@zkproofport-ai/sdk 0.1.0 → 0.1.1

package/README.md

@@ -8,6 +8,23 @@ Client SDK for ZKProofport zero-knowledge proof generation on Base Mainnet.
 
 Proofs are generated in trusted execution environments (Nitro Enclaves) with cryptographic attestation. Payment is handled transparently via the x402 protocol using EIP-3009 (no user gas costs).
 
+## E2E Encryption (TEE Blind Relay)
+
+All proof inputs are **end-to-end encrypted** using X25519 ECDH + AES-256-GCM. The ZKProofport server acts as a **blind relay** — it cannot read your inputs, even during proof generation. Only the TEE (AWS Nitro Enclave) can decrypt.
+
+**How it works:**
+
+1. `generateProof()` requests a 402 payment challenge from the server
+2. The 402 response includes `teePublicKey` — the TEE's attested X25519 public key (cryptographically bound to the Nitro Enclave via COSE Sign1 attestation)
+3. The SDK generates an ephemeral X25519 keypair, performs ECDH key agreement, and encrypts all circuit inputs with AES-256-GCM
+4. The encrypted payload is sent to the server, which relays it blindly to the TEE
+5. The TEE decrypts, generates the ZK proof, and returns it
+
+**This is fully automatic.** `generateProof()` detects `teePublicKey` in the 402 response and applies E2E encryption when available. No additional configuration or code changes needed.
+
+- **TEE enabled (production):** Inputs are E2E encrypted. Server rejects plaintext (`PLAINTEXT_REJECTED`).
+- **TEE disabled (local dev):** Inputs are sent in plaintext. No encryption overhead.
+
 ## Installation
 
 ```bash
@@ -176,9 +193,10 @@ if (result.attestation) {
 2. Fetch Coinbase KYC attestation from EAS
 3. Build circuit inputs (Merkle tree, hashes)
 4. Request 402 payment challenge
-5. Sign EIP-3009 TransferWithAuthorization
-6. Submit payment via x402 facilitator
-7. Generate proof in TEE with payment proof
+5. **Auto-detect E2E encryption** — if `teePublicKey` is present in 402 response, encrypt inputs with X25519 ECDH + AES-256-GCM
+6. Sign EIP-3009 TransferWithAuthorization
+7. Submit payment via x402 facilitator
+8. Generate proof in TEE with payment proof (encrypted inputs if TEE enabled)
 
 **Result fields:**
 

package/dist/flow.d.ts

@@ -6,6 +6,11 @@ export interface FlowCallbacks {
 /**
  * Generate a ZK proof end-to-end using x402 single-step flow.
  *
+ * Automatically detects E2E encryption: if the server returns a TEE public key
+ * in the 402 challenge response (TEE mode = nitro), inputs are encrypted with
+ * the TEE's attested X25519 public key. Otherwise (TEE disabled), inputs are
+ * sent in plaintext.
+ *
  * @param config - Server URL and RPC endpoints
  * @param signers - ProofportSigner for attestation (required) and payment (optional, defaults to attestation)
  * @param params - Circuit name, scope, and optional country params

package/dist/flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../src/flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,YAAY,EAEZ,WAAW,EACX,WAAW,EACX,UAAU,EAEX,MAAM,YAAY,CAAC;AAMpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;CACrC;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE;IAAE,WAAW,EAAE,eAAe,CAAC;IAAC,OAAO,CAAC,EAAE,eAAe,CAAA;CAAE,EACpE,MAAM,EAAE,WAAW,EACnB,SAAS,CAAC,EAAE,aAAa,GACxB,OAAO,CAAC,WAAW,CAAC,CA0EtB"}
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../src/flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,YAAY,EAEZ,WAAW,EACX,WAAW,EACX,UAAU,EAEX,MAAM,YAAY,CAAC;AAMpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAKnD,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,IAAI,CAAC;CACrC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE;IAAE,WAAW,EAAE,eAAe,CAAC;IAAC,OAAO,CAAC,EAAE,eAAe,CAAA;CAAE,EACpE,MAAM,EAAE,WAAW,EACnB,SAAS,CAAC,EAAE,aAAa,GACxB,OAAO,CAAC,WAAW,CAAC,CA2FtB"}

package/dist/flow.js

@@ -3,11 +3,18 @@ import { CIRCUIT_NAME_MAP } from './types.js';
 import { requestChallenge } from './session.js';
 import { prepareInputs, computeSignalHash } from './inputs.js';
 import { makePayment } from './payment.js';
-import { submitProof } from './prove.js';
+import { submitProof, submitEncryptedProof } from './prove.js';
 import { USDC_ADDRESSES } from './constants.js';
+import { encryptForTee } from './tee.js';
+import { buildProverToml } from './toml.js';
 /**
  * Generate a ZK proof end-to-end using x402 single-step flow.
  *
+ * Automatically detects E2E encryption: if the server returns a TEE public key
+ * in the 402 challenge response (TEE mode = nitro), inputs are encrypted with
+ * the TEE's attested X25519 public key. Otherwise (TEE disabled), inputs are
+ * sent in plaintext.
+ *
  * @param config - Server URL and RPC endpoints
  * @param signers - ProofportSigner for attestation (required) and payment (optional, defaults to attestation)
  * @param params - Circuit name, scope, and optional country params
@@ -25,14 +32,14 @@ export async function generateProof(config, signers, params, callbacks) {
         callbacks?.onStep?.(result);
         return data;
     }
-    // Step 1: Sign signal hash with attestation signer
+    // Step 1: Sign signal hash
     let t = Date.now();
     const attestationAddress = await signers.attestation.getAddress();
     const signalHash = computeSignalHash(attestationAddress, scope, circuitId);
     const signalHashHex = ethers.hexlify(signalHash);
     const signature = await signers.attestation.signMessage(signalHash);
     recordStep(1, 'Sign Signal Hash', { signalHash: signalHashHex, signature }, t);
-    // Step 2: Prepare circuit inputs
+    // Step 2: Prepare inputs + build proverToml locally
     t = Date.now();
     const inputs = await prepareInputs(config, {
         circuitId,
@@ -42,11 +49,13 @@ export async function generateProof(config, signers, params, callbacks) {
         countryList: params.countryList,
         isIncluded: params.isIncluded,
     });
-    recordStep(2, 'Prepare Inputs', inputs, t);
-    // Step 3: Request 402 challenge (POST /prove without payment headers)
+    const proverToml = buildProverToml(circuitId, inputs);
+    recordStep(2, 'Prepare Inputs', { inputFields: Object.keys(inputs).length, tomlLength: proverToml.length }, t);
+    // Step 3: Request 402 challenge (without inputs — server only needs circuit)
     t = Date.now();
-    const challenge = await requestChallenge(config, params.circuit, inputs);
-    recordStep(3, 'Request Challenge', challenge, t);
+    const challenge = await requestChallenge(config, params.circuit);
+    const isE2E = !!challenge.teePublicKey;
+    recordStep(3, 'Request Challenge', { nonce: challenge.nonce, e2e: isE2E, keyId: challenge.teePublicKey?.keyId ?? null }, t);
     // Step 4: Make payment
     t = Date.now();
     const network = challenge.payment.network;
@@ -60,15 +69,30 @@ export async function generateProof(config, signers, params, callbacks) {
     };
     const paymentTxHash = await makePayment(paymentSigner, paymentInfo);
     recordStep(4, 'Make Payment', { txHash: paymentTxHash }, t);
-    // Step 5: Submit proof with payment headers
+    // Step 5: Submit proof (encrypted or plaintext based on TEE availability)
     t = Date.now();
-    const proveResponse = await submitProof(config, {
-        circuit: params.circuit,
-        inputs,
-        paymentTxHash,
-        paymentNonce: challenge.nonce,
-    });
-    recordStep(5, 'Generate Proof', proveResponse, t);
+    let proveResponse;
+    if (isE2E) {
+        // E2E path: encrypt inputs with TEE's attested public key
+        const encryptedPayload = encryptForTee(JSON.stringify({ circuitId, proverToml }), challenge.teePublicKey.publicKey);
+        proveResponse = await submitEncryptedProof(config, {
+            circuit: params.circuit,
+            encryptedPayload,
+            paymentTxHash,
+            paymentNonce: challenge.nonce,
+        });
+        recordStep(5, 'Generate Proof (E2E Encrypted)', proveResponse, t);
+    }
+    else {
+        // Standard path: send plaintext inputs (TEE disabled / local dev)
+        proveResponse = await submitProof(config, {
+            circuit: params.circuit,
+            inputs,
+            paymentTxHash,
+            paymentNonce: challenge.nonce,
+        });
+        recordStep(5, 'Generate Proof', proveResponse, t);
+    }
     return {
         proof: proveResponse.proof,
         publicInputs: proveResponse.publicInputs,

package/dist/flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"flow.js","sourceRoot":"","sources":["../src/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAShC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAMhD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAoB,EACpB,OAAoE,EACpE,MAAmB,EACnB,SAAyB;IAEzB,MAAM,SAAS,GAAc,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC;IAE1C,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC;IAE7D,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,SAAS,UAAU,CAAI,IAAY,EAAE,IAAY,EAAE,IAAO,EAAE,SAAiB;QAC3E,MAAM,MAAM,GAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,SAAS,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mDAAmD;IACnD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACnB,MAAM,kBAAkB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;IAClE,MAAM,UAAU,GAAG,iBAAiB,CAAC,kBAAkB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACpE,UAAU,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IAE/E,iCAAiC;IACjC,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACf,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE;QACzC,SAAS;QACT,WAAW,EAAE,kBAAkB;QAC/B,aAAa,EAAE,SAAS;QACxB,KAAK;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,UAAU,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAE3C,sEAAsE;IACtE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACf,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzE,UAAU,CAAC,CAAC,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAEjD,uBAAuB;IACvB,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACf,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,OAAiB,CAAC;IAEpD,MAAM,WAAW,GAAgB;QAC/B,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK;QAClC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACrD,KAAK,EAAE,cAAc,CAAC,OAAsC,CAAC;QAC7D,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO;QAClC,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,WAAW;KAC3C,CAAC;IAEF,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACpE,UAAU,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;IAE5D,4CAA4C;IAC5C,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACf,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE;QAC9C,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM;QACN,aAAa;QACb,YAAY,EAAE,SAAS,CAAC,KAAK;KAC9B,CAAC,CAAC;IACH,UAAU,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IAElD,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,YAAY,EAAE,aAAa,CAAC,YAAY;QACxC,eAAe,EAAE,aAAa,CAAC,eAAe;QAC9C,aAAa;QACb,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,YAAY,EAAE,aAAa,CAAC,YAAY;KACzC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../src/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAShC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAE/D,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAM5C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAoB,EACpB,OAAoE,EACpE,MAAmB,EACnB,SAAyB;IAEzB,MAAM,SAAS,GAAc,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC;IAC1C,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC;IAE7D,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,SAAS,UAAU,CAAI,IAAY,EAAE,IAAY,EAAE,IAAO,EAAE,SAAiB;QAC3E,MAAM,MAAM,GAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,SAAS,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2BAA2B;IAC3B,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACnB,MAAM,kBAAkB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;IAClE,MAAM,UAAU,GAAG,iBAAiB,CAAC,kBAAkB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACpE,UAAU,CAAC,CAAC,EAAE,kBAAkB,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IAE/E,oDAAoD;IACpD,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACf,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE;QACzC,SAAS;QACT,WAAW,EAAE,kBAAkB;QAC/B,aAAa,EAAE,SAAS;QACxB,KAAK;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACtD,UAAU,CAAC,CAAC,EAAE,gBAAgB,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAE/G,6EAA6E;IAC7E,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACf,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC;IACvC,UAAU,CAAC,CAAC,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAE5H,uBAAuB;IACvB,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACf,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,OAAiB,CAAC;IACpD,MAAM,WAAW,GAAgB;QAC/B,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK;QAClC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACrD,KAAK,EAAE,cAAc,CAAC,OAAsC,CAAC;QAC7D,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO;QAClC,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,WAAW;KAC3C,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACpE,UAAU,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;IAE5D,0EAA0E;IAC1E,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACf,IAAI,aAAa,CAAC;IAElB,IAAI,KAAK,EAAE,CAAC;QACV,0DAA0D;QAC1D,MAAM,gBAAgB,GAAG,aAAa,CACpC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EACzC,SAAS,CAAC,YAAa,CAAC,SAAS,CAClC,CAAC;QACF,aAAa,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE;YACjD,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,gBAAgB;YAChB,aAAa;YACb,YAAY,EAAE,SAAS,CAAC,KAAK;SAC9B,CAAC,CAAC;QACH,UAAU,CAAC,CAAC,EAAE,gCAAgC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,kEAAkE;QAClE,aAAa,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE;YACxC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM;YACN,aAAa;YACb,YAAY,EAAE,SAAS,CAAC,KAAK;SAC9B,CAAC,CAAC;QACH,UAAU,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO;QACL,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,YAAY,EAAE,aAAa,CAAC,YAAY;QACxC,eAAe,EAAE,aAAa,CAAC,eAAe;QAC9C,aAAa;QACb,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,YAAY,EAAE,aAAa,CAAC,YAAY;KACzC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export type { ClientConfig, CircuitName, CircuitId, PaymentInfo, PaymentRequirements, ChallengeResponse, ProveInputs, ProveRequest, ProveResponse, VerifyResult, EASAttestation, AttestationData, ProofParams, ProofResult, StepResult, } from './types.js';
+export type { ClientConfig, CircuitName, CircuitId, PaymentInfo, PaymentRequirements, ChallengeResponse, ProveInputs, ProveRequest, ProveResponse, VerifyResult, EASAttestation, AttestationData, ProofParams, ProofResult, StepResult, EncryptedProveRequest, } from './types.js';
 export { CIRCUIT_NAME_MAP, CIRCUIT_ID_MAP } from './types.js';
 export { CIRCUITS, COINBASE_ATTESTER_CONTRACT, AUTHORIZED_SIGNERS, USDC_ADDRESSES, } from './constants.js';
 export { createConfig } from './config.js';
@@ -6,9 +6,12 @@ export { generateProof } from './flow.js';
 export type { FlowCallbacks } from './flow.js';
 export { requestChallenge, createSession } from './session.js';
 export { makePayment } from './payment.js';
-export { submitProof } from './prove.js';
+export { submitProof, submitEncryptedProof } from './prove.js';
 export { verifyOnChain, verifyProof } from './verify.js';
 export { prepareInputs, computeSignalHash, computeScope, computeNullifier, recoverUserPubkey, hexToBytes, extractPubkeyCoordinates, } from './inputs.js';
+export { buildProverToml } from './toml.js';
+export { encryptForTee } from './tee.js';
+export type { EncryptedEnvelope } from './tee.js';
 export type { ProofportSigner } from './signer.js';
 export { EthersWalletSigner, fromEthersWallet, fromPrivateKey } from './signer.js';
 export { CdpWalletSigner } from './cdp.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,YAAY,EACZ,WAAW,EACX,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,cAAc,EACd,eAAe,EACf,WAAW,EACX,WAAW,EACX,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAG9D,OAAO,EACL,QAAQ,EACR,0BAA0B,EAC1B,kBAAkB,EAClB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGzD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAGrB,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGnF,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GACtB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,YAAY,EACZ,WAAW,EACX,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,cAAc,EACd,eAAe,EACf,WAAW,EACX,WAAW,EACX,UAAU,EACV,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAG9D,OAAO,EACL,QAAQ,EACR,0BAA0B,EAC1B,kBAAkB,EAClB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGzD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,YAAY,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAGlD,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGnF,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GACtB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -8,10 +8,14 @@ export { generateProof } from './flow.js';
 // Individual steps (for step-by-step usage)
 export { requestChallenge, createSession } from './session.js';
 export { makePayment } from './payment.js';
-export { submitProof } from './prove.js';
+export { submitProof, submitEncryptedProof } from './prove.js';
 export { verifyOnChain, verifyProof } from './verify.js';
 // Input computation
 export { prepareInputs, computeSignalHash, computeScope, computeNullifier, recoverUserPubkey, hexToBytes, extractPubkeyCoordinates, } from './inputs.js';
+// Prover.toml builder (for E2E encryption)
+export { buildProverToml } from './toml.js';
+// E2E Encryption
+export { encryptForTee } from './tee.js';
 export { EthersWalletSigner, fromEthersWallet, fromPrivateKey } from './signer.js';
 // CDP (Coinbase Developer Platform) signer
 export { CdpWalletSigner } from './cdp.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE9D,YAAY;AACZ,OAAO,EACL,QAAQ,EACR,0BAA0B,EAC1B,kBAAkB,EAClB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,gBAAgB;AAChB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,0BAA0B;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C,4CAA4C;AAC5C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEzD,oBAAoB;AACpB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEnF,2CAA2C;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C,cAAc;AACd,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAE1B,SAAS;AACT,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GACtB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE9D,YAAY;AACZ,OAAO,EACL,QAAQ,EACR,0BAA0B,EAC1B,kBAAkB,EAClB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,gBAAgB;AAChB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,0BAA0B;AAC1B,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C,4CAA4C;AAC5C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEzD,oBAAoB;AACpB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,2CAA2C;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,iBAAiB;AACjB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAKzC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEnF,2CAA2C;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C,cAAc;AACd,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAE1B,SAAS;AACT,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,qBAAqB,GACtB,MAAM,aAAa,CAAC"}

package/dist/prove.d.ts

@@ -1,4 +1,5 @@
 import type { ClientConfig, CircuitName, ProveInputs, ProveResponse } from './types.js';
+import type { EncryptedEnvelope } from './tee.js';
 /**
  * Submit proof generation with x402 payment headers.
  * POST /api/v1/prove with X-Payment-TX and X-Payment-Nonce headers.
@@ -9,4 +10,14 @@ export declare function submitProof(config: ClientConfig, request: {
     paymentTxHash: string;
     paymentNonce: string;
 }): Promise<ProveResponse>;
+/**
+ * Submit an E2E encrypted proof request.
+ * The server acts as a blind relay -- it cannot read the inputs.
+ */
+export declare function submitEncryptedProof(config: ClientConfig, request: {
+    circuit: CircuitName;
+    encryptedPayload: EncryptedEnvelope;
+    paymentTxHash: string;
+    paymentNonce: string;
+}): Promise<ProveResponse>;
 //# sourceMappingURL=prove.d.ts.map

package/dist/prove.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prove.d.ts","sourceRoot":"","sources":["../src/prove.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAExF;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE;IACP,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CAAC,aAAa,CAAC,CAqBxB"}
+{"version":3,"file":"prove.d.ts","sourceRoot":"","sources":["../src/prove.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAElD;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE;IACP,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CAAC,aAAa,CAAC,CAqBxB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE;IACP,OAAO,EAAE,WAAW,CAAC;IACrB,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CAAC,aAAa,CAAC,CA0BxB"}

package/dist/prove.js

@@ -22,4 +22,31 @@ export async function submitProof(config, request) {
     }
     return response.json();
 }
+/**
+ * Submit an E2E encrypted proof request.
+ * The server acts as a blind relay -- it cannot read the inputs.
+ */
+export async function submitEncryptedProof(config, request) {
+    const url = `${config.baseUrl}/api/v1/prove`;
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'X-Payment-TX': request.paymentTxHash,
+            'X-Payment-Nonce': request.paymentNonce,
+        },
+        body: JSON.stringify({
+            circuit: request.circuit,
+            encrypted_payload: request.encryptedPayload,
+        }),
+    });
+    if (!response.ok) {
+        const error = await response.json().catch(() => ({ message: `HTTP ${response.status}` }));
+        if (response.status === 409) {
+            throw new Error('TEE key rotated. Retry with a new 402 challenge to get the updated key.');
+        }
+        throw new Error(`Proof generation failed: ${JSON.stringify(error)}`);
+    }
+    return response.json();
+}
 //# sourceMappingURL=prove.js.map

package/dist/prove.js.map

@@ -1 +1 @@
-{"version":3,"file":"prove.js","sourceRoot":"","sources":["../src/prove.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAoB,EACpB,OAKC;IAED,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,cAAc,EAAE,OAAO,CAAC,aAAa;YACrC,iBAAiB,EAAE,OAAO,CAAC,YAAY;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAA4B,CAAC;AACnD,CAAC"}
+{"version":3,"file":"prove.js","sourceRoot":"","sources":["../src/prove.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAoB,EACpB,OAKC;IAED,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,cAAc,EAAE,OAAO,CAAC,aAAa;YACrC,iBAAiB,EAAE,OAAO,CAAC,YAAY;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAA4B,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAoB,EACpB,OAKC;IAED,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,cAAc,EAAE,OAAO,CAAC,aAAa;YACrC,iBAAiB,EAAE,OAAO,CAAC,YAAY;SACxC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,iBAAiB,EAAE,OAAO,CAAC,gBAAgB;SAC5C,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAE1F,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAA4B,CAAC;AACnD,CAAC"}

package/dist/session.d.ts

@@ -3,6 +3,6 @@ import type { ClientConfig, CircuitName, ChallengeResponse, ProveInputs } from '
  * Request a 402 payment challenge from the server.
  * POST /api/v1/prove without payment headers → 402 with nonce + payment info.
  */
-export declare function requestChallenge(config: ClientConfig, circuit: CircuitName, inputs: ProveInputs): Promise<ChallengeResponse>;
+export declare function requestChallenge(config: ClientConfig, circuit: CircuitName, inputs?: ProveInputs): Promise<ChallengeResponse>;
 export { requestChallenge as createSession };
 //# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE5F;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,iBAAiB,CAAC,CAc5B;AAGD,OAAO,EAAE,gBAAgB,IAAI,aAAa,EAAE,CAAC"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE5F;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,WAAW,EACpB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAc5B;AAGD,OAAO,EAAE,gBAAgB,IAAI,aAAa,EAAE,CAAC"}

package/dist/session.js

@@ -7,7 +7,7 @@ export async function requestChallenge(config, circuit, inputs) {
     const response = await fetch(url, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ circuit, inputs }),
+        body: JSON.stringify({ circuit, ...(inputs && { inputs }) }),
     });
     if (response.status !== 402) {
         const error = await response.json().catch(() => ({ message: `HTTP ${response.status}` }));

package/dist/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAoB,EACpB,OAAoB,EACpB,MAAmB;IAEnB,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,KAAM,KAAa,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAgC,CAAC;AACvD,CAAC;AAED,wEAAwE;AACxE,OAAO,EAAE,gBAAgB,IAAI,aAAa,EAAE,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAoB,EACpB,OAAoB,EACpB,MAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,eAAe,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,KAAM,KAAa,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClH,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAgC,CAAC;AACvD,CAAC;AAED,wEAAwE;AACxE,OAAO,EAAE,gBAAgB,IAAI,aAAa,EAAE,CAAC"}

package/dist/tee.d.ts

@@ -0,0 +1,15 @@
+/**
+ * TEE E2E Encryption -- Client-side X25519 ECDH + AES-256-GCM
+ */
+export interface EncryptedEnvelope {
+    ephemeralPublicKey: string;
+    iv: string;
+    ciphertext: string;
+    authTag: string;
+    keyId: string;
+}
+/**
+ * Encrypt a payload for the TEE using X25519 ECDH + AES-256-GCM.
+ */
+export declare function encryptForTee(plaintext: string, teePublicKeyHex: string): EncryptedEnvelope;
+//# sourceMappingURL=tee.d.ts.map

package/dist/tee.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee.d.ts","sourceRoot":"","sources":["../src/tee.ts"],"names":[],"mappings":"AAAA;;GAEG;AAaH,MAAM,WAAW,iBAAiB;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAUD;;GAEG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,iBAAiB,CAuB3F"}

package/dist/tee.js

@@ -0,0 +1,33 @@
+/**
+ * TEE E2E Encryption -- Client-side X25519 ECDH + AES-256-GCM
+ */
+import { createHash, generateKeyPairSync, diffieHellman, randomBytes, createCipheriv, createPublicKey, } from 'crypto';
+// ─── Encryption ─────────────────────────────────────────────────────────
+const X25519_SPKI_HEADER = Buffer.from('302a300506032b656e032100', 'hex');
+function computeKeyId(publicKeyHex) {
+    return createHash('sha256').update(Buffer.from(publicKeyHex, 'hex')).digest('hex').slice(0, 16);
+}
+/**
+ * Encrypt a payload for the TEE using X25519 ECDH + AES-256-GCM.
+ */
+export function encryptForTee(plaintext, teePublicKeyHex) {
+    const { publicKey: ephPublic, privateKey: ephPrivate } = generateKeyPairSync('x25519');
+    const ephPublicDer = ephPublic.export({ type: 'spki', format: 'der' });
+    const ephPublicRaw = ephPublicDer.subarray(12);
+    const teePubDer = Buffer.concat([X25519_SPKI_HEADER, Buffer.from(teePublicKeyHex, 'hex')]);
+    const teePubKeyObj = createPublicKey({ key: teePubDer, format: 'der', type: 'spki' });
+    const shared = diffieHellman({ publicKey: teePubKeyObj, privateKey: ephPrivate });
+    const aesKey = createHash('sha256').update(shared).digest();
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', aesKey, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    return {
+        ephemeralPublicKey: ephPublicRaw.toString('hex'),
+        iv: iv.toString('hex'),
+        ciphertext: encrypted.toString('hex'),
+        authTag: authTag.toString('hex'),
+        keyId: computeKeyId(teePublicKeyHex),
+    };
+}
+//# sourceMappingURL=tee.js.map

package/dist/tee.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tee.js","sourceRoot":"","sources":["../src/tee.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,cAAc,EACd,eAAe,GAChB,MAAM,QAAQ,CAAC;AAYhB,2EAA2E;AAE3E,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;AAE1E,SAAS,YAAY,CAAC,YAAoB;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,eAAuB;IACtE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACvF,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IACjF,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAE/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,YAAY,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtF,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAE5D,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO;QACL,kBAAkB,EAAE,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChD,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,YAAY,CAAC,eAAe,CAAC;KACrC,CAAC;AACJ,CAAC"}

package/dist/toml.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Prover.toml builder for client-side E2E encryption.
+ *
+ * Converts SDK ProveInputs to Prover.toml string format that the TEE's
+ * bb CLI can consume directly. This enables the client to build the complete
+ * proverToml locally, encrypt it with the TEE's public key, and send the
+ * encrypted blob — making the server a blind relay.
+ */
+import type { ProveInputs, CircuitId } from './types.js';
+/**
+ * Build a Prover.toml string from SDK ProveInputs.
+ *
+ * This is the client-side equivalent of the server's toProverToml().
+ * The output format must exactly match what the TEE's enclave-server.py expects.
+ *
+ * @param circuitId - Canonical circuit ID ('coinbase_attestation' or 'coinbase_country_attestation')
+ * @param inputs - Client-computed ProveInputs from prepareInputs()
+ * @returns Prover.toml content string
+ */
+export declare function buildProverToml(circuitId: CircuitId, inputs: ProveInputs): string;
+//# sourceMappingURL=toml.d.ts.map

package/dist/toml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toml.d.ts","sourceRoot":"","sources":["../src/toml.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA+DzD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CA8BjF"}

package/dist/toml.js

@@ -0,0 +1,102 @@
+/**
+ * Prover.toml builder for client-side E2E encryption.
+ *
+ * Converts SDK ProveInputs to Prover.toml string format that the TEE's
+ * bb CLI can consume directly. This enables the client to build the complete
+ * proverToml locally, encrypt it with the TEE's public key, and send the
+ * encrypted blob — making the server a blind relay.
+ */
+import { ethers } from 'ethers';
+// ─── Helpers ────────────────────────────────────────────────────────────
+function hexToBytes(hex) {
+    const clean = hex.startsWith('0x') ? hex.slice(2) : hex;
+    const bytes = [];
+    for (let i = 0; i < clean.length; i += 2) {
+        bytes.push(parseInt(clean.slice(i, i + 2), 16));
+    }
+    return bytes;
+}
+function padBytes(bytes, length) {
+    const padded = [...bytes];
+    while (padded.length < length) {
+        padded.push(0);
+    }
+    return padded;
+}
+function bytesToHexArray(bytes) {
+    const arr = Array.from(bytes);
+    return '[' + arr.map(b => '0x' + b.toString(16).padStart(2, '0')).join(', ') + ']';
+}
+function splitSignature(sig) {
+    const signature = ethers.Signature.from(sig);
+    const rBytes = hexToBytes(signature.r);
+    // Use _s to get raw s value, bypassing canonical check
+    const sValue = signature._s || signature.s;
+    const sBytes = hexToBytes(sValue);
+    return [...rBytes, ...sBytes];
+}
+function formatMerkleProof(proof, maxDepth) {
+    const paddedProof = [];
+    for (let i = 0; i < maxDepth; i++) {
+        if (i < proof.length) {
+            paddedProof.push(padBytes(hexToBytes(proof[i]), 32));
+        }
+        else {
+            paddedProof.push(new Array(32).fill(0));
+        }
+    }
+    const lines = paddedProof.map(entry => '    ' + bytesToHexArray(entry));
+    return '[\n' + lines.join(',\n') + '\n]';
+}
+function formatCountryList(countries, maxEntries) {
+    const paddedList = [];
+    for (let i = 0; i < maxEntries; i++) {
+        if (i < countries.length) {
+            paddedList.push([countries[i].charCodeAt(0), countries[i].charCodeAt(1)]);
+        }
+        else {
+            paddedList.push([0, 0]);
+        }
+    }
+    const lines = paddedList.map(entry => '    ' + bytesToHexArray(entry));
+    return '[\n' + lines.join(',\n') + '\n]';
+}
+// ─── Main Export ────────────────────────────────────────────────────────
+/**
+ * Build a Prover.toml string from SDK ProveInputs.
+ *
+ * This is the client-side equivalent of the server's toProverToml().
+ * The output format must exactly match what the TEE's enclave-server.py expects.
+ *
+ * @param circuitId - Canonical circuit ID ('coinbase_attestation' or 'coinbase_country_attestation')
+ * @param inputs - Client-computed ProveInputs from prepareInputs()
+ * @returns Prover.toml content string
+ */
+export function buildProverToml(circuitId, inputs) {
+    const lines = [];
+    lines.push(`signal_hash = ${bytesToHexArray(hexToBytes(inputs.signal_hash))}`);
+    lines.push(`signer_list_merkle_root = ${bytesToHexArray(hexToBytes(inputs.merkle_root))}`);
+    if (circuitId === 'coinbase_country_attestation') {
+        if (!inputs.country_list || inputs.is_included === undefined) {
+            throw new Error('country_list and is_included are required for coinbase_country_attestation');
+        }
+        lines.push(`country_list = ${formatCountryList(inputs.country_list, 10)}`);
+        lines.push(`country_list_length = ${inputs.country_list.length}`);
+        lines.push(`is_included = ${inputs.is_included}`);
+    }
+    lines.push(`scope = ${bytesToHexArray(hexToBytes(inputs.scope_bytes))}`);
+    lines.push(`nullifier = ${bytesToHexArray(hexToBytes(inputs.nullifier))}`);
+    lines.push(`user_address = ${bytesToHexArray(hexToBytes(inputs.user_address))}`);
+    lines.push(`user_signature = ${bytesToHexArray(splitSignature(inputs.signature))}`);
+    lines.push(`user_pubkey_x = ${bytesToHexArray(hexToBytes(inputs.user_pubkey_x))}`);
+    lines.push(`user_pubkey_y = ${bytesToHexArray(hexToBytes(inputs.user_pubkey_y))}`);
+    lines.push(`tx_length = ${inputs.tx_length}`);
+    lines.push(`raw_transaction = ${bytesToHexArray(padBytes(hexToBytes(inputs.raw_transaction), 300))}`);
+    lines.push(`coinbase_attester_pubkey_x = ${bytesToHexArray(hexToBytes(inputs.coinbase_attester_pubkey_x))}`);
+    lines.push(`coinbase_attester_pubkey_y = ${bytesToHexArray(hexToBytes(inputs.coinbase_attester_pubkey_y))}`);
+    lines.push(`coinbase_signer_merkle_proof = ${formatMerkleProof(inputs.merkle_proof, 8)}`);
+    lines.push(`coinbase_signer_leaf_index = ${inputs.leaf_index}`);
+    lines.push(`merkle_proof_depth = ${inputs.depth}`);
+    return lines.join('\n');
+}
+//# sourceMappingURL=toml.js.map

package/dist/toml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toml.js","sourceRoot":"","sources":["../src/toml.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhC,2EAA2E;AAE3E,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAe,EAAE,MAAc;IAC/C,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,KAA4B;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;AACrF,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvC,uDAAuD;IACvD,MAAM,MAAM,GAAI,SAAiB,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAe,EAAE,QAAgB;IAC1D,MAAM,WAAW,GAAe,EAAE,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YACrB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;AAC3C,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAmB,EAAE,UAAkB;IAChE,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;YACzB,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,OAAO,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;AAC3C,CAAC;AAED,2EAA2E;AAE3E;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,SAAoB,EAAE,MAAmB;IACvE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,iBAAiB,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,KAAK,CAAC,IAAI,CAAC,6BAA6B,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IAE3F,IAAI,SAAS,KAAK,8BAA8B,EAAE,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,kBAAkB,iBAAiB,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3E,KAAK,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,WAAW,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IACzE,KAAK,CAAC,IAAI,CAAC,eAAe,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,kBAAkB,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,CAAC,oBAAoB,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;IACpF,KAAK,CAAC,IAAI,CAAC,mBAAmB,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,KAAK,CAAC,IAAI,CAAC,mBAAmB,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,qBAAqB,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACtG,KAAK,CAAC,IAAI,CAAC,gCAAgC,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7G,KAAK,CAAC,IAAI,CAAC,gCAAgC,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7G,KAAK,CAAC,IAAI,CAAC,kCAAkC,iBAAiB,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1F,KAAK,CAAC,IAAI,CAAC,gCAAgC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAEnD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/types.d.ts

@@ -41,6 +41,11 @@ export interface ChallengeResponse {
     message: string;
     nonce: string;
     payment: PaymentRequirements;
+    teePublicKey?: {
+        publicKey: string;
+        keyId: string;
+        attestationDocument: string | null;
+    } | null;
 }
 export interface ProveInputs {
     signal_hash: string;
@@ -63,7 +68,17 @@ export interface ProveInputs {
 }
 export interface ProveRequest {
     circuit: CircuitName;
-    inputs: ProveInputs;
+    inputs?: ProveInputs;
+    encrypted_payload?: EncryptedProveRequest['encrypted_payload'];
+}
+export interface EncryptedProveRequest {
+    encrypted_payload: {
+        ephemeralPublicKey: string;
+        iv: string;
+        ciphertext: string;
+        authTag: string;
+        keyId: string;
+    };
 }
 export interface ProveResponse {
     proof: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,uCAAuC;AACvC,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,kBAAkB,CAAC;AAE9D,uDAAuD;AACvD,MAAM,MAAM,SAAS,GAAG,sBAAsB,GAAG,8BAA8B,CAAC;AAEhF,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,CAG3D,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,CAGzD,CAAC;AAIF,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAID,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAID,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B,EAAE,MAAM,CAAC;IACnC,0BAA0B,EAAE,MAAM,CAAC;IACnC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE;YACZ,WAAW,EAAE,OAAO,CAAC;YACrB,UAAU,EAAE,OAAO,CAAC;YACpB,cAAc,EAAE,OAAO,CAAC;YACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC9B,CAAC;KACH,GAAG,IAAI,CAAC;IACT,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,YAAY,EAAE;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,eAAe,EAAE,MAAM,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAAC;CACV;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,cAAc,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;CACxB;AAID,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,WAAW,CAAC;IACrB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iEAAiE;IACjE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChC,YAAY,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CAC7C;AAID,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,CAAC;IACR,UAAU,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,uCAAuC;AACvC,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,kBAAkB,CAAC;AAE9D,uDAAuD;AACvD,MAAM,MAAM,SAAS,GAAG,sBAAsB,GAAG,8BAA8B,CAAC;AAEhF,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,CAG3D,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,CAGzD,CAAC;AAIF,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAID,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,mBAAmB,CAAC;IAC7B,YAAY,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;KACpC,GAAG,IAAI,CAAC;CACV;AAID,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B,EAAE,MAAM,CAAC;IACnC,0BAA0B,EAAE,MAAM,CAAC;IACnC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iBAAiB,CAAC,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;CAChE;AAID,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE;QACjB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE;YACZ,WAAW,EAAE,OAAO,CAAC;YACrB,UAAU,EAAE,OAAO,CAAC;YACpB,cAAc,EAAE,OAAO,CAAC;YACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC9B,CAAC;KACH,GAAG,IAAI,CAAC;IACT,MAAM,EAAE;QACN,OAAO,EAAE,MAAM,CAAC;QAChB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,YAAY,EAAE;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,eAAe,EAAE,MAAM,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAAC;CACV;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,cAAc,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;CACxB;AAID,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,WAAW,CAAC;IACrB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iEAAiE;IACjE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChC,YAAY,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;CAC7C;AAID,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,CAAC;IACR,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zkproofport-ai/sdk",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Client SDK for ZKProofport proof generation",
   "type": "module",
   "main": "dist/index.js",