@solidus-network/bbs 0.6.0 → 0.6.2

package/README.md

@@ -78,6 +78,31 @@ const ok = await proof.verify({
 })
 ```
 
+## Credential-format v2 helpers (unlinkable presentations)
+
+The helpers behind Solidus's unlinkable KYC presentations (used by
+`@solidus-network/auth`'s verifier surface — see that package's README for the
+full relying-party quickstart and the runnable unlinkability demo):
+
+```ts
+import { buildV2Header, derivePresentationHeader, BBS_CREDENTIAL_V2 } from '@solidus-network/bbs'
+
+// The v2 signing header is CONSTANT per (issuer, credential-type, epoch) —
+// no per-credential entropy, so it places a holder in a cohort, never
+// identifies one:
+const header = buildV2Header('did:solidus:testnet:issuer', 'kyc', 2)
+// utf8("solidus-bbs-credential:v2:did:solidus:testnet:issuer:kyc:2")
+
+// The presentation header binds a proof to ONE verifier challenge
+// (length-prefixed domain ‖ nonce, hashed) — replay under any other
+// challenge fails cryptographically:
+const ph = derivePresentationHeader('rp.example.com', nonce32)
+```
+
+Also exported: `benchmarkDevice` / `decideProofPath` (the on-device
+proof-generation benchmark that routes slow devices to an assist prover)
+and `dispatchProof` (the routing itself).
+
 ## Sizes
 
 | Element | Bytes |

package/dist/benchmark.d.ts

@@ -0,0 +1,73 @@
+/** Latency budget for the client-side (primary) proof path. */
+export declare const PROOF_GEN_BUDGET: Readonly<{
+    /** Median proof-gen must be at or under this for the client path. */
+    p50Ms: 1500;
+    /** A single run above this routes to assist immediately. */
+    p95Ms: 3000;
+}>;
+export type ProofGenBudget = typeof PROOF_GEN_BUDGET;
+export interface TimingSummary {
+    runs: number;
+    p50Ms: number;
+    p95Ms: number;
+    meanMs: number;
+    minMs: number;
+    maxMs: number;
+}
+/** Where this device should generate selective-disclosure proofs. */
+export type ProofPath = 'client' | 'assist';
+export interface ProofPathDecision {
+    path: ProofPath;
+    /** Raw per-run proof-gen timings gathered before deciding. */
+    samplesMs: number[];
+    budget: ProofGenBudget;
+    /** ISO timestamp — callers cache the decision keyed by app version. */
+    decidedAt: string;
+}
+export interface ProofGenMeasurement {
+    /** One-time cost: deterministic keygen + signing the 8-message vector. */
+    setupMs: number;
+    proofGen: TimingSummary;
+    verify: TimingSummary;
+    /** True iff a generated proof verified — proves the harness measured real crypto. */
+    proofVerified: boolean;
+    proofBytes: number;
+    messageCount: number;
+    hiddenIndices: number[];
+    disclosedIndices: number[];
+}
+/**
+ * Nearest-rank percentile summary. p50 over an even-sized sample is the
+ * lower-middle element (nearest-rank, not interpolated) — deterministic and
+ * adequate for routing decisions.
+ */
+export declare function summarizeTimings(samplesMs: number[]): TimingSummary;
+/**
+ * Final routing rule: the sample median (nearest-rank p50) must be within
+ * the p50 budget for the client path.
+ */
+export declare function decideProofPath(samplesMs: number[], budget?: ProofGenBudget): ProofPath;
+/**
+ * One-shot adaptive device benchmark (run at wallet init, cache the result).
+ *
+ * Cost on a fast device: one proof-gen. On a decisively slow device: also
+ * one (a single run over the p95 budget answers the question). Only the
+ * inconclusive middle gathers up to `maxRuns` samples, then the median
+ * decides against the p50 budget.
+ */
+export declare function benchmarkDevice(opts?: {
+    budget?: ProofGenBudget;
+    maxRuns?: number;
+    /** Injectable for tests: returns one proof-gen duration in ms. */
+    runProofGen?: () => Promise<number>;
+}): Promise<ProofPathDecision>;
+/**
+ * Full measurement harness behind the device-tier latency table. Signs the
+ * synthetic vector once, then times `runs` proof generations and `runs`
+ * proof verifications, and sanity-verifies one proof so a broken harness
+ * cannot report numbers for crypto it never ran.
+ */
+export declare function measureProofGeneration(opts?: {
+    runs?: number;
+}): Promise<ProofGenMeasurement>;
+//# sourceMappingURL=benchmark.d.ts.map

package/dist/benchmark.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"benchmark.d.ts","sourceRoot":"","sources":["../src/benchmark.ts"],"names":[],"mappings":"AA6BA,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB;IAC3B,qEAAqE;;IAErE,4DAA4D;;EAE5D,CAAA;AAEF,MAAM,MAAM,cAAc,GAAG,OAAO,gBAAgB,CAAA;AAEpD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAED,qEAAqE;AACrE,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAE3C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,SAAS,CAAA;IACf,8DAA8D;IAC9D,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,MAAM,EAAE,cAAc,CAAA;IACtB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,aAAa,CAAA;IACvB,MAAM,EAAE,aAAa,CAAA;IACrB,qFAAqF;IACrF,aAAa,EAAE,OAAO,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B;AAOD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,aAAa,CAenE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,GAAE,cAAiC,GACxC,SAAS,CAEX;AAuED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,CAAC,EAAE;IAC3C,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;CACpC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuB7B;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,CAAC,EAAE;IAClD,IAAI,CAAC,EAAE,MAAM,CAAA;CACd,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8B/B"}

package/dist/benchmark.js

@@ -0,0 +1,190 @@
+/**
+ * Proof-generation micro-benchmark + device routing (privacy rebuild Phase 0).
+ *
+ * BBS+ selective-disclosure proof generation is pure-JS BLS12-381 math
+ * (`@noble/curves` under `@digitalbazaar/bbs-signatures`) — fast enough on
+ * laptops, unproven on phones. The wallet runs {@link benchmarkDevice} once
+ * at init (cache the result — see below) to route each device:
+ *
+ *  - `'client'` — proofs are generated on-device; the signing bundle never
+ *    leaves the wallet (the primary, privacy-preserving path).
+ *  - `'assist'` — this device is too slow; the wallet uses the stateless
+ *    assist prover (pod-mediated fallback). The UI must disclose this.
+ *
+ * Budget (frozen by the rebuild plan §6 Phase 0): the client path requires
+ * proof-gen ≤ 1.5 s p50 / 3 s p95 on the device.
+ *
+ * Caching is the CALLER's job: persist the returned decision keyed by app
+ * version (a library upgrade can change the numbers) and re-use it instead
+ * of re-benchmarking every init. Proof generation is synchronous CPU work —
+ * on the web, run this (and real proof-gen) in a Worker to keep the main
+ * thread responsive.
+ *
+ * The benchmark exercises the production configuration: an 8-message
+ * KYC-shaped vector (synthetic data), hiding indices {0,2,3,6,7} and
+ * disclosing {1,4,5} — hidden messages are what make proof-gen expensive,
+ * so this is the worst-case production shape.
+ */
+import { BbsSecretKey, utf8 } from './index.js';
+/** Latency budget for the client-side (primary) proof path. */
+export const PROOF_GEN_BUDGET = Object.freeze({
+    /** Median proof-gen must be at or under this for the client path. */
+    p50Ms: 1500,
+    /** A single run above this routes to assist immediately. */
+    p95Ms: 3000,
+});
+function now() {
+    const perf = globalThis.performance;
+    return perf ? perf.now() : Date.now();
+}
+/**
+ * Nearest-rank percentile summary. p50 over an even-sized sample is the
+ * lower-middle element (nearest-rank, not interpolated) — deterministic and
+ * adequate for routing decisions.
+ */
+export function summarizeTimings(samplesMs) {
+    if (samplesMs.length === 0) {
+        throw new Error('summarizeTimings requires at least one sample');
+    }
+    const sorted = [...samplesMs].sort((a, b) => a - b);
+    const rank = (q) => sorted[Math.ceil((q / 100) * sorted.length) - 1];
+    const sum = sorted.reduce((n, x) => n + x, 0);
+    return {
+        runs: sorted.length,
+        p50Ms: rank(50),
+        p95Ms: rank(95),
+        meanMs: sum / sorted.length,
+        minMs: sorted[0],
+        maxMs: sorted[sorted.length - 1],
+    };
+}
+/**
+ * Final routing rule: the sample median (nearest-rank p50) must be within
+ * the p50 budget for the client path.
+ */
+export function decideProofPath(samplesMs, budget = PROOF_GEN_BUDGET) {
+    return summarizeTimings(samplesMs).p50Ms <= budget.p50Ms ? 'client' : 'assist';
+}
+// ---------- synthetic production-shaped workload ----------
+// Synthetic KYC-shaped vector — realistic byte lengths, no real data.
+const BENCH_MESSAGES = [
+    'did:solidus:testnet:9f4kAqNwXyBhcVpQ2mTuLgRd3eZs', // 0 subject_did   (hidden)
+    'did:solidus:testnet:6bJcQvJqrgXk2sYwHnEuPfM8dTzA', // 1 issuer_did    (disclosed)
+    '3f2504e0-4f89-41d3-9a0c-0305e82c3301', //             2 verification_id (hidden)
+    '2026-01-01T00:00:00.000Z', //                         3 verified_at   (hidden)
+    '2', //                                                4 kyc_level     (disclosed)
+    'TR', //                                               5 country       (disclosed)
+    'passport', //                                         6 document_type (hidden)
+    '9c1185a5c5e9fc54612808977ee8f548b2258d31d8a4c48e14d3c8b6a9f2e701', // 7 document_hash (hidden)
+].map(utf8);
+const BENCH_HIDDEN = [0, 2, 3, 6, 7];
+const BENCH_DISCLOSED = [1, 4, 5];
+// v2-shaped header: issuer/type/epoch constant (the target envelope format).
+const BENCH_HEADER = utf8('solidus-bbs-credential:v2:did:solidus:testnet:6bJcQvJqrgXk2sYwHnEuPfM8dTzA:kyc:1');
+const BENCH_PH = utf8('solidus-bbs-benchmark-ph:example.rp.solidus.network:0123456789abcdef');
+const BENCH_IKM = utf8('solidus-bbs-proofgen-benchmark-fixed-ikm-32-bytes-or-more.v1');
+async function createBenchContext() {
+    const t0 = now();
+    const sk = await BbsSecretKey.fromIkm(BENCH_IKM);
+    const pk = await sk.publicKey();
+    const sig = await sk.sign(BENCH_HEADER, BENCH_MESSAGES);
+    const setupMs = now() - t0;
+    const runOnce = async () => {
+        const t = now();
+        await sig.createProof({
+            pk,
+            header: BENCH_HEADER,
+            presentationHeader: BENCH_PH,
+            messages: BENCH_MESSAGES,
+            disclosedIndices: BENCH_DISCLOSED,
+        });
+        return now() - t;
+    };
+    const verifyOnce = async () => {
+        const proof = await sig.createProof({
+            pk,
+            header: BENCH_HEADER,
+            presentationHeader: BENCH_PH,
+            messages: BENCH_MESSAGES,
+            disclosedIndices: BENCH_DISCLOSED,
+        });
+        const disclosedMessages = BENCH_DISCLOSED.map((i) => BENCH_MESSAGES[i]);
+        const t = now();
+        const verified = await proof.verify({
+            pk,
+            header: BENCH_HEADER,
+            presentationHeader: BENCH_PH,
+            disclosedIndices: BENCH_DISCLOSED,
+            disclosedMessages,
+        });
+        return { ms: now() - t, verified, proofBytes: proof.toBytes().length };
+    };
+    return { runOnce, verifyOnce, setupMs };
+}
+/**
+ * One-shot adaptive device benchmark (run at wallet init, cache the result).
+ *
+ * Cost on a fast device: one proof-gen. On a decisively slow device: also
+ * one (a single run over the p95 budget answers the question). Only the
+ * inconclusive middle gathers up to `maxRuns` samples, then the median
+ * decides against the p50 budget.
+ */
+export async function benchmarkDevice(opts) {
+    const budget = opts?.budget ?? PROOF_GEN_BUDGET;
+    const maxRuns = opts?.maxRuns ?? 3;
+    const run = opts?.runProofGen ?? (await createBenchContext()).runOnce;
+    const samplesMs = [];
+    let path;
+    for (let i = 0; i < maxRuns; i++) {
+        const ms = await run();
+        samplesMs.push(ms);
+        if (i === 0) {
+            if (ms <= budget.p50Ms) {
+                path = 'client';
+                break;
+            }
+            if (ms > budget.p95Ms) {
+                path = 'assist';
+                break;
+            }
+        }
+    }
+    path ??= decideProofPath(samplesMs, budget);
+    return { path, samplesMs, budget, decidedAt: new Date().toISOString() };
+}
+/**
+ * Full measurement harness behind the device-tier latency table. Signs the
+ * synthetic vector once, then times `runs` proof generations and `runs`
+ * proof verifications, and sanity-verifies one proof so a broken harness
+ * cannot report numbers for crypto it never ran.
+ */
+export async function measureProofGeneration(opts) {
+    const runs = opts?.runs ?? 30;
+    if (runs < 1)
+        throw new Error('measureProofGeneration requires runs ≥ 1');
+    const ctx = await createBenchContext();
+    const proofGenSamples = [];
+    for (let i = 0; i < runs; i++) {
+        proofGenSamples.push(await ctx.runOnce());
+    }
+    const verifySamples = [];
+    let proofVerified = true;
+    let proofBytes = 0;
+    for (let i = 0; i < runs; i++) {
+        const v = await ctx.verifyOnce();
+        verifySamples.push(v.ms);
+        proofVerified &&= v.verified;
+        proofBytes = v.proofBytes;
+    }
+    return {
+        setupMs: ctx.setupMs,
+        proofGen: summarizeTimings(proofGenSamples),
+        verify: summarizeTimings(verifySamples),
+        proofVerified,
+        proofBytes,
+        messageCount: BENCH_MESSAGES.length,
+        hiddenIndices: [...BENCH_HIDDEN],
+        disclosedIndices: [...BENCH_DISCLOSED],
+    };
+}
+//# sourceMappingURL=benchmark.js.map

package/dist/benchmark.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"benchmark.js","sourceRoot":"","sources":["../src/benchmark.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAE/C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,qEAAqE;IACrE,KAAK,EAAE,IAAI;IACX,4DAA4D;IAC5D,KAAK,EAAE,IAAI;CACZ,CAAC,CAAA;AAsCF,SAAS,GAAG;IACV,MAAM,IAAI,GAAI,UAAkD,CAAC,WAAW,CAAA;IAC5E,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAmB;IAClD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAE,CAAA;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACf,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM;QAC3B,KAAK,EAAE,MAAM,CAAC,CAAC,CAAE;QACjB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE;KAClC,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAmB,EACnB,SAAyB,gBAAgB;IAEzC,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAA;AAChF,CAAC;AAED,6DAA6D;AAE7D,sEAAsE;AACtE,MAAM,cAAc,GAAG;IACrB,kDAAkD,EAAE,2BAA2B;IAC/E,kDAAkD,EAAE,8BAA8B;IAClF,sCAAsC,EAAE,yCAAyC;IACjF,0BAA0B,EAAE,mDAAmD;IAC/E,GAAG,EAAE,6EAA6E;IAClF,IAAI,EAAE,4EAA4E;IAClF,UAAU,EAAE,mEAAmE;IAC/E,kEAAkE,EAAE,2BAA2B;CAChG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAEX,MAAM,YAAY,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AACpC,MAAM,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AACjC,6EAA6E;AAC7E,MAAM,YAAY,GAAG,IAAI,CAAC,kFAAkF,CAAC,CAAA;AAC7G,MAAM,QAAQ,GAAG,IAAI,CAAC,sEAAsE,CAAC,CAAA;AAC7F,MAAM,SAAS,GAAG,IAAI,CAAC,8DAA8D,CAAC,CAAA;AAQtF,KAAK,UAAU,kBAAkB;IAC/B,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;IAChB,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAChD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,EAAE,CAAA;IAE1B,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAA;QACf,MAAM,GAAG,CAAC,WAAW,CAAC;YACpB,EAAE;YACF,MAAM,EAAE,YAAY;YACpB,kBAAkB,EAAE,QAAQ;YAC5B,QAAQ,EAAE,cAAc;YACxB,gBAAgB,EAAE,eAAe;SAClC,CAAC,CAAA;QACF,OAAO,GAAG,EAAE,GAAG,CAAC,CAAA;IAClB,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;QAC5B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC;YAClC,EAAE;YACF,MAAM,EAAE,YAAY;YACpB,kBAAkB,EAAE,QAAQ;YAC5B,QAAQ,EAAE,cAAc;YACxB,gBAAgB,EAAE,eAAe;SAClC,CAAC,CAAA;QACF,MAAM,iBAAiB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC,CAAA;QACxE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAA;QACf,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;YAClC,EAAE;YACF,MAAM,EAAE,YAAY;YACpB,kBAAkB,EAAE,QAAQ;YAC5B,gBAAgB,EAAE,eAAe;YACjC,iBAAiB;SAClB,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,CAAA;IACxE,CAAC,CAAA;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAKrC;IACC,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,gBAAgB,CAAA;IAC/C,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,IAAI,EAAE,WAAW,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAA;IAErE,MAAM,SAAS,GAAa,EAAE,CAAA;IAC9B,IAAI,IAA2B,CAAA;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE,CAAA;QACtB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAClB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACZ,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACvB,IAAI,GAAG,QAAQ,CAAA;gBACf,MAAK;YACP,CAAC;YACD,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;gBACtB,IAAI,GAAG,QAAQ,CAAA;gBACf,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC3C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAE5C;IACC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,CAAA;IAC7B,IAAI,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IACzE,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAA;IAEtC,MAAM,eAAe,GAAa,EAAE,CAAA;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,eAAe,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;IAC3C,CAAC;IAED,MAAM,aAAa,GAAa,EAAE,CAAA;IAClC,IAAI,aAAa,GAAG,IAAI,CAAA;IACxB,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAA;QAChC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACxB,aAAa,KAAK,CAAC,CAAC,QAAQ,CAAA;QAC5B,UAAU,GAAG,CAAC,CAAC,UAAU,CAAA;IAC3B,CAAC;IAED,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,gBAAgB,CAAC,eAAe,CAAC;QAC3C,MAAM,EAAE,gBAAgB,CAAC,aAAa,CAAC;QACvC,aAAa;QACb,UAAU;QACV,YAAY,EAAE,cAAc,CAAC,MAAM;QACnC,aAAa,EAAE,CAAC,GAAG,YAAY,CAAC;QAChC,gBAAgB,EAAE,CAAC,GAAG,eAAe,CAAC;KACvC,CAAA;AACH,CAAC"}

package/dist/dispatch.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Proof-path dispatch (privacy rebuild §5.3 — wallet routing).
+ *
+ * The wallet benchmarks the device once (`benchmarkDevice`) and caches the
+ * decision. Each presentation routes through `dispatchProof`: generate the
+ * proof on-device when the device is fast, or hand a decrypted bundle to the
+ * assist prover when it is slow. The dispatcher returns which path ran so the
+ * UI can disclose it honestly ("proving on Solidus's assist service because
+ * this device is slow") — never a blanket "non-custodial" claim.
+ *
+ * A client-path FAILURE is NOT silently retried on the assist service —
+ * rerouting a bundle to the server behind the user's back would violate the
+ * privacy expectation the client path set. The caller decides whether to
+ * re-benchmark and retry.
+ */
+import type { ProofPath, ProofPathDecision } from './benchmark.js';
+export interface ProofDispatchHandlers {
+    /** Generate the proof on-device; returns proofHex. */
+    localProve: () => Promise<string>;
+    /** Generate the proof via the assist prover; returns proofHex. */
+    fallbackProve: () => Promise<string>;
+}
+export interface DispatchedProof {
+    proofHex: string;
+    /** Which path produced the proof — surface this in the UI. */
+    path: ProofPath;
+}
+/** Route a proof to the client or the assist path per the cached decision. */
+export declare function dispatchProof(decision: ProofPathDecision | {
+    path: ProofPath;
+}, handlers: ProofDispatchHandlers): Promise<DispatchedProof>;
+/** Request payload for the assist prover's `POST /v1/prove`. */
+export interface AssistProveRequest {
+    messagesHex: string[];
+    signatureHex: string;
+    issuerPubkeyHex: string;
+    headerHex: string;
+    phHex: string;
+    disclosedIndices: number[];
+}
+/**
+ * Call the stateless assist prover. `walletJwt` is the identity-api-issued
+ * wallet token; `fetchImpl` is injectable for tests. Throws on any non-200.
+ * The caller is responsible for TLS (the URL must be https in production) and
+ * for zeroizing the plaintext bundle it passed once this resolves.
+ */
+export declare function callAssistProver(proveUrl: string, walletJwt: string, req: AssistProveRequest, opts?: {
+    fetchImpl?: typeof fetch;
+}): Promise<string>;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElE,MAAM,WAAW,qBAAqB;IACpC,sDAAsD;IACtD,UAAU,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACjC,kEAAkE;IAClE,aAAa,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;CACrC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,8DAA8D;IAC9D,IAAI,EAAE,SAAS,CAAA;CAChB;AAED,8EAA8E;AAC9E,wBAAsB,aAAa,CACjC,QAAQ,EAAE,iBAAiB,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,EACjD,QAAQ,EAAE,qBAAqB,GAC9B,OAAO,CAAC,eAAe,CAAC,CAK1B;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;IACvB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,kBAAkB,EACvB,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,GAClC,OAAO,CAAC,MAAM,CAAC,CAmBjB"}

package/dist/dispatch.js

@@ -0,0 +1,35 @@
+/** Route a proof to the client or the assist path per the cached decision. */
+export async function dispatchProof(decision, handlers) {
+    if (decision.path === 'client') {
+        return { proofHex: await handlers.localProve(), path: 'client' };
+    }
+    return { proofHex: await handlers.fallbackProve(), path: 'assist' };
+}
+/**
+ * Call the stateless assist prover. `walletJwt` is the identity-api-issued
+ * wallet token; `fetchImpl` is injectable for tests. Throws on any non-200.
+ * The caller is responsible for TLS (the URL must be https in production) and
+ * for zeroizing the plaintext bundle it passed once this resolves.
+ */
+export async function callAssistProver(proveUrl, walletJwt, req, opts) {
+    const doFetch = opts?.fetchImpl ?? globalThis.fetch;
+    if (!doFetch)
+        throw new Error('no fetch implementation available');
+    const res = await doFetch(proveUrl, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            authorization: `Bearer ${walletJwt}`,
+        },
+        body: JSON.stringify(req),
+    });
+    if (!res.ok) {
+        throw new Error(`assist prover returned ${res.status}`);
+    }
+    const body = (await res.json());
+    if (typeof body.proofHex !== 'string' || body.proofHex.length === 0) {
+        throw new Error('assist prover response missing proofHex');
+    }
+    return body.proofHex;
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AA8BA,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAiD,EACjD,QAA+B;IAE/B,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAClE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AACrE,CAAC;AAYD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,SAAiB,EACjB,GAAuB,EACvB,IAAmC;IAEnC,MAAM,OAAO,GAAG,IAAI,EAAE,SAAS,IAAK,UAAU,CAAC,KAAsB,CAAA;IACrE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;QAClC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,SAAS,EAAE;SACrC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;KAC1B,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAA;IACzD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAA;AACtB,CAAC"}

package/dist/index.d.ts

@@ -98,4 +98,7 @@ export declare class BbsProof {
 }
 /** Encode a UTF-8 string as raw bytes (for use as a message or header). */
 export declare function utf8(s: string): Uint8Array;
+export * from './benchmark.js';
+export * from './v2.js';
+export * from './dispatch.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA+BA,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,KAAK,CAAA;AACrC;;;GAGG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAA;AAIvC,qBAAa,QAAS,SAAQ,KAAK;IACJ,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAAzC,OAAO,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,OAAO,YAAA;CAItD;AAuBD,qBAAa,YAAY;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IAA1C,OAAO;IAIP,+CAA+C;WAClC,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC;IAK9C;;;;;;;;;;OAUG;WACU,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC;IAW5D,qDAAqD;IACrD,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,YAAY;IAIjD,uBAAuB;IACvB,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY;IAMzC,0CAA0C;IAC1C,OAAO,IAAI,UAAU;IAIrB,+BAA+B;IAC/B,KAAK,IAAI,MAAM;IAIf,2CAA2C;IACrC,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAQxC;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;CAsB9E;AAID,qBAAa,YAAY;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IAA1C,OAAO;IAIP,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,YAAY;IAIjD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY;IAMzC,OAAO,IAAI,UAAU;IAIrB,KAAK,IAAI,MAAM;IAIf,MAAM,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO;CAOrC;AAID,qBAAa,YAAY;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IAA1C,OAAO;IAIP,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,YAAY;IAIjD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY;IAMzC,OAAO,IAAI,UAAU;IAIrB,KAAK,IAAI,MAAM;IAIf,8EAA8E;IACxE,MAAM,CACV,EAAE,EAAE,YAAY,EAChB,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,UAAU,EAAE,GACrB,OAAO,CAAC,OAAO,CAAC;IAUnB;;;OAGG;IACG,WAAW,CAAC,IAAI,EAAE;QACtB,EAAE,EAAE,YAAY,CAAA;QAChB,MAAM,EAAE,UAAU,CAAA;QAClB,kBAAkB,EAAE,UAAU,CAAA;QAC9B,QAAQ,EAAE,UAAU,EAAE,CAAA;QACtB,gBAAgB,EAAE,MAAM,EAAE,CAAA;KAC3B,GAAG,OAAO,CAAC,QAAQ,CAAC;CAoBtB;AAID,qBAAa,QAAQ;IACC,OAAO,CAAC,QAAQ,CAAC,KAAK;IAA1C,OAAO;IAEP,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ;IAI7C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ;IAIrC,OAAO,IAAI,UAAU;IAIrB,KAAK,IAAI,MAAM;IAIf;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE;QACjB,EAAE,EAAE,YAAY,CAAA;QAChB,MAAM,EAAE,UAAU,CAAA;QAClB,kBAAkB,EAAE,UAAU,CAAA;QAC9B,gBAAgB,EAAE,MAAM,EAAE,CAAA;QAC1B,iBAAiB,EAAE,UAAU,EAAE,CAAA;KAChC,GAAG,OAAO,CAAC,OAAO,CAAC;CAcrB;AAID,2EAA2E;AAC3E,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAE1C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA+BA,kEAAkE;AAClE,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,KAAK,CAAA;AACrC;;;GAGG;AACH,eAAO,MAAM,qBAAqB,KAAK,CAAA;AAIvC,qBAAa,QAAS,SAAQ,KAAK;IACJ,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAAzC,OAAO,EAAE,MAAM,EAAW,KAAK,CAAC,EAAE,OAAO,YAAA;CAItD;AAkCD,qBAAa,YAAY;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IAA1C,OAAO;IAIP,+CAA+C;WAClC,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC;IAK9C;;;;;;;;;;OAUG;WACU,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC;IAW5D,qDAAqD;IACrD,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,YAAY;IAIjD,uBAAuB;IACvB,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY;IAMzC,0CAA0C;IAC1C,OAAO,IAAI,UAAU;IAIrB,+BAA+B;IAC/B,KAAK,IAAI,MAAM;IAIf,2CAA2C;IACrC,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAQxC;;;OAGG;IACG,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;CAsB9E;AAID,qBAAa,YAAY;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IAA1C,OAAO;IAIP,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,YAAY;IAIjD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY;IAMzC,OAAO,IAAI,UAAU;IAIrB,KAAK,IAAI,MAAM;IAIf,MAAM,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO;CAOrC;AAID,qBAAa,YAAY;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IAA1C,OAAO;IAIP,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,YAAY;IAIjD,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY;IAMzC,OAAO,IAAI,UAAU;IAIrB,KAAK,IAAI,MAAM;IAIf,8EAA8E;IACxE,MAAM,CACV,EAAE,EAAE,YAAY,EAChB,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,UAAU,EAAE,GACrB,OAAO,CAAC,OAAO,CAAC;IAUnB;;;OAGG;IACG,WAAW,CAAC,IAAI,EAAE;QACtB,EAAE,EAAE,YAAY,CAAA;QAChB,MAAM,EAAE,UAAU,CAAA;QAClB,kBAAkB,EAAE,UAAU,CAAA;QAC9B,QAAQ,EAAE,UAAU,EAAE,CAAA;QACtB,gBAAgB,EAAE,MAAM,EAAE,CAAA;KAC3B,GAAG,OAAO,CAAC,QAAQ,CAAC;CAoBtB;AAID,qBAAa,QAAQ;IACC,OAAO,CAAC,QAAQ,CAAC,KAAK;IAA1C,OAAO;IAEP,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ;IAI7C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ;IAIrC,OAAO,IAAI,UAAU;IAIrB,KAAK,IAAI,MAAM;IAIf;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE;QACjB,EAAE,EAAE,YAAY,CAAA;QAChB,MAAM,EAAE,UAAU,CAAA;QAClB,kBAAkB,EAAE,UAAU,CAAA;QAC9B,gBAAgB,EAAE,MAAM,EAAE,CAAA;QAC1B,iBAAiB,EAAE,UAAU,EAAE,CAAA;KAChC,GAAG,OAAO,CAAC,OAAO,CAAC;CAcrB;AAID,2EAA2E;AAC3E,wBAAgB,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAE1C;AAID,cAAc,gBAAgB,CAAA;AAI9B,cAAc,SAAS,CAAA;AAIvB,cAAc,eAAe,CAAA"}

package/dist/index.js

@@ -44,14 +44,25 @@ function assertLen(label, got, want) {
         throw new BbsError(`${label}: expected ${want} bytes, got ${got}`);
     }
 }
+// Buffer-free hex codecs — this package runs in the browser wallet
+// (client-side proof generation is the primary path), where node globals
+// don't exist and Next/webpack no longer polyfill them.
 function toHex(bytes) {
-    return Buffer.from(bytes).toString('hex');
+    let out = '';
+    for (let i = 0; i < bytes.length; i++) {
+        out += bytes[i].toString(16).padStart(2, '0');
+    }
+    return out;
 }
 function fromHex(hex, label) {
     if (!/^[0-9a-f]*$/i.test(hex) || hex.length % 2 !== 0) {
         throw new BbsError(`${label} is not valid hex`);
     }
-    return new Uint8Array(Buffer.from(hex, 'hex'));
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < bytes.length; i++) {
+        bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
 }
 // ---------- BbsSecretKey ----------
 export class BbsSecretKey {
@@ -267,4 +278,10 @@ export class BbsProof {
 export function utf8(s) {
     return new TextEncoder().encode(s);
 }
+// ---------- proof-generation benchmark + device routing (Phase 0) ----------
+export * from './benchmark.js';
+// ---------- credential-envelope v2 format helpers (Phase 1) ----------
+export * from './v2.js';
+// ---------- proof-path dispatch: client vs assist prover (Phase 3B) ----------
+export * from './dispatch.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,IAAI,IAAI,OAAO,EACf,eAAe,IAAI,SAAS,EAC5B,WAAW,IAAI,cAAc,EAC7B,WAAW,IAAI,cAAc,GAC9B,MAAM,+BAA+B,CAAA;AAEtC,MAAM,WAAW,GAAG,YAAY,CAAC,eAAe,CAAA;AAEhD,mEAAmE;AAEnE,kEAAkE;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AACtC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AACtC,2CAA2C;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAA;AACrC;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AAEvC,oCAAoC;AAEpC,MAAM,OAAO,QAAS,SAAQ,KAAK;IACK;IAAtC,YAAY,OAAe,EAAW,KAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAA;QADsB,UAAK,GAAL,KAAK,CAAU;QAEnD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;IACxB,CAAC;CACF;AAED,gCAAgC;AAEhC,SAAS,SAAS,CAAC,KAAa,EAAE,GAAW,EAAE,IAAY;IACzD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,cAAc,IAAI,eAAe,GAAG,EAAE,CAAC,CAAA;IACpE,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,KAAiB;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC3C,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,KAAa;IACzC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,qCAAqC;AAErC,MAAM,OAAO,YAAY;IACc;IAArC,YAAqC,KAAiB;QAAjB,UAAK,GAAL,KAAK,CAAY;QACpD,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAC7D,CAAC;IAED,+CAA+C;IAC/C,MAAM,CAAC,KAAK,CAAC,QAAQ;QACnB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAA;QACzE,OAAO,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpD,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAe;QAClC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,QAAQ,CAAC,+BAA+B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC;YAC1C,WAAW,EAAE,WAAW;YACxB,IAAI,EAAE,GAAG;SACV,CAAC,CAAA;QACF,OAAO,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpD,CAAC;IAED,qDAAqD;IACrD,MAAM,CAAC,SAAS,CAAC,KAAiB;QAChC,OAAO,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAChD,CAAC;IAED,uBAAuB;IACvB,MAAM,CAAC,OAAO,CAAC,GAAW;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QACxC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;QAC3D,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAED,0CAA0C;IAC1C,OAAO;QACL,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,+BAA+B;IAC/B,KAAK;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,SAAS;QACb,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,WAAW,EAAE,WAAW;SACzB,CAAC,CAAA;QACF,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACnD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,MAAkB,EAAE,QAAsB;QACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,QAAQ,CAAC,kCAAkC,CAAC,CAAA;QACxD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YAC5C,MAAM,IAAI,QAAQ,CAChB,iBAAiB,QAAQ,CAAC,MAAM,mCAAmC,qBAAqB,GAAG,CAC5F,CAAA;QACH,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,WAAW,EAAE,WAAW;SACzB,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC;YACxB,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,SAAS,EAAE,EAAE;YACb,MAAM;YACN,QAAQ;YACR,WAAW,EAAE,WAAW;SACzB,CAAC,CAAA;QACF,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACpD,CAAC;CACF;AAED,qCAAqC;AAErC,MAAM,OAAO,YAAY;IACc;IAArC,YAAqC,KAAiB;QAAjB,UAAK,GAAL,KAAK,CAAY;QACpD,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAC7D,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAiB;QAChC,OAAO,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAW;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QACxC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;QAC3D,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,KAAK;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,CAAC,KAAmB;QACxB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED,qCAAqC;AAErC,MAAM,OAAO,YAAY;IACc;IAArC,YAAqC,KAAiB;QAAjB,UAAK,GAAL,KAAK,CAAY;QACpD,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAiB;QAChC,OAAO,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAW;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACvC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;QACzD,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,KAAK;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM,CACV,EAAgB,EAChB,MAAkB,EAClB,QAAsB;QAEtB,OAAO,SAAS,CAAC;YACf,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE;YACvB,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,MAAM;YACN,QAAQ;YACR,WAAW,EAAE,WAAW;SACzB,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,IAMjB;QACC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAE,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAE,EAAE,CAAC;gBAC/D,MAAM,IAAI,QAAQ,CAAC,6CAA6C,CAAC,CAAA;YACnE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,QAAQ,CAAC,8CAA8C,CAAC,CAAA;QACpE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,uBAAuB,EAAE,IAAI,CAAC,gBAAgB;YAC9C,WAAW,EAAE,WAAW;SACzB,CAAC,CAAA;QACF,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAClD,CAAC;CACF;AAED,iCAAiC;AAEjC,MAAM,OAAO,QAAQ;IACkB;IAArC,YAAqC,KAAiB;QAAjB,UAAK,GAAL,KAAK,CAAY;IAAG,CAAC;IAE1D,MAAM,CAAC,SAAS,CAAC,KAAiB;QAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5C,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAW;QACxB,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;IAC5C,CAAC;IAED,OAAO;QACL,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,KAAK;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,IAMZ;QACC,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACnE,MAAM,IAAI,QAAQ,CAAC,wDAAwD,CAAC,CAAA;QAC9E,CAAC;QACD,OAAO,cAAc,CAAC;YACpB,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE;YAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,uBAAuB,EAAE,IAAI,CAAC,gBAAgB;YAC9C,WAAW,EAAE,WAAW;SACzB,CAAC,CAAA;IACJ,CAAC;CACF;AAED,4CAA4C;AAE5C,2EAA2E;AAC3E,MAAM,UAAU,IAAI,CAAC,CAAS;IAC5B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACpC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,IAAI,IAAI,OAAO,EACf,eAAe,IAAI,SAAS,EAC5B,WAAW,IAAI,cAAc,EAC7B,WAAW,IAAI,cAAc,GAC9B,MAAM,+BAA+B,CAAA;AAEtC,MAAM,WAAW,GAAG,YAAY,CAAC,eAAe,CAAA;AAEhD,mEAAmE;AAEnE,kEAAkE;AAClE,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AACtC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AACtC,2CAA2C;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAA;AACrC;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAA;AAEvC,oCAAoC;AAEpC,MAAM,OAAO,QAAS,SAAQ,KAAK;IACK;IAAtC,YAAY,OAAe,EAAW,KAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAA;QADsB,UAAK,GAAL,KAAK,CAAU;QAEnD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;IACxB,CAAC;CACF;AAED,gCAAgC;AAEhC,SAAS,SAAS,CAAC,KAAa,EAAE,GAAW,EAAE,IAAY;IACzD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,cAAc,IAAI,eAAe,GAAG,EAAE,CAAC,CAAA;IACpE,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,yEAAyE;AACzE,wDAAwD;AACxD,SAAS,KAAK,CAAC,KAAiB;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,KAAa;IACzC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAA;IACjD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACtD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,qCAAqC;AAErC,MAAM,OAAO,YAAY;IACc;IAArC,YAAqC,KAAiB;QAAjB,UAAK,GAAL,KAAK,CAAY;QACpD,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAC7D,CAAC;IAED,+CAA+C;IAC/C,MAAM,CAAC,KAAK,CAAC,QAAQ;QACnB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAA;QACzE,OAAO,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpD,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAe;QAClC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,QAAQ,CAAC,+BAA+B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC;YAC1C,WAAW,EAAE,WAAW;YACxB,IAAI,EAAE,GAAG;SACV,CAAC,CAAA;QACF,OAAO,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpD,CAAC;IAED,qDAAqD;IACrD,MAAM,CAAC,SAAS,CAAC,KAAiB;QAChC,OAAO,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAChD,CAAC;IAED,uBAAuB;IACvB,MAAM,CAAC,OAAO,CAAC,GAAW;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QACxC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;QAC3D,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAED,0CAA0C;IAC1C,OAAO;QACL,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,+BAA+B;IAC/B,KAAK;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,SAAS;QACb,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,WAAW,EAAE,WAAW;SACzB,CAAC,CAAA;QACF,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACnD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,MAAkB,EAAE,QAAsB;QACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,QAAQ,CAAC,kCAAkC,CAAC,CAAA;QACxD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YAC5C,MAAM,IAAI,QAAQ,CAChB,iBAAiB,QAAQ,CAAC,MAAM,mCAAmC,qBAAqB,GAAG,CAC5F,CAAA;QACH,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,WAAW,EAAE,WAAW;SACzB,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC;YACxB,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,SAAS,EAAE,EAAE;YACb,MAAM;YACN,QAAQ;YACR,WAAW,EAAE,WAAW;SACzB,CAAC,CAAA;QACF,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IACpD,CAAC;CACF;AAED,qCAAqC;AAErC,MAAM,OAAO,YAAY;IACc;IAArC,YAAqC,KAAiB;QAAjB,UAAK,GAAL,KAAK,CAAY;QACpD,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAC7D,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAiB;QAChC,OAAO,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAW;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QACxC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;QAC3D,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,KAAK;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED,MAAM,CAAC,KAAmB;QACxB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAED,qCAAqC;AAErC,MAAM,OAAO,YAAY;IACc;IAArC,YAAqC,KAAiB;QAAjB,UAAK,GAAL,KAAK,CAAY;QACpD,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,KAAiB;QAChC,OAAO,IAAI,YAAY,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAW;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;QACvC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;QACzD,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAED,OAAO;QACL,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,KAAK;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM,CACV,EAAgB,EAChB,MAAkB,EAClB,QAAsB;QAEtB,OAAO,SAAS,CAAC;YACf,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE;YACvB,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,MAAM;YACN,QAAQ;YACR,WAAW,EAAE,WAAW;SACzB,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,IAMjB;QACC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAE,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAE,EAAE,CAAC;gBAC/D,MAAM,IAAI,QAAQ,CAAC,6CAA6C,CAAC,CAAA;YACnE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,QAAQ,CAAC,8CAA8C,CAAC,CAAA;QACpE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE;YAC5B,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,uBAAuB,EAAE,IAAI,CAAC,gBAAgB;YAC9C,WAAW,EAAE,WAAW;SACzB,CAAC,CAAA;QACF,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAClD,CAAC;CACF;AAED,iCAAiC;AAEjC,MAAM,OAAO,QAAQ;IACkB;IAArC,YAAqC,KAAiB;QAAjB,UAAK,GAAL,KAAK,CAAY;IAAG,CAAC;IAE1D,MAAM,CAAC,SAAS,CAAC,KAAiB;QAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5C,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAW;QACxB,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAA;IAC5C,CAAC;IAED,OAAO;QACL,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IAED,KAAK;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,IAMZ;QACC,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACnE,MAAM,IAAI,QAAQ,CAAC,wDAAwD,CAAC,CAAA;QAC9E,CAAC;QACD,OAAO,cAAc,CAAC;YACpB,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE;YAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,uBAAuB,EAAE,IAAI,CAAC,gBAAgB;YAC9C,WAAW,EAAE,WAAW;SACzB,CAAC,CAAA;IACJ,CAAC;CACF;AAED,4CAA4C;AAE5C,2EAA2E;AAC3E,MAAM,UAAU,IAAI,CAAC,CAAS;IAC5B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACpC,CAAC;AAED,8EAA8E;AAE9E,cAAc,gBAAgB,CAAA;AAE9B,wEAAwE;AAExE,cAAc,SAAS,CAAA;AAEvB,gFAAgF;AAEhF,cAAc,eAAe,CAAA"}

package/dist/v2.d.ts

@@ -0,0 +1,30 @@
+/** Version marker carried by v2 credential bundles and envelopes. */
+export declare const BBS_CREDENTIAL_V2 = "bbs-v2";
+/**
+ * Build the v2 BBS header: `solidus-bbs-credential:v2:<issuerDid>:<credentialType>:<epoch>`.
+ *
+ * Issuer/type/epoch-level CONSTANT — contains no per-credential entropy by
+ * construction. `credentialType` must not contain `:` (keeps the cohort
+ * label unambiguous); `epoch` is the issuer's key-rotation epoch (a cohort
+ * label shared by all holders issued in that epoch, never per-credential).
+ */
+export declare function buildV2Header(issuerDid: string, credentialType: string, epoch: number): Uint8Array;
+/**
+ * Derive the presentation header binding a proof to one verifier challenge:
+ *
+ *   ph = SHA-256( utf8("solidus.bbs.ph.v1") ‖ u32le(|domain|) ‖ utf8(domain) ‖ nonce )
+ *
+ * `deriveProof` folds `ph` into the Fiat–Shamir challenge, so a proof made
+ * under one `ph` fails under any other — replay across challenges or across
+ * verifiers is cryptographically dead. The verifier recomputes `ph` from its
+ * own authenticated `domain` and the stored challenge `nonce`; nonce
+ * single-use + expiry enforcement is the verifier's job on top.
+ *
+ * The domain is length-prefixed (u32le, matching the project's LE
+ * convention) because bare `domain ‖ nonce` concatenation is boundary-
+ * ambiguous: ("rp.example.com", 00‖…) and ("rp.example.com\x00", …) would
+ * hash identically, letting a verifier with a prefix-compatible domain
+ * alias another verifier's challenge and replay a captured presentation.
+ */
+export declare function derivePresentationHeader(domain: string, nonce: Uint8Array): Uint8Array;
+//# sourceMappingURL=v2.d.ts.map

package/dist/v2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2.d.ts","sourceRoot":"","sources":["../src/v2.ts"],"names":[],"mappings":"AAgBA,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,WAAW,CAAA;AAKzC;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,GACZ,UAAU,CAUZ;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,UAAU,CAetF"}

package/dist/v2.js

@@ -0,0 +1,75 @@
+/**
+ * Credential-envelope v2 format helpers (privacy rebuild — T2).
+ *
+ * WIRE FORMAT — changing anything here is a credential-format change that
+ * requires bumping the version marker and re-issuing credentials.
+ *
+ * Header v2 closes the v1 header leak: v1 embedded the per-credential
+ * `verificationId`, which IRTF BBS requires in cleartext at verify — a
+ * correlation handle as strong as the DID even with all messages hidden.
+ * v2 headers are constant per (issuer, credentialType, epoch) cohort, so
+ * every holder in the cohort shares one header — an anonymity set, not a
+ * handle. `verification_id` lives on as hidden message index 2 only.
+ */
+import { sha256 } from '@noble/hashes/sha256';
+import { BbsError, utf8 } from './index.js';
+/** Version marker carried by v2 credential bundles and envelopes. */
+export const BBS_CREDENTIAL_V2 = 'bbs-v2';
+/** Domain-separation tag for presentation-header derivation. */
+const PH_DOMAIN_TAG = 'solidus.bbs.ph.v1';
+/**
+ * Build the v2 BBS header: `solidus-bbs-credential:v2:<issuerDid>:<credentialType>:<epoch>`.
+ *
+ * Issuer/type/epoch-level CONSTANT — contains no per-credential entropy by
+ * construction. `credentialType` must not contain `:` (keeps the cohort
+ * label unambiguous); `epoch` is the issuer's key-rotation epoch (a cohort
+ * label shared by all holders issued in that epoch, never per-credential).
+ */
+export function buildV2Header(issuerDid, credentialType, epoch) {
+    if (!issuerDid)
+        throw new BbsError('issuerDid must be non-empty');
+    if (!credentialType)
+        throw new BbsError('credentialType must be non-empty');
+    if (credentialType.includes(':')) {
+        throw new BbsError('credentialType must not contain ":"');
+    }
+    if (!Number.isInteger(epoch) || epoch < 0) {
+        throw new BbsError(`epoch must be a non-negative integer, got ${epoch}`);
+    }
+    return utf8(`solidus-bbs-credential:v2:${issuerDid}:${credentialType}:${epoch}`);
+}
+/**
+ * Derive the presentation header binding a proof to one verifier challenge:
+ *
+ *   ph = SHA-256( utf8("solidus.bbs.ph.v1") ‖ u32le(|domain|) ‖ utf8(domain) ‖ nonce )
+ *
+ * `deriveProof` folds `ph` into the Fiat–Shamir challenge, so a proof made
+ * under one `ph` fails under any other — replay across challenges or across
+ * verifiers is cryptographically dead. The verifier recomputes `ph` from its
+ * own authenticated `domain` and the stored challenge `nonce`; nonce
+ * single-use + expiry enforcement is the verifier's job on top.
+ *
+ * The domain is length-prefixed (u32le, matching the project's LE
+ * convention) because bare `domain ‖ nonce` concatenation is boundary-
+ * ambiguous: ("rp.example.com", 00‖…) and ("rp.example.com\x00", …) would
+ * hash identically, letting a verifier with a prefix-compatible domain
+ * alias another verifier's challenge and replay a captured presentation.
+ */
+export function derivePresentationHeader(domain, nonce) {
+    if (!domain)
+        throw new BbsError('domain must be non-empty');
+    if (nonce.length < 16) {
+        throw new BbsError(`nonce must be ≥ 16 bytes, got ${nonce.length}`);
+    }
+    const tag = utf8(PH_DOMAIN_TAG);
+    const dom = utf8(domain);
+    const len = new Uint8Array(4);
+    new DataView(len.buffer).setUint32(0, dom.length, true);
+    const input = new Uint8Array(tag.length + 4 + dom.length + nonce.length);
+    input.set(tag, 0);
+    input.set(len, tag.length);
+    input.set(dom, tag.length + 4);
+    input.set(nonce, tag.length + 4 + dom.length);
+    return sha256(input);
+}
+//# sourceMappingURL=v2.js.map

package/dist/v2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2.js","sourceRoot":"","sources":["../src/v2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAE3C,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAA;AAEzC,gEAAgE;AAChE,MAAM,aAAa,GAAG,mBAAmB,CAAA;AAEzC;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,cAAsB,EACtB,KAAa;IAEb,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,QAAQ,CAAC,6BAA6B,CAAC,CAAA;IACjE,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,QAAQ,CAAC,kCAAkC,CAAC,CAAA;IAC3E,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,QAAQ,CAAC,qCAAqC,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC,6BAA6B,SAAS,IAAI,cAAc,IAAI,KAAK,EAAE,CAAC,CAAA;AAClF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,KAAiB;IACxE,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,QAAQ,CAAC,0BAA0B,CAAC,CAAA;IAC3D,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,QAAQ,CAAC,iCAAiC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,CAAA;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IACxB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IACvD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IACxE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACjB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC9B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;IAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@solidus-network/bbs",
-  "version": "0.6.0",
-  "description": "BBS+ selective-disclosure primitives for Solidus Network — IRTF draft-irtf-cfrg-bbs-signatures, BLS12-381 SHA-256. Byte-compatible with the Solidus chain (zkryptium-backed).",
+  "version": "0.6.2",
+  "description": "BBS+ selective-disclosure primitives for Solidus Network — IRTF draft-irtf-cfrg-bbs-signatures, BLS12-381 SHA-256 ciphersuite. Byte-compatible with the Solidus chain (zkryptium-backed).",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -11,19 +11,37 @@
       "types": "./dist/index.d.ts"
     }
   },
-  "files": ["dist", "README.md", "LICENSE"],
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
   "dependencies": {
-    "@digitalbazaar/bbs-signatures": "^3.0.0"
+    "@digitalbazaar/bbs-signatures": "^3.0.0",
+    "@noble/hashes": "^1.5.0"
   },
-  "keywords": ["solidus", "bbs", "bbs+", "selective-disclosure", "verifiable-credentials", "zero-knowledge", "bls12-381", "irtf"],
+  "keywords": [
+    "solidus",
+    "bbs",
+    "bbs+",
+    "selective-disclosure",
+    "verifiable-credentials",
+    "zero-knowledge",
+    "bls12-381",
+    "irtf"
+  ],
   "author": "Solidus Network (https://solidus.network)",
   "license": "Apache-2.0",
   "homepage": "https://solidus.network",
-  "bugs": { "url": "https://github.com/solidusnetwork/sdk/issues" },
+  "bugs": {
+    "url": "https://github.com/solidusnetwork/sdk/issues"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/solidusnetwork/sdk.git",
     "directory": "bbs"
   },
-  "publishConfig": { "access": "public" }
+  "publishConfig": {
+    "access": "public"
+  }
 }