@tamga-network/zk 0.0.0-stage → 0.3.0

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Tamga Network
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,71 @@
-# Temporary Holding Version
+# @tamga-network/zk
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Wallet-side zero-knowledge proofs for ISO mdoc credentials on Tamga Network ([ADR-0032](https://docs.tamga.network/adr/0032-zk-mdoc-presentation),
+Longfellow ZK — the system the EU age-verification profile uses). The wallet proves a statement about a credential it holds — "in
+this credential, `age_over_18` is `true`" — without showing the credential, the issuer's signature or any other element. The
+issuer's credential is not changed (ZK1). Verification is `@tamga-network/verifier/zk`.
+
+Any wallet on the network can use this package.
+
+## Entry points
+
+| Import | Runs on | What |
+|---|---|---|
+| `@tamga-network/zk` | everywhere (pure TS, React Native safe) | DCQL `mso_mdoc_zk` query → claims, circuit selection and check against the trust list (ZK2), ZK DeviceResponse (TS13 `ZkDocument`) |
+| `@tamga-network/zk/react-native` | iOS, Android (Expo module `TamgaZk`) | on-device prover: Rust → static library (iOS) / `.so` (Android) |
+| `@tamga-network/zk/node` | desktop, CI | prover as a child process (`tamga-zk-prove`): tests, conformance runs, development |
+
+When no prover is available (Expo Go, unsupported phone, module missing) `available()` returns `false` and the wallet presents the
+usual way (ZK5).
+
+## Flow
+
+```ts
+import { presentZk, zkQueryFromDcql, firstCircuitSource } from "@tamga-network/zk";
+import { nativeProver } from "@tamga-network/zk/react-native";
+
+const query = zkQueryFromDcql(dcqlCredentialQuery); // format "mso_mdoc_zk"
+const response = await presentZk({
+  prover: nativeProver,
+  circuits: firstCircuitSource(bundledCircuits /* , httpCircuitSource(<circuit host>) */),
+  trustedCircuits: lotl.zk_circuits,
+  query,
+  deviceResponse, // the wallet's usual device-signed DeviceResponse for this session (never sent)
+  transcript, // OpenID4VP / DC API SessionTranscript
+  issuerX5chain, // issuer leaf (+ chain), DER
+  issuerKey, // issuer P-256 key, uncompressed point
+});
+```
+
+Circuit files (~300 KB, no personal data) are checked against the SHA-256 in the signed trust list before use, so their source
+does not change trust: bundle them with the app, or fetch them with `httpCircuitSource` once a circuit host is published.
+
+The device signature is made the usual way (hardware key, phone lock — WL11); the prover only takes the signed response as input.
+Nothing leaves the device except the proof.
+
+## Building the native parts
+
+| Target | Command | Needs |
+|---|---|---|
+| Desktop prover (`bin/`) | `npm run zk:build -w @tamga-network/zk` | Rust (`rust/rust-toolchain.toml`); on Windows the patched upstream clone from `tools/zk-circuit` |
+| Android (`android/src/main/jniLibs/`) | `npm run zk:android -w @tamga-network/zk` | Android NDK, `cargo-ndk` |
+| iOS (`ios/TamgaZkProver.xcframework`) | `npm run zk:ios -w @tamga-network/zk` | macOS, Xcode |
+
+Build outputs are not committed; the published package includes them. Packing (`scripts/pack-packages.mjs`) fails if any of the
+three Android libraries is missing, and writes their SHA-256 checksums to `lib/native-checksums.json`.
+
+**iOS (for now):** the iOS library needs macOS to build and has not been built yet. Until `ios/TamgaZkProver.xcframework` exists,
+the module is Android-only: `expo-module.config.json` lists only `"android"` and the published package does not contain `ios/`, so
+iOS apps build normally and `available()` returns `false` there (usual presentation, ZK5). Once the xcframework is built, packing
+adds `ios/` and the `"apple"` platform automatically. The Rust core (`rust/`) uses the same pinned upstream commit
+as the verifier (`packages/verifier/zk`).
+
+## Status
+
+Published on npm as the `0.3.0` test release; the stable `1.0.0` comes when everything is ready. In test releases the API
+may change. Every release is built from this repository by GitHub Actions and carries npm provenance (verifiable link to
+the source commit).
+
+## License
+
+Apache-2.0

package/android/build.gradle

@@ -0,0 +1,20 @@
+// @tamga-network/zk — Expo modülü (Android). Rust kütüphanesi `src/main/jniLibs/<abi>/libtamga_zk_prover.so` olarak gelir
+// (packages/zk/scripts/build-android.mjs; depoya girmez, paket yayınında dahil edilir).
+plugins {
+  id 'com.android.library'
+  id 'expo-module-gradle-plugin'
+}
+
+group = 'network.tamga'
+version = '1.0.0'
+
+android {
+  namespace "network.tamga.zk"
+  defaultConfig {
+    versionCode 1
+    versionName '1.0.0'
+    ndk {
+      abiFilters 'arm64-v8a', 'armeabi-v7a', 'x86_64'
+    }
+  }
+}

package/android/src/main/java/network/tamga/zk/TamgaZkModule.kt

@@ -0,0 +1,41 @@
+// @tamga-network/zk — Android yerel ispatçı (ADR-0032 Aşama 2). Rust `tamga_zk_prover` kütüphanesi (`scripts/build-android.mjs`,
+// cargo-ndk → jniLibs/<abi>/libtamga_zk_prover.so) JNI ile çağrılır. Girdi tamponu biçimi packages/zk/rust/src/lib.rs.
+// İspat cihazda üretilir; girdiler (belge, cihaz imzası) ağa ya da diske yazılmaz, günlüklenmez. Kütüphane yoksa (ABI desteklenmiyor,
+// derlemeye girmemiş) isSupported() false döner ve cüzdan olağan sunuma döner (ZK5).
+package network.tamga.zk
+
+import expo.modules.kotlin.exception.CodedException
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+
+internal object ZkNative {
+  val loaded: Boolean = try {
+    System.loadLibrary("tamga_zk_prover")
+    true
+  } catch (_: Throwable) {
+    false
+  }
+
+  @JvmStatic external fun circuitVersion(): Int
+
+  /** Başarıda ispat baytları; hatada `null` — hata kodu/ayrıntısı Kotlin'e geçmez (kişi verisi içerebilir; rust/src/lib.rs). */
+  @JvmStatic external fun prove(input: ByteArray): ByteArray?
+}
+
+internal class ProveFailedException : CodedException("ERR_ZK_PROVE_FAILED", "TamgaZk: the proof could not be created", null)
+
+class TamgaZkModule : Module() {
+  override fun definition() = ModuleDefinition {
+    Name("TamgaZk")
+
+    Function("isSupported") { ZkNative.loaded }
+
+    Function("circuitVersion") { if (ZkNative.loaded) ZkNative.circuitVersion() else 0 }
+
+    // Ağır iş (~0,5–3 sn): Expo AsyncFunction arka plan iş parçacığında çalışır, arayüzü kilitlemez.
+    AsyncFunction("prove") { input: ByteArray ->
+      if (!ZkNative.loaded) throw ProveFailedException()
+      ZkNative.prove(input) ?: throw ProveFailedException()
+    }
+  }
+}

package/expo-module.config.json

@@ -0,0 +1,15 @@
+{
+  "platforms": [
+    "android"
+  ],
+  "apple": {
+    "modules": [
+      "TamgaZkModule"
+    ]
+  },
+  "android": {
+    "modules": [
+      "network.tamga.zk.TamgaZkModule"
+    ]
+  }
+}

package/lib/circuits.d.ts

@@ -0,0 +1,10 @@
+import { type ZkCircuitEntry, type ZkCircuitSource } from "./types.js";
+export declare const ZK_SYSTEM = "longfellow-libzk-v1";
+/**
+ * `attributes` öğeli istek için kullanılacak devre: etkin, sistem Longfellow, sürümü ispatçınınkiyle aynı, öğe sayısı eşleşen.
+ * Birden çok uygun devre varsa listedeki ilki (yayıncı sırası). Yoksa `no_circuit`.
+ */
+export declare function selectCircuit(list: readonly ZkCircuitEntry[] | undefined, attributes: number, version: number): ZkCircuitEntry;
+/** Devre baytlarını kaynaktan alır ve listedeki SHA-256 ile karşılaştırır (eşleşmezse kullanılmaz). */
+export declare function loadCircuit(source: ZkCircuitSource, entry: ZkCircuitEntry): Promise<Uint8Array>;
+//# sourceMappingURL=circuits.d.ts.map

package/lib/circuits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"circuits.d.ts","sourceRoot":"","sources":["../src/circuits.ts"],"names":[],"mappings":"AAMA,OAAO,EAAW,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAEhF,eAAO,MAAM,SAAS,wBAAwB,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,EAC3C,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,cAAc,CAUhB;AAED,uGAAuG;AACvG,wBAAsB,WAAW,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAMrG"}

package/lib/circuits.js

@@ -0,0 +1,31 @@
+/**
+ * Devre seçimi ve denetimi (ZK2: yalnız güven listesinde yayınlanan ve özetiyle sabitlenen devre kullanılır). Cüzdan ve doğrulayıcı
+ * aynı listeye bakar; ispatçı listede olmayan devreyle ispat üretmez.
+ */
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex } from "@noble/hashes/utils.js";
+import { ZkError } from "./types.js";
+export const ZK_SYSTEM = "longfellow-libzk-v1";
+/**
+ * `attributes` öğeli istek için kullanılacak devre: etkin, sistem Longfellow, sürümü ispatçınınkiyle aynı, öğe sayısı eşleşen.
+ * Birden çok uygun devre varsa listedeki ilki (yayıncı sırası). Yoksa `no_circuit`.
+ */
+export function selectCircuit(list, attributes, version) {
+    const c = (list ?? []).find((x) => x.status.toUpperCase() === "ACTIVE" &&
+        x.system === ZK_SYSTEM &&
+        x.version === version &&
+        x.attributes === attributes);
+    if (!c)
+        throw new ZkError("no_circuit", `no active circuit for ${attributes} attribute(s), version ${version}`);
+    return c;
+}
+/** Devre baytlarını kaynaktan alır ve listedeki SHA-256 ile karşılaştırır (eşleşmezse kullanılmaz). */
+export async function loadCircuit(source, entry) {
+    const bytes = await source.get(entry.circuit_id);
+    if (!bytes)
+        throw new ZkError("no_circuit", `circuit ${entry.circuit_id} is not available on this device`);
+    if (bytesToHex(sha256(bytes)) !== entry.sha256)
+        throw new ZkError("circuit_mismatch", "circuit does not match the trust list");
+    return bytes;
+}
+//# sourceMappingURL=circuits.js.map

package/lib/circuits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"circuits.js","sourceRoot":"","sources":["../src/circuits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,OAAO,EAA6C,MAAM,YAAY,CAAC;AAEhF,MAAM,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,IAA2C,EAC3C,UAAkB,EAClB,OAAe;IAEf,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ;QACnC,CAAC,CAAC,MAAM,KAAK,SAAS;QACtB,CAAC,CAAC,OAAO,KAAK,OAAO;QACrB,CAAC,CAAC,UAAU,KAAK,UAAU,CAC9B,CAAC;IACF,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,OAAO,CAAC,YAAY,EAAE,yBAAyB,UAAU,0BAA0B,OAAO,EAAE,CAAC,CAAC;IAChH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAuB,EAAE,KAAqB;IAC9E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,OAAO,CAAC,YAAY,EAAE,WAAW,KAAK,CAAC,UAAU,kCAAkC,CAAC,CAAC;IAC3G,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM;QAC5C,MAAM,IAAI,OAAO,CAAC,kBAAkB,EAAE,uCAAuC,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @tamga-network/zk — cüzdan tarafında sıfır bilgi ispatı (ADR-0032 Aşama 2, Longfellow ZK). Kurumun imzaladığı mdoc belgesi
+ * hakkında "şu öğe şu değerdedir" ispatını üretir (ilk kullanım: 18 yaş üstü); belge, kurum imzası ve diğer öğeler gösterilmez.
+ *
+ *   - Çekirdek (bu giriş): saf TS, React Native uyumlu — DCQL'den istek, devre seçimi ve denetimi, ZK DeviceResponse.
+ *   - `@tamga-network/zk/react-native`: telefonda yerel ispatçı (Expo modülü; Rust → iOS/Android).
+ *   - `@tamga-network/zk/node`: masaüstü ispatçı (alt süreç) — test, uyum denemesi, geliştirme.
+ *
+ * Ağdaki her cüzdan kullanabilir; doğrulama tarafı `@tamga-network/verifier/zk`.
+ */
+export * from "./types.js";
+export { ZK_FORMAT, isZkQuery, zkQueryFromDcql } from "./request.js";
+export type { DcqlCredentialQuery, ZkQuery } from "./request.js";
+export { ZK_SYSTEM, selectCircuit, loadCircuit } from "./circuits.js";
+export { presentZk, encodeProveBuffer } from "./present.js";
+export type { ZkPresentArgs } from "./present.js";
+export { memoryCircuitSource, httpCircuitSource, firstCircuitSource, unavailableProver } from "./sources.js";
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACrE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/lib/index.js

@@ -0,0 +1,16 @@
+/**
+ * @tamga-network/zk — cüzdan tarafında sıfır bilgi ispatı (ADR-0032 Aşama 2, Longfellow ZK). Kurumun imzaladığı mdoc belgesi
+ * hakkında "şu öğe şu değerdedir" ispatını üretir (ilk kullanım: 18 yaş üstü); belge, kurum imzası ve diğer öğeler gösterilmez.
+ *
+ *   - Çekirdek (bu giriş): saf TS, React Native uyumlu — DCQL'den istek, devre seçimi ve denetimi, ZK DeviceResponse.
+ *   - `@tamga-network/zk/react-native`: telefonda yerel ispatçı (Expo modülü; Rust → iOS/Android).
+ *   - `@tamga-network/zk/node`: masaüstü ispatçı (alt süreç) — test, uyum denemesi, geliştirme.
+ *
+ * Ağdaki her cüzdan kullanabilir; doğrulama tarafı `@tamga-network/verifier/zk`.
+ */
+export * from "./types.js";
+export { ZK_FORMAT, isZkQuery, zkQueryFromDcql } from "./request.js";
+export { ZK_SYSTEM, selectCircuit, loadCircuit } from "./circuits.js";
+export { presentZk, encodeProveBuffer } from "./present.js";
+export { memoryCircuitSource, httpCircuitSource, firstCircuitSource, unavailableProver } from "./sources.js";
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAE5D,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/lib/native-checksums.json

@@ -0,0 +1,8 @@
+{
+  "note": "SHA-256 of the packed native prover libraries (ADR-0032)",
+  "files": {
+    "android/src/main/jniLibs/arm64-v8a/libtamga_zk_prover.so": "fe9e421a4ea70cc61f02ea5b714917648d82812ce151c02335bad1ef01dfaac2",
+    "android/src/main/jniLibs/armeabi-v7a/libtamga_zk_prover.so": "ea55f289a6ef49ad21a2ef21fbc75c0d5efbcd6911af1d31d351bc1b6be7485e",
+    "android/src/main/jniLibs/x86_64/libtamga_zk_prover.so": "7aba0a6566339d68f1243d9e0dd5bf9f8404838e50e5de142606ad4ec8f3b49e"
+  }
+}

package/lib/node.d.ts

@@ -0,0 +1,17 @@
+import { type ZkCircuitSource, type ZkProveArgs, type ZkProver } from "./types.js";
+export declare class NodeProcessProver implements ZkProver {
+    private readonly bin;
+    private readonly timeoutMs;
+    readonly name = "node-process";
+    private version?;
+    constructor(bin: string, timeoutMs?: number);
+    available(): Promise<boolean>;
+    circuitVersion(): Promise<number>;
+    prove(args: ZkProveArgs): Promise<Uint8Array>;
+    private run;
+}
+/** Varsayılan ikili yolu: `TAMGA_ZK_PROVE_BIN` ya da derleme betiğinin çıktısı (`packages/zk/bin/`). */
+export declare function defaultProverBin(): string;
+/** Klasördeki devre dosyaları (`<circuit_id>.zst`). */
+export declare function fileCircuitSource(dir: string): ZkCircuitSource;
+//# sourceMappingURL=node.d.ts.map

package/lib/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAUA,OAAO,EAAW,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI5F,qBAAa,iBAAkB,YAAW,QAAQ;IAI9C,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAJ5B,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,OAAO,CAAC,OAAO,CAAC,CAAS;gBAEN,GAAG,EAAE,MAAM,EACX,SAAS,SAAS;IAG/B,SAAS;IAUT,cAAc;IAOd,KAAK,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAanD,OAAO,CAAC,GAAG;CAoBZ;AAED,wGAAwG;AACxG,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAQ9D"}

package/lib/node.js

@@ -0,0 +1,97 @@
+/**
+ * @tamga-network/zk/node — masaüstü ispatçısı: Rust `tamga-zk-prove` ikilisini alt süreç olarak çalıştırır (stdin/stdout, ağ yok,
+ * dosya yok). Test, uyum denemesi ve geliştirme içindir; telefonda aynı Rust kodu yerel kütüphane olarak çalışır
+ * (`@tamga-network/zk/react-native`). İkili: `npm run zk:build -w @tamga-network/zk` (packages/zk/scripts/build-cli.mjs).
+ */
+import { spawn } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { encodeProveBuffer } from "./present.js";
+import { ZkError } from "./types.js";
+const MAX_OUTPUT = 4 * 1024 * 1024;
+export class NodeProcessProver {
+    bin;
+    timeoutMs;
+    name = "node-process";
+    version;
+    constructor(bin, timeoutMs = 60_000) {
+        this.bin = bin;
+        this.timeoutMs = timeoutMs;
+    }
+    async available() {
+        if (!existsSync(this.bin))
+            return false;
+        try {
+            await this.circuitVersion();
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async circuitVersion() {
+        if (this.version !== undefined)
+            return this.version;
+        const out = await this.run(["--info"]);
+        this.version = JSON.parse(new TextDecoder().decode(out)).circuit_version;
+        return this.version;
+    }
+    async prove(args) {
+        const req = encodeProveBuffer(args);
+        const frame = new Uint8Array(4 + req.length);
+        new DataView(frame.buffer).setUint32(0, req.length, true);
+        frame.set(req, 4);
+        const out = await this.run([], frame);
+        if (out.length < 4)
+            throw new ZkError("prove_failed", "prover returned no result");
+        const dv = new DataView(out.buffer, out.byteOffset, out.byteLength);
+        if (dv.getInt32(0, true) !== 0)
+            throw new ZkError("prove_failed", "the proof could not be created");
+        const n = dv.getUint32(4, true);
+        return out.slice(8, 8 + n);
+    }
+    run(argv, input) {
+        return new Promise((resolve, reject) => {
+            const p = spawn(this.bin, argv, { stdio: ["pipe", "pipe", "ignore"], windowsHide: true });
+            const chunks = [];
+            let size = 0;
+            const timer = setTimeout(() => p.kill(), this.timeoutMs);
+            p.stdout.on("data", (c) => {
+                size += c.length;
+                if (size > MAX_OUTPUT)
+                    p.kill();
+                else
+                    chunks.push(c);
+            });
+            p.on("error", (e) => (clearTimeout(timer), reject(e)));
+            p.on("close", () => {
+                clearTimeout(timer);
+                resolve(new Uint8Array(Buffer.concat(chunks)));
+            });
+            if (input)
+                p.stdin.end(Buffer.from(input));
+            else
+                p.stdin.end();
+        });
+    }
+}
+/** Varsayılan ikili yolu: `TAMGA_ZK_PROVE_BIN` ya da derleme betiğinin çıktısı (`packages/zk/bin/`). */
+export function defaultProverBin() {
+    if (process.env.TAMGA_ZK_PROVE_BIN)
+        return process.env.TAMGA_ZK_PROVE_BIN;
+    const exe = process.platform === "win32" ? "tamga-zk-prove.exe" : "tamga-zk-prove";
+    return join(fileURLToPath(new URL("../bin/", import.meta.url)), exe);
+}
+/** Klasördeki devre dosyaları (`<circuit_id>.zst`). */
+export function fileCircuitSource(dir) {
+    return {
+        get: async (id) => {
+            if (!/^[0-9a-f]{64}$/.test(id))
+                return undefined;
+            const p = join(dir, `${id}.zst`);
+            return existsSync(p) ? new Uint8Array(readFileSync(p)) : undefined;
+        },
+    };
+}
+//# sourceMappingURL=node.js.map

package/lib/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,OAAO,EAAyD,MAAM,YAAY,CAAC;AAE5F,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnC,MAAM,OAAO,iBAAiB;IAIT;IACA;IAJV,IAAI,GAAG,cAAc,CAAC;IACvB,OAAO,CAAU;IACzB,YACmB,GAAW,EACX,YAAY,MAAM;QADlB,QAAG,GAAH,GAAG,CAAQ;QACX,cAAS,GAAT,SAAS,CAAS;IAClC,CAAC;IAEJ,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAiC,CAAC,eAAe,CAAC;QAC1G,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAiB;QAC3B,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1D,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,OAAO,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;QACnF,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,OAAO,CAAC,cAAc,EAAE,gCAAgC,CAAC,CAAC;QACpG,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,CAAC;IAEO,GAAG,CAAC,IAAc,EAAE,KAAkB;QAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;gBAChC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC;gBACjB,IAAI,IAAI,GAAG,UAAU;oBAAE,CAAC,CAAC,IAAI,EAAE,CAAC;;oBAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACjB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC,CAAC,CAAC;YACH,IAAI,KAAK;gBAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;;gBACtC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,wGAAwG;AACxG,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACnF,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACvE,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO;QACL,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;YAChB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/lib/present.d.ts

@@ -0,0 +1,32 @@
+import type { ZkQuery } from "./request.js";
+import { type ZkCircuitEntry, type ZkCircuitSource, type ZkProveArgs, type ZkProver } from "./types.js";
+export interface ZkPresentArgs {
+    prover: ZkProver;
+    circuits: ZkCircuitSource;
+    /** Güven listesindeki devreler (`lotl.zk_circuits`). */
+    trustedCircuits: readonly ZkCircuitEntry[] | undefined;
+    /**
+     * Doğrulayıcının kabul ettiği devre kimlikleri (DCQL `meta.zk_system_type[].params.circuit_hash`). Verilirse yalnız hem güven
+     * listesinde hem bu listede olan devre kullanılır — doğrulayıcının kabul etmeyeceği ispat üretilmez.
+     */
+    acceptedCircuits?: readonly string[];
+    query: ZkQuery;
+    /** Bu oturumun cihaz imzalı DeviceResponse'u (cüzdanın olağan mdoc sunumu; doğrulayıcıya gönderilmez). */
+    deviceResponse: Uint8Array;
+    transcript: Uint8Array;
+    /** Kurum yaprak sertifikası (+ zincir), DER; ZkDocument'e `msoX5chain` olarak girer. */
+    issuerX5chain: Uint8Array[];
+    /** Kurum anahtarı, P-256 sıkıştırılmamış nokta (65 bayt). */
+    issuerKey: Uint8Array;
+    /** Varsayılan: şimdi. */
+    now?: Date;
+}
+/** İspatı üretir ve doğrulayıcıya gidecek ZK DeviceResponse'u döndürür. Yapılamıyorsa `ZkError` (cüzdan olağan yola döner — ZK5). */
+export declare function presentZk(a: ZkPresentArgs): Promise<Uint8Array>;
+/**
+ * Arka uçların ortak girdi tamponu (Rust `prove_buffer`, packages/zk/rust/src/lib.rs): art arda `u32 LE uzunluk + bayt`.
+ *   combined_hash(32) · circuit · device_response · transcript · pkx("0x…") · pky · now · doc_type · öğe sayısı (u32 LE)
+ *   · her öğe için namespace · id · değerin CBOR'u
+ */
+export declare function encodeProveBuffer(a: ZkProveArgs): Uint8Array;
+//# sourceMappingURL=present.d.ts.map

package/lib/present.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"present.d.ts","sourceRoot":"","sources":["../src/present.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAW,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEjH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,EAAE,eAAe,CAAC;IAC1B,wDAAwD;IACxD,eAAe,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,CAAC;IACvD;;;OAGG;IACH,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,0GAA0G;IAC1G,cAAc,EAAE,UAAU,CAAC;IAC3B,UAAU,EAAE,UAAU,CAAC;IACvB,wFAAwF;IACxF,aAAa,EAAE,UAAU,EAAE,CAAC;IAC5B,6DAA6D;IAC7D,SAAS,EAAE,UAAU,CAAC;IACtB,yBAAyB;IACzB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAID,qIAAqI;AACrI,wBAAsB,SAAS,CAAC,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAoCrE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,WAAW,GAAG,UAAU,CAyB5D"}

package/lib/present.js

@@ -0,0 +1,94 @@
+/**
+ * ZK sunumu (ADR-0032; AB TS13 §5): cüzdan önce bu oturum için olağan, cihaz imzalı DeviceResponse'u üretir (donanım anahtarı,
+ * telefon kilidi onayı — WL11 aynen), sonra ispatçı bu yanıttan "belgede şu öğeler şu değerdedir" ispatını üretir. Doğrulayıcıya
+ * yalnız ZkDocument gider: belge, MSO, cihaz anahtarı ve iptal listesi indeksi GİTMEZ (ZK3, ZK4).
+ */
+import { buildZkDeviceResponse, encode } from "@tamga-network/mdoc";
+import { loadCircuit, selectCircuit } from "./circuits.js";
+import { ZkError } from "./types.js";
+const isoSeconds = (d) => d.toISOString().replace(/\.\d{3}Z$/, "Z");
+/** İspatı üretir ve doğrulayıcıya gidecek ZK DeviceResponse'u döndürür. Yapılamıyorsa `ZkError` (cüzdan olağan yola döner — ZK5). */
+export async function presentZk(a) {
+    if (!(await a.prover.available()))
+        throw new ZkError("unavailable", "zero-knowledge proofs are not available on this device");
+    const version = await a.prover.circuitVersion();
+    const trusted = a.acceptedCircuits
+        ? (a.trustedCircuits ?? []).filter((c) => a.acceptedCircuits.includes(c.circuit_id))
+        : a.trustedCircuits;
+    const entry = selectCircuit(trusted, a.query.claims.length, version);
+    const circuit = await loadCircuit(a.circuits, entry);
+    const timestamp = isoSeconds(a.now ?? new Date());
+    let proof;
+    try {
+        proof = await a.prover.prove({
+            circuitId: entry.circuit_id,
+            circuit,
+            deviceResponse: a.deviceResponse,
+            transcript: a.transcript,
+            docType: a.query.docType,
+            claims: a.query.claims,
+            now: timestamp,
+            issuerKey: a.issuerKey,
+        });
+    }
+    catch (e) {
+        if (e instanceof ZkError)
+            throw e;
+        throw new ZkError("prove_failed", "the proof could not be created");
+    }
+    const elements = {};
+    for (const c of a.query.claims)
+        elements[c.element] = c.value;
+    return buildZkDeviceResponse({
+        docType: a.query.docType,
+        zkSystemId: entry.circuit_id,
+        timestamp,
+        disclosed: { namespace: a.query.claims[0].namespace, elements },
+        msoX5chain: a.issuerX5chain,
+        proof,
+    });
+}
+/**
+ * Arka uçların ortak girdi tamponu (Rust `prove_buffer`, packages/zk/rust/src/lib.rs): art arda `u32 LE uzunluk + bayt`.
+ *   combined_hash(32) · circuit · device_response · transcript · pkx("0x…") · pky · now · doc_type · öğe sayısı (u32 LE)
+ *   · her öğe için namespace · id · değerin CBOR'u
+ */
+export function encodeProveBuffer(a) {
+    if (a.issuerKey.length !== 65 || a.issuerKey[0] !== 0x04)
+        throw new ZkError("unsupported_request", "issuer key must be an uncompressed P-256 point");
+    const te = new TextEncoder();
+    const fields = [
+        hexToBytes(a.circuitId),
+        a.circuit,
+        a.deviceResponse,
+        a.transcript,
+        te.encode("0x" + toHex(a.issuerKey.subarray(1, 33))),
+        te.encode("0x" + toHex(a.issuerKey.subarray(33, 65))),
+        te.encode(a.now),
+        te.encode(a.docType),
+        u32(a.claims.length),
+    ];
+    for (const c of a.claims)
+        fields.push(te.encode(c.namespace), te.encode(c.element), encode(c.value));
+    const out = new Uint8Array(fields.reduce((n, f) => n + 4 + f.length, 0));
+    const dv = new DataView(out.buffer);
+    let at = 0;
+    for (const f of fields) {
+        dv.setUint32(at, f.length, true);
+        out.set(f, at + 4);
+        at += 4 + f.length;
+    }
+    return out;
+}
+const toHex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+function u32(n) {
+    const b = new Uint8Array(4);
+    new DataView(b.buffer).setUint32(0, n, true);
+    return b;
+}
+function hexToBytes(h) {
+    if (!/^[0-9a-f]{64}$/.test(h))
+        throw new ZkError("unsupported_request", "circuit id must be 64 lowercase hex characters");
+    return Uint8Array.from(h.match(/../g), (x) => parseInt(x, 16));
+}
+//# sourceMappingURL=present.js.map

package/lib/present.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"present.js","sourceRoot":"","sources":["../src/present.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAkB,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE3D,OAAO,EAAE,OAAO,EAA8E,MAAM,YAAY,CAAC;AAwBjH,MAAM,UAAU,GAAG,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAE1E,qIAAqI;AACrI,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,CAAgB;IAC9C,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,wDAAwD,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,CAAC,gBAAgB;QAChC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IACtB,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC3B,SAAS,EAAE,KAAK,CAAC,UAAU;YAC3B,OAAO;YACP,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO;YACxB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;YACtB,GAAG,EAAE,SAAS;YACd,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,OAAO;YAAE,MAAM,CAAC,CAAC;QAClC,MAAM,IAAI,OAAO,CAAC,cAAc,EAAE,gCAAgC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM;QAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9D,OAAO,qBAAqB,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS;QACT,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE;QAC/D,UAAU,EAAE,CAAC,CAAC,aAAa;QAC3B,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAc;IAC9C,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI;QACtD,MAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,gDAAgD,CAAC,CAAC;IAC7F,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAiB;QAC3B,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACvB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,UAAU;QACZ,EAAE,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACpD,EAAE,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACrD,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACpB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACrG,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACnB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChG,SAAS,GAAG,CAAC,CAAS;IACpB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3B,MAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,gDAAgD,CAAC,CAAC;IAC7F,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/lib/react-native.d.ts

@@ -0,0 +1,10 @@
+import { type ZkProveArgs, type ZkProver } from "./types.js";
+export declare class NativeModuleProver implements ZkProver {
+    readonly name = "native-module";
+    available(): Promise<boolean>;
+    circuitVersion(): Promise<number>;
+    prove(args: ZkProveArgs): Promise<Uint8Array>;
+}
+/** Uygulamanın tek ispatçısı. */
+export declare const nativeProver: NativeModuleProver;
+//# sourceMappingURL=react-native.d.ts.map

package/lib/react-native.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"react-native.d.ts","sourceRoot":"","sources":["../src/react-native.ts"],"names":[],"mappings":"AAOA,OAAO,EAAW,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AAUtE,qBAAa,kBAAmB,YAAW,QAAQ;IACjD,QAAQ,CAAC,IAAI,mBAAmB;IAE1B,SAAS;IAQT,cAAc;IAKd,KAAK,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;CASpD;AAED,iCAAiC;AACjC,eAAO,MAAM,YAAY,oBAA2B,CAAC"}

package/lib/react-native.js

@@ -0,0 +1,40 @@
+/**
+ * @tamga-network/zk/react-native — telefonda yerel ispatçı (Expo modülü `TamgaZk`; Rust → Android .so / iOS xcframework).
+ * Modül yalnız geliştirme ve mağaza derlemesinde vardır; Expo Go'da ya da desteklenmeyen telefonda `available()` false döner ve
+ * cüzdan olağan sunuma döner (ZK5). İspat telefonda üretilir; belge ve cihaz imzası telefondan çıkmaz.
+ */
+import { requireOptionalNativeModule } from "expo-modules-core";
+import { encodeProveBuffer } from "./present.js";
+import { ZkError } from "./types.js";
+const native = requireOptionalNativeModule("TamgaZk");
+export class NativeModuleProver {
+    name = "native-module";
+    async available() {
+        try {
+            return !!native && native.isSupported();
+        }
+        catch {
+            return false;
+        }
+    }
+    async circuitVersion() {
+        if (!native)
+            throw new ZkError("unavailable", "zero-knowledge prover is not available");
+        return native.circuitVersion();
+    }
+    async prove(args) {
+        if (!native)
+            throw new ZkError("unavailable", "zero-knowledge prover is not available");
+        try {
+            return await native.prove(encodeProveBuffer(args));
+        }
+        catch (e) {
+            if (e instanceof ZkError)
+                throw e;
+            throw new ZkError("prove_failed", "the proof could not be created");
+        }
+    }
+}
+/** Uygulamanın tek ispatçısı. */
+export const nativeProver = new NativeModuleProver();
+//# sourceMappingURL=react-native.js.map

package/lib/react-native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react-native.js","sourceRoot":"","sources":["../src/react-native.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,OAAO,EAAmC,MAAM,YAAY,CAAC;AAQtE,MAAM,MAAM,GAAG,2BAA2B,CAAgB,SAAS,CAAC,CAAC;AAErE,MAAM,OAAO,kBAAkB;IACpB,IAAI,GAAG,eAAe,CAAC;IAEhC,KAAK,CAAC,SAAS;QACb,IAAI,CAAC;YACH,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC,cAAc,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAiB;QAC3B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,OAAO,CAAC,aAAa,EAAE,wCAAwC,CAAC,CAAC;QACxF,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,OAAO;gBAAE,MAAM,CAAC,CAAC;YAClC,MAAM,IAAI,OAAO,CAAC,cAAc,EAAE,gCAAgC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;CACF;AAED,iCAAiC;AACjC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAC"}

package/lib/request.d.ts

@@ -0,0 +1,29 @@
+/**
+ * DCQL isteğinden ZK ile ispatlanacak öğeleri çıkarır (ADR-0032; AB TS13 `format: "mso_mdoc_zk"`). ZK ispatı yalnız sabit değerli
+ * öğeleri kanıtlar ("age_over_18 = true"): tek bir beklenen değeri olmayan öğe ZK ile istenemez (ZK açıklama değil, ispattır).
+ * Bir sorgu tek belge türü ve tek ad alanı içerir (ZK6: bir belge türünde bir öğe adı yalnız bir ad alanında bulunur).
+ */
+import { type ZkClaim } from "./types.js";
+export declare const ZK_FORMAT = "mso_mdoc_zk";
+/** DCQL `credentials[]` öğesinin bu paketi ilgilendiren kısmı. */
+export interface DcqlCredentialQuery {
+    id: string;
+    format: string;
+    meta?: {
+        doctype_value?: string;
+    };
+    claims?: {
+        path: (string | number)[];
+        values?: unknown[];
+    }[];
+}
+export interface ZkQuery {
+    queryId: string;
+    docType: string;
+    claims: ZkClaim[];
+}
+/** Sorgu ZK sorgusu mu? */
+export declare const isZkQuery: (q: DcqlCredentialQuery) => boolean;
+/** ZK sorgusunu ispatlanacak öğelere çevirir; ispatlanamayan biçimdeyse `unsupported_request`. */
+export declare function zkQueryFromDcql(q: DcqlCredentialQuery): ZkQuery;
+//# sourceMappingURL=request.d.ts.map

package/lib/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAEnD,eAAO,MAAM,SAAS,gBAAgB,CAAC;AAEvC,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAA;KAAE,EAAE,CAAC;CAC9D;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,EAAE,CAAC;CACnB;AAED,2BAA2B;AAC3B,eAAO,MAAM,SAAS,GAAI,GAAG,mBAAmB,YAA2B,CAAC;AAE5E,kGAAkG;AAClG,wBAAgB,eAAe,CAAC,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAmB/D"}

package/lib/request.js

@@ -0,0 +1,34 @@
+/**
+ * DCQL isteğinden ZK ile ispatlanacak öğeleri çıkarır (ADR-0032; AB TS13 `format: "mso_mdoc_zk"`). ZK ispatı yalnız sabit değerli
+ * öğeleri kanıtlar ("age_over_18 = true"): tek bir beklenen değeri olmayan öğe ZK ile istenemez (ZK açıklama değil, ispattır).
+ * Bir sorgu tek belge türü ve tek ad alanı içerir (ZK6: bir belge türünde bir öğe adı yalnız bir ad alanında bulunur).
+ */
+import { ZkError } from "./types.js";
+export const ZK_FORMAT = "mso_mdoc_zk";
+/** Sorgu ZK sorgusu mu? */
+export const isZkQuery = (q) => q.format === ZK_FORMAT;
+/** ZK sorgusunu ispatlanacak öğelere çevirir; ispatlanamayan biçimdeyse `unsupported_request`. */
+export function zkQueryFromDcql(q) {
+    if (!isZkQuery(q))
+        throw new ZkError("unsupported_request", `not a ${ZK_FORMAT} query`);
+    const docType = q.meta?.doctype_value;
+    if (!docType)
+        throw new ZkError("unsupported_request", "doctype_value missing");
+    const claims = (q.claims ?? []).map((c) => {
+        const [namespace, element] = c.path;
+        if (c.path.length !== 2 || typeof namespace !== "string" || typeof element !== "string")
+            throw new ZkError("unsupported_request", "claim path must be [namespace, element]");
+        if (!c.values || c.values.length !== 1)
+            throw new ZkError("unsupported_request", `claim ${element}: exactly one expected value is required`);
+        const v = c.values[0];
+        if (typeof v !== "boolean" && typeof v !== "string" && typeof v !== "number")
+            throw new ZkError("unsupported_request", `claim ${element}: value type not supported`);
+        return { namespace, element, value: v };
+    });
+    if (claims.length === 0)
+        throw new ZkError("unsupported_request", "no claims");
+    if (new Set(claims.map((c) => c.namespace)).size > 1)
+        throw new ZkError("unsupported_request", "claims must share one namespace");
+    return { queryId: q.id, docType, claims };
+}
+//# sourceMappingURL=request.js.map

package/lib/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../src/request.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,OAAO,EAAgB,MAAM,YAAY,CAAC;AAEnD,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CAAC;AAgBvC,2BAA2B;AAC3B,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAsB,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC;AAE5E,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAAC,CAAsB;IACpD,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,SAAS,SAAS,QAAQ,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;IAChF,MAAM,MAAM,GAAc,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACnD,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ;YACrF,MAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;QACtF,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YACpC,MAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,SAAS,OAAO,0CAA0C,CAAC,CAAC;QACvG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;YAC1E,MAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,SAAS,OAAO,4BAA4B,CAAC,CAAC;QACzF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;IAC/E,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAClD,MAAM,IAAI,OAAO,CAAC,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;IAC9E,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC"}

package/lib/sources.d.ts

@@ -0,0 +1,30 @@
+import type { ZkCircuitEntry, ZkCircuitSource } from "./types.js";
+/** Bellekteki devreler (uygulamayla gelen varlıklar ya da testler). */
+export declare function memoryCircuitSource(circuits: Record<string, Uint8Array>): ZkCircuitSource;
+/**
+ * Ağdan indirilen devreler: `${baseUrl}/${circuit_id}.zst` (ör. güven listesi sitesi). İsteğe bağlı önbellek telefonda tutar;
+ * indirme yalnız devre içindir (kişi verisi, belge ya da oturum bilgisi gönderilmez). Boyut üst sınırlı (`maxBytes`). Önbelleğe
+ * yalnız güven listesindeki özetle (`trustedCircuits`) eşleşen dosya yazılır — bozuk/sahte dosya önbelleği kalıcı zehirlemez;
+ * liste verilmezse indirilen dosya önbelleğe yazılmaz (kullanımda `loadCircuit` yine denetler).
+ */
+export declare function httpCircuitSource(baseUrl: string, opts?: {
+    fetch?: typeof fetch;
+    cache?: {
+        get(id: string): Promise<Uint8Array | undefined>;
+        set(id: string, bytes: Uint8Array): Promise<void>;
+    };
+    /** Güven listesindeki devreler (`lotl.zk_circuits`): önbelleğe yazmadan önce özet denetimi için. */
+    trustedCircuits?: readonly ZkCircuitEntry[];
+    /** Dosya üst sınırı (bayt; varsayılan 8 MiB). */
+    maxBytes?: number;
+}): ZkCircuitSource;
+/** Birden çok kaynağı sırayla dener (ör. önce uygulamayla gelen, yoksa ağ). */
+export declare function firstCircuitSource(...sources: ZkCircuitSource[]): ZkCircuitSource;
+/** Bu cihazda ispatçı yokken kullanılan arka uç: her zaman `available() === false` (cüzdan olağan yola döner — ZK5). */
+export declare const unavailableProver: {
+    readonly name: "unavailable";
+    readonly available: () => Promise<boolean>;
+    readonly circuitVersion: () => Promise<number>;
+    readonly prove: () => Promise<Uint8Array>;
+};
+//# sourceMappingURL=sources.d.ts.map

package/lib/sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.d.ts","sourceRoot":"","sources":["../src/sources.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAKlE,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,eAAe,CAEzF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IACJ,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;QAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAChH,oGAAoG;IACpG,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACd,GACL,eAAe,CAsBjB;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,GAAG,OAAO,EAAE,eAAe,EAAE,GAAG,eAAe,CAUjF;AAED,wHAAwH;AACxH,eAAO,MAAM,iBAAiB;;;;0BAIX,OAAO,CAAC,UAAU,CAAC;CAG5B,CAAC"}

package/lib/sources.js

@@ -0,0 +1,70 @@
+/**
+ * Devre kaynakları (React Native uyumlu). Devre dosyası (~300 KB, zstd) kişisel veri içermez; güven listesinde özetiyle yayınlanır
+ * ve her kullanımda o özetle denetlenir (`loadCircuit`), bu yüzden nereden geldiği güveni değiştirmez.
+ */
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex } from "@noble/hashes/utils.js";
+/** İndirilen devre dosyası üst sınırı (bugünkü devreler ~300 KB) — bellek tüketme saldırısı. */
+const MAX_CIRCUIT_BYTES = 8 * 1024 * 1024;
+/** Bellekteki devreler (uygulamayla gelen varlıklar ya da testler). */
+export function memoryCircuitSource(circuits) {
+    return { get: async (id) => circuits[id] };
+}
+/**
+ * Ağdan indirilen devreler: `${baseUrl}/${circuit_id}.zst` (ör. güven listesi sitesi). İsteğe bağlı önbellek telefonda tutar;
+ * indirme yalnız devre içindir (kişi verisi, belge ya da oturum bilgisi gönderilmez). Boyut üst sınırlı (`maxBytes`). Önbelleğe
+ * yalnız güven listesindeki özetle (`trustedCircuits`) eşleşen dosya yazılır — bozuk/sahte dosya önbelleği kalıcı zehirlemez;
+ * liste verilmezse indirilen dosya önbelleğe yazılmaz (kullanımda `loadCircuit` yine denetler).
+ */
+export function httpCircuitSource(baseUrl, opts = {}) {
+    const f = opts.fetch ?? fetch;
+    const base = baseUrl.replace(/\/$/, "");
+    return {
+        async get(id) {
+            if (!/^[0-9a-f]{64}$/.test(id))
+                return undefined;
+            const hit = await opts.cache?.get(id);
+            if (hit)
+                return hit;
+            const r = await f(`${base}/${id}.zst`);
+            if (!r.ok)
+                return undefined;
+            const max = opts.maxBytes ?? MAX_CIRCUIT_BYTES;
+            if (Number(r.headers?.get?.("content-length") ?? 0) > max)
+                return undefined;
+            const bytes = new Uint8Array(await r.arrayBuffer());
+            if (bytes.length > max)
+                return undefined;
+            const want = opts.trustedCircuits?.find((c) => c.circuit_id === id)?.sha256;
+            if (opts.cache && want) {
+                if (bytesToHex(sha256(bytes)) !== want)
+                    return undefined; // ZK2: listedeki özetle tutmayan dosya kullanılmaz
+                await opts.cache.set(id, bytes);
+            }
+            return bytes;
+        },
+    };
+}
+/** Birden çok kaynağı sırayla dener (ör. önce uygulamayla gelen, yoksa ağ). */
+export function firstCircuitSource(...sources) {
+    return {
+        async get(id) {
+            for (const s of sources) {
+                const b = await s.get(id);
+                if (b)
+                    return b;
+            }
+            return undefined;
+        },
+    };
+}
+/** Bu cihazda ispatçı yokken kullanılan arka uç: her zaman `available() === false` (cüzdan olağan yola döner — ZK5). */
+export const unavailableProver = {
+    name: "unavailable",
+    available: async () => false,
+    circuitVersion: async () => 0,
+    prove: async () => {
+        throw new Error("zero-knowledge prover is not available");
+    },
+};
+//# sourceMappingURL=sources.js.map

package/lib/sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.js","sourceRoot":"","sources":["../src/sources.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,gGAAgG;AAChG,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CAAC,QAAoC;IACtE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,OAOI,EAAE;IAEN,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACtC,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;YAC/C,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC5E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACpD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC;YAC5E,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI;oBAAE,OAAO,SAAS,CAAC,CAAC,mDAAmD;gBAC7G,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,GAAG,OAA0B;IAC9D,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1B,IAAI,CAAC;oBAAE,OAAO,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wHAAwH;AACxH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,IAAI,EAAE,aAAa;IACnB,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;IAC5B,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAC7B,KAAK,EAAE,KAAK,IAAyB,EAAE;QACrC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;CACO,CAAC"}

package/lib/types.d.ts

@@ -0,0 +1,54 @@
+/**
+ * @tamga-network/zk türleri (ADR-0032 Aşama 2). Paket cüzdan tarafındadır: ispatı ÜRETİR. Doğrulama `@tamga-network/verifier/zk`.
+ * İlke (ZK1): kurum belgesi değişmez; ispat cüzdanın sakladığı belgeden ve o oturumun olağan cihaz imzasından üretilir.
+ */
+import type { CborValue } from "@tamga-network/mdoc";
+/** İspatlanacak tek öğe: "bu ad alanında bu öğe şu değerdir" (ör. tamga.id.1 / age_over_18 = true). */
+export interface ZkClaim {
+    namespace: string;
+    element: string;
+    value: CborValue;
+}
+/** Güven listesindeki kabul edilen devre (`lotl.zk_circuits[]`, SPEC-TRUST-0001). Yapısal tür: trust paketine bağımlılık yok. */
+export interface ZkCircuitEntry {
+    circuit_id: string;
+    system: string;
+    version: number;
+    attributes: number;
+    sha256: string;
+    status: string;
+}
+/** Arka uca giden ham istek. Bütün baytlar cihazda kalır; arka uç ağa çıkmaz, dosyaya yazmaz, loglamaz. */
+export interface ZkProveArgs {
+    /** Devre kimliği (`circuit_id`, onaltılık 64) ve özeti denetlenmiş devre baytları (zstd). */
+    circuitId: string;
+    circuit: Uint8Array;
+    /** Bu oturum için cüzdanın olağan yolla ürettiği, cihaz imzalı DeviceResponse (CBOR). Doğrulayıcıya GİTMEZ. */
+    deviceResponse: Uint8Array;
+    /** OpenID4VP / DC API SessionTranscript (CBOR). */
+    transcript: Uint8Array;
+    docType: string;
+    claims: ZkClaim[];
+    /** İspatın "şimdi"si: ISO 8601, saniye, `Z`. */
+    now: string;
+    /** Belgeyi imzalayan kurum anahtarı (P-256, sıkıştırılmamış nokta 65 bayt: 04 || X || Y). */
+    issuerKey: Uint8Array;
+}
+/** İspat üreticisi. Telefonda yerel modül, masaüstünde alt süreç; yoksa `available() === false` ve cüzdan olağan yola döner (ZK5). */
+export interface ZkProver {
+    readonly name: string;
+    available(): Promise<boolean>;
+    /** Longfellow devre sürümü (güven listesindeki devreyle eşleşmeli). */
+    circuitVersion(): Promise<number>;
+    prove(args: ZkProveArgs): Promise<Uint8Array>;
+}
+/** Devre baytlarını sağlayan kaynak (paketle gelen devreler, uygulama varlıkları ya da önbellek). */
+export interface ZkCircuitSource {
+    get(circuitId: string): Promise<Uint8Array | undefined>;
+}
+export type ZkErrorCode = "unavailable" | "no_circuit" | "circuit_mismatch" | "unsupported_request" | "prove_failed";
+export declare class ZkError extends Error {
+    readonly code: ZkErrorCode;
+    constructor(code: ZkErrorCode, message: string);
+}
+//# sourceMappingURL=types.d.ts.map

package/lib/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,uGAAuG;AACvG,MAAM,WAAW,OAAO;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,iIAAiI;AACjI,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2GAA2G;AAC3G,MAAM,WAAW,WAAW;IAC1B,6FAA6F;IAC7F,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,+GAA+G;IAC/G,cAAc,EAAE,UAAU,CAAC;IAC3B,mDAAmD;IACnD,UAAU,EAAE,UAAU,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,6FAA6F;IAC7F,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,sIAAsI;AACtI,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,uEAAuE;IACvE,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC/C;AAED,qGAAqG;AACrG,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;CACzD;AAED,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,YAAY,GACZ,kBAAkB,GAClB,qBAAqB,GACrB,cAAc,CAAC;AAEnB,qBAAa,OAAQ,SAAQ,KAAK;IAE9B,QAAQ,CAAC,IAAI,EAAE,WAAW;gBAAjB,IAAI,EAAE,WAAW,EAC1B,OAAO,EAAE,MAAM;CAKlB"}

package/lib/types.js

@@ -0,0 +1,9 @@
+export class ZkError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "ZkError";
+    }
+}
+//# sourceMappingURL=types.js.map

package/lib/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AA6DA,MAAM,OAAO,OAAQ,SAAQ,KAAK;IAErB;IADX,YACW,IAAiB,EAC1B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAa;QAI1B,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACxB,CAAC;CACF"}

package/package.json

@@ -1,6 +1,56 @@
 {
   "name": "@tamga-network/zk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.0",
+  "description": "Cüzdan tarafında sıfır bilgi ispatı (ADR-0032, Longfellow ZK): ISO mdoc belgesi hakkında \"şu öğe şu değerdedir\" ispatını cihazda üretir (ilk kullanım: 18 yaş üstü). Çekirdek saf TS (React Native uyumlu); /react-native yerel ispatçı (Expo modülü, Rust), /node masaüstü ispatçı. Doğrulama: @tamga-network/verifier/zk.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./lib/index.js",
+  "types": "./lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./node": {
+      "types": "./lib/node.d.ts",
+      "default": "./lib/node.js"
+    },
+    "./react-native": {
+      "types": "./lib/react-native.d.ts",
+      "default": "./lib/react-native.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "README.md",
+    "LICENSE",
+    "android",
+    "expo-module.config.json"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "@noble/hashes": "^2.0.0",
+    "@tamga-network/mdoc": "^0.3.0"
+  },
+  "peerDependencies": {
+    "expo-modules-core": "*"
+  },
+  "peerDependenciesMeta": {
+    "expo-modules-core": {
+      "optional": true
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/tamga-network/tamga-network.git",
+    "directory": "packages/zk"
+  },
+  "homepage": "https://docs.tamga.network",
+  "publishConfig": {
+    "access": "public"
+  }
+}