@ilalv3/cli 0.2.4 → 0.2.6

package/README.md

@@ -34,7 +34,7 @@ ilal status --wallet 0xc0807D4778a9E5FE15ad68A8500e64d65BA78D58
 ilal demo check --wallet 0xc0807D4778a9E5FE15ad68A8500e64d65BA78D58
 
 # 4. Execute a compliant swap with the seeded reviewer key
-PRIVATE_KEY=0x... ilal swap --amount-in 1 --token-in 0x582362E608F36850F6f641510d5D19C1EaB4cb27 --min-amount-out 0
+PRIVATE_KEY=0x... ilal swap --amount-in 1 --token-in 0x3a7d58fAc623B4C30D7735B01DcE036EfF46e079 --min-amount-out 0
 ```
 
 For a fully seeded local/testnet demo, deploy mock EAS + demo pool pieces:
@@ -76,8 +76,22 @@ PRIVATE_KEY=0x... ilal demo faucet --wallet 0xYourWallet
 
 ### Path B — ZK proof (privacy-preserving)
 
+Operator prepares the active Merkle root. For a fresh demo deployment this root
+can be passed into the CNFIssuer constructor as `INITIAL_MERKLE_ROOT`, avoiding a
+48-hour wait while still keeping future root updates timelocked.
+
+```bash
+ilal credential zk-root \
+  --wallet 0xYourWallet \
+  --expires-at 1800000000
+```
+
+Trader proves against the same expiry:
+
 ```bash
-PRIVATE_KEY=0x... ilal credential prove --wallet 0xYourWallet
+PRIVATE_KEY=0x... ilal credential prove \
+  --wallet 0xYourWallet \
+  --expires-at 1800000000
 ```
 
 Generates a Groth16 proof locally (~5s), verifies it on-chain, and mints/renews your CNF without revealing identity. If the Merkle root does not match, the issuer/operator must queue the updated root with `ilal oracle propose-root --root <newRoot>` and activate it after the timelock.
@@ -88,6 +102,7 @@ Generates a Groth16 proof locally (~5s), verifies it on-chain, and mints/renews
 |---|---|
 | `ilal init` | Create `.ilal.json` with contract addresses |
 | `ilal status` | Dashboard: credential · issuer config · pool policy |
+| `ilal credential zk-root` | Operator helper: compute the ZK Merkle root for a demo wallet/expiry |
 | `ilal credential prove` | Trader flow: local ZK proof → mint or renew CNF |
 | `ilal credential mint` | Mint CNF via Coinbase EAS attestation |
 | `ilal credential renew` | Renew CNF via EAS attestation |
@@ -115,10 +130,10 @@ The CLI reads `.ilal.json` in the current directory. Run `ilal init` to create i
 
 ```bash
 ilal swap \
-  --router    0x7727F0f3EBe99A558487394D001950ee6B33BB86 \
-  --hook      0xF5066ad9c25F3f54cfb19609A60187C48C184A80 \
-  --issuer    0xc4E032A7574016bd0e3d1a5BbFdE886af09CeD9A \
-  --pool-id   0xc1c8f29d6f03b5cd18bf2b862d48f45cc338022a154945b89c4bcb0a3e11e87f \
+  --router    0xEfB2F179F6Ce44d7af66d3e3FF792563033C9b7e \
+  --hook      0xaCD0fccDDd96471f7De9b3f015C5ebFaADe70a80 \
+  --issuer    0x108fA8db11616d73ccB67725B44C535Ddcaac5a9 \
+  --pool-id   0x0decaeb998563be8faf6e6b66d4a0c32025a166e35bae97b8ec62ded1b04be1b \
   --amount-in 0.001
 ```
 
@@ -126,19 +141,20 @@ ilal swap \
 
 | Contract | Address |
 |---|---|
-| CNFIssuer | `0xc4E032A7574016bd0e3d1a5BbFdE886af09CeD9A` |
-| ComplianceHook | `0xF5066ad9c25F3f54cfb19609A60187C48C184A80` |
-| ILALRouter | `0x7727F0f3EBe99A558487394D001950ee6B33BB86` |
-| PolicyRegistry | `0x910a3efDc426f3216738106dd0DC6EA696477233` |
-| TokenA / TOKA | `0x582362E608F36850F6f641510d5D19C1EaB4cb27` |
-| TokenB / TOKB | `0x6eBBdAC70EC422C512727B25c7F0D9120ed101Ff` |
-| Pool ID | `0xc1c8f29d6f03b5cd18bf2b862d48f45cc338022a154945b89c4bcb0a3e11e87f` |
+| CNFIssuer | `0x108fA8db11616d73ccB67725B44C535Ddcaac5a9` |
+| MockEAS | `0xE46d87960b8740585010ae5158193D67da7dd807` |
+| ZKVerifierAdapter | `0xb77BB4566d5D1e81370E159bb0251467e4a2fcfa` |
+| ComplianceHook | `0xaCD0fccDDd96471f7De9b3f015C5ebFaADe70a80` |
+| ILALRouter | `0xEfB2F179F6Ce44d7af66d3e3FF792563033C9b7e` |
+| PolicyRegistry | `0xC2Be4887aF9218b4B617F7125924737413292160` |
+| Currency0 / TOKA | `0x3a7d58fAc623B4C30D7735B01DcE036EfF46e079` |
+| Currency1 / TOKB | `0x7BC67f7Fd3892fBE6AcC4F10bc3df95b64c2eD80` |
+| Pool ID | `0x0decaeb998563be8faf6e6b66d4a0c32025a166e35bae97b8ec62ded1b04be1b` |
 
 Live proof:
 
-- CNF mint tx: `0x676ca67698eb8fed6c905c2b3a9536d4d056e89c199c41c44085a29db8b4d462`
-- Add liquidity tx: `0x531fac3678878e4855471318b8ea39b2b2f3ced3d890d9d7c40721af296084ca`
-- Swap tx: `0xdaf4136d305e546d6936715cc0101efb4dc88abcb779add9ee03591fdf555a5a`
+- CNF ZK mint tx: `0x8c0ca35cb666d839b7070ed8103d12379b12ccb399283fcacaf5caa8b86e4542`
+- Current-stack add liquidity / swap: pending re-run after local RPC/TLS instability clears; router happy path is covered by the Solidity integration tests.
 
 ## License
 

package/dist/commands/demo.js

@@ -10,10 +10,10 @@ const POOL_MANAGER = {
 };
 const SAMPLE = {
     wallet: "0xc0807D4778a9E5FE15ad68A8500e64d65BA78D58",
-    issuer: "0xc4E032A7574016bd0e3d1a5BbFdE886af09CeD9A",
-    hook: "0xF5066ad9c25F3f54cfb19609A60187C48C184A80",
-    router: "0x7727F0f3EBe99A558487394D001950ee6B33BB86",
-    pool: "0xc1c8f29d6f03b5cd18bf2b862d48f45cc338022a154945b89c4bcb0a3e11e87f",
+    issuer: "0x108fA8db11616d73ccB67725B44C535Ddcaac5a9",
+    hook: "0xaCD0fccDDd96471f7De9b3f015C5ebFaADe70a80",
+    router: "0xEfB2F179F6Ce44d7af66d3e3FF792563033C9b7e",
+    pool: "0x0decaeb998563be8faf6e6b66d4a0c32025a166e35bae97b8ec62ded1b04be1b",
     proof: "0x91f2b8a0c43e902f7f1a8c0d",
     session: "0x6b84eac5e0db21f8d5d43b7a",
 };
@@ -24,6 +24,12 @@ const CNF_ABI = [
     { name: "merkleRoot", type: "function", stateMutability: "view", inputs: [], outputs: [{ type: "uint256" }] },
     { name: "zkVerifier", type: "function", stateMutability: "view", inputs: [], outputs: [{ type: "address" }] },
     { name: "eas", type: "function", stateMutability: "view", inputs: [], outputs: [{ type: "address" }] },
+    { name: "issuerMetadata", type: "function", stateMutability: "view", inputs: [], outputs: [
+            { name: "name", type: "string" },
+            { name: "jurisdiction", type: "string" },
+            { name: "credentialStandard", type: "string" },
+            { name: "uri", type: "string" },
+        ] },
 ];
 const REGISTRY_ABI = [
     { name: "getPolicy", type: "function", stateMutability: "view", inputs: [{ name: "poolId", type: "bytes32" }], outputs: [{ type: "tuple", components: [{ name: "cnfIssuer", type: "address" }, { name: "requiredCredentialType", type: "bytes32" }, { name: "enabled", type: "bool" }] }] },
@@ -274,6 +280,24 @@ export async function demoCheck(opts) {
             ]);
             const hasEASPath = eas !== ZERO;
             const hasZKPath = root !== 0n && verifier !== ZERO;
+            try {
+                const meta = await client.readContract({
+                    address: cfg.issuer,
+                    abi: CNF_ABI,
+                    functionName: "issuerMetadata",
+                });
+                if (meta[0])
+                    ok("issuer name", meta[0]);
+                if (meta[1])
+                    ok("jurisdiction", meta[1]);
+                if (meta[2])
+                    ok("standard", meta[2]);
+                if (meta[3])
+                    ok("metadata uri", fmt.gray(meta[3]));
+            }
+            catch {
+                warn("issuer metadata", fmt.badge("legacy issuer", "yellow"));
+            }
             if (hasEASPath)
                 ok("issuance path", `${fmt.badge("EAS/mock", "green")} ${fmt.addr(eas)}`);
             else if (hasZKPath)

package/dist/commands/init.js

@@ -10,14 +10,14 @@ import { fmt, log, header, die } from "../ui.js";
 // Known testnet / mainnet addresses for quick init
 const PRESETS = {
     "84532": {
-        issuer: "0xc4E032A7574016bd0e3d1a5BbFdE886af09CeD9A",
-        hook: "0xF5066ad9c25F3f54cfb19609A60187C48C184A80",
-        registry: "0x910a3efDc426f3216738106dd0DC6EA696477233",
-        router: "0x7727F0f3EBe99A558487394D001950ee6B33BB86",
+        issuer: "0x108fA8db11616d73ccB67725B44C535Ddcaac5a9",
+        hook: "0xaCD0fccDDd96471f7De9b3f015C5ebFaADe70a80",
+        registry: "0xC2Be4887aF9218b4B617F7125924737413292160",
+        router: "0xEfB2F179F6Ce44d7af66d3e3FF792563033C9b7e",
         treasury: "0x1804c8AB1F12E6bbf3894d4083f33e07309d1f38",
-        tokenA: "0x582362E608F36850F6f641510d5D19C1EaB4cb27",
-        tokenB: "0x6eBBdAC70EC422C512727B25c7F0D9120ed101Ff",
-        poolId: "0xc1c8f29d6f03b5cd18bf2b862d48f45cc338022a154945b89c4bcb0a3e11e87f",
+        tokenA: "0x3a7d58fAc623B4C30D7735B01DcE036EfF46e079",
+        tokenB: "0x7BC67f7Fd3892fBE6AcC4F10bc3df95b64c2eD80",
+        poolId: "0x0decaeb998563be8faf6e6b66d4a0c32025a166e35bae97b8ec62ded1b04be1b",
         fee: "8388608",
         tickSpacing: "60",
         rpc: "https://sepolia.base.org",

package/dist/commands/oracle.d.ts

@@ -12,11 +12,11 @@
  *   # Step 1 — queue a new root (requires owner key, executes immediately)
  *   PRIVATE_KEY=0x... ilal oracle propose-root \
  *     --root 0xDEADBEEF... \
- *     --issuer 0xc4E032...
+ *     --issuer 0x108fA8...
  *
  *   # Step 2 — after ROOT_DELAY (48 h) has elapsed, activate it
  *   PRIVATE_KEY=0x... ilal oracle activate-root \
- *     --issuer 0xc4E032...
+ *     --issuer 0x108fA8...
  *
  *   # Same pattern for the ZK verifier (VERIFIER_DELAY = 72 h)
  *   PRIVATE_KEY=0x... ilal oracle propose-verifier --verifier 0x... --issuer 0x...

package/dist/commands/oracle.js

@@ -12,11 +12,11 @@
  *   # Step 1 — queue a new root (requires owner key, executes immediately)
  *   PRIVATE_KEY=0x... ilal oracle propose-root \
  *     --root 0xDEADBEEF... \
- *     --issuer 0xc4E032...
+ *     --issuer 0x108fA8...
  *
  *   # Step 2 — after ROOT_DELAY (48 h) has elapsed, activate it
  *   PRIVATE_KEY=0x... ilal oracle activate-root \
- *     --issuer 0xc4E032...
+ *     --issuer 0x108fA8...
  *
  *   # Same pattern for the ZK verifier (VERIFIER_DELAY = 72 h)
  *   PRIVATE_KEY=0x... ilal oracle propose-verifier --verifier 0x... --issuer 0x...

package/dist/commands/prove.d.ts

@@ -7,7 +7,7 @@
  * Usage:
  *   ilal credential prove \
  *     --wallet  0x1b869... \
- *     --issuer  0xc4E032... \
+ *     --issuer  0x108fA8... \
  *     --chain   84532 \
  *     --action  mint          # or renew (default: auto-detect)
  *     --circuit-dir ./circuits/build
@@ -24,4 +24,10 @@ export declare function credentialProve(opts: {
     outDir?: string;
     rpc?: string;
     privateKey?: string;
+    expiresAt?: string;
+}): Promise<void>;
+export declare function credentialRoot(opts: {
+    wallet?: string;
+    issuer?: string;
+    expiresAt?: string;
 }): Promise<void>;

package/dist/commands/prove.js

@@ -7,7 +7,7 @@
  * Usage:
  *   ilal credential prove \
  *     --wallet  0x1b869... \
- *     --issuer  0xc4E032... \
+ *     --issuer  0x108fA8... \
  *     --chain   84532 \
  *     --action  mint          # or renew (default: auto-detect)
  *     --circuit-dir ./circuits/build
@@ -103,6 +103,21 @@ function findCircuitDir(override) {
         "  Run: bash circuits/scripts/compile.sh\n" +
         "  Or pass: --circuit-dir <path/to/circuits/build>");
 }
+function resolveExpiresAt(expiresAt) {
+    if (!expiresAt)
+        return BigInt(Math.floor(Date.now() / 1000) + 90 * 24 * 3600);
+    const parsed = BigInt(expiresAt);
+    if (parsed <= BigInt(Math.floor(Date.now() / 1000)))
+        die("--expires-at must be a future Unix timestamp");
+    return parsed;
+}
+function computeZKLeafAndRoot(walletAddr, expiresAt) {
+    const walletField = addressToField(walletAddr);
+    const leaf = poseidon4([walletField, 2n, 840n, expiresAt]);
+    const tree = new IncrementalMerkleTree(poseidon2, DEPTH, 0n, 2);
+    tree.insert(leaf);
+    return { leaf, merkleRoot: tree.root };
+}
 function generateProof(opts) {
     const { walletAddr, issuerAddr, circuitDir, outDir } = opts;
     mkdirSync(outDir, { recursive: true });
@@ -111,13 +126,12 @@ function generateProof(opts) {
     const walletHash = computeWalletHash(walletAddr);
     const issuerHash = poseidonField(addressToField(issuerAddr));
     const schemaHashValue = schemaHash(COINBASE_SCHEMA_UID);
-    const expiresAt = BigInt(Math.floor(Date.now() / 1000) + 90 * 24 * 3600); // +90 days
+    const expiresAt = resolveExpiresAt(opts.expiresAt);
     // Build single-leaf Poseidon Merkle tree
-    const leaf = poseidon4([walletField, 2n, 840n, expiresAt]);
+    const { leaf, merkleRoot } = computeZKLeafAndRoot(walletAddr, expiresAt);
     const tree = new IncrementalMerkleTree(poseidon2, DEPTH, 0n, 2);
     tree.insert(leaf);
     const merkleProof = tree.createProof(0);
-    const merkleRoot = tree.root;
     // Build input.json
     const input = {
         walletField: walletField.toString(),
@@ -223,14 +237,21 @@ export async function credentialProve(opts) {
     let proofResult;
     try {
         spin.update("Generating ZK witness…");
-        proofResult = generateProof({ walletAddr: cfg.wallet, issuerAddr: cfg.issuer, circuitDir, outDir });
+        proofResult = generateProof({
+            walletAddr: cfg.wallet,
+            issuerAddr: cfg.issuer,
+            circuitDir,
+            outDir,
+            expiresAt: opts.expiresAt,
+        });
         spin.succeed(`Proof generated & verified locally`);
     }
     catch (e) {
         spin.fail("Proof generation failed");
         die(e instanceof Error ? e.message.split("\n")[0] : String(e));
     }
-    log.kv("expiresAt", fmt.cyan(new Date((Date.now() + 90 * 24 * 3600 * 1000)).toISOString().split("T")[0]));
+    const proofExpiresAt = BigInt(proofResult.publicJson[3]);
+    log.kv("expiresAt", fmt.cyan(new Date(Number(proofExpiresAt) * 1000).toISOString().split("T")[0]));
     log.kv("merkleRoot", fmt.gray(proofResult.merkleRoot.toString().slice(0, 22) + "…"));
     log.line();
     // ── Send mint / renew tx ───────────────────────────────────────────────────
@@ -269,3 +290,28 @@ export async function credentialProve(opts) {
     log.kv("isValid()", valid ? fmt.green("✓ true") : fmt.red("✗ false"));
     console.log();
 }
+export async function credentialRoot(opts) {
+    if (!opts.wallet)
+        die("Wallet address required. Use --wallet <address>.");
+    if (!isAddress(opts.wallet))
+        die(`Invalid wallet address: ${opts.wallet}`);
+    const expiresAt = resolveExpiresAt(opts.expiresAt);
+    const { leaf, merkleRoot } = computeZKLeafAndRoot(opts.wallet, expiresAt);
+    header("ILAL ZK Root Preparation", "operator pre-deploy / pre-root");
+    log.kv("wallet", fmt.cyan(opts.wallet));
+    log.kv("kycLevel", "2");
+    log.kv("countryCode", "840");
+    log.kv("expiresAt", `${expiresAt.toString()} ${fmt.gray(new Date(Number(expiresAt) * 1000).toISOString())}`);
+    log.kv("leaf", leaf.toString());
+    log.kv("merkleRoot", fmt.cyan(merkleRoot.toString()));
+    if (opts.issuer) {
+        if (!isAddress(opts.issuer))
+            die(`Invalid issuer address: ${opts.issuer}`);
+        log.kv("issuerHash", poseidonField(addressToField(opts.issuer)).toString());
+        log.kv("schemaHash", schemaHash(COINBASE_SCHEMA_UID).toString());
+    }
+    log.line();
+    log.command(`INITIAL_MERKLE_ROOT=${merkleRoot.toString()} forge script contracts/script/DeployDemo.s.sol ...`);
+    log.command(`PRIVATE_KEY=0x... ilal credential prove --wallet ${opts.wallet} --expires-at ${expiresAt.toString()}`);
+    console.log();
+}

package/dist/commands/status.js

@@ -15,6 +15,12 @@ const CNF_ABI = [
     { name: "merkleRoot", type: "function", stateMutability: "view", inputs: [], outputs: [{ type: "uint256" }] },
     { name: "zkVerifier", type: "function", stateMutability: "view", inputs: [], outputs: [{ type: "address" }] },
     { name: "eas", type: "function", stateMutability: "view", inputs: [], outputs: [{ type: "address" }] },
+    { name: "issuerMetadata", type: "function", stateMutability: "view", inputs: [], outputs: [
+            { name: "name", type: "string" },
+            { name: "jurisdiction", type: "string" },
+            { name: "credentialStandard", type: "string" },
+            { name: "uri", type: "string" },
+        ] },
 ];
 const HOOK_ABI = [
     { name: "issuer", type: "function", stateMutability: "view", inputs: [], outputs: [{ type: "address" }] },
@@ -100,6 +106,24 @@ export async function status(opts) {
             const hasZKPath = root !== 0n && verifier !== ZERO_ADDRESS;
             log.section("Issuer");
             log.kv("address", fmt.cyan(cfg.issuer));
+            try {
+                const meta = await client.readContract({
+                    address: cfg.issuer,
+                    abi: CNF_ABI,
+                    functionName: "issuerMetadata",
+                });
+                if (meta[0])
+                    log.kv("name", meta[0]);
+                if (meta[1])
+                    log.kv("jurisdiction", meta[1]);
+                if (meta[2])
+                    log.kv("standard", meta[2]);
+                if (meta[3])
+                    log.kv("uri", fmt.gray(meta[3]));
+            }
+            catch {
+                log.kv("metadata", fmt.badge("legacy issuer", "yellow"));
+            }
             log.kv("issuance", hasEASPath
                 ? `${fmt.badge("EAS", "green")} ${fmt.addr(eas)}`
                 : hasZKPath

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Command } from "commander";
 import { credentialStatus } from "./commands/credential.js";
-import { credentialProve } from "./commands/prove.js";
+import { credentialProve, credentialRoot } from "./commands/prove.js";
 import { oracleProposeRoot, oracleActivateRoot, oracleProposeVerifier, oracleActivateVerifier } from "./commands/oracle.js";
 import { mintCredential, renewCredential } from "./commands/mint.js";
 import { proofMint, proofRenew } from "./commands/proof.js";
@@ -19,7 +19,7 @@ const program = new Command();
 program
     .name("ilal")
     .description("ILAL Protocol CLI — Uniswap v4 compliance hook toolkit")
-    .version("0.2.4")
+    .version("0.2.6")
     .addHelpText("before", `\n  ${fmt.bold(fmt.cyan("◆"))} ${fmt.bold("ILAL Protocol")}  ${fmt.gray("Uniswap v4 Compliance Hook")}\n`);
 // ─── init ─────────────────────────────────────────────────────────────────────
 program
@@ -116,9 +116,19 @@ credential
     .option("-c, --chain <chainId>", "Chain ID (8453=Base, 84532=Base Sepolia)", "84532")
     .option("-r, --rpc <url>", "Custom RPC URL")
     .option("-k, --private-key <hex>", "Private key (or set PRIVATE_KEY env var)")
+    .option("--expires-at <unix>", "Unix timestamp used in the ZK proof/root (must match issuer root)")
     .action(async (opts) => {
     await credentialProve(opts).catch(err);
 });
+credential
+    .command("zk-root")
+    .description("Compute the Merkle root needed for a one-wallet ZK credential demo")
+    .requiredOption("-w, --wallet <address>", "Wallet address included in the ZK tree")
+    .option("-i, --issuer <address>", "Issuer address, used to print matching public-input hashes")
+    .requiredOption("--expires-at <unix>", "Future Unix timestamp; pass the same value to credential prove")
+    .action(async (opts) => {
+    await credentialRoot(opts).catch(err);
+});
 credential
     .command("mint")
     .description("Mint a CNF credential using a Coinbase EAS attestation")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ilalv3/cli",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "ILAL Protocol CLI — compliant swaps and credential management for Uniswap v4",
   "type": "module",
   "bin": {