@pvium/p2id-core 0.1.0

package/contracts/interfaces/IP2IDPolicy.sol

@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.27;
+
+/// @title IP2IDPolicy
+/// @notice Everything about P2ID vaults that is expected to evolve lives behind this interface,
+///         so it can change without changing vault bytecode (and therefore without moving any
+///         P2ID address). The vault factory points at one policy and can replace it only through
+///         a timelock; every vault consults the factory's current policy on each call.
+///
+///         What a policy decides, and the limits the vault enforces on it:
+///         - which verifiers deposits may be funded under and claimed through. Gating is the one
+///           thing a policy can use to stop claims (by disallowing a verifier), which freezes
+///           claims under it but never moves funds; refunds never consult the policy.
+///         - the protocol fee on payouts, in basis points. The vault caps it at its own
+///           MAX_FEE_BPS, fixes a deposit's rate when the deposit is made, never charges it on
+///           refunds, and treats a failing quote as no fee.
+///         - how accrued fees are distributed. Fees accrue in each vault per (verifier, token);
+///           anyone can have a vault hand them to the policy (withdrawFees), which pulls them and
+///           splits them however it chooses, e.g. between a verifier's operator and the protocol.
+///
+///         Launch policy: an owner-managed verifier allowlist and no fee. Permissionless,
+///         stake-based verifier registration and fees are later policies.
+interface IP2IDPolicy {
+    /// @notice Whether deposits may be funded under, and claimed through, `verifier`.
+    function isVerifierAllowed(address verifier) external view returns (bool);
+
+    /// @notice Fee on paying out `token` claimed through `verifier`, in basis points. Quoted when a
+    ///         deposit is made (and fixed for it), or at sweep time for untracked funds.
+    function feeBps(address verifier, address token) external view returns (uint16);
+
+    /// @notice Called by a vault holding fees earned through `verifier`. For an ERC-20 the vault
+    ///         first approves this policy for exactly `amount`: pull the tokens (transferFrom the
+    ///         caller) and distribute them; whatever is not pulled stays accrued in the vault, and
+    ///         the allowance is reset afterwards. Pulling from msg.sender makes the amount
+    ///         self-verifying: a caller that is not a vault can only give away its own tokens.
+    ///         For the native coin (token == address(0)) the vault sends `amount` as msg.value
+    ///         instead, and all of it counts as distributed.
+    function distributeFee(address verifier, address token, uint256 amount) external payable;
+}

package/contracts/interfaces/IP2IDVault.sol

@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.27;
+
+import {IP2IDVerifier} from "./IP2IDVerifier.sol";
+
+/// @title IP2IDVault
+/// @notice A vault holding ERC-20 tokens and the native coin for one identity until its owner
+///         proves it and sweeps. The native coin is the token address(0) in every function.
+///         Every deposit names the verifier whose proofs can release it; the factory's policy
+///         decides which verifiers are allowed and what (capped) fee applies.
+interface IP2IDVault {
+    /// @dev Field order packs into 5 storage slots:
+    ///      [funder, fundedAt, consumed] [token, refundWindow] [verifier, feeBps] [amount] [constraint].
+    struct Deposit {
+        address funder;
+        uint64 fundedAt;
+        bool consumed;
+        address token;
+        uint64 refundWindow;
+        address verifier;
+        /// Fee rate fixed when the deposit was made (<= MAX_FEE_BPS); charged only on a claim.
+        uint16 feeBps;
+        uint128 amount;
+        bytes32 constraint;
+    }
+
+    // ------------------------------------------------------------------ events
+    // Every deposit is Funded once and then either Refunded (by its funder) or Claimed by a sweep.
+    // Sweeps also emit one aggregate event with the net amount paid and the fee.
+
+    /// @notice A deposit was recorded via fund()/fundWith()/fundFor().
+    /// @param ref Opaque application reference; zero means absent. Emitted only, not stored or enforced as unique.
+    event Funded(uint256 indexed depositId, address indexed funder, address indexed token, uint256 amount, address verifier, bytes32 constraint, uint64 refundWindow, uint16 feeBps, bytes32 ref);
+    /// @notice An unconsumed deposit was returned to its funder after its refund window (never charged a fee).
+    event Refunded(uint256 indexed depositId, address indexed funder, address indexed token, uint256 amount);
+    /// @notice A deposit was paid out by a sweep: `amount` gross, of which `fee` accrued as a fee.
+    event Claimed(uint256 indexed depositId, address indexed to, uint256 amount, uint256 fee);
+    /// @notice A proof newer than any seen under `verifier` set that verifier's owner wallet; older proofs are now refused.
+    event OwnerRefreshed(address indexed verifier, address indexed owner, uint64 iat);
+    /// @notice Default-bucket funds under `verifier` were paid to its owner wallet (`amount` net of `fee`).
+    event Swept(address indexed verifier, address indexed token, uint256 amount, uint256 fee, address indexed to, uint256 depositsConsumed);
+    /// @notice Funds from a constrained bucket were paid to the wallet the proof resolved to (`amount` net of `fee`).
+    event SweptBucket(address indexed verifier, bytes32 indexed constraint, address indexed token, uint256 amount, uint256 fee, address to, uint256 depositsConsumed);
+    /// @notice A fee accrued for `verifier`; it stays in the vault until withdrawFees() hands it to the policy.
+    event FeeAccrued(address indexed verifier, address indexed token, uint256 amount);
+    /// @notice The policy pulled `amount` of accrued fees to distribute.
+    event FeesDistributed(address indexed verifier, address indexed token, uint256 amount, address policy);
+
+    // setup (factory only, once)
+    function initialize(bytes32 nsHash, bytes32 saltCommitment, uint64 minRefundWindow, uint64 maxRefundWindow) external;
+
+    // funding
+    /// @notice Fund under the factory's default verifier. A non-zero `constraint` can be used once per funder.
+    /// @param ref Opaque application reference emitted in Funded; bytes32(0) for none. Does not affect claims or refunds.
+    function fund(address token, uint256 amount, bytes32 constraint, uint64 refundWindow, bytes32 ref) external payable returns (uint256 depositId);
+    /// @notice Fund under any verifier the factory's policy allows.
+    /// @param ref Opaque application reference emitted in Funded; bytes32(0) for none.
+    function fundWith(address verifier, address token, uint256 amount, bytes32 constraint, uint64 refundWindow, bytes32 ref) external payable returns (uint256 depositId);
+    /// @notice Factory-only: record a deposit owned by `funder`; tokens are pulled from the factory.
+    /// @param ref Opaque application reference emitted in Funded; bytes32(0) for none.
+    function fundFor(address funder, address verifier, address token, uint256 amount, bytes32 constraint, uint64 refundWindow, bytes32 ref) external payable returns (uint256 depositId);
+    function refund(uint256 depositId) external;
+
+    // proofs
+    /// @notice Present a proof under `verifier` without claiming: sets that verifier's owner wallet
+    ///         if the proof is newer than anything seen under it, and retires older proofs.
+    function refreshProof(address verifier, bytes calldata proof) external;
+    function refreshProofAndSweep(address verifier, bytes calldata proof, address token, uint256 depositCountLimit) external returns (uint256 amount, uint256 consumed);
+
+    // claiming (amounts returned are net of fees)
+    /// @notice Sweep `verifier`'s default bucket to its owner; the default verifier's sweep also takes untracked funds.
+    function sweep(address verifier, address token, uint256 depositCountLimit) external returns (uint256 amount, uint256 consumed);
+    function sweepUntracked(address token) external returns (uint256 amount);
+    function sweepDeposits(address verifier, address token, uint256[] calldata depositIds) external returns (uint256 amount);
+    function sweepBucket(address verifier, IP2IDVerifier.Constraint calldata constraint, address token, bytes calldata proof, uint256 depositCountLimit) external returns (uint256 amount, uint256 consumed);
+    function sweepBucketDeposits(address verifier, IP2IDVerifier.Constraint calldata constraint, address token, uint256[] calldata depositIds, bytes calldata proof) external returns (uint256 amount);
+
+    // fees
+    /// @notice Hand the fees earned through `verifier` in `token` to the current policy to distribute. Anyone may call it.
+    function withdrawFees(address verifier, address token) external returns (uint256 amount);
+
+    // views
+    /// @notice P2ID vault interface version implemented by this contract.
+    function p2idVersion() external pure returns (string memory);
+    function MAX_FEE_BPS() external view returns (uint16);
+    /// @notice address(0): the token address standing for the native coin.
+    function NATIVE() external view returns (address);
+    /// @notice keccak256 of the address scheme this vault was issued under, e.g. keccak256("pvium.vault.v1").
+    function nsHash() external view returns (bytes32);
+    function factory() external view returns (address);
+    function policy() external view returns (address);
+    function defaultVerifier() external view returns (address);
+    function owner(address verifier) external view returns (address);
+    function latestProofIat(address verifier) external view returns (uint64);
+    /// @notice Freshness floor for direct transfers, carried across default-verifier changes.
+    function untrackedProofIat() external view returns (uint64);
+    function saltCommitment() external view returns (bytes32);
+    function depositCount() external view returns (uint256);
+    function bucketDepositIds(address verifier, bytes32 constraint, address token) external view returns (uint256[] memory);
+    function bucketDepositCount(address verifier, bytes32 constraint, address token) external view returns (uint256);
+    /// @notice Whether `funder` has funded under `constraint`, and which deposit. A funder can use a
+    ///         constraint once (refunded or claimed, it stays used), so a signature over it releases
+    ///         at most one of their deposits. Funders must make constraints unique, e.g. by salting.
+    function constraintDeposit(bytes32 constraint, address funder) external view returns (bool used, uint256 depositId);
+    function bucketTotal(address verifier, bytes32 constraint, address token) external view returns (uint256);
+    function trackedTotal(address token) external view returns (uint256);
+    function feesOwed(address verifier, address token) external view returns (uint256);
+    function feesOwedTotal(address token) external view returns (uint256);
+    /// @notice Gross amount `sweep(verifier, token, 0)` would release now, before fees.
+    function sweepable(address verifier, address token) external view returns (uint256);
+    function untrackedBalance(address token) external view returns (uint256);
+}

package/contracts/interfaces/IP2IDVerifier.sol

@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.27;
+
+/// @title IP2IDVerifier
+/// @notice Use-case-agnostic identity verification: given a proof, return the wallet the proven
+///         identity resolves to. Optionally also verify a funding constraint.
+interface IP2IDVerifier {
+    /// @notice A funding constraint and the evidence that it is satisfied.
+    /// @param commitment bytes32(0) = no constraint; otherwise the commitment a deposit was funded with.
+    /// @param signature  Evidence for `commitment`; for PviumVerifier, the registered signer's
+    ///                   EIP-712 signature over Constraint(bytes32 commitment) in the verifier's
+    ///                   domain. Empty when commitment is zero.
+    struct Constraint {
+        bytes32 commitment;
+        bytes signature;
+    }
+
+    /// @param identityHash The identity the caller expects the proof to be for (e.g. the vault's
+    ///                     commitment). Proofs are public once used on-chain, so the caller MUST
+    ///                     pin the identity rather than trust whatever the submitted proof proves.
+    /// @param proof        Opaque identity proof; the implementation defines the encoding.
+    /// @param constraint   Skipped when `constraint.commitment == bytes32(0)`.
+    /// @return wallet Wallet associated with the proven identity (never address(0)).
+    /// @return iat    When the underlying attestation was issued (unix seconds).
+    /// @dev MUST revert (never return address(0)) if the proof is invalid, is for a different
+    ///      identity than `identityHash`, or the constraint is not satisfied.
+    function getIdentityWallet(
+        bytes32 identityHash,
+        bytes calldata proof,
+        Constraint calldata constraint
+    ) external view returns (address wallet, uint64 iat);
+
+    /// @notice Whether this verifier can ever satisfy a non-zero constraint. Vaults refuse
+    ///         constrained deposits under a verifier that returns false (or does not implement
+    ///         this), so a payer cannot lock funds behind a condition nobody can meet.
+    function supportsConstraints() external view returns (bool);
+
+    /// @notice Changes (increments) whenever proofs this verifier accepted before may no longer be
+    ///         trusted, e.g. a signing key was revoked. A vault caches the wallet a proof resolved
+    ///         to and pays it without re-verifying; it discards that cache when the revision moved,
+    ///         so revoking a key also revokes what was proven under it. Return a constant if
+    ///         nothing this verifier trusts can ever be revoked.
+    function revision() external view returns (uint64);
+}

package/contracts/interfaces/IP2IdVaultFactory.sol

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.27;
+
+/// @title IP2IdVaultFactory
+/// @notice Deploys one P2IDVault per identity at an address anyone can derive offline from the
+///         identity hash, and points every vault at the current policy and default verifier.
+interface IP2IdVaultFactory {
+    event VaultDeployed(bytes32 indexed identityHash, address indexed vault);
+
+    /// @notice P2ID factory interface version implemented by this contract.
+    function p2idVersion() external pure returns (string memory);
+
+    // ---- what vaults consult on every call; both change only through a timelock ----
+    /// @notice The IP2IDPolicy deciding which verifiers are allowed and what (capped) fee applies.
+    function policy() external view returns (address);
+    /// @notice Verifier used when a payer does not choose one, and the one bare transfers are claimed through.
+    function defaultVerifier() external view returns (address);
+
+    // ---- vaults ----
+    /// @notice The vault address for `identityHash`, deployed or not:
+    ///         `keccak256(0xff ‖ factory ‖ identityHash ‖ keccak256(P2IDVault creationCode))`.
+    function vaultFor(bytes32 identityHash) external view returns (address);
+    function isDeployed(bytes32 identityHash) external view returns (bool);
+    /// @notice Deploy the vault for `identityHash`; returns the existing one if already deployed.
+    function deploy(bytes32 identityHash) external returns (address vault);
+    /// @notice Deploy if needed, then fund under the default verifier on the caller's behalf
+    ///         (caller keeps the refund right). ERC-20: approve this factory once to pay any
+    ///         identity. Native coin: token = address(0), send `amount` as msg.value.
+    /// @param ref Opaque application reference forwarded to the vault's Funded event; bytes32(0) for none.
+    function fund(
+        bytes32 identityHash,
+        address token,
+        uint256 amount,
+        bytes32 constraint,
+        uint64 refundWindow,
+        bytes32 ref
+    ) external payable returns (address vault, uint256 depositId);
+    /// @notice Same, under a chosen approved verifier.
+    /// @param ref Opaque application reference forwarded to the vault's Funded event; bytes32(0) for none.
+    function fundWith(
+        bytes32 identityHash,
+        address verifier,
+        address token,
+        uint256 amount,
+        bytes32 constraint,
+        uint64 refundWindow,
+        bytes32 ref
+    ) external payable returns (address vault, uint256 depositId);
+}

package/contracts/interfaces/IPviumIdentity.sol

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.27;
+
+/// @title IPviumIdentity
+/// @notice Verify a Pvium attestation on chain: "identity X and wallet W belong to the same
+///         Privy user". Every function reverts unless the proof is valid, was made from a token
+///         signed by one of the accepted keys, and binds exactly the values given. The return value is
+///         when Privy issued that token (unix seconds); freshness policy is the caller's.
+interface IPviumIdentity {
+    /// @notice Circuit version this deployment verifies. Attestations state theirs; use the matching deployment.
+    function circuitVersion() external view returns (uint16);
+    /// @notice Whether tokens signed by this P-256 key are accepted. Keys are added with 7 days' public notice.
+    function isSignerKey(uint256 x, uint256 y) external view returns (bool);
+
+    /// @notice Verify that the proof binds exactly this identity and this wallet.
+    /// @dev Both are passed as hashes (P2IDHash on chain, or the SDK's identityHash), so the raw
+    ///      identity never appears in calldata.
+    /// @param identityType Identity type id: 0 email, 3 twitter, 5 github, … (see P2IDHash)
+    /// @param identityHash P2IDHash.identityHash(identityType, value)
+    /// @param walletHash   P2IDHash.walletHash(wallet): an address, or a string for a non-EVM wallet
+    function verifyIdentity(
+        bytes calldata proof,
+        bytes32[] calldata publicInputs,
+        uint8 identityType,
+        bytes32 identityHash,
+        bytes32 walletHash
+    ) external view returns (uint64 issuedAt);
+}

package/contracts/lib/P2IDHash.sol

@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.27;
+
+/// @title P2IDHash
+/// @notice The identity commitment exactly as circuit/src/main.nr computes it:
+///         sha256("p2id.identity.v1" || identityType || normalize(value)).
+///         `normalize` ASCII-lowercases every type except phone and wallet, and lowercases
+///         `0x…` (EVM, hex) wallet addresses; base58 (Solana) addresses are untouched.
+library P2IDHash {
+    bytes internal constant PREFIX = "p2id.identity.v1";
+    uint8 internal constant PHONE = 1;
+    uint8 internal constant WALLET = 12;
+    uint8 internal constant NUM_TYPES = 13;
+
+    error ValueLength(uint256 length);
+    error UnknownIdentityType(uint8 identityType);
+
+    /// @notice Commitment for an identity value, e.g. (0, "you@example.com").
+    function identityHash(uint8 identityType, bytes memory value) internal pure returns (bytes32) {
+        if (identityType >= NUM_TYPES) revert UnknownIdentityType(identityType);
+        if (value.length == 0 || value.length > 128) revert ValueLength(value.length);
+        return sha256(abi.encodePacked(PREFIX, identityType, normalize(identityType, value)));
+    }
+
+    /// @notice Commitment for an EVM wallet, hashed as its lowercase `0x…` hex string.
+    function walletHash(address wallet) internal pure returns (bytes32) {
+        return sha256(abi.encodePacked(PREFIX, WALLET, toLowerHex(wallet)));
+    }
+
+    /// @notice Commitment for a wallet on any chain, given as Privy stores it (e.g. base58).
+    function walletHash(string memory wallet) internal pure returns (bytes32) {
+        return identityHash(WALLET, bytes(wallet));
+    }
+
+    function normalize(uint8 identityType, bytes memory value) internal pure returns (bytes memory) {
+        bool lower;
+        if (identityType == WALLET) {
+            lower = value.length >= 2 && value[0] == "0" && value[1] == "x";
+        } else {
+            lower = identityType != PHONE;
+        }
+        if (!lower) return value;
+        bytes memory out = new bytes(value.length);
+        for (uint256 i = 0; i < value.length; i++) {
+            uint8 c = uint8(value[i]);
+            out[i] = (c >= 65 && c <= 90) ? bytes1(c + 32) : value[i];
+        }
+        return out;
+    }
+
+    /// @dev "0x" + 40 lowercase hex chars, the form the circuit hashes an EVM address in.
+    function toLowerHex(address a) internal pure returns (bytes memory out) {
+        bytes16 digits = "0123456789abcdef";
+        out = new bytes(42);
+        out[0] = "0";
+        out[1] = "x";
+        uint160 v = uint160(a);
+        for (uint256 i = 41; i > 1; i--) {
+            out[i] = digits[v & 0xf];
+            v >>= 4;
+        }
+    }
+}

package/dist/cjs/identity.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HASH_PREFIX = exports.IdentityType = void 0;
+exports.isCaseInsensitive = isCaseInsensitive;
+exports.normalizeIdentityValue = normalizeIdentityValue;
+exports.identityHash = identityHash;
+exports.toHex = toHex;
+const sha256_1 = require("@noble/hashes/sha256");
+/**
+ * Identity types. The numeric value is the protocol's type id (it is what gets hashed), so it
+ * must match circuit/src/identity.nr and never change.
+ */
+var IdentityType;
+(function (IdentityType) {
+    IdentityType[IdentityType["Email"] = 0] = "Email";
+    IdentityType[IdentityType["Phone"] = 1] = "Phone";
+    IdentityType[IdentityType["Google"] = 2] = "Google";
+    IdentityType[IdentityType["Twitter"] = 3] = "Twitter";
+    /** Alias of `Twitter`: the platform's current name. Same id, same addresses. */
+    IdentityType[IdentityType["X"] = 3] = "X";
+    IdentityType[IdentityType["Discord"] = 4] = "Discord";
+    IdentityType[IdentityType["Github"] = 5] = "Github";
+    IdentityType[IdentityType["Linkedin"] = 6] = "Linkedin";
+    IdentityType[IdentityType["Apple"] = 7] = "Apple";
+    IdentityType[IdentityType["Telegram"] = 8] = "Telegram";
+    IdentityType[IdentityType["Tiktok"] = 9] = "Tiktok";
+    IdentityType[IdentityType["Instagram"] = 10] = "Instagram";
+    IdentityType[IdentityType["Farcaster"] = 11] = "Farcaster";
+    IdentityType[IdentityType["Wallet"] = 12] = "Wallet";
+})(IdentityType || (exports.IdentityType = IdentityType = {}));
+/** Domain-separation prefix baked into the circuit's identity hash. */
+exports.HASH_PREFIX = 'p2id.identity.v1';
+/** Types whose value is ASCII-lowercased before hashing: everything except phone numbers and
+ *  wallet addresses (matches CASE_INSENSITIVE in circuit/src/identity.nr). */
+function isCaseInsensitive(type) {
+    return type !== IdentityType.Wallet && type !== IdentityType.Phone;
+}
+/**
+ * Apply the circuit's normalisation to an identity value: ASCII-lowercase for case-insensitive
+ * types and for EVM (`0x…`) wallet addresses; base58 (Solana) addresses are left untouched.
+ */
+function normalizeIdentityValue(type, value) {
+    const lower = isCaseInsensitive(type) || (type === IdentityType.Wallet && value.startsWith('0x'));
+    return lower ? value.replace(/[A-Z]/g, (c) => c.toLowerCase()) : value;
+}
+/**
+ * `sha256(HASH_PREFIX || type || normalize(value))`, exactly as the circuit computes it.
+ * This is the routing salt a payer uses to address an identity, and the value a proof's
+ * `identityHash` output is compared against.
+ */
+function identityHash(type, value, domain = exports.HASH_PREFIX) {
+    const enc = new TextEncoder();
+    const prefix = enc.encode(domain);
+    const body = enc.encode(normalizeIdentityValue(type, value));
+    if (body.length < 1 || body.length > 128)
+        throw new Error('identity value must be 1..128 bytes');
+    const preimage = new Uint8Array(prefix.length + 1 + body.length);
+    preimage.set(prefix, 0);
+    preimage[prefix.length] = type;
+    preimage.set(body, prefix.length + 1);
+    return toHex((0, sha256_1.sha256)(preimage));
+}
+function toHex(bytes) {
+    let s = '';
+    for (const b of bytes)
+        s += b.toString(16).padStart(2, '0');
+    return `0x${s}`;
+}

package/dist/cjs/identityNames.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_TYPE_BY_NAME = exports.P2ID_TYPE_NAMES = void 0;
+exports.identityTypeName = identityTypeName;
+exports.resolveIdentityType = resolveIdentityType;
+const identity_js_1 = require("./identity.js");
+/** P2ID type names (the URI names in P2ID.md). */
+exports.P2ID_TYPE_NAMES = {
+    email: identity_js_1.IdentityType.Email,
+    phone: identity_js_1.IdentityType.Phone,
+    google: identity_js_1.IdentityType.Google,
+    x: identity_js_1.IdentityType.X,
+    discord: identity_js_1.IdentityType.Discord,
+    github: identity_js_1.IdentityType.Github,
+    linkedin: identity_js_1.IdentityType.Linkedin,
+    apple: identity_js_1.IdentityType.Apple,
+    telegram: identity_js_1.IdentityType.Telegram,
+    tiktok: identity_js_1.IdentityType.Tiktok,
+    instagram: identity_js_1.IdentityType.Instagram,
+    farcaster: identity_js_1.IdentityType.Farcaster,
+    wallet: identity_js_1.IdentityType.Wallet,
+};
+/**
+ * Every accepted name: the canonical P2ID names plus `twitter` (an alias of `x`). P2ID core is
+ * agnostic of any identity provider — it does not know Privy (or any other verifier's) account
+ * types. Callers map their provider's account types to these names themselves.
+ */
+exports.IDENTITY_TYPE_BY_NAME = {
+    ...exports.P2ID_TYPE_NAMES,
+    twitter: identity_js_1.IdentityType.Twitter,
+};
+/** The P2ID name of a type, e.g. IdentityType.Twitter -> "x". */
+function identityTypeName(type) {
+    const entry = Object.entries(exports.P2ID_TYPE_NAMES).find(([, id]) => id === type);
+    if (!entry)
+        throw new Error(`unknown identity type id ${type}`);
+    return entry[0];
+}
+function resolveIdentityType(t) {
+    if (typeof t === 'number') {
+        if (!Object.values(exports.IDENTITY_TYPE_BY_NAME).includes(t))
+            throw new Error(`unknown identity type id ${t}`);
+        return t;
+    }
+    const id = exports.IDENTITY_TYPE_BY_NAME[t];
+    if (id === undefined)
+        throw new Error(`unknown identity type "${t}"`);
+    return id;
+}

package/dist/cjs/index.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.P2ID_SCHEMES = exports.P2ID_SCHEME = exports.checksumAddress = exports.p2idScheme = exports.p2idAddressForHash = exports.p2idAddress = exports.identityHash = exports.resolveIdentityType = exports.identityTypeName = exports.P2ID_TYPE_NAMES = exports.IDENTITY_TYPE_BY_NAME = exports.toHex = exports.normalizeIdentityValue = exports.isCaseInsensitive = exports.HASH_PREFIX = exports.IdentityType = void 0;
+// P2ID protocol core: no proof verification here, and no heavy dependencies, so it is safe in
+// browsers. Verifying attestations lives in @pvium/p2id-verifier.
+var identity_js_1 = require("./identity.js");
+Object.defineProperty(exports, "IdentityType", { enumerable: true, get: function () { return identity_js_1.IdentityType; } });
+Object.defineProperty(exports, "HASH_PREFIX", { enumerable: true, get: function () { return identity_js_1.HASH_PREFIX; } });
+Object.defineProperty(exports, "isCaseInsensitive", { enumerable: true, get: function () { return identity_js_1.isCaseInsensitive; } });
+Object.defineProperty(exports, "normalizeIdentityValue", { enumerable: true, get: function () { return identity_js_1.normalizeIdentityValue; } });
+Object.defineProperty(exports, "toHex", { enumerable: true, get: function () { return identity_js_1.toHex; } });
+var identityNames_js_1 = require("./identityNames.js");
+Object.defineProperty(exports, "IDENTITY_TYPE_BY_NAME", { enumerable: true, get: function () { return identityNames_js_1.IDENTITY_TYPE_BY_NAME; } });
+Object.defineProperty(exports, "P2ID_TYPE_NAMES", { enumerable: true, get: function () { return identityNames_js_1.P2ID_TYPE_NAMES; } });
+Object.defineProperty(exports, "identityTypeName", { enumerable: true, get: function () { return identityNames_js_1.identityTypeName; } });
+Object.defineProperty(exports, "resolveIdentityType", { enumerable: true, get: function () { return identityNames_js_1.resolveIdentityType; } });
+var p2id_js_1 = require("./p2id.js");
+Object.defineProperty(exports, "identityHash", { enumerable: true, get: function () { return p2id_js_1.identityHash; } });
+Object.defineProperty(exports, "p2idAddress", { enumerable: true, get: function () { return p2id_js_1.p2idAddress; } });
+Object.defineProperty(exports, "p2idAddressForHash", { enumerable: true, get: function () { return p2id_js_1.p2idAddressForHash; } });
+Object.defineProperty(exports, "p2idScheme", { enumerable: true, get: function () { return p2id_js_1.p2idScheme; } });
+Object.defineProperty(exports, "checksumAddress", { enumerable: true, get: function () { return p2id_js_1.checksumAddress; } });
+Object.defineProperty(exports, "P2ID_SCHEME", { enumerable: true, get: function () { return p2id_js_1.P2ID_SCHEME; } });
+Object.defineProperty(exports, "P2ID_SCHEMES", { enumerable: true, get: function () { return p2id_js_1.P2ID_SCHEMES; } });

package/dist/cjs/p2id.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.P2ID_SCHEMES = exports.P2ID_SCHEME = void 0;
+exports.p2idScheme = p2idScheme;
+exports.identityHash = identityHash;
+exports.p2idAddress = p2idAddress;
+exports.p2idAddressForHash = p2idAddressForHash;
+exports.checksumAddress = checksumAddress;
+const sha3_1 = require("@noble/hashes/sha3");
+const identity_js_1 = require("./identity.js");
+const identityNames_js_1 = require("./identityNames.js");
+const p2idConstants_js_1 = require("./p2idConstants.js");
+Object.defineProperty(exports, "P2ID_SCHEME", { enumerable: true, get: function () { return p2idConstants_js_1.P2ID_SCHEME; } });
+Object.defineProperty(exports, "P2ID_SCHEMES", { enumerable: true, get: function () { return p2idConstants_js_1.P2ID_SCHEMES; } });
+/**
+ * P2ID address derivation.
+ *
+ *   identityHash = sha256(identityDomain ‖ byte(typeId) ‖ normalize(value))
+ *   p2id         = keccak256(0xff ‖ factory ‖ identityHash ‖ vaultInitCodeHash)[12..]
+ *
+ * `normalize` ASCII-lowercases every type except phone and wallet, and lowercases `0x…` wallet
+ * addresses. A *scheme* (`pvium.vault.v1`, or a later `pvium.vault.vN`) fixes the three constants: the identity domain, the
+ * vault creation-code hash and the factory. The factory is deployed through the deterministic
+ * deployment proxy, so it is at the same address on every EVM chain: a P2ID address is
+ * chain-agnostic, like any wallet address. (The vault contract still has to be deployed on each
+ * chain where it is claimed; anyone can do that, and funds sent before then are claimable once
+ * it is.)
+ *
+ * Each Pvium environment is its own stack: `production` (mainnets, the production Privy app) and
+ * `sandbox` (testnets, the sandbox Privy app) have different factories, so the same identity has
+ * a different address in each. Production is the default.
+ *
+ * Schemes are history. A change to the vault bytecode moves every address, so it ships as the
+ * next scheme and becomes `P2ID_SCHEME`; earlier schemes stay in `P2ID_SCHEMES` so addresses
+ * people were already given can be derived, and claimed, forever.
+ */
+/** Constants of a scheme; defaults to the current one. */
+function p2idScheme(name = p2idConstants_js_1.P2ID_SCHEME) {
+    const s = p2idConstants_js_1.P2ID_SCHEMES[name];
+    if (!s)
+        throw new Error(`unknown P2ID scheme "${name}" (known: ${Object.keys(p2idConstants_js_1.P2ID_SCHEMES).join(', ')})`);
+    return s;
+}
+/** The identity commitment: the CREATE2 salt of the identity's vault and the value proofs bind. */
+function identityHash(type, value, scheme = p2idConstants_js_1.P2ID_SCHEME) {
+    return (0, identity_js_1.identityHash)((0, identityNames_js_1.resolveIdentityType)(type), value, p2idScheme(scheme).identityDomain);
+}
+/** The P2ID address for an identity: where to pay it, on any EVM chain, deployed or not. Checksummed. */
+function p2idAddress(input) {
+    const salt = identityHash(input.identityType, input.identityValue, input.scheme);
+    return p2idAddressForHash(salt, { scheme: input.scheme, environment: input.environment, factory: input.factory });
+}
+/** Same, from an identity hash you already have (e.g. from an attestation's claim). */
+function p2idAddressForHash(identityHash, opts = {}) {
+    const scheme = p2idScheme(opts.scheme);
+    const environment = opts.environment ?? 'production';
+    if (environment !== 'production' && environment !== 'sandbox')
+        throw new Error(`unknown environment "${environment}"`);
+    const factory = opts.factory ?? scheme.factories[environment];
+    if (!factory) {
+        throw new Error(`scheme ${opts.scheme ?? p2idConstants_js_1.P2ID_SCHEME} has no ${environment} factory address in this release yet; pass \`factory\` explicitly`);
+    }
+    if (!/^0x[0-9a-fA-F]{40}$/.test(factory))
+        throw new Error(`bad factory address ${factory}`);
+    const preimage = new Uint8Array(1 + 20 + 32 + 32);
+    preimage[0] = 0xff;
+    preimage.set(hexToBytes(factory, 20), 1);
+    preimage.set(hexToBytes(identityHash, 32), 21);
+    preimage.set(hexToBytes(scheme.vaultInitCodeHash, 32), 53);
+    return checksumAddress((0, identity_js_1.toHex)((0, sha3_1.keccak_256)(preimage).subarray(12)));
+}
+/** EIP-55 checksum. */
+function checksumAddress(address) {
+    const lower = address.slice(2).toLowerCase();
+    const hash = (0, sha3_1.keccak_256)(new TextEncoder().encode(lower));
+    let out = '0x';
+    for (let i = 0; i < 40; i++) {
+        const nibble = (hash[i >> 1] >> (i % 2 === 0 ? 4 : 0)) & 0xf;
+        out += nibble >= 8 ? lower[i].toUpperCase() : lower[i];
+    }
+    return out;
+}
+function hexToBytes(hex, length) {
+    const h = hex.startsWith('0x') ? hex.slice(2) : hex;
+    if (h.length !== length * 2 || !/^[0-9a-fA-F]*$/.test(h))
+        throw new Error(`expected ${length}-byte hex, got ${hex}`);
+    const out = new Uint8Array(length);
+    for (let i = 0; i < length; i++)
+        out[i] = parseInt(h.slice(i * 2, i * 2 + 2), 16);
+    return out;
+}

package/dist/cjs/p2idConstants.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.P2ID_SCHEME = exports.P2ID_SCHEMES = void 0;
+/** Every P2ID address scheme this release can derive, keyed by domain. Older schemes stay forever. */
+exports.P2ID_SCHEMES = {
+    "pvium.vault.v1": {
+        "identityDomain": "p2id.identity.v1",
+        "vaultInitCodeHash": "0x59c2f7f1e9725340e25a45b122fae7d1e9cbd9c7b00dba6215ebaa67cfb691ef",
+        "factories": {
+            "production": null,
+            "sandbox": "0xd1DEa4e8911955DAD961B643AFdE6Ab34d9Bd371"
+        }
+    }
+};
+/** The scheme new payments should use. */
+exports.P2ID_SCHEME = 'pvium.vault.v1';

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/esm/identity.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Identity types. The numeric value is the protocol's type id (it is what gets hashed), so it
+ * must match circuit/src/identity.nr and never change.
+ */
+export declare enum IdentityType {
+    Email = 0,
+    Phone = 1,
+    Google = 2,
+    Twitter = 3,
+    /** Alias of `Twitter`: the platform's current name. Same id, same addresses. */
+    X = 3,
+    Discord = 4,
+    Github = 5,
+    Linkedin = 6,
+    Apple = 7,
+    Telegram = 8,
+    Tiktok = 9,
+    Instagram = 10,
+    Farcaster = 11,
+    Wallet = 12
+}
+/** Domain-separation prefix baked into the circuit's identity hash. */
+export declare const HASH_PREFIX = "p2id.identity.v1";
+/** Types whose value is ASCII-lowercased before hashing: everything except phone numbers and
+ *  wallet addresses (matches CASE_INSENSITIVE in circuit/src/identity.nr). */
+export declare function isCaseInsensitive(type: IdentityType): boolean;
+/**
+ * Apply the circuit's normalisation to an identity value: ASCII-lowercase for case-insensitive
+ * types and for EVM (`0x…`) wallet addresses; base58 (Solana) addresses are left untouched.
+ */
+export declare function normalizeIdentityValue(type: IdentityType, value: string): string;
+/**
+ * `sha256(HASH_PREFIX || type || normalize(value))`, exactly as the circuit computes it.
+ * This is the routing salt a payer uses to address an identity, and the value a proof's
+ * `identityHash` output is compared against.
+ */
+export declare function identityHash(type: IdentityType, value: string, domain?: string): `0x${string}`;
+export declare function toHex(bytes: Uint8Array): `0x${string}`;