@affix-io/sdk 2.0.0

package/.env.example

@@ -0,0 +1,5 @@
+# Copy to .env. The key below is the public SDK tier (6 req/sec per IP).
+# Commercial keys: contact AffixIO.
+
+AFFIX_API_KEY=aio_1b51ae929fb4ac1e78e6d5f61ab50262a4302dedbfd9b583
+AFFIX_API_BASE=https://api.affix-io.com

package/AUTHORS

@@ -0,0 +1,5 @@
+# Authors
+
+AffixIO <dev@affix-io.com>
+
+Maintained by [AffixIO](https://github.com/AffixIO).

package/CONTRIBUTING.md

@@ -0,0 +1,32 @@
+# Contributing
+
+This repository ships compiled JavaScript in `dist/`. TypeScript source is maintained privately by AffixIO.
+
+## What we accept
+
+- Documentation fixes (README, SECURITY, examples)
+- Issue reports with reproduction steps
+- Feature requests with concrete use cases
+
+## What we do not accept
+
+- Pull requests that modify `dist/` directly
+- Changes that expose witness construction or circuit internals
+
+## Development setup
+
+```bash
+git clone https://github.com/AffixIO/SDK.git
+cd SDK
+npm install
+cp .env.example .env
+npx affix-sdk health
+```
+
+## Code of conduct
+
+Be direct, stay on topic, no harassment.
+
+## Commercial access
+
+For source access, custom circuits, or higher API limits: [affix-io.com](https://affix-io.com).

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 AffixIO
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,7 @@
+AffixIO SDK
+Copyright 2026 AffixIO
+
+This product includes software developed for zero-knowledge proof generation
+and verification using Noir circuits and the Barretenberg proving system.
+
+Post-quantum attestation uses ML-DSA-65 as specified in NIST FIPS 204.

package/README.md

@@ -0,0 +1,211 @@
+# AffixIO SDK
+
+[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE)
+[![Node](https://img.shields.io/badge/node-%3E%3D18-brightgreen)](package.json)
+[![FIPS 204](https://img.shields.io/badge/FIPS%20204-ML--DSA-blue)](https://csrc.nist.gov/pubs/fips/204/final)
+[![ZK](https://img.shields.io/badge/zero--knowledge-Noir%20%2B%20Barretenberg-8b5cf6)](https://noir-lang.org/)
+
+Node.js SDK for **privacy-preserving zero-knowledge proofs** with **post-quantum attestation**. Prove eligibility, KYC outcomes, age checks, residency, and other predicates without exposing raw credentials. Verify proofs locally or via the AffixIO API.
+
+Built for developers working with [Noir](https://noir-lang.org/) circuits, [Barretenberg](https://github.com/AztecProtocol/barretenberg) (UltraHonk), verifiable credentials, and [NIST post-quantum standards](https://csrc.nist.gov/projects/post-quantum-cryptography) ([FIPS 204 ML-DSA](https://csrc.nist.gov/pubs/fips/204/final)).
+
+## Why AffixIO
+
+Classical signatures (ECDSA, EdDSA, RSA) are vulnerable to future quantum attacks via Shor's algorithm. NIST finalised ML-KEM, ML-DSA, and SLH-DSA in 2024. AffixIO combines:
+
+- **Zero-knowledge SNARK proving** over Noir attestation circuits (115+ templates)
+- **ML-DSA-65 (FIPS 204)** signatures on proof payloads and credentials
+- **Merkle audit anchoring** for tamper-evident proof history
+- **Offline-first queue** for unreliable networks
+
+You get prove, verify, storage, and a CLI without running a proving cluster locally.
+
+## Install
+
+```bash
+npm install @affix-io/sdk
+```
+
+Or clone this repository (compiled `dist/` only):
+
+```bash
+git clone https://github.com/AffixIO/SDK.git
+cd SDK
+npm install
+cp .env.example .env
+```
+
+Requires Node.js 18+.
+
+## Quick start
+
+```typescript
+import { AffixSDK, defaultContext } from "@affix-io/sdk";
+
+const sdk = new AffixSDK();
+
+const result = await sdk.prove({
+  circuitId: "attested_boolean",
+  credential: {
+    schema_id: "eligibility_v1",
+    issuer_id: "issuer_abc",
+    issuer_pubkey_hash: "0x...",
+    credential_id: "0x...",
+    claim_value: "approved",
+    valid_from: 1700000000,
+    valid_until: 1800000000,
+  },
+  context: defaultContext({ required_claim_hash: "approved" }),
+});
+
+console.log(result.valid, result.decision);
+```
+
+```bash
+npx affix-sdk health
+npx affix-sdk prove --circuit attested_boolean --claim approved
+npx affix-sdk verify <proof-id>
+```
+
+## API key
+
+A public-tier key ships in `.env.example` (6 requests/second per IP). Copy to `.env`:
+
+```bash
+cp .env.example .env
+```
+
+| Variable | Required | Default |
+|---|---|---|
+| `AFFIX_API_KEY` | Yes | Public tier key in `.env.example` |
+| `AFFIX_API_BASE` | No | `https://api.affix-io.com` |
+
+Commercial keys with higher throughput: [affix-io.com](https://affix-io.com).
+
+## Prove input modes
+
+`prove()` accepts one of three shapes.
+
+### 1. Credential + context (recommended)
+
+Credentials are normalised to BN254 field elements, witness-prepared server-side, then proved.
+
+```typescript
+await sdk.prove({ circuitId, credential, context });
+```
+
+### 2. Pre-built witness
+
+Call `buildWitness()` (`POST /v1/witness/prepare`) then prove:
+
+```typescript
+const witness = await sdk.buildWitness(circuitId, credential, context);
+await sdk.prove({ circuitId, witness });
+```
+
+### 3. Raw circuit fields
+
+For Merkle batch proofs and custom Noir inputs:
+
+```typescript
+await sdk.prove({
+  circuitId: "merkle_batch",
+  fields: { leaf: "0x...", sibling0: "0x...", index: "0", expected_root: "0x..." },
+});
+```
+
+## SDK methods
+
+| Method | Description |
+|---|---|
+| `prove(input)` | Generate a zero-knowledge proof |
+| `verify(circuitId, proof)` | Verify a proof string |
+| `proveAndVerify(input)` | Prove then verify in one call |
+| `buildWitness(...)` | Server-side witness preparation |
+| `isOnline()` | API health check |
+| `flushOfflineQueue()` | Replay queued prove jobs |
+| `listQueuedJobs()` | Inspect offline queue |
+| `listStoredProofs()` | Local proof store (last 500) |
+
+## CLI
+
+```bash
+npx affix-sdk config
+npx affix-sdk health
+npx affix-sdk circuits
+npx affix-sdk prove [--circuit <id>] [--claim <value>]
+npx affix-sdk verify <proof-id-or-path> [--circuit <id>]
+npx affix-sdk list
+npx affix-sdk flush
+```
+
+## Post-quantum attestation
+
+Proof responses can include **ML-DSA-65** attestations (FIPS 204, CRYSTALS-Dilithium family). Credentials carry `mldsa_signature_b64` for issuer binding. This aligns with the migration path described in [NIST IR 8547](https://csrc.nist.gov/pubs/ir/8547/final) toward quantum-resistant cryptography.
+
+The proving backend uses Noir compiled to ACIR with Barretenberg UltraHonk, the same stack documented in the [Noir web app guide](https://noir-lang.org/docs/dev/guides/building_a_web_app).
+
+## Circuit library
+
+115+ attested Noir circuits including:
+
+| Domain | Examples |
+|---|---|
+| Identity / KYC | `kyc`, `attested_boolean`, `attested_membership` |
+| Age / health | `health_age`, `health_vaccination_status` |
+| Residency / travel | `ticket_local_resident`, `travel_visa_eligibility` |
+| Education | `edu_attendance_threshold`, `edu_enrollment_verification` |
+| Merkle / audit | `merkle_batch`, `audit_proof`, `quantum_safe_token` |
+| Governance | `govt_voting_eligibility`, `zk_voting` |
+
+Run `npx affix-sdk circuits` for the full list from the live API.
+
+## Offline queue
+
+When `prove()` fails and `queueOnFailure` is not `false`:
+
+1. **Witness or fields** bodies queue as-is for `flushOfflineQueue()`.
+2. **Credential-based** queueing requires the private `@affix-io/sdk-witness` add-on (commercial).
+3. Online witness prep always uses `POST /v1/witness/prepare`.
+
+Local paths: `.affix/offline-queue.json`, `.affix/proofs.json`.
+
+## API endpoints
+
+| Endpoint | Purpose |
+|---|---|
+| `GET /api/health` | Service health |
+| `GET /v1/circuits` | Circuit catalogue |
+| `POST /v1/witness/prepare` | Witness preparation |
+| `POST /v1/circuits/:id/prove` | SNARK proof generation |
+| `POST /v1/circuits/:id/verify` | Proof verification |
+| `GET /v1/merkle/root` | Audit Merkle root |
+| `POST /v1/merkle/audit` | Anchor proof to audit log |
+
+## Use cases
+
+- **Privacy-preserving KYC**: prove eligibility without revealing PII
+- **Age verification**: `health_age`, `ent_age_restriction`, `hosp_checkin_age`
+- **Local residency / ticketing**: `ticket_local_resident`, `ticket_student_discount`
+- **Verifiable credentials**: ML-DSA-signed claims with ZK predicates
+- **Compliance audit trails**: Merkle-anchored proof history
+- **Quantum-safe token validation**: `quantum_safe_token` circuit
+
+## Related projects
+
+- [noir-lang/noir](https://github.com/noir-lang/noir) — ZK domain-specific language
+- [@aztec/bb.js](https://www.npmjs.com/package/@aztec/bb.js) — Barretenberg proving backend
+- [@noble/post-quantum](https://www.npmjs.com/package/@noble/post-quantum) — ML-DSA / SLH-DSA primitives
+- [NIST PQC standards](https://csrc.nist.gov/projects/post-quantum-cryptography) — FIPS 203, 204, 205
+
+## License
+
+Apache License 2.0. See [LICENSE](LICENSE).
+
+## Security
+
+Report vulnerabilities via [SECURITY.md](SECURITY.md).
+
+---
+
+Maintained by [AffixIO](https://github.com/AffixIO). See [AUTHORS](AUTHORS).

package/SECURITY.md

@@ -0,0 +1,39 @@
+# Security policy
+
+## Supported versions
+
+| Version | Supported |
+|---|---|
+| 2.x | Yes |
+
+## Reporting a vulnerability
+
+Email security@affix-io.com with:
+
+- Description of the issue
+- Steps to reproduce
+- Impact assessment (confidentiality, integrity, availability)
+- Proof-of-concept if available
+
+Do not open public GitHub issues for security reports.
+
+We aim to acknowledge reports within 72 hours.
+
+## Scope
+
+In scope:
+
+- This SDK package (`dist/`, CLI, local storage)
+- Credential handling and offline queue behaviour
+- TLS certificate pinning in `certs/`
+
+Out of scope:
+
+- The AffixIO API infrastructure (report separately)
+- Third-party proving backends (Noir, Barretenberg, noble-post-quantum)
+
+## Safe defaults
+
+- Never commit `.env` with production API keys
+- Use commercial keys for production workloads
+- The public-tier key is rate-limited (6 req/sec per IP)

package/certs/sectigo-r36.pem

@@ -0,0 +1,36 @@
+-----BEGIN CERTIFICATE-----
+MIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBf
+MQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQD
+Ey1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYw
+HhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEY
+MBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1Ymxp
+YyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0B
+AQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7Yeq
+RPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH
+12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAja
+EMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTm
+M64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv
+38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HB
+pXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn
+2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFN
+xx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hk
+lfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycw
+DgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYI
+KwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEw
+VAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdv
+UHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUH
+AQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3Rp
+Z29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUF
+BzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEA
+YtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8
+ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+d
+q1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OF
+h2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH
+5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD
+4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOd
+unQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536
+WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l
+7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzW
+r8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvh
+JEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=
+-----END CERTIFICATE-----

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+import { readFileSync, existsSync } from "node:fs";
+import { AffixSDK, defaultContext, envStatus, loadEnv, randomFieldHex } from "./index.js";
+loadEnv();
+function arg(name) {
+    const idx = process.argv.indexOf(name);
+    if (idx === -1)
+        return undefined;
+    return process.argv[idx + 1];
+}
+function resolveVerifyTarget(sdk, target, circuitFlag) {
+    const stored = sdk.listStoredProofs().find((p) => p.proof_id === target);
+    if (stored) {
+        return { circuitId: stored.circuit_id, proof: stored.proof };
+    }
+    if (existsSync(target)) {
+        const raw = readFileSync(target, "utf8").trim();
+        try {
+            const parsed = JSON.parse(raw);
+            if (parsed.proof && parsed.circuit_id) {
+                return { circuitId: parsed.circuit_id, proof: parsed.proof };
+            }
+            if (parsed.proof && circuitFlag) {
+                return { circuitId: circuitFlag, proof: parsed.proof };
+            }
+        }
+        catch {
+            if (circuitFlag) {
+                return { circuitId: circuitFlag, proof: raw };
+            }
+        }
+        throw new Error("verify_path_needs_circuit_or_json_with_circuit_id");
+    }
+    if (circuitFlag) {
+        return { circuitId: circuitFlag, proof: target };
+    }
+    throw new Error("verify_needs_stored_proof_id_path_or_circuit");
+}
+async function main() {
+    const command = process.argv[2] ?? "health";
+    if (command === "config") {
+        console.log(JSON.stringify(envStatus(), null, 2));
+        return;
+    }
+    const apiKey = process.env.AFFIX_API_KEY ?? arg("--api-key");
+    if (!apiKey) {
+        const status = envStatus();
+        console.error(`Set AFFIX_API_KEY in ${status.env_file} or pass --api-key`);
+        process.exit(1);
+    }
+    const sdk = new AffixSDK({
+        apiKey,
+        apiBase: process.env.AFFIX_API_BASE ?? arg("--api-base") ?? "https://api.affix-io.com",
+    });
+    if (command === "health") {
+        console.log(JSON.stringify(await sdk.client.health(), null, 2));
+        return;
+    }
+    if (command === "flush") {
+        const flushed = await sdk.flushOfflineQueue();
+        console.log(JSON.stringify({ flushed: flushed.length, proofs: flushed }, null, 2));
+        return;
+    }
+    if (command === "circuits") {
+        console.log(JSON.stringify(await sdk.client.listCircuits(), null, 2));
+        return;
+    }
+    if (command === "list") {
+        console.log(JSON.stringify({
+            queued: sdk.listQueuedJobs(),
+            stored: sdk.listStoredProofs(),
+        }, null, 2));
+        return;
+    }
+    if (command === "verify") {
+        const target = process.argv[3];
+        if (!target) {
+            console.error("Usage: affix-sdk verify <proof-id-or-path> [--circuit <id>]");
+            process.exit(1);
+        }
+        const circuitFlag = arg("--circuit");
+        const { circuitId, proof } = resolveVerifyTarget(sdk, target, circuitFlag);
+        const result = await sdk.verify(circuitId, proof);
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (command === "prove") {
+        const circuitId = arg("--circuit") ?? "ticket_local_resident";
+        const now = Math.floor(Date.now() / 1000);
+        const claim = arg("--claim") ?? "local_resident";
+        const region = arg("--region") ?? claim;
+        const schemaLabel = arg("--schema") ?? "residency_v1";
+        const credential = {
+            schema_id: schemaLabel,
+            issuer_id: "demo_issuer",
+            issuer_pubkey_hash: randomFieldHex(),
+            credential_id: randomFieldHex(),
+            claim_value: claim,
+            valid_from: now - 86_400,
+            valid_until: now + 31_536_000,
+            fields: { region },
+        };
+        const context = defaultContext({
+            region_hash: region,
+            as_of_timestamp: now,
+        });
+        const result = await sdk.prove({ circuitId, credential, context });
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log("Usage: affix-sdk config | health | prove | verify | circuits | list | flush");
+}
+main().catch((err) => {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+});