfileNonce = BigInt(params.credentialSubjectProfileNonce);
             circuitInputs.profileNonce = BigInt(params.authProfileNonce);
             circuitInputs.skipClaimRevocationCheck = params.skipRevocation;
+            this.checkOperatorSupport(proofReq.circuitId, query.operator);
             return circuitInputs.inputsMarshal();
         };
         this.credentialAtomicQueryMTPV2OnChainPrepareInputs = async ({ preparedCredential, identifier, proofReq, params, circuitQueries }) => {
@@ -98,6 +99,7 @@ class InputGenerator {
             circuitInputs.claimSubjectProfileNonce = BigInt(params.credentialSubjectProfileNonce);
             circuitInputs.profileNonce = BigInt(params.authProfileNonce);
             circuitInputs.skipClaimRevocationCheck = params.skipRevocation;
+            this.checkOperatorSupport(proofReq.circuitId, query.operator);
             return circuitInputs.inputsMarshal();
         };
         this.credentialAtomicQuerySigV2PrepareInputs = async ({ preparedCredential, identifier, proofReq, params, circuitQueries }) => {
@@ -119,6 +121,7 @@ class InputGenerator {
             query.operator = this.transformV2QueryOperator(query.operator);
             circuitInputs.query = query;
             circuitInputs.currentTimeStamp = (0, js_iden3_core_1.getUnixTimestamp)(new Date());
+            this.checkOperatorSupport(proofReq.circuitId, query.operator);
             return circuitInputs.inputsMarshal();
         };
         this.credentialAtomicQuerySigV2OnChainPrepareInputs = async ({ preparedCredential, identifier, proofReq, params, circuitQueries }) => {
@@ -166,6 +169,7 @@ class InputGenerator {
             const signature = await this._identityWallet.signChallenge(params.challenge, authInfo.credential);
             circuitInputs.signature = signature;
             circuitInputs.challenge = params.challenge;
+            this.checkOperatorSupport(proofReq.circuitId, query.operator);
             return circuitInputs.inputsMarshal();
         };
         this.credentialAtomicQueryV3PrepareInputs = async ({ preparedCredential, identifier, proofReq, params, circuitQueries }) => {
@@ -215,6 +219,7 @@ class InputGenerator {
             circuitInputs.nullifierSessionID = proofReq.params?.nullifierSessionId
                 ? BigInt(proofReq.params?.nullifierSessionId?.toString())
                 : BigInt(0);
+            this.checkOperatorSupport(proofReq.circuitId, query.operator);
             return circuitInputs.inputsMarshal();
         };
         this.credentialAtomicQueryV3OnChainPrepareInputs = async ({ preparedCredential, identifier, proofReq, params, circuitQueries }) => {
@@ -293,15 +298,19 @@ class InputGenerator {
                 circuitInputs.treeState = authClaimData.treeState;
                 circuitInputs.signature = signature;
             }
+            this.checkOperatorSupport(proofReq.circuitId, query.operator);
             return circuitInputs.inputsMarshal();
         };
-        this.linkedMultiQuery10PrepareInputs = async ({ preparedCredential, params, circuitQueries }) => {
+        this.linkedMultiQuery10PrepareInputs = async ({ preparedCredential, params, proofReq, circuitQueries }) => {
             const circuitClaimData = await this.newCircuitClaimData(preparedCredential);
             circuitClaimData.nonRevProof = (0, common_1.toClaimNonRevStatus)(preparedCredential.revStatus);
             const circuitInputs = new circuits_1.LinkedMultiQueryInputs();
             circuitInputs.linkNonce = params.linkNonce ?? BigInt(0);
             circuitInputs.claim = circuitClaimData.claim;
             circuitInputs.query = circuitQueries;
+            circuitQueries.forEach((query) => {
+                this.checkOperatorSupport(proofReq.circuitId, query.operator);
+            });
             return circuitInputs.inputsMarshal();
         };
     }
@@ -386,5 +395,11 @@ class InputGenerator {
     transformV2QueryOperator(operator) {
         return operator === circuits_1.Operators.SD || operator === circuits_1.Operators.NOOP ? circuits_1.Operators.EQ : operator;
     }
+    checkOperatorSupport(circuitId, operator) {
+        const supportedOperators = exports.circuitValidator[circuitId].supportedOperations;
+        if (!supportedOperators.includes(operator)) {
+            throw new Error(`operator ${(0, circuits_1.getOperatorNameByValue)(operator)} is not supported by ${circuitId}`);
+        }
+    }
 }
 exports.InputGenerator = InputGenerator;

package/dist/node/cjs/proof/verifiers/pub-signals-verifier.js

@@ -59,7 +59,7 @@ class PubSignalsVerifier {
                 valueArraySize: mtpv2PubSignals.getValueArrSize(),
                 isRevocationChecked: mtpv2PubSignals.isRevocationChecked
             };
-            await (0, query_1.checkQueryRequest)(query, outs, models_1.CircuitId.AtomicQueryMTPV2, this._documentLoader, verifiablePresentation, opts);
+            await this.checkQueryV2Circuits(models_1.CircuitId.AtomicQueryMTPV2, query, outs, opts, verifiablePresentation);
             // verify state
             await this.checkStateExistenceForId(mtpv2PubSignals.issuerID, mtpv2PubSignals.issuerClaimIdenState);
             if (mtpv2PubSignals.isRevocationChecked !== 0) {
@@ -88,7 +88,7 @@ class PubSignalsVerifier {
                 valueArraySize: sigV2PubSignals.getValueArrSize(),
                 isRevocationChecked: sigV2PubSignals.isRevocationChecked
             };
-            await (0, query_1.checkQueryRequest)(query, outs, models_1.CircuitId.AtomicQuerySigV2, this._documentLoader, verifiablePresentation, opts);
+            await this.checkQueryV2Circuits(models_1.CircuitId.AtomicQuerySigV2, query, outs, opts, verifiablePresentation);
             // verify state
             await this.checkStateExistenceForId(sigV2PubSignals.issuerID, sigV2PubSignals.issuerAuthState);
             if (sigV2PubSignals.isRevocationChecked !== 0) {
@@ -114,9 +114,55 @@ class PubSignalsVerifier {
                 merklized: v3PubSignals.merklized,
                 claimPathKey: v3PubSignals.claimPathKey,
                 valueArraySize: v3PubSignals.getValueArrSize(),
+                operatorOutput: v3PubSignals.operatorOutput,
                 isRevocationChecked: v3PubSignals.isRevocationChecked
             };
-            await (0, query_1.checkQueryRequest)(query, outs, models_1.CircuitId.AtomicQueryV3, this._documentLoader, verifiablePresentation, opts);
+            if (!query.type) {
+                throw new Error(`proof query type is undefined`);
+            }
+            const loader = this._documentLoader ?? (0, js_jsonld_merklization_1.getDocumentLoader)();
+            // validate schema
+            let context;
+            try {
+                context = (await loader(query.context ?? '')).document;
+            }
+            catch (e) {
+                throw new Error(`can't load schema for request query`);
+            }
+            const queriesMetadata = await (0, common_2.parseQueriesMetadata)(query.type, JSON.stringify(context), query.credentialSubject, {
+                documentLoader: loader
+            });
+            const circuitId = models_1.CircuitId.AtomicQueryV3;
+            await (0, query_1.checkQueryRequest)(query, queriesMetadata, context, outs, circuitId, this._documentLoader, opts);
+            const queryMetadata = queriesMetadata[0]; // only one query is supported
+            (0, query_1.checkCircuitOperator)(circuitId, outs.operator);
+            // validate selective disclosure
+            if (queryMetadata.operator === circuits_1.Operators.SD) {
+                try {
+                    await (0, query_1.validateDisclosureNativeSDSupport)(queryMetadata, outs, verifiablePresentation, loader);
+                }
+                catch (e) {
+                    throw new Error(`failed to validate selective disclosure: ${e.message}`);
+                }
+            }
+            else if (!queryMetadata.fieldName && queryMetadata.operator == circuits_1.Operators.NOOP) {
+                try {
+                    await (0, query_1.validateEmptyCredentialSubjectNoopNativeSupport)(outs);
+                }
+                catch (e) {
+                    throw new Error(`failed to validate operators: ${e.message}`);
+                }
+            }
+            else {
+                try {
+                    await (0, query_1.validateOperators)(queryMetadata, outs);
+                }
+                catch (e) {
+                    throw new Error(`failed to validate operators: ${e.message}`);
+                }
+            }
+            // verify field inclusion / non-inclusion
+            (0, query_1.verifyFieldValueInclusionNativeExistsSupport)(outs, queryMetadata);
             const { proofType, verifierID, nullifier, nullifierSessionID, linkID } = v3PubSignals;
             switch (query.proofType) {
                 case verifiable_1.ProofType.BJJSignature:
@@ -291,6 +337,53 @@ class PubSignalsVerifier {
         }
         return fn(ctx);
     }
+    async checkQueryV2Circuits(circuitId, query, outs, opts, verifiablePresentation) {
+        if (!query.type) {
+            throw new Error(`proof query type is undefined`);
+        }
+        const loader = this._documentLoader ?? (0, js_jsonld_merklization_1.getDocumentLoader)();
+        // validate schema
+        let context;
+        try {
+            context = (await loader(query.context ?? '')).document;
+        }
+        catch (e) {
+            throw new Error(`can't load schema for request query`);
+        }
+        const queriesMetadata = await (0, common_2.parseQueriesMetadata)(query.type, JSON.stringify(context), query.credentialSubject, {
+            documentLoader: loader
+        });
+        await (0, query_1.checkQueryRequest)(query, queriesMetadata, context, outs, circuitId, this._documentLoader, opts);
+        const queryMetadata = queriesMetadata[0]; // only one query is supported
+        (0, query_1.checkCircuitOperator)(circuitId, outs.operator);
+        // validate selective disclosure
+        if (queryMetadata.operator === circuits_1.Operators.SD) {
+            try {
+                await (0, query_1.validateDisclosureV2Circuit)(queryMetadata, outs, verifiablePresentation, loader);
+            }
+            catch (e) {
+                throw new Error(`failed to validate selective disclosure: ${e.message}`);
+            }
+        }
+        else if (!queryMetadata.fieldName && queryMetadata.operator == circuits_1.Operators.NOOP) {
+            try {
+                await (0, query_1.validateEmptyCredentialSubjectV2Circuit)(queryMetadata, outs);
+            }
+            catch (e) {
+                throw new Error(`failed to validate operators: ${e.message}`);
+            }
+        }
+        else {
+            try {
+                await (0, query_1.validateOperators)(queryMetadata, outs);
+            }
+            catch (e) {
+                throw new Error(`failed to validate operators: ${e.message}`);
+            }
+        }
+        // verify field inclusion
+        (0, query_1.verifyFieldValueInclusionV2)(outs, queryMetadata);
+    }
     async resolve(id, state) {
         const idBigInt = id.bigInt();
         const did = js_iden3_core_1.DID.parseFromId(id);

package/dist/node/cjs/proof/verifiers/query.js

@@ -1,15 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.fieldValueFromVerifiablePresentation = exports.checkQueryRequest = void 0;
+exports.fieldValueFromVerifiablePresentation = exports.validateEmptyCredentialSubjectNoopNativeSupport = exports.validateDisclosureNativeSDSupport = exports.validateDisclosureV2Circuit = exports.validateOperators = exports.validateEmptyCredentialSubjectV2Circuit = exports.verifyFieldValueInclusionNativeExistsSupport = exports.verifyFieldValueInclusionV2 = exports.checkCircuitOperator = exports.checkCircuitQueriesLength = exports.checkQueryRequest = void 0;
 const js_iden3_core_1 = require("@iden3/js-iden3-core");
 const js_jsonld_merklization_1 = require("@iden3/js-jsonld-merklization");
 const utils_1 = require("../../utils");
 const comparer_1 = require("../../circuits/comparer");
 const verifiable_1 = require("../../verifiable");
-const common_1 = require("../common");
 const provers_1 = require("../provers");
 const defaultProofGenerationDelayOpts = 24 * 60 * 60 * 1000; // 24 hours
-async function checkQueryRequest(query, outputs, circuitId, schemaLoader, verifiablePresentation, opts) {
+async function checkQueryRequest(query, queriesMetadata, ldContext, outputs, circuitId, schemaLoader, opts) {
     // validate issuer
     const userDID = js_iden3_core_1.DID.parseFromId(outputs.issuerId);
     const issuerAllowed = !query.allowedIssuers ||
@@ -17,19 +16,10 @@ async function checkQueryRequest(query, outputs, circuitId, schemaLoader, verifi
     if (!issuerAllowed) {
         throw new Error('issuer is not in allowed list');
     }
-    // validate schema
-    let schema;
-    try {
-        const loader = schemaLoader ?? (0, js_jsonld_merklization_1.getDocumentLoader)();
-        schema = (await loader(query.context ?? '')).document;
-    }
-    catch (e) {
-        throw new Error(`can't load schema for request query`);
-    }
     if (!query.type) {
-        throw new Error(`proof query type is undefined`);
+        throw new Error('query type is missing');
     }
-    const schemaId = await js_jsonld_merklization_1.Path.getTypeIDFromContext(JSON.stringify(schema), query.type, {
+    const schemaId = await js_jsonld_merklization_1.Path.getTypeIDFromContext(JSON.stringify(ldContext), query.type, {
         documentLoader: schemaLoader
     });
     const schemaHash = (0, verifiable_1.calculateCoreSchemaHash)(utils_1.byteEncoder.encode(schemaId));
@@ -39,76 +29,72 @@ async function checkQueryRequest(query, outputs, circuitId, schemaLoader, verifi
     if (!query.skipClaimRevocationCheck && outputs.isRevocationChecked === 0) {
         throw new Error(`check revocation is required`);
     }
-    const queriesMetadata = await (0, common_1.parseQueriesMetadata)(query.type, JSON.stringify(schema), query.credentialSubject, {
-        documentLoader: schemaLoader
-    });
+    checkCircuitQueriesLength(circuitId, queriesMetadata);
+    // verify timestamp
+    let acceptedProofGenerationDelay = defaultProofGenerationDelayOpts;
+    if (opts?.acceptedProofGenerationDelay) {
+        acceptedProofGenerationDelay = opts.acceptedProofGenerationDelay;
+    }
+    const timeDiff = Date.now() - (0, js_iden3_core_1.getDateFromUnixTimestamp)(Number(outputs.timestamp)).getTime();
+    if (timeDiff > acceptedProofGenerationDelay) {
+        throw new Error('generated proof is outdated');
+    }
+    return;
+}
+exports.checkQueryRequest = checkQueryRequest;
+function checkCircuitQueriesLength(circuitId, queriesMetadata) {
     const circuitValidationData = provers_1.circuitValidator[circuitId];
     if (queriesMetadata.length > circuitValidationData.maxQueriesCount) {
         throw new Error(`circuit ${circuitId} supports only ${provers_1.circuitValidator[circuitId].maxQueriesCount} queries`);
     }
-    const notSupportedOpIndx = queriesMetadata.findIndex((i) => !circuitValidationData.supportedOperations.includes(i.operator));
-    if (notSupportedOpIndx > -1) {
-        throw new Error(`circuit ${circuitId} not support ${queriesMetadata[notSupportedOpIndx].operator} operator`);
+}
+exports.checkCircuitQueriesLength = checkCircuitQueriesLength;
+function checkCircuitOperator(circuitId, operator) {
+    const circuitValidationData = provers_1.circuitValidator[circuitId];
+    if (!circuitValidationData.supportedOperations.includes(operator)) {
+        throw new Error(`circuit ${circuitId} not support ${(0, comparer_1.getOperatorNameByValue)(operator)} operator`);
     }
-    for (let i = 0; i < queriesMetadata.length; i++) {
-        const metadata = queriesMetadata[i];
-        if (!query.type) {
-            throw new Error(`proof query type is undefined`);
-        }
-        // validate selective disclosure
-        if (metadata.operator === comparer_1.Operators.SD) {
-            try {
-                await validateDisclosure(metadata, outputs, verifiablePresentation, schemaLoader);
-            }
-            catch (e) {
-                throw new Error(`failed to validate selective disclosure: ${e.message}`);
-            }
-        }
-        else if (!metadata.fieldName && metadata.operator == comparer_1.Operators.NOOP) {
-            try {
-                await validateEmptyCredentialSubject(metadata, outputs);
-                return;
-            }
-            catch (e) {
-                throw new Error(`failed to validate operators: ${e.message}`);
-            }
-        }
-        else {
-            try {
-                await validateOperators(metadata, outputs);
-            }
-            catch (e) {
-                throw new Error(`failed to validate operators: ${e.message}`);
-            }
+}
+exports.checkCircuitOperator = checkCircuitOperator;
+function verifyFieldValueInclusionV2(outputs, metadata) {
+    if (outputs.operator == comparer_1.QueryOperators.$noop) {
+        return;
+    }
+    if (outputs.merklized === 1) {
+        if (outputs.claimPathNotExists === 1) {
+            throw new Error(`proof doesn't contains target query key`);
         }
-        // verify claim
-        if (outputs.merklized === 1) {
-            if (outputs.claimPathNotExists === 1) {
-                throw new Error(`proof doesn't contains target query key`);
-            }
-            if (outputs.claimPathKey !== metadata.claimPathKey) {
-                throw new Error(`proof was generated for another path`);
-            }
+        if (outputs.claimPathKey !== metadata.claimPathKey) {
+            throw new Error(`proof was generated for another path`);
         }
-        else {
-            if (outputs.slotIndex !== metadata.slotIndex) {
-                throw new Error(`wrong claim slot was used in claim`);
-            }
+    }
+    else {
+        if (outputs.slotIndex !== metadata.slotIndex) {
+            throw new Error(`wrong claim slot was used in claim`);
         }
-        // verify timestamp
-        let acceptedProofGenerationDelay = defaultProofGenerationDelayOpts;
-        if (opts?.acceptedProofGenerationDelay) {
-            acceptedProofGenerationDelay = opts.acceptedProofGenerationDelay;
+    }
+}
+exports.verifyFieldValueInclusionV2 = verifyFieldValueInclusionV2;
+function verifyFieldValueInclusionNativeExistsSupport(outputs, metadata) {
+    if (outputs.operator == comparer_1.Operators.NOOP) {
+        return;
+    }
+    if (outputs.operator === comparer_1.Operators.EXISTS && !outputs.merklized) {
+        throw new Error('$exists operator is not supported for non-merklized credential');
+    }
+    if (outputs.merklized === 1) {
+        if (outputs.claimPathKey !== metadata.claimPathKey) {
+            throw new Error(`proof was generated for another path`);
         }
-        const timeDiff = Date.now() - (0, js_iden3_core_1.getDateFromUnixTimestamp)(Number(outputs.timestamp)).getTime();
-        if (timeDiff > acceptedProofGenerationDelay) {
-            throw new Error('generated proof is outdated');
+    }
+    else {
+        if (outputs.slotIndex !== metadata.slotIndex) {
+            throw new Error(`wrong claim slot was used in claim`);
         }
     }
-    return;
 }
-exports.checkQueryRequest = checkQueryRequest;
-async function validateEmptyCredentialSubject(cq, outputs) {
+exports.verifyFieldValueInclusionNativeExistsSupport = verifyFieldValueInclusionNativeExistsSupport;
+async function validateEmptyCredentialSubjectV2Circuit(cq, outputs) {
     if (outputs.operator !== comparer_1.Operators.EQ) {
         throw new Error('empty credentialSubject request available only for equal operation');
     }
@@ -124,6 +110,7 @@ async function validateEmptyCredentialSubject(cq, outputs) {
     }
     return;
 }
+exports.validateEmptyCredentialSubjectV2Circuit = validateEmptyCredentialSubjectV2Circuit;
 async function validateOperators(cq, outputs) {
     if (outputs.operator !== cq.operator) {
         throw new Error(`operator that was used is not equal to request`);
@@ -141,7 +128,12 @@ async function validateOperators(cq, outputs) {
         }
     }
 }
-async function validateDisclosure(cq, outputs, verifiablePresentation, ldLoader) {
+exports.validateOperators = validateOperators;
+async function validateDisclosureV2Circuit(cq, outputs, verifiablePresentation, ldLoader) {
+    const bi = await (0, exports.fieldValueFromVerifiablePresentation)(cq.fieldName, verifiablePresentation, ldLoader);
+    if (bi !== outputs.value[0]) {
+        throw new Error(`value that was used is not equal to requested in query`);
+    }
     if (outputs.operator !== comparer_1.Operators.EQ) {
         throw new Error(`operator for selective disclosure must be $eq`);
     }
@@ -150,11 +142,34 @@ async function validateDisclosure(cq, outputs, verifiablePresentation, ldLoader)
             throw new Error(`selective disclosure not available for array of values`);
         }
     }
+}
+exports.validateDisclosureV2Circuit = validateDisclosureV2Circuit;
+async function validateDisclosureNativeSDSupport(cq, outputs, verifiablePresentation, ldLoader) {
     const bi = await (0, exports.fieldValueFromVerifiablePresentation)(cq.fieldName, verifiablePresentation, ldLoader);
-    if (bi !== outputs.value[0]) {
-        throw new Error(`value that was used is not equal to requested in query`);
+    if (bi !== outputs.operatorOutput) {
+        throw new Error(`operator output should be equal to disclosed value`);
+    }
+    if (outputs.operator !== comparer_1.Operators.SD) {
+        throw new Error(`operator for selective disclosure must be $sd`);
+    }
+    for (let index = 0; index < outputs.value.length; index++) {
+        if (outputs.value[index] !== 0n) {
+            throw new Error(`public signal values must be zero`);
+        }
+    }
+}
+exports.validateDisclosureNativeSDSupport = validateDisclosureNativeSDSupport;
+async function validateEmptyCredentialSubjectNoopNativeSupport(outputs) {
+    if (outputs.operator !== comparer_1.Operators.NOOP) {
+        throw new Error('empty credentialSubject request available only for $noop operation');
+    }
+    for (let index = 1; index < outputs.value.length; index++) {
+        if (outputs.value[index] !== 0n) {
+            throw new Error(`empty credentialSubject request not available for array of values`);
+        }
     }
 }
+exports.validateEmptyCredentialSubjectNoopNativeSupport = validateEmptyCredentialSubjectNoopNativeSupport;
 const fieldValueFromVerifiablePresentation = async (fieldName, verifiablePresentation, ldLoader) => {
     if (!verifiablePresentation) {
         throw new Error(`verifiablePresentation is required for selective disclosure request`);

package/dist/node/esm/circuits/comparer.js

@@ -52,6 +52,10 @@ export const QueryOperators = {
     $sd: Operators.SD,
     $nullify: Operators.NULLIFY
 };
+export const getOperatorNameByValue = (operator) => {
+    const ops = Object.entries(QueryOperators).find(([, queryOp]) => queryOp === operator);
+    return ops ? ops[0] : 'unknown';
+};
 const allOperations = Object.values(QueryOperators);
 export const availableTypesOperators = new Map([
     [

package/dist/node/esm/kms/key-providers/ed25519-provider.js

@@ -0,0 +1,69 @@
+import * as providerHelpers from '../provider-helpers';
+import { ed25519 } from '@noble/curves/ed25519';
+import { bytesToHex } from '../../utils';
+/**
+ * Provider for Ed25519 keys
+ * @public
+ * @class Ed25519Provider
+ * @implements IKeyProvider interface
+ */
+export class Ed25519Provider {
+    /**
+     * Creates an instance of Ed25519Provider.
+     * @param {KmsKeyType} keyType - kms key type
+     * @param {AbstractPrivateKeyStore} keyStore - key store for kms
+     */
+    constructor(keyType, _keyStore) {
+        this.keyType = keyType;
+        this._keyStore = _keyStore;
+    }
+    /**
+     * generates a ed25519 key from a seed phrase
+     * @param {Uint8Array} seed - byte array seed
+     * @returns {Promise<KmsKeyId>} kms key identifier
+     */
+    async newPrivateKeyFromSeed(seed) {
+        if (seed.length !== 32) {
+            throw new Error('Seed should be 32 bytes');
+        }
+        const publicKey = ed25519.getPublicKey(seed);
+        const kmsId = {
+            type: this.keyType,
+            id: providerHelpers.keyPath(this.keyType, bytesToHex(publicKey))
+        };
+        await this._keyStore.importKey({
+            alias: kmsId.id,
+            key: bytesToHex(seed)
+        });
+        return kmsId;
+    }
+    /**
+     * Gets public key by kmsKeyId
+     * @param {KmsKeyId} keyId - key identifier
+     * @returns {Promise<string>} Public key as a hex string
+     */
+    async publicKey(keyId) {
+        const privateKeyHex = await this.privateKey(keyId);
+        const publicKey = ed25519.getPublicKey(privateKeyHex);
+        return bytesToHex(publicKey);
+    }
+    /**
+     * signs prepared payload of size,
+     * with a key id
+     * @param {KmsKeyId} keyId  - key identifier
+     * @param {Uint8Array} data - data to sign (32 bytes)
+     * @returns {Promise<Uint8Array>} signature
+     */
+    async sign(keyId, data) {
+        const privateKeyHex = await this.privateKey(keyId);
+        return ed25519.sign(data, privateKeyHex);
+    }
+    /**
+     * Retrieves the private key for a given keyId from the key store.
+     * @param {KmsKeyId} keyId - The identifier of the key to retrieve.
+     * @returns {Promise<string>} The private key associated with the keyId.
+     */
+    async privateKey(keyId) {
+        return this._keyStore.get({ alias: keyId.id });
+    }
+}

package/dist/node/esm/kms/key-providers/index.js

@@ -1,2 +1,3 @@
 export * from './bjj-provider';
+export * from './ed25519-provider';
 export * from './sec256k1-provider';

package/dist/node/esm/kms/store/types.js

@@ -7,4 +7,5 @@ export var KmsKeyType;
 (function (KmsKeyType) {
     KmsKeyType["BabyJubJub"] = "BJJ";
     KmsKeyType["Secp256k1"] = "Secp256k1";
+    KmsKeyType["Ed25519"] = "Ed25519";
 })(KmsKeyType || (KmsKeyType = {}));