@entros/pulse-sdk 1.4.1 → 1.5.0

package/dist/index.js

@@ -1364,6 +1364,2255 @@ async function generateSolanaProof(current, previous, wasmPath, zkeyPath, thresh
   return serializeProof(proof, publicSignals);
 }
 
+// src/protocol/idl/entros_anchor.json
+var entros_anchor_default = {
+  address: "GZYwTp2ozeuRA5Gof9vs4ya961aANcJBdUzB7LN6q4b2",
+  metadata: {
+    name: "entros_anchor",
+    version: "0.1.0",
+    spec: "0.1.0",
+    description: "Non-transferable identity token for Entros Protocol"
+  },
+  docs: [
+    "Mint account space for Token-2022 with NonTransferable extension.",
+    "Base mint = 82 bytes, account type = 1 byte, extension type (2) + length (2) = 4 bytes,",
+    "NonTransferable data = 0 bytes. Plus multisig padding from Token-2022.",
+    "We use a constant derived from the Token-2022 spec."
+  ],
+  instructions: [
+    {
+      name: "authorize_new_wallet",
+      docs: [
+        "Authorize a new wallet by 2 signers. This can be done many times before invoking migrate_identity()"
+      ],
+      discriminator: [
+        178,
+        186,
+        185,
+        108,
+        51,
+        219,
+        107,
+        197
+      ],
+      accounts: [
+        {
+          name: "signer",
+          writable: true,
+          signer: true
+        },
+        {
+          name: "identity_state",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  105,
+                  100,
+                  101,
+                  110,
+                  116,
+                  105,
+                  116,
+                  121
+                ]
+              },
+              {
+                kind: "account",
+                path: "signer"
+              }
+            ]
+          }
+        },
+        {
+          name: "signer_new",
+          writable: true,
+          signer: true
+        },
+        {
+          name: "token_program"
+        },
+        {
+          name: "mint",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  109,
+                  105,
+                  110,
+                  116
+                ]
+              },
+              {
+                kind: "account",
+                path: "signer"
+              }
+            ]
+          }
+        },
+        {
+          name: "token_account",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "account",
+                path: "signer"
+              },
+              {
+                kind: "account",
+                path: "token_program"
+              },
+              {
+                kind: "account",
+                path: "mint"
+              }
+            ],
+            program: {
+              kind: "const",
+              value: [
+                140,
+                151,
+                37,
+                143,
+                78,
+                36,
+                137,
+                241,
+                187,
+                61,
+                16,
+                41,
+                20,
+                142,
+                13,
+                131,
+                11,
+                90,
+                19,
+                153,
+                218,
+                255,
+                16,
+                132,
+                4,
+                142,
+                123,
+                216,
+                219,
+                233,
+                248,
+                89
+              ]
+            }
+          }
+        }
+      ],
+      args: []
+    },
+    {
+      name: "migrate_identity",
+      docs: [
+        "Migrate from an user's old Anchor IdentityState PDA to a new one",
+        "After this function call, the orphaned 0-balance ATA, pointing at a closed mint, locks ~0.002 SOL of rent. This ATA can be recovered by the old wallet calling closeAccount()"
+      ],
+      discriminator: [
+        161,
+        192,
+        70,
+        80,
+        47,
+        37,
+        26,
+        10
+      ],
+      accounts: [
+        {
+          name: "user",
+          writable: true,
+          signer: true
+        },
+        {
+          name: "identity_state",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  105,
+                  100,
+                  101,
+                  110,
+                  116,
+                  105,
+                  116,
+                  121
+                ]
+              },
+              {
+                kind: "account",
+                path: "user"
+              }
+            ]
+          }
+        },
+        {
+          name: "mint",
+          docs: [
+            "initialization ordering. PDA seeds ensure uniqueness per user."
+          ],
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  109,
+                  105,
+                  110,
+                  116
+                ]
+              },
+              {
+                kind: "account",
+                path: "user"
+              }
+            ]
+          }
+        },
+        {
+          name: "mint_authority",
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  109,
+                  105,
+                  110,
+                  116,
+                  95,
+                  97,
+                  117,
+                  116,
+                  104,
+                  111,
+                  114,
+                  105,
+                  116,
+                  121
+                ]
+              }
+            ]
+          }
+        },
+        {
+          name: "token_account",
+          writable: true
+        },
+        {
+          name: "associated_token_program",
+          address: "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL"
+        },
+        {
+          name: "token_program"
+        },
+        {
+          name: "system_program",
+          address: "11111111111111111111111111111111"
+        },
+        {
+          name: "protocol_config",
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  112,
+                  114,
+                  111,
+                  116,
+                  111,
+                  99,
+                  111,
+                  108,
+                  95,
+                  99,
+                  111,
+                  110,
+                  102,
+                  105,
+                  103
+                ]
+              }
+            ],
+            program: {
+              kind: "const",
+              value: [
+                81,
+                130,
+                250,
+                230,
+                30,
+                253,
+                246,
+                69,
+                82,
+                96,
+                7,
+                173,
+                78,
+                160,
+                131,
+                188,
+                70,
+                106,
+                173,
+                59,
+                102,
+                163,
+                198,
+                189,
+                82,
+                37,
+                225,
+                38,
+                52,
+                233,
+                157,
+                117
+              ]
+            }
+          }
+        },
+        {
+          name: "treasury",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  112,
+                  114,
+                  111,
+                  116,
+                  111,
+                  99,
+                  111,
+                  108,
+                  95,
+                  116,
+                  114,
+                  101,
+                  97,
+                  115,
+                  117,
+                  114,
+                  121
+                ]
+              }
+            ],
+            program: {
+              kind: "const",
+              value: [
+                81,
+                130,
+                250,
+                230,
+                30,
+                253,
+                246,
+                69,
+                82,
+                96,
+                7,
+                173,
+                78,
+                160,
+                131,
+                188,
+                70,
+                106,
+                173,
+                59,
+                102,
+                163,
+                198,
+                189,
+                82,
+                37,
+                225,
+                38,
+                52,
+                233,
+                157,
+                117
+              ]
+            }
+          }
+        },
+        {
+          name: "wallet_old",
+          writable: true
+        },
+        {
+          name: "identity_state_old",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  105,
+                  100,
+                  101,
+                  110,
+                  116,
+                  105,
+                  116,
+                  121
+                ]
+              },
+              {
+                kind: "account",
+                path: "wallet_old"
+              }
+            ]
+          }
+        },
+        {
+          name: "mint_old",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  109,
+                  105,
+                  110,
+                  116
+                ]
+              },
+              {
+                kind: "account",
+                path: "wallet_old"
+              }
+            ]
+          }
+        },
+        {
+          name: "token_account_old",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "account",
+                path: "wallet_old"
+              },
+              {
+                kind: "account",
+                path: "token_program"
+              },
+              {
+                kind: "account",
+                path: "mint_old"
+              }
+            ],
+            program: {
+              kind: "const",
+              value: [
+                140,
+                151,
+                37,
+                143,
+                78,
+                36,
+                137,
+                241,
+                187,
+                61,
+                16,
+                41,
+                20,
+                142,
+                13,
+                131,
+                11,
+                90,
+                19,
+                153,
+                218,
+                255,
+                16,
+                132,
+                4,
+                142,
+                123,
+                216,
+                219,
+                233,
+                248,
+                89
+              ]
+            }
+          }
+        }
+      ],
+      args: []
+    },
+    {
+      name: "mint_anchor",
+      docs: [
+        "Mint a new Entros Anchor identity for the caller.",
+        "Creates a NonTransferable Token-2022 mint, mints 1 token to the user's ATA,",
+        "and initializes the IdentityState PDA."
+      ],
+      discriminator: [
+        68,
+        56,
+        113,
+        102,
+        236,
+        152,
+        146,
+        60
+      ],
+      accounts: [
+        {
+          name: "user",
+          writable: true,
+          signer: true
+        },
+        {
+          name: "identity_state",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  105,
+                  100,
+                  101,
+                  110,
+                  116,
+                  105,
+                  116,
+                  121
+                ]
+              },
+              {
+                kind: "account",
+                path: "user"
+              }
+            ]
+          }
+        },
+        {
+          name: "mint",
+          docs: [
+            "initialization ordering. PDA seeds ensure uniqueness per user."
+          ],
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  109,
+                  105,
+                  110,
+                  116
+                ]
+              },
+              {
+                kind: "account",
+                path: "user"
+              }
+            ]
+          }
+        },
+        {
+          name: "mint_authority",
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  109,
+                  105,
+                  110,
+                  116,
+                  95,
+                  97,
+                  117,
+                  116,
+                  104,
+                  111,
+                  114,
+                  105,
+                  116,
+                  121
+                ]
+              }
+            ]
+          }
+        },
+        {
+          name: "token_account",
+          writable: true
+        },
+        {
+          name: "associated_token_program",
+          address: "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL"
+        },
+        {
+          name: "token_program"
+        },
+        {
+          name: "system_program",
+          address: "11111111111111111111111111111111"
+        },
+        {
+          name: "protocol_config",
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  112,
+                  114,
+                  111,
+                  116,
+                  111,
+                  99,
+                  111,
+                  108,
+                  95,
+                  99,
+                  111,
+                  110,
+                  102,
+                  105,
+                  103
+                ]
+              }
+            ],
+            program: {
+              kind: "const",
+              value: [
+                81,
+                130,
+                250,
+                230,
+                30,
+                253,
+                246,
+                69,
+                82,
+                96,
+                7,
+                173,
+                78,
+                160,
+                131,
+                188,
+                70,
+                106,
+                173,
+                59,
+                102,
+                163,
+                198,
+                189,
+                82,
+                37,
+                225,
+                38,
+                52,
+                233,
+                157,
+                117
+              ]
+            }
+          }
+        },
+        {
+          name: "treasury",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  112,
+                  114,
+                  111,
+                  116,
+                  111,
+                  99,
+                  111,
+                  108,
+                  95,
+                  116,
+                  114,
+                  101,
+                  97,
+                  115,
+                  117,
+                  114,
+                  121
+                ]
+              }
+            ],
+            program: {
+              kind: "const",
+              value: [
+                81,
+                130,
+                250,
+                230,
+                30,
+                253,
+                246,
+                69,
+                82,
+                96,
+                7,
+                173,
+                78,
+                160,
+                131,
+                188,
+                70,
+                106,
+                173,
+                59,
+                102,
+                163,
+                198,
+                189,
+                82,
+                37,
+                225,
+                38,
+                52,
+                233,
+                157,
+                117
+              ]
+            }
+          }
+        },
+        {
+          name: "instructions_sysvar",
+          docs: [
+            "receipt verification (master-list #146 Phase 3) to inspect the",
+            "preceding Ed25519Program::verify instruction in the same tx.",
+            "Address is constrained to the canonical sysvar pubkey, so the",
+            "program is guaranteed to be reading the real sysvar regardless of",
+            "what the client passes."
+          ],
+          address: "Sysvar1nstructions1111111111111111111111111"
+        }
+      ],
+      args: [
+        {
+          name: "initial_commitment",
+          type: {
+            array: [
+              "u8",
+              32
+            ]
+          }
+        }
+      ]
+    },
+    {
+      name: "reset_identity_state",
+      docs: [
+        "Reset the caller's identity state to a fresh baseline.",
+        "",
+        "Recovery path for users whose client-side fingerprint envelope is",
+        "unrecoverable (cleared site data, new device, corrupted keystore).",
+        'Without this instruction the only answer is "mint a new wallet,"',
+        "which discards on-chain history and the SAS attestation. Reset",
+        "rotates `current_commitment` in place and zeroes verification",
+        "history so a compromised wallet cannot inherit reputation.",
+        "",
+        "Defenses:",
+        "- Signer constraint on `authority` proves wallet ownership.",
+        "- 7-day cooldown (`RESET_COOLDOWN_SECS`) bounds abuse frequency.",
+        "- Full zero of `verification_count`, `trust_score`, and",
+        "`recent_timestamps` means an attacker who compromises the",
+        "wallet key and passes Tier 1 validation starts from zero.",
+        "- Verification fee charged, matching mint/update economics.",
+        "",
+        "No ZK proof is consumed: there is no prior fingerprint to",
+        "Hamming-compare against, and the Hamming circuit's",
+        "`min_distance \u2265 3` constraint would reject a same-fingerprint",
+        "proof anyway. Live-humanness evidence comes from the Tier 1",
+        "validation pipeline at the SAS attestation step (handled by",
+        "the off-chain executor, not this instruction)."
+      ],
+      discriminator: [
+        26,
+        78,
+        86,
+        143,
+        247,
+        132,
+        85,
+        203
+      ],
+      accounts: [
+        {
+          name: "authority",
+          writable: true,
+          signer: true
+        },
+        {
+          name: "identity_state",
+          docs: [
+            "may realloc legacy-layout accounts (207 or 543 bytes) to the current",
+            "551-byte layout before deserialization. PDA validated by seeds;",
+            "ownership verified in instruction body after deserialization."
+          ],
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  105,
+                  100,
+                  101,
+                  110,
+                  116,
+                  105,
+                  116,
+                  121
+                ]
+              },
+              {
+                kind: "account",
+                path: "authority"
+              }
+            ]
+          }
+        },
+        {
+          name: "protocol_config",
+          docs: [
+            "Supplies the verification fee amount charged on reset."
+          ],
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  112,
+                  114,
+                  111,
+                  116,
+                  111,
+                  99,
+                  111,
+                  108,
+                  95,
+                  99,
+                  111,
+                  110,
+                  102,
+                  105,
+                  103
+                ]
+              }
+            ],
+            program: {
+              kind: "const",
+              value: [
+                81,
+                130,
+                250,
+                230,
+                30,
+                253,
+                246,
+                69,
+                82,
+                96,
+                7,
+                173,
+                78,
+                160,
+                131,
+                188,
+                70,
+                106,
+                173,
+                59,
+                102,
+                163,
+                198,
+                189,
+                82,
+                37,
+                225,
+                38,
+                52,
+                233,
+                157,
+                117
+              ]
+            }
+          }
+        },
+        {
+          name: "treasury",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  112,
+                  114,
+                  111,
+                  116,
+                  111,
+                  99,
+                  111,
+                  108,
+                  95,
+                  116,
+                  114,
+                  101,
+                  97,
+                  115,
+                  117,
+                  114,
+                  121
+                ]
+              }
+            ],
+            program: {
+              kind: "const",
+              value: [
+                81,
+                130,
+                250,
+                230,
+                30,
+                253,
+                246,
+                69,
+                82,
+                96,
+                7,
+                173,
+                78,
+                160,
+                131,
+                188,
+                70,
+                106,
+                173,
+                59,
+                102,
+                163,
+                198,
+                189,
+                82,
+                37,
+                225,
+                38,
+                52,
+                233,
+                157,
+                117
+              ]
+            }
+          }
+        },
+        {
+          name: "system_program",
+          address: "11111111111111111111111111111111"
+        }
+      ],
+      args: [
+        {
+          name: "new_commitment",
+          type: {
+            array: [
+              "u8",
+              32
+            ]
+          }
+        }
+      ]
+    },
+    {
+      name: "update_anchor",
+      docs: [
+        "Update the identity state after a successful proof verification.",
+        "",
+        "Trust score is computed automatically from verification history and protocol config.",
+        "Handles transparent migration from old (10-slot) to new (52-slot) account layouts.",
+        "",
+        "Requires a matching, fresh `VerificationResult` PDA (owned by entros-verifier)",
+        "whose `commitment_new` equals `new_commitment` and whose `commitment_prev`",
+        "equals the identity's current stored commitment. Without this binding the",
+        "instruction would accept any commitment with no biometric proof \u2014 allowing",
+        "trust-score farming via per-call fee payment, which contradicts the",
+        "protocol's economic deterrence model. See AUDIT.md for details.",
+        "",
+        "The `verification_nonce` argument supplies the challenge nonce used to",
+        'derive the VerificationResult PDA (`seeds = [b"verification", authority, nonce]`).',
+        "Single-use is enforced implicitly: after this call, `current_commitment`",
+        "rotates to `new_commitment`, so the consumed VerificationResult's",
+        "`commitment_prev` no longer matches on any future call."
+      ],
+      discriminator: [
+        120,
+        192,
+        72,
+        245,
+        112,
+        246,
+        119,
+        135
+      ],
+      accounts: [
+        {
+          name: "authority",
+          writable: true,
+          signer: true
+        },
+        {
+          name: "identity_state",
+          docs: [
+            "from old (10-slot) to new (52-slot) account layouts. PDA validated by seeds.",
+            "Ownership verified in instruction body after deserialization."
+          ],
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  105,
+                  100,
+                  101,
+                  110,
+                  116,
+                  105,
+                  116,
+                  121
+                ]
+              },
+              {
+                kind: "account",
+                path: "authority"
+              }
+            ]
+          }
+        },
+        {
+          name: "verification_result",
+          docs: [
+            "PDA seeds validated by Anchor; layout + owner + cross-field constraints",
+            "validated in instruction body. Binds the ZK proof to this specific",
+            "update \u2014 without this account, update_anchor would accept any commitment",
+            "with no proof."
+          ],
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  118,
+                  101,
+                  114,
+                  105,
+                  102,
+                  105,
+                  99,
+                  97,
+                  116,
+                  105,
+                  111,
+                  110
+                ]
+              },
+              {
+                kind: "account",
+                path: "authority"
+              },
+              {
+                kind: "arg",
+                path: "verification_nonce"
+              }
+            ],
+            program: {
+              kind: "const",
+              value: [
+                48,
+                50,
+                94,
+                115,
+                90,
+                162,
+                108,
+                8,
+                240,
+                151,
+                76,
+                223,
+                101,
+                176,
+                170,
+                86,
+                254,
+                247,
+                252,
+                28,
+                240,
+                145,
+                60,
+                108,
+                42,
+                129,
+                105,
+                32,
+                232,
+                212,
+                226,
+                52
+              ]
+            }
+          }
+        },
+        {
+          name: "protocol_config",
+          docs: [
+            "Validated by seeds + owner via seeds::program."
+          ],
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  112,
+                  114,
+                  111,
+                  116,
+                  111,
+                  99,
+                  111,
+                  108,
+                  95,
+                  99,
+                  111,
+                  110,
+                  102,
+                  105,
+                  103
+                ]
+              }
+            ],
+            program: {
+              kind: "const",
+              value: [
+                81,
+                130,
+                250,
+                230,
+                30,
+                253,
+                246,
+                69,
+                82,
+                96,
+                7,
+                173,
+                78,
+                160,
+                131,
+                188,
+                70,
+                106,
+                173,
+                59,
+                102,
+                163,
+                198,
+                189,
+                82,
+                37,
+                225,
+                38,
+                52,
+                233,
+                157,
+                117
+              ]
+            }
+          }
+        },
+        {
+          name: "treasury",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  112,
+                  114,
+                  111,
+                  116,
+                  111,
+                  99,
+                  111,
+                  108,
+                  95,
+                  116,
+                  114,
+                  101,
+                  97,
+                  115,
+                  117,
+                  114,
+                  121
+                ]
+              }
+            ],
+            program: {
+              kind: "const",
+              value: [
+                81,
+                130,
+                250,
+                230,
+                30,
+                253,
+                246,
+                69,
+                82,
+                96,
+                7,
+                173,
+                78,
+                160,
+                131,
+                188,
+                70,
+                106,
+                173,
+                59,
+                102,
+                163,
+                198,
+                189,
+                82,
+                37,
+                225,
+                38,
+                52,
+                233,
+                157,
+                117
+              ]
+            }
+          }
+        },
+        {
+          name: "system_program",
+          address: "11111111111111111111111111111111"
+        }
+      ],
+      args: [
+        {
+          name: "new_commitment",
+          type: {
+            array: [
+              "u8",
+              32
+            ]
+          }
+        },
+        {
+          name: "verification_nonce",
+          type: {
+            array: [
+              "u8",
+              32
+            ]
+          }
+        }
+      ]
+    }
+  ],
+  accounts: [
+    {
+      name: "IdentityState",
+      discriminator: [
+        156,
+        32,
+        87,
+        93,
+        52,
+        155,
+        248,
+        207
+      ]
+    }
+  ],
+  events: [
+    {
+      name: "AnchorMinted",
+      discriminator: [
+        11,
+        188,
+        6,
+        169,
+        20,
+        50,
+        128,
+        172
+      ]
+    },
+    {
+      name: "AnchorReset",
+      discriminator: [
+        183,
+        48,
+        146,
+        155,
+        112,
+        20,
+        140,
+        31
+      ]
+    },
+    {
+      name: "AnchorUpdated",
+      discriminator: [
+        112,
+        73,
+        210,
+        183,
+        57,
+        84,
+        103,
+        59
+      ]
+    },
+    {
+      name: "MigrateIdentityEvent",
+      discriminator: [
+        33,
+        239,
+        166,
+        187,
+        108,
+        47,
+        49,
+        139
+      ]
+    }
+  ],
+  errors: [
+    {
+      code: 6e3,
+      name: "InvalidCommitment",
+      msg: "Invalid commitment: must be 32 non-zero bytes"
+    },
+    {
+      code: 6001,
+      name: "Unauthorized",
+      msg: "Unauthorized: caller is not the identity owner"
+    },
+    {
+      code: 6002,
+      name: "ArithmeticOverflow",
+      msg: "Arithmetic overflow"
+    },
+    {
+      code: 6003,
+      name: "InvalidProtocolConfig",
+      msg: "Invalid protocol config account"
+    },
+    {
+      code: 6004,
+      name: "InvalidIdentityState",
+      msg: "Identity state account failed to deserialize"
+    },
+    {
+      code: 6005,
+      name: "IdentitySerializationFailed",
+      msg: "Identity state account failed to serialize"
+    },
+    {
+      code: 6006,
+      name: "VerificationResultWrongOwner",
+      msg: "VerificationResult account is owned by the wrong program"
+    },
+    {
+      code: 6007,
+      name: "StaleVerificationResult",
+      msg: "VerificationResult account has stale layout (pre-binding-patch)"
+    },
+    {
+      code: 6008,
+      name: "VerifierMismatch",
+      msg: "VerificationResult verifier does not match the signing authority"
+    },
+    {
+      code: 6009,
+      name: "ProofExpired",
+      msg: "Proof is too old to consume (MAX_PROOF_AGE_SECS exceeded)"
+    },
+    {
+      code: 6010,
+      name: "CommitmentMismatch",
+      msg: "Proof commitment_new does not match the submitted new_commitment"
+    },
+    {
+      code: 6011,
+      name: "PrevCommitmentMismatch",
+      msg: "Proof commitment_prev does not match the identity's current_commitment"
+    },
+    {
+      code: 6012,
+      name: "ResetCooldownActive",
+      msg: "Reset cooldown has not elapsed since the last reset"
+    },
+    {
+      code: 6013,
+      name: "UnauthorizedNewWallet",
+      msg: "caller is not authorized by the old identity"
+    },
+    {
+      code: 6014,
+      name: "ProofFromFuture",
+      msg: "VerificationResult.verified_at is in the future relative to the cluster clock"
+    },
+    {
+      code: 6015,
+      name: "MissingValidatorReceipt",
+      msg: "mint_anchor expected a preceding Ed25519Program::verify instruction with a validator-signed receipt; none found"
+    },
+    {
+      code: 6016,
+      name: "ReceiptValidatorMismatch",
+      msg: "Receipt was signed by a key that does not match ProtocolConfig.validator_pubkey"
+    },
+    {
+      code: 6017,
+      name: "ReceiptCommitmentMismatch",
+      msg: "Receipt commitment does not match the mint_anchor commitment argument"
+    },
+    {
+      code: 6018,
+      name: "ReceiptWalletMismatch",
+      msg: "Receipt wallet does not match the mint signer"
+    },
+    {
+      code: 6019,
+      name: "ReceiptExpired",
+      msg: "Receipt has aged past MAX_RECEIPT_AGE_SECS"
+    },
+    {
+      code: 6020,
+      name: "ReceiptFromFuture",
+      msg: "Receipt validated_at is in the future relative to the cluster clock"
+    },
+    {
+      code: 6021,
+      name: "MalformedReceiptMessage",
+      msg: "Receipt message has malformed length or layout"
+    }
+  ],
+  types: [
+    {
+      name: "AnchorMinted",
+      type: {
+        kind: "struct",
+        fields: [
+          {
+            name: "owner",
+            type: "pubkey"
+          },
+          {
+            name: "mint",
+            type: "pubkey"
+          },
+          {
+            name: "commitment",
+            type: {
+              array: [
+                "u8",
+                32
+              ]
+            }
+          }
+        ]
+      }
+    },
+    {
+      name: "AnchorReset",
+      type: {
+        kind: "struct",
+        fields: [
+          {
+            name: "owner",
+            type: "pubkey"
+          },
+          {
+            name: "mint",
+            type: "pubkey"
+          },
+          {
+            name: "commitment",
+            type: {
+              array: [
+                "u8",
+                32
+              ]
+            }
+          }
+        ]
+      }
+    },
+    {
+      name: "AnchorUpdated",
+      type: {
+        kind: "struct",
+        fields: [
+          {
+            name: "owner",
+            type: "pubkey"
+          },
+          {
+            name: "verification_count",
+            type: "u32"
+          },
+          {
+            name: "trust_score",
+            type: "u16"
+          },
+          {
+            name: "commitment",
+            type: {
+              array: [
+                "u8",
+                32
+              ]
+            }
+          }
+        ]
+      }
+    },
+    {
+      name: "IdentityState",
+      type: {
+        kind: "struct",
+        fields: [
+          {
+            name: "owner",
+            docs: [
+              "The user's wallet pubkey"
+            ],
+            type: "pubkey"
+          },
+          {
+            name: "creation_timestamp",
+            docs: [
+              "When the identity was first minted"
+            ],
+            type: "i64"
+          },
+          {
+            name: "last_verification_timestamp",
+            docs: [
+              "Most recent successful verification"
+            ],
+            type: "i64"
+          },
+          {
+            name: "verification_count",
+            docs: [
+              "Total successful verifications"
+            ],
+            type: "u32"
+          },
+          {
+            name: "trust_score",
+            docs: [
+              "Computed reputation metric"
+            ],
+            type: "u16"
+          },
+          {
+            name: "current_commitment",
+            docs: [
+              "Latest Poseidon commitment H_TBH"
+            ],
+            type: {
+              array: [
+                "u8",
+                32
+              ]
+            }
+          },
+          {
+            name: "mint",
+            docs: [
+              "The NonTransferable mint associated with this identity"
+            ],
+            type: "pubkey"
+          },
+          {
+            name: "bump",
+            docs: [
+              "PDA bump seed"
+            ],
+            type: "u8"
+          },
+          {
+            name: "recent_timestamps",
+            docs: [
+              "Timestamps of last 52 verifications (newest at index 0).",
+              "52 slots covers 1 year of weekly or 4+ years of monthly verifications.",
+              "Older entries contribute negligible score due to exponential recency decay."
+            ],
+            type: {
+              array: [
+                "i64",
+                52
+              ]
+            }
+          },
+          {
+            name: "last_reset_timestamp",
+            docs: [
+              "Most recent `reset_identity_state` invocation. Zero when the identity",
+              "has never been reset (including freshly minted accounts and accounts",
+              "created before this field existed and then realloc'd in-place)."
+            ],
+            type: "i64"
+          },
+          {
+            name: "new_wallet",
+            docs: [
+              "new wallet for migrate_identity()"
+            ],
+            type: "pubkey"
+          }
+        ]
+      }
+    },
+    {
+      name: "MigrateIdentityEvent",
+      type: {
+        kind: "struct",
+        fields: [
+          {
+            name: "wallet_old",
+            type: "pubkey"
+          },
+          {
+            name: "wallet_new",
+            type: "pubkey"
+          },
+          {
+            name: "identity_old",
+            type: "pubkey"
+          },
+          {
+            name: "identity_new",
+            type: "pubkey"
+          }
+        ]
+      }
+    }
+  ]
+};
+
+// src/protocol/idl/entros_verifier.json
+var entros_verifier_default = {
+  address: "4F97jNoxQzT2qRbkWpW3ztC3Nz2TtKj3rnKG8ExgnrfV",
+  metadata: {
+    name: "entros_verifier",
+    version: "0.1.0",
+    spec: "0.1.0",
+    description: "ZK proof verification program for Entros Protocol"
+  },
+  instructions: [
+    {
+      name: "close_challenge",
+      docs: [
+        "Close a used or expired challenge account to reclaim rent."
+      ],
+      discriminator: [
+        29,
+        156,
+        109,
+        17,
+        41,
+        99,
+        71,
+        236
+      ],
+      accounts: [
+        {
+          name: "challenger",
+          writable: true,
+          signer: true
+        },
+        {
+          name: "challenge",
+          writable: true
+        }
+      ],
+      args: []
+    },
+    {
+      name: "close_verification_result",
+      docs: [
+        "Close a verification result account to reclaim rent."
+      ],
+      discriminator: [
+        202,
+        203,
+        62,
+        127,
+        7,
+        157,
+        143,
+        12
+      ],
+      accounts: [
+        {
+          name: "verifier",
+          writable: true,
+          signer: true
+        },
+        {
+          name: "verification_result",
+          writable: true
+        }
+      ],
+      args: []
+    },
+    {
+      name: "create_challenge",
+      docs: [
+        "Create a verification challenge with a client-generated nonce."
+      ],
+      discriminator: [
+        170,
+        244,
+        47,
+        1,
+        1,
+        15,
+        173,
+        239
+      ],
+      accounts: [
+        {
+          name: "challenger",
+          writable: true,
+          signer: true
+        },
+        {
+          name: "challenge",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  99,
+                  104,
+                  97,
+                  108,
+                  108,
+                  101,
+                  110,
+                  103,
+                  101
+                ]
+              },
+              {
+                kind: "account",
+                path: "challenger"
+              },
+              {
+                kind: "arg",
+                path: "nonce"
+              }
+            ]
+          }
+        },
+        {
+          name: "system_program",
+          address: "11111111111111111111111111111111"
+        }
+      ],
+      args: [
+        {
+          name: "nonce",
+          type: {
+            array: [
+              "u8",
+              32
+            ]
+          }
+        }
+      ]
+    },
+    {
+      name: "verify_proof",
+      docs: [
+        "Verify a proof against a challenge.",
+        "Validates the challenge is unused and not expired, runs mock verification,",
+        "and stores the result."
+      ],
+      discriminator: [
+        217,
+        211,
+        191,
+        110,
+        144,
+        13,
+        186,
+        98
+      ],
+      accounts: [
+        {
+          name: "verifier",
+          writable: true,
+          signer: true
+        },
+        {
+          name: "challenge",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  99,
+                  104,
+                  97,
+                  108,
+                  108,
+                  101,
+                  110,
+                  103,
+                  101
+                ]
+              },
+              {
+                kind: "account",
+                path: "verifier"
+              },
+              {
+                kind: "arg",
+                path: "nonce"
+              }
+            ]
+          }
+        },
+        {
+          name: "verification_result",
+          writable: true,
+          pda: {
+            seeds: [
+              {
+                kind: "const",
+                value: [
+                  118,
+                  101,
+                  114,
+                  105,
+                  102,
+                  105,
+                  99,
+                  97,
+                  116,
+                  105,
+                  111,
+                  110
+                ]
+              },
+              {
+                kind: "account",
+                path: "verifier"
+              },
+              {
+                kind: "arg",
+                path: "nonce"
+              }
+            ]
+          }
+        },
+        {
+          name: "system_program",
+          address: "11111111111111111111111111111111"
+        }
+      ],
+      args: [
+        {
+          name: "proof_bytes",
+          type: "bytes"
+        },
+        {
+          name: "public_inputs",
+          type: {
+            vec: {
+              array: [
+                "u8",
+                32
+              ]
+            }
+          }
+        },
+        {
+          name: "nonce",
+          type: {
+            array: [
+              "u8",
+              32
+            ]
+          }
+        }
+      ]
+    }
+  ],
+  accounts: [
+    {
+      name: "Challenge",
+      discriminator: [
+        119,
+        250,
+        161,
+        121,
+        119,
+        81,
+        22,
+        208
+      ]
+    },
+    {
+      name: "VerificationResult",
+      discriminator: [
+        104,
+        111,
+        80,
+        172,
+        219,
+        191,
+        162,
+        38
+      ]
+    }
+  ],
+  events: [
+    {
+      name: "ChallengeCreated",
+      discriminator: [
+        166,
+        178,
+        174,
+        178,
+        11,
+        172,
+        98,
+        243
+      ]
+    },
+    {
+      name: "VerificationComplete",
+      discriminator: [
+        22,
+        74,
+        77,
+        232,
+        220,
+        46,
+        59,
+        120
+      ]
+    }
+  ],
+  errors: [
+    {
+      code: 6e3,
+      name: "InvalidProofFormat",
+      msg: "Invalid proof format"
+    },
+    {
+      code: 6001,
+      name: "ProofVerificationFailed",
+      msg: "Proof verification failed"
+    },
+    {
+      code: 6002,
+      name: "ChallengeExpired",
+      msg: "Challenge has expired"
+    },
+    {
+      code: 6003,
+      name: "ChallengeAlreadyUsed",
+      msg: "Challenge already used"
+    },
+    {
+      code: 6004,
+      name: "InvalidPublicInputs",
+      msg: "Invalid public inputs"
+    },
+    {
+      code: 6005,
+      name: "ChallengeNotUsed",
+      msg: "Challenge must be used before closing"
+    },
+    {
+      code: 6006,
+      name: "InvalidNonce",
+      msg: "Invalid nonce: must not be all zeros"
+    },
+    {
+      code: 6007,
+      name: "ArithmeticOverflow",
+      msg: "Arithmetic overflow"
+    }
+  ],
+  types: [
+    {
+      name: "Challenge",
+      type: {
+        kind: "struct",
+        fields: [
+          {
+            name: "challenger",
+            docs: [
+              "The user who requested the challenge"
+            ],
+            type: "pubkey"
+          },
+          {
+            name: "nonce",
+            docs: [
+              "Random nonce for anti-replay"
+            ],
+            type: {
+              array: [
+                "u8",
+                32
+              ]
+            }
+          },
+          {
+            name: "created_at",
+            docs: [
+              "Unix timestamp when challenge was created"
+            ],
+            type: "i64"
+          },
+          {
+            name: "expires_at",
+            docs: [
+              "Unix timestamp when challenge expires"
+            ],
+            type: "i64"
+          },
+          {
+            name: "used",
+            docs: [
+              "Whether this challenge has been consumed"
+            ],
+            type: "bool"
+          },
+          {
+            name: "bump",
+            docs: [
+              "PDA bump seed"
+            ],
+            type: "u8"
+          }
+        ]
+      }
+    },
+    {
+      name: "ChallengeCreated",
+      type: {
+        kind: "struct",
+        fields: [
+          {
+            name: "challenger",
+            type: "pubkey"
+          },
+          {
+            name: "nonce",
+            type: {
+              array: [
+                "u8",
+                32
+              ]
+            }
+          },
+          {
+            name: "expires_at",
+            type: "i64"
+          }
+        ]
+      }
+    },
+    {
+      name: "VerificationComplete",
+      type: {
+        kind: "struct",
+        fields: [
+          {
+            name: "verifier",
+            type: "pubkey"
+          },
+          {
+            name: "is_valid",
+            type: "bool"
+          },
+          {
+            name: "nonce",
+            type: {
+              array: [
+                "u8",
+                32
+              ]
+            }
+          }
+        ]
+      }
+    },
+    {
+      name: "VerificationResult",
+      type: {
+        kind: "struct",
+        fields: [
+          {
+            name: "verifier",
+            docs: [
+              "Who submitted the proof"
+            ],
+            type: "pubkey"
+          },
+          {
+            name: "proof_hash",
+            docs: [
+              "Hash of the proof bytes for audit trail"
+            ],
+            type: {
+              array: [
+                "u8",
+                32
+              ]
+            }
+          },
+          {
+            name: "verified_at",
+            docs: [
+              "Unix timestamp of verification"
+            ],
+            type: "i64"
+          },
+          {
+            name: "is_valid",
+            docs: [
+              "Whether the proof was valid.",
+              "Always true for persisted records \u2014 invalid proofs revert the transaction",
+              "and never create a VerificationResult. Retained for account layout stability."
+            ],
+            type: "bool"
+          },
+          {
+            name: "challenge_nonce",
+            docs: [
+              "The challenge nonce that was consumed"
+            ],
+            type: {
+              array: [
+                "u8",
+                32
+              ]
+            }
+          },
+          {
+            name: "bump",
+            docs: [
+              "PDA bump seed"
+            ],
+            type: "u8"
+          },
+          {
+            name: "commitment_new",
+            docs: [
+              "New fingerprint commitment from public_inputs[0]. Read cross-program",
+              "by entros-anchor::update_anchor to bind the proof to the identity update."
+            ],
+            type: {
+              array: [
+                "u8",
+                32
+              ]
+            }
+          },
+          {
+            name: "commitment_prev",
+            docs: [
+              "Previous fingerprint commitment from public_inputs[1]. Read cross-program",
+              "by entros-anchor::update_anchor to bind to the identity's stored commitment."
+            ],
+            type: {
+              array: [
+                "u8",
+                32
+              ]
+            }
+          },
+          {
+            name: "threshold",
+            docs: [
+              "Hamming threshold from public_inputs[2]. Bounded at proof time to prevent",
+              "attacker-chosen circuit parameters."
+            ],
+            type: "u16"
+          },
+          {
+            name: "min_distance",
+            docs: [
+              "Hamming min_distance from public_inputs[3]. Bounded at proof time to",
+              "prevent replay (Hamming=0) attacks via attacker-chosen min_distance=0."
+            ],
+            type: "u16"
+          }
+        ]
+      }
+    }
+  ]
+};
+
 // src/submit/receipt.ts
 var PUBKEY_BYTES = 32;
 var SIGNATURE_BYTES = 64;
@@ -1404,7 +3653,38 @@ async function buildEd25519ReceiptIx(receipt) {
 }
 
 // src/submit/wallet.ts
+async function confirmAndCheck(connection, signature) {
+  if (!signature) {
+    throw new Error("confirmAndCheck called without a transaction signature");
+  }
+  const confirmation = await connection.confirmTransaction(signature, "confirmed");
+  if (confirmation?.value?.err != null) {
+    throw new Error(
+      `Transaction failed on chain: ${JSON.stringify(confirmation.value.err)} (sig=${signature})`
+    );
+  }
+}
 async function requestSasAttestation(wallet, walletAddress, relayerUrl, relayerApiKey, serverNonce) {
+  if (!serverNonce) {
+    sdkLog("[Entros SDK] Skipping SAS attestation: no server-issued nonce");
+    return void 0;
+  }
+  if (!wallet?.signMessage) {
+    sdkLog("[Entros SDK] Skipping SAS attestation: wallet does not support signMessage");
+    return void 0;
+  }
+  let signature;
+  let message;
+  try {
+    const timestamp = Math.floor(Date.now() / 1e3);
+    message = `Entros-ATTEST:${walletAddress}:${timestamp}`;
+    const messageBytes = new TextEncoder().encode(message);
+    const sigBytes = await wallet.signMessage(messageBytes);
+    signature = Array.from(sigBytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+  } catch {
+    sdkWarn("[Entros SDK] Wallet signMessage failed, skipping SAS attestation");
+    return void 0;
+  }
   try {
     const attestHeaders = {
       "Content-Type": "application/json"
@@ -1416,21 +3696,12 @@ async function requestSasAttestation(wallet, walletAddress, relayerUrl, relayerA
     const timer = setTimeout(() => controller.abort(), 15e3);
     const baseUrl = new URL(relayerUrl);
     const attestUrl = `${baseUrl.origin}/attest`;
-    const attestBody = { wallet_address: walletAddress };
-    if (serverNonce) attestBody.nonce = serverNonce;
-    if (wallet?.signMessage) {
-      try {
-        const timestamp = Math.floor(Date.now() / 1e3);
-        const attestMessage = `Entros-ATTEST:${walletAddress}:${timestamp}`;
-        const messageBytes = new TextEncoder().encode(attestMessage);
-        const sigBytes = await wallet.signMessage(messageBytes);
-        const sigHex = Array.from(sigBytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-        attestBody.signature = sigHex;
-        attestBody.message = attestMessage;
-      } catch {
-        sdkWarn("Wallet signMessage failed, skipping ownership proof");
-      }
-    }
+    const attestBody = {
+      wallet_address: walletAddress,
+      nonce: serverNonce,
+      signature,
+      message
+    };
     const attestRes = await fetch(attestUrl, {
       method: "POST",
       headers: attestHeaders,
@@ -1535,24 +3806,14 @@ async function submitViaWallet(proof, commitment, options) {
         [new TextEncoder().encode("protocol_treasury")],
         registryProgramId
       );
-      const [verifierIdl, anchorIdl] = await Promise.all([
-        anchor.Program.fetchIdl(verifierProgramId, provider),
-        anchor.Program.fetchIdl(anchorProgramId, provider)
-      ]);
-      if (!verifierIdl) {
-        return {
-          success: false,
-          error: `Failed to fetch entros-verifier IDL from Solana (program ${PROGRAM_IDS.entrosVerifier}). Check your RPC endpoint is reachable and on the correct cluster.`
-        };
-      }
-      if (!anchorIdl) {
-        return {
-          success: false,
-          error: `Failed to fetch entros-anchor IDL from Solana (program ${PROGRAM_IDS.entrosAnchor}). Check your RPC endpoint is reachable and on the correct cluster.`
-        };
-      }
-      const verifierProgram = new anchor.Program(verifierIdl, provider);
-      const anchorProgram = new anchor.Program(anchorIdl, provider);
+      const verifierProgram = new anchor.Program(
+        entros_verifier_default,
+        provider
+      );
+      const anchorProgram = new anchor.Program(
+        entros_anchor_default,
+        provider
+      );
       const { Buffer: SolBuffer } = await import("buffer");
       const createChallengeIx = await verifierProgram.methods.createChallenge(nonce).accounts({
         challenger: provider.wallet.publicKey,
@@ -1587,16 +3848,12 @@ async function submitViaWallet(proof, commitment, options) {
       txSig = await options.wallet.sendTransaction(tx, options.connection, {
         skipPreflight: true
       });
-      await options.connection.confirmTransaction(txSig, "confirmed");
+      await confirmAndCheck(options.connection, txSig);
     } else {
-      const anchorIdl = await anchor.Program.fetchIdl(anchorProgramId, provider);
-      if (!anchorIdl) {
-        return {
-          success: false,
-          error: `Failed to fetch entros-anchor IDL from Solana (program ${PROGRAM_IDS.entrosAnchor}). Check your RPC endpoint is reachable and on the correct cluster.`
-        };
-      }
-      const anchorProgram = new anchor.Program(anchorIdl, provider);
+      const anchorProgram = new anchor.Program(
+        entros_anchor_default,
+        provider
+      );
       const [identityPda] = PublicKey.findProgramAddressSync(
         [new TextEncoder().encode("identity"), provider.wallet.publicKey.toBuffer()],
         anchorProgramId
@@ -1669,7 +3926,7 @@ async function submitViaWallet(proof, commitment, options) {
       txSig = await options.wallet.sendTransaction(tx, options.connection, {
         skipPreflight: true
       });
-      await options.connection.confirmTransaction(txSig, "confirmed");
+      await confirmAndCheck(options.connection, txSig);
     }
     const attestationTx = options.relayerUrl ? await requestSasAttestation(
       options.wallet,
@@ -1706,14 +3963,10 @@ async function submitResetViaWallet(commitment, options) {
       [new TextEncoder().encode("protocol_treasury")],
       registryProgramId
     );
-    const anchorIdl = await anchor.Program.fetchIdl(anchorProgramId, provider);
-    if (!anchorIdl) {
-      return {
-        success: false,
-        error: `Failed to fetch entros-anchor IDL from Solana (program ${PROGRAM_IDS.entrosAnchor}). Check your RPC endpoint is reachable and on the correct cluster.`
-      };
-    }
-    const anchorProgram = new anchor.Program(anchorIdl, provider);
+    const anchorProgram = new anchor.Program(
+      entros_anchor_default,
+      provider
+    );
     const resetIx = await anchorProgram.methods.resetIdentityState(Array.from(commitment)).accounts({
       authority: provider.wallet.publicKey,
       identityState: identityPda,
@@ -1731,7 +3984,7 @@ async function submitResetViaWallet(commitment, options) {
       options.connection,
       { skipPreflight: true }
     );
-    await options.connection.confirmTransaction(txSig, "confirmed");
+    await confirmAndCheck(options.connection, txSig);
     const attestationTx = options.relayerUrl ? await requestSasAttestation(
       options.wallet,
       provider.wallet.publicKey.toBase58(),
@@ -1941,11 +4194,7 @@ async function fetchIdentityState(walletPubkey, connection) {
     );
     const accountInfo = await connection.getAccountInfo(identityPda);
     if (!accountInfo) return null;
-    const idl = await anchor.Program.fetchIdl(programId, {
-      connection
-    });
-    if (!idl) return null;
-    const coder = new anchor.BorshAccountsCoder(idl);
+    const coder = new anchor.BorshAccountsCoder(entros_anchor_default);
     const decoded = coder.decode("identityState", accountInfo.data);
     return {
       owner: decoded.owner.toBase58(),