@veilpass/shared 0.1.0

package/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Irham Tri Ahmadi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,20 @@
+# @veilpass/shared
+
+Shared, runtime-validated contracts for a VeilPass host integration.
+
+## Install
+
+```bash
+npm install @veilpass/shared
+```
+
+## Use
+
+```ts
+import { normalizeOrigin, verifyResultSchema } from "@veilpass/shared";
+
+const hostOrigin = normalizeOrigin("https://app.example");
+const result = verifyResultSchema.parse(serverResponse);
+```
+
+This package contains no wallet access, proof generation, or server persistence. It provides the public schemas and exact-origin normalization shared by the browser SDK and host verifier.

package/dist/chunk-LYZMDCUB.js

@@ -0,0 +1,30 @@
+// src/origin.ts
+function isLoopback(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function normalizeOrigin(input) {
+  let parsed;
+  try {
+    parsed = new URL(input);
+  } catch {
+    throw new Error("Origin must be an absolute HTTP or HTTPS origin");
+  }
+  const protocol = parsed.protocol.toLowerCase();
+  const hostname = parsed.hostname.toLowerCase();
+  const hasExtraParts = parsed.pathname !== "" && parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "";
+  if (protocol !== "https:" && protocol !== "http:") {
+    throw new Error("Origin must use HTTP or HTTPS");
+  }
+  if (protocol === "http:" && !isLoopback(hostname)) {
+    throw new Error("Origin must use HTTPS outside local development");
+  }
+  if (!hostname || hostname.includes("*") || parsed.username !== "" || parsed.password !== "" || hasExtraParts) {
+    throw new Error("Origin must not include credentials, wildcards, or URL parts");
+  }
+  return `${protocol}//${parsed.host.toLowerCase()}`;
+}
+
+export {
+  normalizeOrigin
+};
+//# sourceMappingURL=chunk-LYZMDCUB.js.map

package/dist/chunk-LYZMDCUB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/origin.ts"],"sourcesContent":["export type NormalizedOrigin = `${\"http\" | \"https\"}://${string}`;\n\nfunction isLoopback(hostname: string) {\n  return (\n    hostname === \"localhost\" ||\n    hostname === \"127.0.0.1\" ||\n    hostname === \"[::1]\"\n  );\n}\n\nexport function normalizeOrigin(input: string): NormalizedOrigin {\n  let parsed: URL;\n\n  try {\n    parsed = new URL(input);\n  } catch {\n    throw new Error(\"Origin must be an absolute HTTP or HTTPS origin\");\n  }\n\n  const protocol = parsed.protocol.toLowerCase();\n  const hostname = parsed.hostname.toLowerCase();\n  const hasExtraParts =\n    (parsed.pathname !== \"\" && parsed.pathname !== \"/\") ||\n    parsed.search !== \"\" ||\n    parsed.hash !== \"\";\n\n  if (protocol !== \"https:\" && protocol !== \"http:\") {\n    throw new Error(\"Origin must use HTTP or HTTPS\");\n  }\n  if (protocol === \"http:\" && !isLoopback(hostname)) {\n    throw new Error(\"Origin must use HTTPS outside local development\");\n  }\n  if (\n    !hostname ||\n    hostname.includes(\"*\") ||\n    parsed.username !== \"\" ||\n    parsed.password !== \"\" ||\n    hasExtraParts\n  ) {\n    throw new Error(\"Origin must not include credentials, wildcards, or URL parts\");\n  }\n\n  return `${protocol}//${parsed.host.toLowerCase()}` as NormalizedOrigin;\n}\n"],"mappings":";AAEA,SAAS,WAAW,UAAkB;AACpC,SACE,aAAa,eACb,aAAa,eACb,aAAa;AAEjB;AAEO,SAAS,gBAAgB,OAAiC;AAC/D,MAAI;AAEJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AAEA,QAAM,WAAW,OAAO,SAAS,YAAY;AAC7C,QAAM,WAAW,OAAO,SAAS,YAAY;AAC7C,QAAM,gBACH,OAAO,aAAa,MAAM,OAAO,aAAa,OAC/C,OAAO,WAAW,MAClB,OAAO,SAAS;AAElB,MAAI,aAAa,YAAY,aAAa,SAAS;AACjD,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,MAAI,aAAa,WAAW,CAAC,WAAW,QAAQ,GAAG;AACjD,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,MACE,CAAC,YACD,SAAS,SAAS,GAAG,KACrB,OAAO,aAAa,MACpB,OAAO,aAAa,MACpB,eACA;AACA,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AAEA,SAAO,GAAG,QAAQ,KAAK,OAAO,KAAK,YAAY,CAAC;AAClD;","names":[]}

package/dist/chunk-MX2GIROV.js

@@ -0,0 +1,72 @@
+// src/contracts.ts
+import { z } from "zod";
+var VEILPASS_ERROR_CODES = [
+  "WALLET_NOT_FOUND",
+  "WRONG_NETWORK",
+  "USER_REJECTED",
+  "NOT_ELIGIBLE",
+  "CHALLENGE_EXPIRED",
+  "CHALLENGE_SPENT",
+  "ORIGIN_MISMATCH",
+  "GATE_MISMATCH",
+  "STALE_EPOCH",
+  "CREDENTIAL_EXPIRED",
+  "CREDENTIAL_REVOKED",
+  "PROOF_INVALID",
+  "SERVICE_UNAVAILABLE"
+];
+var veilPassErrorCodeSchema = z.enum(VEILPASS_ERROR_CODES);
+var publicInputsSchema = z.object({
+  gateId: z.string().min(1).max(128),
+  epoch: z.number().int().nonnegative(),
+  origin: z.string().min(1).max(512),
+  challengeHash: z.string().min(1).max(256),
+  credentialCommitment: z.string().min(1).max(256),
+  credentialRoot: z.string().min(1).max(256),
+  privateAppId: z.string().min(1).max(256),
+  loginNullifier: z.string().min(1).max(256),
+  revocationHash: z.string().min(1).max(256),
+  proofCreatedAt: z.string().datetime(),
+  proofExpiresAt: z.string().datetime()
+}).strict();
+var proofResultSchema = z.object({
+  challengeId: z.string().min(1).max(128),
+  proof: z.string().min(1).max(15e5),
+  publicInputs: publicInputsSchema
+}).strict();
+var verifiedLoginSchema = z.object({
+  ok: z.literal(true),
+  privateAppId: z.string().min(1).max(256),
+  gateId: z.string().min(1).max(128),
+  epoch: z.number().int().nonnegative(),
+  origin: z.string().min(1).max(512),
+  expiresAt: z.string().datetime()
+}).strict();
+var verifyErrorSchema = z.object({
+  ok: z.literal(false),
+  error: veilPassErrorCodeSchema,
+  requestId: z.string().min(1).max(128)
+}).strict();
+var verifyResultSchema = z.discriminatedUnion("ok", [
+  verifiedLoginSchema,
+  verifyErrorSchema
+]);
+var challengeResponseSchema = z.object({
+  challengeId: z.string().min(1).max(128),
+  challenge: z.string().min(1).max(512),
+  origin: z.string().min(1).max(512),
+  gateId: z.string().min(1).max(128),
+  expiresAt: z.string().datetime()
+}).strict();
+
+export {
+  VEILPASS_ERROR_CODES,
+  veilPassErrorCodeSchema,
+  publicInputsSchema,
+  proofResultSchema,
+  verifiedLoginSchema,
+  verifyErrorSchema,
+  verifyResultSchema,
+  challengeResponseSchema
+};
+//# sourceMappingURL=chunk-MX2GIROV.js.map

package/dist/chunk-MX2GIROV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/contracts.ts"],"sourcesContent":["import { z } from \"zod\";\r\n\r\nexport const VEILPASS_ERROR_CODES = [\r\n  \"WALLET_NOT_FOUND\",\r\n  \"WRONG_NETWORK\",\r\n  \"USER_REJECTED\",\r\n  \"NOT_ELIGIBLE\",\r\n  \"CHALLENGE_EXPIRED\",\r\n  \"CHALLENGE_SPENT\",\r\n  \"ORIGIN_MISMATCH\",\r\n  \"GATE_MISMATCH\",\r\n  \"STALE_EPOCH\",\r\n  \"CREDENTIAL_EXPIRED\",\r\n  \"CREDENTIAL_REVOKED\",\r\n  \"PROOF_INVALID\",\r\n  \"SERVICE_UNAVAILABLE\",\r\n] as const;\r\n\r\nexport const veilPassErrorCodeSchema = z.enum(VEILPASS_ERROR_CODES);\r\n\r\nexport const publicInputsSchema = z\r\n  .object({\r\n    gateId: z.string().min(1).max(128),\r\n    epoch: z.number().int().nonnegative(),\r\n    origin: z.string().min(1).max(512),\r\n    challengeHash: z.string().min(1).max(256),\r\n    credentialCommitment: z.string().min(1).max(256),\r\n    credentialRoot: z.string().min(1).max(256),\r\n    privateAppId: z.string().min(1).max(256),\r\n    loginNullifier: z.string().min(1).max(256),\r\n    revocationHash: z.string().min(1).max(256),\r\n    proofCreatedAt: z.string().datetime(),\r\n    proofExpiresAt: z.string().datetime(),\r\n  })\r\n  .strict();\r\n\r\nexport const proofResultSchema = z\r\n  .object({\r\n    challengeId: z.string().min(1).max(128),\r\n    proof: z.string().min(1).max(1_500_000),\r\n    publicInputs: publicInputsSchema,\r\n  })\r\n  .strict();\r\n\r\nexport const verifiedLoginSchema = z\r\n  .object({\r\n    ok: z.literal(true),\r\n    privateAppId: z.string().min(1).max(256),\r\n    gateId: z.string().min(1).max(128),\r\n    epoch: z.number().int().nonnegative(),\r\n    origin: z.string().min(1).max(512),\r\n    expiresAt: z.string().datetime(),\r\n  })\r\n  .strict();\r\n\r\nexport const verifyErrorSchema = z\r\n  .object({\r\n    ok: z.literal(false),\r\n    error: veilPassErrorCodeSchema,\r\n    requestId: z.string().min(1).max(128),\r\n  })\r\n  .strict();\r\n\r\nexport const verifyResultSchema = z.discriminatedUnion(\"ok\", [\r\n  verifiedLoginSchema,\r\n  verifyErrorSchema,\r\n]);\r\n\r\nexport const challengeResponseSchema = z\r\n  .object({\r\n    challengeId: z.string().min(1).max(128),\r\n    challenge: z.string().min(1).max(512),\r\n    origin: z.string().min(1).max(512),\r\n    gateId: z.string().min(1).max(128),\r\n    expiresAt: z.string().datetime(),\r\n  })\r\n  .strict();\r\n\r\nexport type VeilPassErrorCode = z.infer<typeof veilPassErrorCodeSchema>;\r\nexport type PublicInputs = z.infer<typeof publicInputsSchema>;\r\nexport type ProofResult = z.infer<typeof proofResultSchema>;\r\nexport type VerifiedLogin = z.infer<typeof verifiedLoginSchema>;\r\nexport type VerifyResult = z.infer<typeof verifyResultSchema>;\r\nexport type ChallengeResponse = z.infer<typeof challengeResponseSchema>;\r\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,0BAA0B,EAAE,KAAK,oBAAoB;AAE3D,IAAM,qBAAqB,EAC/B,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,sBAAsB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/C,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC,EACA,OAAO;AAEH,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAS;AAAA,EACtC,cAAc;AAChB,CAAC,EACA,OAAO;AAEH,IAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC,EACA,OAAO;AAEH,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO;AAAA,EACP,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACtC,CAAC,EACA,OAAO;AAEH,IAAM,qBAAqB,EAAE,mBAAmB,MAAM;AAAA,EAC3D;AAAA,EACA;AACF,CAAC;AAEM,IAAM,0BAA0B,EACpC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACpC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC,EACA,OAAO;","names":[]}

package/dist/contracts.cjs

@@ -0,0 +1,103 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/contracts.ts
+var contracts_exports = {};
+__export(contracts_exports, {
+  VEILPASS_ERROR_CODES: () => VEILPASS_ERROR_CODES,
+  challengeResponseSchema: () => challengeResponseSchema,
+  proofResultSchema: () => proofResultSchema,
+  publicInputsSchema: () => publicInputsSchema,
+  veilPassErrorCodeSchema: () => veilPassErrorCodeSchema,
+  verifiedLoginSchema: () => verifiedLoginSchema,
+  verifyErrorSchema: () => verifyErrorSchema,
+  verifyResultSchema: () => verifyResultSchema
+});
+module.exports = __toCommonJS(contracts_exports);
+var import_zod = require("zod");
+var VEILPASS_ERROR_CODES = [
+  "WALLET_NOT_FOUND",
+  "WRONG_NETWORK",
+  "USER_REJECTED",
+  "NOT_ELIGIBLE",
+  "CHALLENGE_EXPIRED",
+  "CHALLENGE_SPENT",
+  "ORIGIN_MISMATCH",
+  "GATE_MISMATCH",
+  "STALE_EPOCH",
+  "CREDENTIAL_EXPIRED",
+  "CREDENTIAL_REVOKED",
+  "PROOF_INVALID",
+  "SERVICE_UNAVAILABLE"
+];
+var veilPassErrorCodeSchema = import_zod.z.enum(VEILPASS_ERROR_CODES);
+var publicInputsSchema = import_zod.z.object({
+  gateId: import_zod.z.string().min(1).max(128),
+  epoch: import_zod.z.number().int().nonnegative(),
+  origin: import_zod.z.string().min(1).max(512),
+  challengeHash: import_zod.z.string().min(1).max(256),
+  credentialCommitment: import_zod.z.string().min(1).max(256),
+  credentialRoot: import_zod.z.string().min(1).max(256),
+  privateAppId: import_zod.z.string().min(1).max(256),
+  loginNullifier: import_zod.z.string().min(1).max(256),
+  revocationHash: import_zod.z.string().min(1).max(256),
+  proofCreatedAt: import_zod.z.string().datetime(),
+  proofExpiresAt: import_zod.z.string().datetime()
+}).strict();
+var proofResultSchema = import_zod.z.object({
+  challengeId: import_zod.z.string().min(1).max(128),
+  proof: import_zod.z.string().min(1).max(15e5),
+  publicInputs: publicInputsSchema
+}).strict();
+var verifiedLoginSchema = import_zod.z.object({
+  ok: import_zod.z.literal(true),
+  privateAppId: import_zod.z.string().min(1).max(256),
+  gateId: import_zod.z.string().min(1).max(128),
+  epoch: import_zod.z.number().int().nonnegative(),
+  origin: import_zod.z.string().min(1).max(512),
+  expiresAt: import_zod.z.string().datetime()
+}).strict();
+var verifyErrorSchema = import_zod.z.object({
+  ok: import_zod.z.literal(false),
+  error: veilPassErrorCodeSchema,
+  requestId: import_zod.z.string().min(1).max(128)
+}).strict();
+var verifyResultSchema = import_zod.z.discriminatedUnion("ok", [
+  verifiedLoginSchema,
+  verifyErrorSchema
+]);
+var challengeResponseSchema = import_zod.z.object({
+  challengeId: import_zod.z.string().min(1).max(128),
+  challenge: import_zod.z.string().min(1).max(512),
+  origin: import_zod.z.string().min(1).max(512),
+  gateId: import_zod.z.string().min(1).max(128),
+  expiresAt: import_zod.z.string().datetime()
+}).strict();
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  VEILPASS_ERROR_CODES,
+  challengeResponseSchema,
+  proofResultSchema,
+  publicInputsSchema,
+  veilPassErrorCodeSchema,
+  verifiedLoginSchema,
+  verifyErrorSchema,
+  verifyResultSchema
+});
+//# sourceMappingURL=contracts.cjs.map

package/dist/contracts.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/contracts.ts"],"sourcesContent":["import { z } from \"zod\";\r\n\r\nexport const VEILPASS_ERROR_CODES = [\r\n  \"WALLET_NOT_FOUND\",\r\n  \"WRONG_NETWORK\",\r\n  \"USER_REJECTED\",\r\n  \"NOT_ELIGIBLE\",\r\n  \"CHALLENGE_EXPIRED\",\r\n  \"CHALLENGE_SPENT\",\r\n  \"ORIGIN_MISMATCH\",\r\n  \"GATE_MISMATCH\",\r\n  \"STALE_EPOCH\",\r\n  \"CREDENTIAL_EXPIRED\",\r\n  \"CREDENTIAL_REVOKED\",\r\n  \"PROOF_INVALID\",\r\n  \"SERVICE_UNAVAILABLE\",\r\n] as const;\r\n\r\nexport const veilPassErrorCodeSchema = z.enum(VEILPASS_ERROR_CODES);\r\n\r\nexport const publicInputsSchema = z\r\n  .object({\r\n    gateId: z.string().min(1).max(128),\r\n    epoch: z.number().int().nonnegative(),\r\n    origin: z.string().min(1).max(512),\r\n    challengeHash: z.string().min(1).max(256),\r\n    credentialCommitment: z.string().min(1).max(256),\r\n    credentialRoot: z.string().min(1).max(256),\r\n    privateAppId: z.string().min(1).max(256),\r\n    loginNullifier: z.string().min(1).max(256),\r\n    revocationHash: z.string().min(1).max(256),\r\n    proofCreatedAt: z.string().datetime(),\r\n    proofExpiresAt: z.string().datetime(),\r\n  })\r\n  .strict();\r\n\r\nexport const proofResultSchema = z\r\n  .object({\r\n    challengeId: z.string().min(1).max(128),\r\n    proof: z.string().min(1).max(1_500_000),\r\n    publicInputs: publicInputsSchema,\r\n  })\r\n  .strict();\r\n\r\nexport const verifiedLoginSchema = z\r\n  .object({\r\n    ok: z.literal(true),\r\n    privateAppId: z.string().min(1).max(256),\r\n    gateId: z.string().min(1).max(128),\r\n    epoch: z.number().int().nonnegative(),\r\n    origin: z.string().min(1).max(512),\r\n    expiresAt: z.string().datetime(),\r\n  })\r\n  .strict();\r\n\r\nexport const verifyErrorSchema = z\r\n  .object({\r\n    ok: z.literal(false),\r\n    error: veilPassErrorCodeSchema,\r\n    requestId: z.string().min(1).max(128),\r\n  })\r\n  .strict();\r\n\r\nexport const verifyResultSchema = z.discriminatedUnion(\"ok\", [\r\n  verifiedLoginSchema,\r\n  verifyErrorSchema,\r\n]);\r\n\r\nexport const challengeResponseSchema = z\r\n  .object({\r\n    challengeId: z.string().min(1).max(128),\r\n    challenge: z.string().min(1).max(512),\r\n    origin: z.string().min(1).max(512),\r\n    gateId: z.string().min(1).max(128),\r\n    expiresAt: z.string().datetime(),\r\n  })\r\n  .strict();\r\n\r\nexport type VeilPassErrorCode = z.infer<typeof veilPassErrorCodeSchema>;\r\nexport type PublicInputs = z.infer<typeof publicInputsSchema>;\r\nexport type ProofResult = z.infer<typeof proofResultSchema>;\r\nexport type VerifiedLogin = z.infer<typeof verifiedLoginSchema>;\r\nexport type VerifyResult = z.infer<typeof verifyResultSchema>;\r\nexport type ChallengeResponse = z.infer<typeof challengeResponseSchema>;\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAAkB;AAEX,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,0BAA0B,aAAE,KAAK,oBAAoB;AAE3D,IAAM,qBAAqB,aAC/B,OAAO;AAAA,EACN,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,OAAO,aAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,eAAe,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,sBAAsB,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/C,gBAAgB,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,cAAc,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,gBAAgB,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,gBAAgB,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,gBAAgB,aAAE,OAAO,EAAE,SAAS;AAAA,EACpC,gBAAgB,aAAE,OAAO,EAAE,SAAS;AACtC,CAAC,EACA,OAAO;AAEH,IAAM,oBAAoB,aAC9B,OAAO;AAAA,EACN,aAAa,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,OAAO,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAS;AAAA,EACtC,cAAc;AAChB,CAAC,EACA,OAAO;AAEH,IAAM,sBAAsB,aAChC,OAAO;AAAA,EACN,IAAI,aAAE,QAAQ,IAAI;AAAA,EAClB,cAAc,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,OAAO,aAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,WAAW,aAAE,OAAO,EAAE,SAAS;AACjC,CAAC,EACA,OAAO;AAEH,IAAM,oBAAoB,aAC9B,OAAO;AAAA,EACN,IAAI,aAAE,QAAQ,KAAK;AAAA,EACnB,OAAO;AAAA,EACP,WAAW,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACtC,CAAC,EACA,OAAO;AAEH,IAAM,qBAAqB,aAAE,mBAAmB,MAAM;AAAA,EAC3D;AAAA,EACA;AACF,CAAC;AAEM,IAAM,0BAA0B,aACpC,OAAO;AAAA,EACN,aAAa,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,WAAW,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACpC,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,WAAW,aAAE,OAAO,EAAE,SAAS;AACjC,CAAC,EACA,OAAO;","names":[]}

package/dist/contracts.d.cts

@@ -0,0 +1,116 @@
+import { z } from 'zod';
+
+declare const VEILPASS_ERROR_CODES: readonly ["WALLET_NOT_FOUND", "WRONG_NETWORK", "USER_REJECTED", "NOT_ELIGIBLE", "CHALLENGE_EXPIRED", "CHALLENGE_SPENT", "ORIGIN_MISMATCH", "GATE_MISMATCH", "STALE_EPOCH", "CREDENTIAL_EXPIRED", "CREDENTIAL_REVOKED", "PROOF_INVALID", "SERVICE_UNAVAILABLE"];
+declare const veilPassErrorCodeSchema: z.ZodEnum<{
+    WALLET_NOT_FOUND: "WALLET_NOT_FOUND";
+    WRONG_NETWORK: "WRONG_NETWORK";
+    USER_REJECTED: "USER_REJECTED";
+    NOT_ELIGIBLE: "NOT_ELIGIBLE";
+    CHALLENGE_EXPIRED: "CHALLENGE_EXPIRED";
+    CHALLENGE_SPENT: "CHALLENGE_SPENT";
+    ORIGIN_MISMATCH: "ORIGIN_MISMATCH";
+    GATE_MISMATCH: "GATE_MISMATCH";
+    STALE_EPOCH: "STALE_EPOCH";
+    CREDENTIAL_EXPIRED: "CREDENTIAL_EXPIRED";
+    CREDENTIAL_REVOKED: "CREDENTIAL_REVOKED";
+    PROOF_INVALID: "PROOF_INVALID";
+    SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";
+}>;
+declare const publicInputsSchema: z.ZodObject<{
+    gateId: z.ZodString;
+    epoch: z.ZodNumber;
+    origin: z.ZodString;
+    challengeHash: z.ZodString;
+    credentialCommitment: z.ZodString;
+    credentialRoot: z.ZodString;
+    privateAppId: z.ZodString;
+    loginNullifier: z.ZodString;
+    revocationHash: z.ZodString;
+    proofCreatedAt: z.ZodString;
+    proofExpiresAt: z.ZodString;
+}, z.core.$strict>;
+declare const proofResultSchema: z.ZodObject<{
+    challengeId: z.ZodString;
+    proof: z.ZodString;
+    publicInputs: z.ZodObject<{
+        gateId: z.ZodString;
+        epoch: z.ZodNumber;
+        origin: z.ZodString;
+        challengeHash: z.ZodString;
+        credentialCommitment: z.ZodString;
+        credentialRoot: z.ZodString;
+        privateAppId: z.ZodString;
+        loginNullifier: z.ZodString;
+        revocationHash: z.ZodString;
+        proofCreatedAt: z.ZodString;
+        proofExpiresAt: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+declare const verifiedLoginSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    privateAppId: z.ZodString;
+    gateId: z.ZodString;
+    epoch: z.ZodNumber;
+    origin: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strict>;
+declare const verifyErrorSchema: z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    error: z.ZodEnum<{
+        WALLET_NOT_FOUND: "WALLET_NOT_FOUND";
+        WRONG_NETWORK: "WRONG_NETWORK";
+        USER_REJECTED: "USER_REJECTED";
+        NOT_ELIGIBLE: "NOT_ELIGIBLE";
+        CHALLENGE_EXPIRED: "CHALLENGE_EXPIRED";
+        CHALLENGE_SPENT: "CHALLENGE_SPENT";
+        ORIGIN_MISMATCH: "ORIGIN_MISMATCH";
+        GATE_MISMATCH: "GATE_MISMATCH";
+        STALE_EPOCH: "STALE_EPOCH";
+        CREDENTIAL_EXPIRED: "CREDENTIAL_EXPIRED";
+        CREDENTIAL_REVOKED: "CREDENTIAL_REVOKED";
+        PROOF_INVALID: "PROOF_INVALID";
+        SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";
+    }>;
+    requestId: z.ZodString;
+}, z.core.$strict>;
+declare const verifyResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    privateAppId: z.ZodString;
+    gateId: z.ZodString;
+    epoch: z.ZodNumber;
+    origin: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    error: z.ZodEnum<{
+        WALLET_NOT_FOUND: "WALLET_NOT_FOUND";
+        WRONG_NETWORK: "WRONG_NETWORK";
+        USER_REJECTED: "USER_REJECTED";
+        NOT_ELIGIBLE: "NOT_ELIGIBLE";
+        CHALLENGE_EXPIRED: "CHALLENGE_EXPIRED";
+        CHALLENGE_SPENT: "CHALLENGE_SPENT";
+        ORIGIN_MISMATCH: "ORIGIN_MISMATCH";
+        GATE_MISMATCH: "GATE_MISMATCH";
+        STALE_EPOCH: "STALE_EPOCH";
+        CREDENTIAL_EXPIRED: "CREDENTIAL_EXPIRED";
+        CREDENTIAL_REVOKED: "CREDENTIAL_REVOKED";
+        PROOF_INVALID: "PROOF_INVALID";
+        SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";
+    }>;
+    requestId: z.ZodString;
+}, z.core.$strict>], "ok">;
+declare const challengeResponseSchema: z.ZodObject<{
+    challengeId: z.ZodString;
+    challenge: z.ZodString;
+    origin: z.ZodString;
+    gateId: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strict>;
+type VeilPassErrorCode = z.infer<typeof veilPassErrorCodeSchema>;
+type PublicInputs = z.infer<typeof publicInputsSchema>;
+type ProofResult = z.infer<typeof proofResultSchema>;
+type VerifiedLogin = z.infer<typeof verifiedLoginSchema>;
+type VerifyResult = z.infer<typeof verifyResultSchema>;
+type ChallengeResponse = z.infer<typeof challengeResponseSchema>;
+
+export { type ChallengeResponse, type ProofResult, type PublicInputs, VEILPASS_ERROR_CODES, type VeilPassErrorCode, type VerifiedLogin, type VerifyResult, challengeResponseSchema, proofResultSchema, publicInputsSchema, veilPassErrorCodeSchema, verifiedLoginSchema, verifyErrorSchema, verifyResultSchema };

package/dist/contracts.d.ts

@@ -0,0 +1,116 @@
+import { z } from 'zod';
+
+declare const VEILPASS_ERROR_CODES: readonly ["WALLET_NOT_FOUND", "WRONG_NETWORK", "USER_REJECTED", "NOT_ELIGIBLE", "CHALLENGE_EXPIRED", "CHALLENGE_SPENT", "ORIGIN_MISMATCH", "GATE_MISMATCH", "STALE_EPOCH", "CREDENTIAL_EXPIRED", "CREDENTIAL_REVOKED", "PROOF_INVALID", "SERVICE_UNAVAILABLE"];
+declare const veilPassErrorCodeSchema: z.ZodEnum<{
+    WALLET_NOT_FOUND: "WALLET_NOT_FOUND";
+    WRONG_NETWORK: "WRONG_NETWORK";
+    USER_REJECTED: "USER_REJECTED";
+    NOT_ELIGIBLE: "NOT_ELIGIBLE";
+    CHALLENGE_EXPIRED: "CHALLENGE_EXPIRED";
+    CHALLENGE_SPENT: "CHALLENGE_SPENT";
+    ORIGIN_MISMATCH: "ORIGIN_MISMATCH";
+    GATE_MISMATCH: "GATE_MISMATCH";
+    STALE_EPOCH: "STALE_EPOCH";
+    CREDENTIAL_EXPIRED: "CREDENTIAL_EXPIRED";
+    CREDENTIAL_REVOKED: "CREDENTIAL_REVOKED";
+    PROOF_INVALID: "PROOF_INVALID";
+    SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";
+}>;
+declare const publicInputsSchema: z.ZodObject<{
+    gateId: z.ZodString;
+    epoch: z.ZodNumber;
+    origin: z.ZodString;
+    challengeHash: z.ZodString;
+    credentialCommitment: z.ZodString;
+    credentialRoot: z.ZodString;
+    privateAppId: z.ZodString;
+    loginNullifier: z.ZodString;
+    revocationHash: z.ZodString;
+    proofCreatedAt: z.ZodString;
+    proofExpiresAt: z.ZodString;
+}, z.core.$strict>;
+declare const proofResultSchema: z.ZodObject<{
+    challengeId: z.ZodString;
+    proof: z.ZodString;
+    publicInputs: z.ZodObject<{
+        gateId: z.ZodString;
+        epoch: z.ZodNumber;
+        origin: z.ZodString;
+        challengeHash: z.ZodString;
+        credentialCommitment: z.ZodString;
+        credentialRoot: z.ZodString;
+        privateAppId: z.ZodString;
+        loginNullifier: z.ZodString;
+        revocationHash: z.ZodString;
+        proofCreatedAt: z.ZodString;
+        proofExpiresAt: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+declare const verifiedLoginSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    privateAppId: z.ZodString;
+    gateId: z.ZodString;
+    epoch: z.ZodNumber;
+    origin: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strict>;
+declare const verifyErrorSchema: z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    error: z.ZodEnum<{
+        WALLET_NOT_FOUND: "WALLET_NOT_FOUND";
+        WRONG_NETWORK: "WRONG_NETWORK";
+        USER_REJECTED: "USER_REJECTED";
+        NOT_ELIGIBLE: "NOT_ELIGIBLE";
+        CHALLENGE_EXPIRED: "CHALLENGE_EXPIRED";
+        CHALLENGE_SPENT: "CHALLENGE_SPENT";
+        ORIGIN_MISMATCH: "ORIGIN_MISMATCH";
+        GATE_MISMATCH: "GATE_MISMATCH";
+        STALE_EPOCH: "STALE_EPOCH";
+        CREDENTIAL_EXPIRED: "CREDENTIAL_EXPIRED";
+        CREDENTIAL_REVOKED: "CREDENTIAL_REVOKED";
+        PROOF_INVALID: "PROOF_INVALID";
+        SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";
+    }>;
+    requestId: z.ZodString;
+}, z.core.$strict>;
+declare const verifyResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    privateAppId: z.ZodString;
+    gateId: z.ZodString;
+    epoch: z.ZodNumber;
+    origin: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    error: z.ZodEnum<{
+        WALLET_NOT_FOUND: "WALLET_NOT_FOUND";
+        WRONG_NETWORK: "WRONG_NETWORK";
+        USER_REJECTED: "USER_REJECTED";
+        NOT_ELIGIBLE: "NOT_ELIGIBLE";
+        CHALLENGE_EXPIRED: "CHALLENGE_EXPIRED";
+        CHALLENGE_SPENT: "CHALLENGE_SPENT";
+        ORIGIN_MISMATCH: "ORIGIN_MISMATCH";
+        GATE_MISMATCH: "GATE_MISMATCH";
+        STALE_EPOCH: "STALE_EPOCH";
+        CREDENTIAL_EXPIRED: "CREDENTIAL_EXPIRED";
+        CREDENTIAL_REVOKED: "CREDENTIAL_REVOKED";
+        PROOF_INVALID: "PROOF_INVALID";
+        SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";
+    }>;
+    requestId: z.ZodString;
+}, z.core.$strict>], "ok">;
+declare const challengeResponseSchema: z.ZodObject<{
+    challengeId: z.ZodString;
+    challenge: z.ZodString;
+    origin: z.ZodString;
+    gateId: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strict>;
+type VeilPassErrorCode = z.infer<typeof veilPassErrorCodeSchema>;
+type PublicInputs = z.infer<typeof publicInputsSchema>;
+type ProofResult = z.infer<typeof proofResultSchema>;
+type VerifiedLogin = z.infer<typeof verifiedLoginSchema>;
+type VerifyResult = z.infer<typeof verifyResultSchema>;
+type ChallengeResponse = z.infer<typeof challengeResponseSchema>;
+
+export { type ChallengeResponse, type ProofResult, type PublicInputs, VEILPASS_ERROR_CODES, type VeilPassErrorCode, type VerifiedLogin, type VerifyResult, challengeResponseSchema, proofResultSchema, publicInputsSchema, veilPassErrorCodeSchema, verifiedLoginSchema, verifyErrorSchema, verifyResultSchema };

package/dist/contracts.js

@@ -0,0 +1,21 @@
+import {
+  VEILPASS_ERROR_CODES,
+  challengeResponseSchema,
+  proofResultSchema,
+  publicInputsSchema,
+  veilPassErrorCodeSchema,
+  verifiedLoginSchema,
+  verifyErrorSchema,
+  verifyResultSchema
+} from "./chunk-MX2GIROV.js";
+export {
+  VEILPASS_ERROR_CODES,
+  challengeResponseSchema,
+  proofResultSchema,
+  publicInputsSchema,
+  veilPassErrorCodeSchema,
+  verifiedLoginSchema,
+  verifyErrorSchema,
+  verifyResultSchema
+};
+//# sourceMappingURL=contracts.js.map

package/dist/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/index.cjs

@@ -0,0 +1,208 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  BN254_SCALAR_MODULUS_HEX: () => BN254_SCALAR_MODULUS_HEX,
+  VEILPASS_ERROR_CODES: () => VEILPASS_ERROR_CODES,
+  base64urlToBytes: () => base64urlToBytes,
+  canonicalFieldHex: () => canonicalFieldHex,
+  challengeResponseSchema: () => challengeResponseSchema,
+  fieldHexFromBytes: () => fieldHexFromBytes,
+  fieldHexFromDigest: () => fieldHexFromDigest,
+  fieldHexToNoir: () => fieldHexToNoir,
+  hashBytesToFieldHex: () => hashBytesToFieldHex,
+  hashTextToFieldHex: () => hashTextToFieldHex,
+  normalizeOrigin: () => normalizeOrigin,
+  proofResultSchema: () => proofResultSchema,
+  publicInputsSchema: () => publicInputsSchema,
+  randomFieldHex: () => randomFieldHex,
+  u64ToFieldHex: () => u64ToFieldHex,
+  veilPassErrorCodeSchema: () => veilPassErrorCodeSchema,
+  verifiedLoginSchema: () => verifiedLoginSchema,
+  verifyErrorSchema: () => verifyErrorSchema,
+  verifyResultSchema: () => verifyResultSchema
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/contracts.ts
+var import_zod = require("zod");
+var VEILPASS_ERROR_CODES = [
+  "WALLET_NOT_FOUND",
+  "WRONG_NETWORK",
+  "USER_REJECTED",
+  "NOT_ELIGIBLE",
+  "CHALLENGE_EXPIRED",
+  "CHALLENGE_SPENT",
+  "ORIGIN_MISMATCH",
+  "GATE_MISMATCH",
+  "STALE_EPOCH",
+  "CREDENTIAL_EXPIRED",
+  "CREDENTIAL_REVOKED",
+  "PROOF_INVALID",
+  "SERVICE_UNAVAILABLE"
+];
+var veilPassErrorCodeSchema = import_zod.z.enum(VEILPASS_ERROR_CODES);
+var publicInputsSchema = import_zod.z.object({
+  gateId: import_zod.z.string().min(1).max(128),
+  epoch: import_zod.z.number().int().nonnegative(),
+  origin: import_zod.z.string().min(1).max(512),
+  challengeHash: import_zod.z.string().min(1).max(256),
+  credentialCommitment: import_zod.z.string().min(1).max(256),
+  credentialRoot: import_zod.z.string().min(1).max(256),
+  privateAppId: import_zod.z.string().min(1).max(256),
+  loginNullifier: import_zod.z.string().min(1).max(256),
+  revocationHash: import_zod.z.string().min(1).max(256),
+  proofCreatedAt: import_zod.z.string().datetime(),
+  proofExpiresAt: import_zod.z.string().datetime()
+}).strict();
+var proofResultSchema = import_zod.z.object({
+  challengeId: import_zod.z.string().min(1).max(128),
+  proof: import_zod.z.string().min(1).max(15e5),
+  publicInputs: publicInputsSchema
+}).strict();
+var verifiedLoginSchema = import_zod.z.object({
+  ok: import_zod.z.literal(true),
+  privateAppId: import_zod.z.string().min(1).max(256),
+  gateId: import_zod.z.string().min(1).max(128),
+  epoch: import_zod.z.number().int().nonnegative(),
+  origin: import_zod.z.string().min(1).max(512),
+  expiresAt: import_zod.z.string().datetime()
+}).strict();
+var verifyErrorSchema = import_zod.z.object({
+  ok: import_zod.z.literal(false),
+  error: veilPassErrorCodeSchema,
+  requestId: import_zod.z.string().min(1).max(128)
+}).strict();
+var verifyResultSchema = import_zod.z.discriminatedUnion("ok", [
+  verifiedLoginSchema,
+  verifyErrorSchema
+]);
+var challengeResponseSchema = import_zod.z.object({
+  challengeId: import_zod.z.string().min(1).max(128),
+  challenge: import_zod.z.string().min(1).max(512),
+  origin: import_zod.z.string().min(1).max(512),
+  gateId: import_zod.z.string().min(1).max(128),
+  expiresAt: import_zod.z.string().datetime()
+}).strict();
+
+// src/field.ts
+var BN254_SCALAR_MODULUS_HEX = "30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47";
+var FIELD_HEX_LENGTH = 64;
+function canonicalFieldHex(value) {
+  const normalized = value.trim().replace(/^0x/i, "").toLowerCase();
+  if (!/^[0-9a-f]{1,64}$/.test(normalized)) throw new Error("Expected a field element encoded as at most 32 bytes of hex");
+  const padded = normalized.padStart(FIELD_HEX_LENGTH, "0");
+  if (padded >= BN254_SCALAR_MODULUS_HEX) throw new Error("Field element exceeds the BN254 scalar modulus");
+  return padded;
+}
+function fieldHexToNoir(value) {
+  return `0x${canonicalFieldHex(value)}`;
+}
+function fieldHexFromBytes(bytes) {
+  if (bytes.byteLength !== 32) throw new Error("Expected exactly 32 bytes for a field element");
+  return canonicalFieldHex(Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join(""));
+}
+function fieldHexFromDigest(bytes) {
+  if (bytes.byteLength !== 32) throw new Error("Expected a 32-byte digest");
+  const fieldBytes = Uint8Array.from(bytes);
+  fieldBytes[0] &= 31;
+  return fieldHexFromBytes(fieldBytes);
+}
+function u64ToFieldHex(value) {
+  if (!Number.isSafeInteger(value) || value < 0) throw new Error("Expected a non-negative safe integer");
+  const bytes = new Uint8Array(32);
+  let remaining = value;
+  for (let index = 31; index >= 0 && remaining > 0; index -= 1) {
+    bytes[index] = remaining % 256;
+    remaining = Math.floor(remaining / 256);
+  }
+  return fieldHexFromBytes(bytes);
+}
+function randomFieldHex(randomBytes) {
+  if (randomBytes.byteLength !== 32) throw new Error("Expected 32 random bytes");
+  const fieldBytes = Uint8Array.from(randomBytes);
+  fieldBytes[0] &= 31;
+  return fieldHexFromBytes(fieldBytes);
+}
+async function hashTextToFieldHex(value) {
+  return hashBytesToFieldHex(new TextEncoder().encode(value));
+}
+async function hashBytesToFieldHex(value) {
+  if (!globalThis.crypto?.subtle) throw new Error("Web Crypto is unavailable");
+  const digest = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new Uint8Array(value)));
+  return fieldHexFromDigest(digest);
+}
+function base64urlToBytes(value) {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(padded)) throw new Error("Invalid base64url value");
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+
+// src/origin.ts
+function isLoopback(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function normalizeOrigin(input) {
+  let parsed;
+  try {
+    parsed = new URL(input);
+  } catch {
+    throw new Error("Origin must be an absolute HTTP or HTTPS origin");
+  }
+  const protocol = parsed.protocol.toLowerCase();
+  const hostname = parsed.hostname.toLowerCase();
+  const hasExtraParts = parsed.pathname !== "" && parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "";
+  if (protocol !== "https:" && protocol !== "http:") {
+    throw new Error("Origin must use HTTP or HTTPS");
+  }
+  if (protocol === "http:" && !isLoopback(hostname)) {
+    throw new Error("Origin must use HTTPS outside local development");
+  }
+  if (!hostname || hostname.includes("*") || parsed.username !== "" || parsed.password !== "" || hasExtraParts) {
+    throw new Error("Origin must not include credentials, wildcards, or URL parts");
+  }
+  return `${protocol}//${parsed.host.toLowerCase()}`;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BN254_SCALAR_MODULUS_HEX,
+  VEILPASS_ERROR_CODES,
+  base64urlToBytes,
+  canonicalFieldHex,
+  challengeResponseSchema,
+  fieldHexFromBytes,
+  fieldHexFromDigest,
+  fieldHexToNoir,
+  hashBytesToFieldHex,
+  hashTextToFieldHex,
+  normalizeOrigin,
+  proofResultSchema,
+  publicInputsSchema,
+  randomFieldHex,
+  u64ToFieldHex,
+  veilPassErrorCodeSchema,
+  verifiedLoginSchema,
+  verifyErrorSchema,
+  verifyResultSchema
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/contracts.ts","../src/field.ts","../src/origin.ts"],"sourcesContent":["export * from \"./contracts\";\r\nexport * from \"./field\";\r\nexport * from \"./origin\";\r\n","import { z } from \"zod\";\r\n\r\nexport const VEILPASS_ERROR_CODES = [\r\n  \"WALLET_NOT_FOUND\",\r\n  \"WRONG_NETWORK\",\r\n  \"USER_REJECTED\",\r\n  \"NOT_ELIGIBLE\",\r\n  \"CHALLENGE_EXPIRED\",\r\n  \"CHALLENGE_SPENT\",\r\n  \"ORIGIN_MISMATCH\",\r\n  \"GATE_MISMATCH\",\r\n  \"STALE_EPOCH\",\r\n  \"CREDENTIAL_EXPIRED\",\r\n  \"CREDENTIAL_REVOKED\",\r\n  \"PROOF_INVALID\",\r\n  \"SERVICE_UNAVAILABLE\",\r\n] as const;\r\n\r\nexport const veilPassErrorCodeSchema = z.enum(VEILPASS_ERROR_CODES);\r\n\r\nexport const publicInputsSchema = z\r\n  .object({\r\n    gateId: z.string().min(1).max(128),\r\n    epoch: z.number().int().nonnegative(),\r\n    origin: z.string().min(1).max(512),\r\n    challengeHash: z.string().min(1).max(256),\r\n    credentialCommitment: z.string().min(1).max(256),\r\n    credentialRoot: z.string().min(1).max(256),\r\n    privateAppId: z.string().min(1).max(256),\r\n    loginNullifier: z.string().min(1).max(256),\r\n    revocationHash: z.string().min(1).max(256),\r\n    proofCreatedAt: z.string().datetime(),\r\n    proofExpiresAt: z.string().datetime(),\r\n  })\r\n  .strict();\r\n\r\nexport const proofResultSchema = z\r\n  .object({\r\n    challengeId: z.string().min(1).max(128),\r\n    proof: z.string().min(1).max(1_500_000),\r\n    publicInputs: publicInputsSchema,\r\n  })\r\n  .strict();\r\n\r\nexport const verifiedLoginSchema = z\r\n  .object({\r\n    ok: z.literal(true),\r\n    privateAppId: z.string().min(1).max(256),\r\n    gateId: z.string().min(1).max(128),\r\n    epoch: z.number().int().nonnegative(),\r\n    origin: z.string().min(1).max(512),\r\n    expiresAt: z.string().datetime(),\r\n  })\r\n  .strict();\r\n\r\nexport const verifyErrorSchema = z\r\n  .object({\r\n    ok: z.literal(false),\r\n    error: veilPassErrorCodeSchema,\r\n    requestId: z.string().min(1).max(128),\r\n  })\r\n  .strict();\r\n\r\nexport const verifyResultSchema = z.discriminatedUnion(\"ok\", [\r\n  verifiedLoginSchema,\r\n  verifyErrorSchema,\r\n]);\r\n\r\nexport const challengeResponseSchema = z\r\n  .object({\r\n    challengeId: z.string().min(1).max(128),\r\n    challenge: z.string().min(1).max(512),\r\n    origin: z.string().min(1).max(512),\r\n    gateId: z.string().min(1).max(128),\r\n    expiresAt: z.string().datetime(),\r\n  })\r\n  .strict();\r\n\r\nexport type VeilPassErrorCode = z.infer<typeof veilPassErrorCodeSchema>;\r\nexport type PublicInputs = z.infer<typeof publicInputsSchema>;\r\nexport type ProofResult = z.infer<typeof proofResultSchema>;\r\nexport type VerifiedLogin = z.infer<typeof verifiedLoginSchema>;\r\nexport type VerifyResult = z.infer<typeof verifyResultSchema>;\r\nexport type ChallengeResponse = z.infer<typeof challengeResponseSchema>;\r\n","/**\r\n * Canonical, 32-byte BN254 scalar encoding used by the Noir membership\r\n * circuit. Values are kept as lowercase, unprefixed hex at API boundaries.\r\n * Keeping this module free of Node APIs lets the hosted login use exactly the\r\n * same encoding as the verifier.\r\n */\r\nexport const BN254_SCALAR_MODULUS_HEX = \"30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47\";\r\nconst FIELD_HEX_LENGTH = 64;\r\n\r\nexport function canonicalFieldHex(value: string): string {\r\n  const normalized = value.trim().replace(/^0x/i, \"\").toLowerCase();\r\n  if (!/^[0-9a-f]{1,64}$/.test(normalized)) throw new Error(\"Expected a field element encoded as at most 32 bytes of hex\");\r\n  const padded = normalized.padStart(FIELD_HEX_LENGTH, \"0\");\r\n  if (padded >= BN254_SCALAR_MODULUS_HEX) throw new Error(\"Field element exceeds the BN254 scalar modulus\");\r\n  return padded;\r\n}\r\n\r\nexport function fieldHexToNoir(value: string): string {\r\n  return `0x${canonicalFieldHex(value)}`;\r\n}\r\n\r\nexport function fieldHexFromBytes(bytes: Uint8Array): string {\r\n  if (bytes.byteLength !== 32) throw new Error(\"Expected exactly 32 bytes for a field element\");\r\n  return canonicalFieldHex(Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\"));\r\n}\r\n\r\n/** Maps a SHA-256 digest into a 253-bit field value without a modulo bias. */\r\nexport function fieldHexFromDigest(bytes: Uint8Array): string {\r\n  if (bytes.byteLength !== 32) throw new Error(\"Expected a 32-byte digest\");\r\n  const fieldBytes = Uint8Array.from(bytes);\r\n  fieldBytes[0] &= 0x1f;\r\n  return fieldHexFromBytes(fieldBytes);\r\n}\r\n\r\nexport function u64ToFieldHex(value: number): string {\r\n  if (!Number.isSafeInteger(value) || value < 0) throw new Error(\"Expected a non-negative safe integer\");\r\n  const bytes = new Uint8Array(32);\r\n  let remaining = value;\r\n  for (let index = 31; index >= 0 && remaining > 0; index -= 1) {\r\n    bytes[index] = remaining % 256;\r\n    remaining = Math.floor(remaining / 256);\r\n  }\r\n  return fieldHexFromBytes(bytes);\r\n}\r\n\r\nexport function randomFieldHex(randomBytes: Uint8Array): string {\r\n  if (randomBytes.byteLength !== 32) throw new Error(\"Expected 32 random bytes\");\r\n  const fieldBytes = Uint8Array.from(randomBytes);\r\n  fieldBytes[0] &= 0x1f;\r\n  return fieldHexFromBytes(fieldBytes);\r\n}\r\n\r\nexport async function hashTextToFieldHex(value: string): Promise<string> {\r\n  return hashBytesToFieldHex(new TextEncoder().encode(value));\r\n}\r\n\r\nexport async function hashBytesToFieldHex(value: Uint8Array): Promise<string> {\r\n  if (!globalThis.crypto?.subtle) throw new Error(\"Web Crypto is unavailable\");\r\n  const digest = new Uint8Array(await globalThis.crypto.subtle.digest(\"SHA-256\", new Uint8Array(value)));\r\n  return fieldHexFromDigest(digest);\r\n}\r\n\r\nexport function base64urlToBytes(value: string): Uint8Array {\r\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\r\n  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, \"=\");\r\n  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(padded)) throw new Error(\"Invalid base64url value\");\r\n  const binary = atob(padded);\r\n  return Uint8Array.from(binary, (character) => character.charCodeAt(0));\r\n}\r\n","export type NormalizedOrigin = `${\"http\" | \"https\"}://${string}`;\n\nfunction isLoopback(hostname: string) {\n  return (\n    hostname === \"localhost\" ||\n    hostname === \"127.0.0.1\" ||\n    hostname === \"[::1]\"\n  );\n}\n\nexport function normalizeOrigin(input: string): NormalizedOrigin {\n  let parsed: URL;\n\n  try {\n    parsed = new URL(input);\n  } catch {\n    throw new Error(\"Origin must be an absolute HTTP or HTTPS origin\");\n  }\n\n  const protocol = parsed.protocol.toLowerCase();\n  const hostname = parsed.hostname.toLowerCase();\n  const hasExtraParts =\n    (parsed.pathname !== \"\" && parsed.pathname !== \"/\") ||\n    parsed.search !== \"\" ||\n    parsed.hash !== \"\";\n\n  if (protocol !== \"https:\" && protocol !== \"http:\") {\n    throw new Error(\"Origin must use HTTP or HTTPS\");\n  }\n  if (protocol === \"http:\" && !isLoopback(hostname)) {\n    throw new Error(\"Origin must use HTTPS outside local development\");\n  }\n  if (\n    !hostname ||\n    hostname.includes(\"*\") ||\n    parsed.username !== \"\" ||\n    parsed.password !== \"\" ||\n    hasExtraParts\n  ) {\n    throw new Error(\"Origin must not include credentials, wildcards, or URL parts\");\n  }\n\n  return `${protocol}//${parsed.host.toLowerCase()}` as NormalizedOrigin;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,iBAAkB;AAEX,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,0BAA0B,aAAE,KAAK,oBAAoB;AAE3D,IAAM,qBAAqB,aAC/B,OAAO;AAAA,EACN,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,OAAO,aAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,eAAe,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,sBAAsB,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/C,gBAAgB,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,cAAc,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,gBAAgB,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,gBAAgB,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,gBAAgB,aAAE,OAAO,EAAE,SAAS;AAAA,EACpC,gBAAgB,aAAE,OAAO,EAAE,SAAS;AACtC,CAAC,EACA,OAAO;AAEH,IAAM,oBAAoB,aAC9B,OAAO;AAAA,EACN,aAAa,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,OAAO,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAS;AAAA,EACtC,cAAc;AAChB,CAAC,EACA,OAAO;AAEH,IAAM,sBAAsB,aAChC,OAAO;AAAA,EACN,IAAI,aAAE,QAAQ,IAAI;AAAA,EAClB,cAAc,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,OAAO,aAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,WAAW,aAAE,OAAO,EAAE,SAAS;AACjC,CAAC,EACA,OAAO;AAEH,IAAM,oBAAoB,aAC9B,OAAO;AAAA,EACN,IAAI,aAAE,QAAQ,KAAK;AAAA,EACnB,OAAO;AAAA,EACP,WAAW,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACtC,CAAC,EACA,OAAO;AAEH,IAAM,qBAAqB,aAAE,mBAAmB,MAAM;AAAA,EAC3D;AAAA,EACA;AACF,CAAC;AAEM,IAAM,0BAA0B,aACpC,OAAO;AAAA,EACN,aAAa,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,WAAW,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACpC,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,QAAQ,aAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACjC,WAAW,aAAE,OAAO,EAAE,SAAS;AACjC,CAAC,EACA,OAAO;;;ACtEH,IAAM,2BAA2B;AACxC,IAAM,mBAAmB;AAElB,SAAS,kBAAkB,OAAuB;AACvD,QAAM,aAAa,MAAM,KAAK,EAAE,QAAQ,QAAQ,EAAE,EAAE,YAAY;AAChE,MAAI,CAAC,mBAAmB,KAAK,UAAU,EAAG,OAAM,IAAI,MAAM,6DAA6D;AACvH,QAAM,SAAS,WAAW,SAAS,kBAAkB,GAAG;AACxD,MAAI,UAAU,yBAA0B,OAAM,IAAI,MAAM,gDAAgD;AACxG,SAAO;AACT;AAEO,SAAS,eAAe,OAAuB;AACpD,SAAO,KAAK,kBAAkB,KAAK,CAAC;AACtC;AAEO,SAAS,kBAAkB,OAA2B;AAC3D,MAAI,MAAM,eAAe,GAAI,OAAM,IAAI,MAAM,+CAA+C;AAC5F,SAAO,kBAAkB,MAAM,KAAK,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AACnG;AAGO,SAAS,mBAAmB,OAA2B;AAC5D,MAAI,MAAM,eAAe,GAAI,OAAM,IAAI,MAAM,2BAA2B;AACxE,QAAM,aAAa,WAAW,KAAK,KAAK;AACxC,aAAW,CAAC,KAAK;AACjB,SAAO,kBAAkB,UAAU;AACrC;AAEO,SAAS,cAAc,OAAuB;AACnD,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,EAAG,OAAM,IAAI,MAAM,sCAAsC;AACrG,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,MAAI,YAAY;AAChB,WAAS,QAAQ,IAAI,SAAS,KAAK,YAAY,GAAG,SAAS,GAAG;AAC5D,UAAM,KAAK,IAAI,YAAY;AAC3B,gBAAY,KAAK,MAAM,YAAY,GAAG;AAAA,EACxC;AACA,SAAO,kBAAkB,KAAK;AAChC;AAEO,SAAS,eAAe,aAAiC;AAC9D,MAAI,YAAY,eAAe,GAAI,OAAM,IAAI,MAAM,0BAA0B;AAC7E,QAAM,aAAa,WAAW,KAAK,WAAW;AAC9C,aAAW,CAAC,KAAK;AACjB,SAAO,kBAAkB,UAAU;AACrC;AAEA,eAAsB,mBAAmB,OAAgC;AACvE,SAAO,oBAAoB,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAC5D;AAEA,eAAsB,oBAAoB,OAAoC;AAC5E,MAAI,CAAC,WAAW,QAAQ,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAC3E,QAAM,SAAS,IAAI,WAAW,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,KAAK,CAAC,CAAC;AACrG,SAAO,mBAAmB,MAAM;AAClC;AAEO,SAAS,iBAAiB,OAA2B;AAC1D,QAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC7D,QAAM,SAAS,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS,CAAC,IAAI,GAAG,GAAG;AAC1E,MAAI,CAAC,yBAAyB,KAAK,MAAM,EAAG,OAAM,IAAI,MAAM,yBAAyB;AACrF,QAAM,SAAS,KAAK,MAAM;AAC1B,SAAO,WAAW,KAAK,QAAQ,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AACvE;;;AClEA,SAAS,WAAW,UAAkB;AACpC,SACE,aAAa,eACb,aAAa,eACb,aAAa;AAEjB;AAEO,SAAS,gBAAgB,OAAiC;AAC/D,MAAI;AAEJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AAEA,QAAM,WAAW,OAAO,SAAS,YAAY;AAC7C,QAAM,WAAW,OAAO,SAAS,YAAY;AAC7C,QAAM,gBACH,OAAO,aAAa,MAAM,OAAO,aAAa,OAC/C,OAAO,WAAW,MAClB,OAAO,SAAS;AAElB,MAAI,aAAa,YAAY,aAAa,SAAS;AACjD,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,MAAI,aAAa,WAAW,CAAC,WAAW,QAAQ,GAAG;AACjD,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,MACE,CAAC,YACD,SAAS,SAAS,GAAG,KACrB,OAAO,aAAa,MACpB,OAAO,aAAa,MACpB,eACA;AACA,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AAEA,SAAO,GAAG,QAAQ,KAAK,OAAO,KAAK,YAAY,CAAC;AAClD;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,23 @@
+export { ChallengeResponse, ProofResult, PublicInputs, VEILPASS_ERROR_CODES, VeilPassErrorCode, VerifiedLogin, VerifyResult, challengeResponseSchema, proofResultSchema, publicInputsSchema, veilPassErrorCodeSchema, verifiedLoginSchema, verifyErrorSchema, verifyResultSchema } from './contracts.cjs';
+export { NormalizedOrigin, normalizeOrigin } from './origin.cjs';
+import 'zod';
+
+/**
+ * Canonical, 32-byte BN254 scalar encoding used by the Noir membership
+ * circuit. Values are kept as lowercase, unprefixed hex at API boundaries.
+ * Keeping this module free of Node APIs lets the hosted login use exactly the
+ * same encoding as the verifier.
+ */
+declare const BN254_SCALAR_MODULUS_HEX = "30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47";
+declare function canonicalFieldHex(value: string): string;
+declare function fieldHexToNoir(value: string): string;
+declare function fieldHexFromBytes(bytes: Uint8Array): string;
+/** Maps a SHA-256 digest into a 253-bit field value without a modulo bias. */
+declare function fieldHexFromDigest(bytes: Uint8Array): string;
+declare function u64ToFieldHex(value: number): string;
+declare function randomFieldHex(randomBytes: Uint8Array): string;
+declare function hashTextToFieldHex(value: string): Promise<string>;
+declare function hashBytesToFieldHex(value: Uint8Array): Promise<string>;
+declare function base64urlToBytes(value: string): Uint8Array;
+
+export { BN254_SCALAR_MODULUS_HEX, base64urlToBytes, canonicalFieldHex, fieldHexFromBytes, fieldHexFromDigest, fieldHexToNoir, hashBytesToFieldHex, hashTextToFieldHex, randomFieldHex, u64ToFieldHex };

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+export { ChallengeResponse, ProofResult, PublicInputs, VEILPASS_ERROR_CODES, VeilPassErrorCode, VerifiedLogin, VerifyResult, challengeResponseSchema, proofResultSchema, publicInputsSchema, veilPassErrorCodeSchema, verifiedLoginSchema, verifyErrorSchema, verifyResultSchema } from './contracts.js';
+export { NormalizedOrigin, normalizeOrigin } from './origin.js';
+import 'zod';
+
+/**
+ * Canonical, 32-byte BN254 scalar encoding used by the Noir membership
+ * circuit. Values are kept as lowercase, unprefixed hex at API boundaries.
+ * Keeping this module free of Node APIs lets the hosted login use exactly the
+ * same encoding as the verifier.
+ */
+declare const BN254_SCALAR_MODULUS_HEX = "30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47";
+declare function canonicalFieldHex(value: string): string;
+declare function fieldHexToNoir(value: string): string;
+declare function fieldHexFromBytes(bytes: Uint8Array): string;
+/** Maps a SHA-256 digest into a 253-bit field value without a modulo bias. */
+declare function fieldHexFromDigest(bytes: Uint8Array): string;
+declare function u64ToFieldHex(value: number): string;
+declare function randomFieldHex(randomBytes: Uint8Array): string;
+declare function hashTextToFieldHex(value: string): Promise<string>;
+declare function hashBytesToFieldHex(value: Uint8Array): Promise<string>;
+declare function base64urlToBytes(value: string): Uint8Array;
+
+export { BN254_SCALAR_MODULUS_HEX, base64urlToBytes, canonicalFieldHex, fieldHexFromBytes, fieldHexFromDigest, fieldHexToNoir, hashBytesToFieldHex, hashTextToFieldHex, randomFieldHex, u64ToFieldHex };

package/dist/index.js

@@ -0,0 +1,90 @@
+import {
+  VEILPASS_ERROR_CODES,
+  challengeResponseSchema,
+  proofResultSchema,
+  publicInputsSchema,
+  veilPassErrorCodeSchema,
+  verifiedLoginSchema,
+  verifyErrorSchema,
+  verifyResultSchema
+} from "./chunk-MX2GIROV.js";
+import {
+  normalizeOrigin
+} from "./chunk-LYZMDCUB.js";
+
+// src/field.ts
+var BN254_SCALAR_MODULUS_HEX = "30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47";
+var FIELD_HEX_LENGTH = 64;
+function canonicalFieldHex(value) {
+  const normalized = value.trim().replace(/^0x/i, "").toLowerCase();
+  if (!/^[0-9a-f]{1,64}$/.test(normalized)) throw new Error("Expected a field element encoded as at most 32 bytes of hex");
+  const padded = normalized.padStart(FIELD_HEX_LENGTH, "0");
+  if (padded >= BN254_SCALAR_MODULUS_HEX) throw new Error("Field element exceeds the BN254 scalar modulus");
+  return padded;
+}
+function fieldHexToNoir(value) {
+  return `0x${canonicalFieldHex(value)}`;
+}
+function fieldHexFromBytes(bytes) {
+  if (bytes.byteLength !== 32) throw new Error("Expected exactly 32 bytes for a field element");
+  return canonicalFieldHex(Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join(""));
+}
+function fieldHexFromDigest(bytes) {
+  if (bytes.byteLength !== 32) throw new Error("Expected a 32-byte digest");
+  const fieldBytes = Uint8Array.from(bytes);
+  fieldBytes[0] &= 31;
+  return fieldHexFromBytes(fieldBytes);
+}
+function u64ToFieldHex(value) {
+  if (!Number.isSafeInteger(value) || value < 0) throw new Error("Expected a non-negative safe integer");
+  const bytes = new Uint8Array(32);
+  let remaining = value;
+  for (let index = 31; index >= 0 && remaining > 0; index -= 1) {
+    bytes[index] = remaining % 256;
+    remaining = Math.floor(remaining / 256);
+  }
+  return fieldHexFromBytes(bytes);
+}
+function randomFieldHex(randomBytes) {
+  if (randomBytes.byteLength !== 32) throw new Error("Expected 32 random bytes");
+  const fieldBytes = Uint8Array.from(randomBytes);
+  fieldBytes[0] &= 31;
+  return fieldHexFromBytes(fieldBytes);
+}
+async function hashTextToFieldHex(value) {
+  return hashBytesToFieldHex(new TextEncoder().encode(value));
+}
+async function hashBytesToFieldHex(value) {
+  if (!globalThis.crypto?.subtle) throw new Error("Web Crypto is unavailable");
+  const digest = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new Uint8Array(value)));
+  return fieldHexFromDigest(digest);
+}
+function base64urlToBytes(value) {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(padded)) throw new Error("Invalid base64url value");
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+export {
+  BN254_SCALAR_MODULUS_HEX,
+  VEILPASS_ERROR_CODES,
+  base64urlToBytes,
+  canonicalFieldHex,
+  challengeResponseSchema,
+  fieldHexFromBytes,
+  fieldHexFromDigest,
+  fieldHexToNoir,
+  hashBytesToFieldHex,
+  hashTextToFieldHex,
+  normalizeOrigin,
+  proofResultSchema,
+  publicInputsSchema,
+  randomFieldHex,
+  u64ToFieldHex,
+  veilPassErrorCodeSchema,
+  verifiedLoginSchema,
+  verifyErrorSchema,
+  verifyResultSchema
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/field.ts"],"sourcesContent":["/**\r\n * Canonical, 32-byte BN254 scalar encoding used by the Noir membership\r\n * circuit. Values are kept as lowercase, unprefixed hex at API boundaries.\r\n * Keeping this module free of Node APIs lets the hosted login use exactly the\r\n * same encoding as the verifier.\r\n */\r\nexport const BN254_SCALAR_MODULUS_HEX = \"30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47\";\r\nconst FIELD_HEX_LENGTH = 64;\r\n\r\nexport function canonicalFieldHex(value: string): string {\r\n  const normalized = value.trim().replace(/^0x/i, \"\").toLowerCase();\r\n  if (!/^[0-9a-f]{1,64}$/.test(normalized)) throw new Error(\"Expected a field element encoded as at most 32 bytes of hex\");\r\n  const padded = normalized.padStart(FIELD_HEX_LENGTH, \"0\");\r\n  if (padded >= BN254_SCALAR_MODULUS_HEX) throw new Error(\"Field element exceeds the BN254 scalar modulus\");\r\n  return padded;\r\n}\r\n\r\nexport function fieldHexToNoir(value: string): string {\r\n  return `0x${canonicalFieldHex(value)}`;\r\n}\r\n\r\nexport function fieldHexFromBytes(bytes: Uint8Array): string {\r\n  if (bytes.byteLength !== 32) throw new Error(\"Expected exactly 32 bytes for a field element\");\r\n  return canonicalFieldHex(Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\"));\r\n}\r\n\r\n/** Maps a SHA-256 digest into a 253-bit field value without a modulo bias. */\r\nexport function fieldHexFromDigest(bytes: Uint8Array): string {\r\n  if (bytes.byteLength !== 32) throw new Error(\"Expected a 32-byte digest\");\r\n  const fieldBytes = Uint8Array.from(bytes);\r\n  fieldBytes[0] &= 0x1f;\r\n  return fieldHexFromBytes(fieldBytes);\r\n}\r\n\r\nexport function u64ToFieldHex(value: number): string {\r\n  if (!Number.isSafeInteger(value) || value < 0) throw new Error(\"Expected a non-negative safe integer\");\r\n  const bytes = new Uint8Array(32);\r\n  let remaining = value;\r\n  for (let index = 31; index >= 0 && remaining > 0; index -= 1) {\r\n    bytes[index] = remaining % 256;\r\n    remaining = Math.floor(remaining / 256);\r\n  }\r\n  return fieldHexFromBytes(bytes);\r\n}\r\n\r\nexport function randomFieldHex(randomBytes: Uint8Array): string {\r\n  if (randomBytes.byteLength !== 32) throw new Error(\"Expected 32 random bytes\");\r\n  const fieldBytes = Uint8Array.from(randomBytes);\r\n  fieldBytes[0] &= 0x1f;\r\n  return fieldHexFromBytes(fieldBytes);\r\n}\r\n\r\nexport async function hashTextToFieldHex(value: string): Promise<string> {\r\n  return hashBytesToFieldHex(new TextEncoder().encode(value));\r\n}\r\n\r\nexport async function hashBytesToFieldHex(value: Uint8Array): Promise<string> {\r\n  if (!globalThis.crypto?.subtle) throw new Error(\"Web Crypto is unavailable\");\r\n  const digest = new Uint8Array(await globalThis.crypto.subtle.digest(\"SHA-256\", new Uint8Array(value)));\r\n  return fieldHexFromDigest(digest);\r\n}\r\n\r\nexport function base64urlToBytes(value: string): Uint8Array {\r\n  const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\r\n  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, \"=\");\r\n  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(padded)) throw new Error(\"Invalid base64url value\");\r\n  const binary = atob(padded);\r\n  return Uint8Array.from(binary, (character) => character.charCodeAt(0));\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;AAMO,IAAM,2BAA2B;AACxC,IAAM,mBAAmB;AAElB,SAAS,kBAAkB,OAAuB;AACvD,QAAM,aAAa,MAAM,KAAK,EAAE,QAAQ,QAAQ,EAAE,EAAE,YAAY;AAChE,MAAI,CAAC,mBAAmB,KAAK,UAAU,EAAG,OAAM,IAAI,MAAM,6DAA6D;AACvH,QAAM,SAAS,WAAW,SAAS,kBAAkB,GAAG;AACxD,MAAI,UAAU,yBAA0B,OAAM,IAAI,MAAM,gDAAgD;AACxG,SAAO;AACT;AAEO,SAAS,eAAe,OAAuB;AACpD,SAAO,KAAK,kBAAkB,KAAK,CAAC;AACtC;AAEO,SAAS,kBAAkB,OAA2B;AAC3D,MAAI,MAAM,eAAe,GAAI,OAAM,IAAI,MAAM,+CAA+C;AAC5F,SAAO,kBAAkB,MAAM,KAAK,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AACnG;AAGO,SAAS,mBAAmB,OAA2B;AAC5D,MAAI,MAAM,eAAe,GAAI,OAAM,IAAI,MAAM,2BAA2B;AACxE,QAAM,aAAa,WAAW,KAAK,KAAK;AACxC,aAAW,CAAC,KAAK;AACjB,SAAO,kBAAkB,UAAU;AACrC;AAEO,SAAS,cAAc,OAAuB;AACnD,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,EAAG,OAAM,IAAI,MAAM,sCAAsC;AACrG,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,MAAI,YAAY;AAChB,WAAS,QAAQ,IAAI,SAAS,KAAK,YAAY,GAAG,SAAS,GAAG;AAC5D,UAAM,KAAK,IAAI,YAAY;AAC3B,gBAAY,KAAK,MAAM,YAAY,GAAG;AAAA,EACxC;AACA,SAAO,kBAAkB,KAAK;AAChC;AAEO,SAAS,eAAe,aAAiC;AAC9D,MAAI,YAAY,eAAe,GAAI,OAAM,IAAI,MAAM,0BAA0B;AAC7E,QAAM,aAAa,WAAW,KAAK,WAAW;AAC9C,aAAW,CAAC,KAAK;AACjB,SAAO,kBAAkB,UAAU;AACrC;AAEA,eAAsB,mBAAmB,OAAgC;AACvE,SAAO,oBAAoB,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AAC5D;AAEA,eAAsB,oBAAoB,OAAoC;AAC5E,MAAI,CAAC,WAAW,QAAQ,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAC3E,QAAM,SAAS,IAAI,WAAW,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,IAAI,WAAW,KAAK,CAAC,CAAC;AACrG,SAAO,mBAAmB,MAAM;AAClC;AAEO,SAAS,iBAAiB,OAA2B;AAC1D,QAAM,aAAa,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC7D,QAAM,SAAS,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS,CAAC,IAAI,GAAG,GAAG;AAC1E,MAAI,CAAC,yBAAyB,KAAK,MAAM,EAAG,OAAM,IAAI,MAAM,yBAAyB;AACrF,QAAM,SAAS,KAAK,MAAM;AAC1B,SAAO,WAAW,KAAK,QAAQ,CAAC,cAAc,UAAU,WAAW,CAAC,CAAC;AACvE;","names":[]}

package/dist/origin.cjs

@@ -0,0 +1,54 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/origin.ts
+var origin_exports = {};
+__export(origin_exports, {
+  normalizeOrigin: () => normalizeOrigin
+});
+module.exports = __toCommonJS(origin_exports);
+function isLoopback(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function normalizeOrigin(input) {
+  let parsed;
+  try {
+    parsed = new URL(input);
+  } catch {
+    throw new Error("Origin must be an absolute HTTP or HTTPS origin");
+  }
+  const protocol = parsed.protocol.toLowerCase();
+  const hostname = parsed.hostname.toLowerCase();
+  const hasExtraParts = parsed.pathname !== "" && parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "";
+  if (protocol !== "https:" && protocol !== "http:") {
+    throw new Error("Origin must use HTTP or HTTPS");
+  }
+  if (protocol === "http:" && !isLoopback(hostname)) {
+    throw new Error("Origin must use HTTPS outside local development");
+  }
+  if (!hostname || hostname.includes("*") || parsed.username !== "" || parsed.password !== "" || hasExtraParts) {
+    throw new Error("Origin must not include credentials, wildcards, or URL parts");
+  }
+  return `${protocol}//${parsed.host.toLowerCase()}`;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  normalizeOrigin
+});
+//# sourceMappingURL=origin.cjs.map

package/dist/origin.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/origin.ts"],"sourcesContent":["export type NormalizedOrigin = `${\"http\" | \"https\"}://${string}`;\n\nfunction isLoopback(hostname: string) {\n  return (\n    hostname === \"localhost\" ||\n    hostname === \"127.0.0.1\" ||\n    hostname === \"[::1]\"\n  );\n}\n\nexport function normalizeOrigin(input: string): NormalizedOrigin {\n  let parsed: URL;\n\n  try {\n    parsed = new URL(input);\n  } catch {\n    throw new Error(\"Origin must be an absolute HTTP or HTTPS origin\");\n  }\n\n  const protocol = parsed.protocol.toLowerCase();\n  const hostname = parsed.hostname.toLowerCase();\n  const hasExtraParts =\n    (parsed.pathname !== \"\" && parsed.pathname !== \"/\") ||\n    parsed.search !== \"\" ||\n    parsed.hash !== \"\";\n\n  if (protocol !== \"https:\" && protocol !== \"http:\") {\n    throw new Error(\"Origin must use HTTP or HTTPS\");\n  }\n  if (protocol === \"http:\" && !isLoopback(hostname)) {\n    throw new Error(\"Origin must use HTTPS outside local development\");\n  }\n  if (\n    !hostname ||\n    hostname.includes(\"*\") ||\n    parsed.username !== \"\" ||\n    parsed.password !== \"\" ||\n    hasExtraParts\n  ) {\n    throw new Error(\"Origin must not include credentials, wildcards, or URL parts\");\n  }\n\n  return `${protocol}//${parsed.host.toLowerCase()}` as NormalizedOrigin;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,SAAS,WAAW,UAAkB;AACpC,SACE,aAAa,eACb,aAAa,eACb,aAAa;AAEjB;AAEO,SAAS,gBAAgB,OAAiC;AAC/D,MAAI;AAEJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AAEA,QAAM,WAAW,OAAO,SAAS,YAAY;AAC7C,QAAM,WAAW,OAAO,SAAS,YAAY;AAC7C,QAAM,gBACH,OAAO,aAAa,MAAM,OAAO,aAAa,OAC/C,OAAO,WAAW,MAClB,OAAO,SAAS;AAElB,MAAI,aAAa,YAAY,aAAa,SAAS;AACjD,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,MAAI,aAAa,WAAW,CAAC,WAAW,QAAQ,GAAG;AACjD,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,MACE,CAAC,YACD,SAAS,SAAS,GAAG,KACrB,OAAO,aAAa,MACpB,OAAO,aAAa,MACpB,eACA;AACA,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AAEA,SAAO,GAAG,QAAQ,KAAK,OAAO,KAAK,YAAY,CAAC;AAClD;","names":[]}

package/dist/origin.d.cts

@@ -0,0 +1,4 @@
+type NormalizedOrigin = `${"http" | "https"}://${string}`;
+declare function normalizeOrigin(input: string): NormalizedOrigin;
+
+export { type NormalizedOrigin, normalizeOrigin };

package/dist/origin.d.ts

@@ -0,0 +1,4 @@
+type NormalizedOrigin = `${"http" | "https"}://${string}`;
+declare function normalizeOrigin(input: string): NormalizedOrigin;
+
+export { type NormalizedOrigin, normalizeOrigin };

package/dist/origin.js

@@ -0,0 +1,7 @@
+import {
+  normalizeOrigin
+} from "./chunk-LYZMDCUB.js";
+export {
+  normalizeOrigin
+};
+//# sourceMappingURL=origin.js.map

package/dist/origin.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@veilpass/shared",
+  "version": "0.1.0",
+  "description": "Public contracts and exact-origin helpers for VeilPass integrations.",
+  "license": "MIT",
+  "author": "Irham Tri Ahmadi <irhamtria@gmail.com>",
+  "repository": { "type": "git", "url": "git+https://github.com/irham3/veilpass.git", "directory": "frontend/packages/shared" },
+  "bugs": "https://github.com/irham3/veilpass/issues",
+  "homepage": "https://github.com/irham3/veilpass#readme",
+  "type": "module",
+  "sideEffects": false,
+  "files": ["dist", "README.md", "LICENSE"],
+  "exports": {
+    ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js", "require": "./dist/index.cjs" },
+    "./contracts": { "types": "./dist/contracts.d.ts", "import": "./dist/contracts.js", "require": "./dist/contracts.cjs" },
+    "./origin": { "types": "./dist/origin.d.ts", "import": "./dist/origin.js", "require": "./dist/origin.cjs" }
+  },
+  "types": "./dist/index.d.ts",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "scripts": { "build": "tsup src/index.ts src/contracts.ts src/origin.ts --format esm,cjs --dts --clean --sourcemap --tsconfig tsconfig.build.json" },
+  "dependencies": { "zod": "^4.4.3" },
+  "publishConfig": { "access": "public", "provenance": true }
+}