@zkproofport-ai/sdk 0.3.0 → 0.4.1

package/README.md

@@ -1,8 +1,8 @@
 # @zkproofport-ai/sdk
 
-Client SDK for ZKProofport zero-knowledge proofs, including experimental exact-action authorization on Arc Testnet.
+Client SDK for ZKProofport zero-knowledge proofs, including experimental exact-action authorization with `giwa_attestation` on GIWA Sepolia.
 
-The shared `hashTypedAction` helper is available from **SDK 0.2.12**. Arc/GIWA optional actions require **SDK 0.2.14 or later**; MCP stepwise input preparation requires **MCP 0.2.15 or later**. Release Please owns the versions. Confirm the resolved npm versions before using this path.
+The shared `hashTypedAction` helper is available from **SDK 0.2.12**. GIWA optional actions require **SDK 0.2.14 or later**; MCP stepwise input preparation requires **MCP 0.2.15 or later**. Release Please owns the versions. Confirm the resolved npm versions before using this path.
 
 Human action approval requires SDK **0.3.0 or later** and a compatible AI service with the approval API enabled. For the CLI/MCP flow, use MCP **0.3.0 or later** as well. Earlier releases that support action hashing do not implement this approval lifecycle. Action requests now pause for human approval; handle `ActionApprovalRequiredError` and resume as shown below.
 
@@ -17,7 +17,7 @@ ZKProofport has a TEE-based proving architecture. Enclave encryption and hardwar
 A service tells you what it charges. Ask for a proof and the answer is either
 the proof or a `402` listing the chains it takes USDC on — you pick one.
 
-For supported x402 offers, the payer signs an authorization and the payment rail settles it. Arc Gateway nanopayments spend an already funded Gateway balance; its initial deposit is an on-chain transaction requiring gas. A USDC wallet balance alone is insufficient for nanopayments. Wallet, chain and signing-domain compatibility must match the actual offer.
+For supported x402 offers, the payer signs an authorization and the payment rail settles it. Wallet, chain and signing-domain compatibility must match the actual offer.
 
 Supported payment-wallet adapters:
 
@@ -26,9 +26,7 @@ import {
   generateProof,
   walletFromPrivateKey,   // a raw key
   walletFromCdp,          // a Coinbase CDP server wallet
-  walletFromCircle,      // a Circle developer-controlled wallet
-  walletFromArcAgent,    // an existing Circle Agent Wallet through Circle CLI
-  walletFor,            // walletFor('arc') selects the same adapter from environment
+  walletFor,              // walletFor('key' | 'cdp') builds one from environment
 } from '@zkproofport-ai/sdk';
 
 const proof = await generateProof(
@@ -64,14 +62,13 @@ never quietly pays on a different one.
 From the command line:
 
 ```bash
-zkproofport-prove coinbase_kyc --pay-with circle --pay-on <chain>
+zkproofport-prove coinbase_kyc --pay-with key --pay-on <chain>
 zkproofport-prove coinbase_kyc --pay-with cdp
 ```
 
 `--pay-with cdp` needs `CDP_API_KEY_ID`, `CDP_API_KEY_SECRET` and
-`CDP_WALLET_SECRET`; `--pay-with circle` needs `CIRCLE_API_KEY`,
-`CIRCLE_ENTITY_SECRET` and `CIRCLE_WALLET_ID`; `--pay-with key` needs
-`PAYMENT_PRIVATE_KEY`. For the existing Circle Agent Wallet, explicitly select `--pay-with arc`; Circle CLI owns the login, and `ARC_AGENT_WALLET` selects its wallet. With exactly one key/CDP/developer-controlled wallet configured you can omit
+`CDP_WALLET_SECRET`; `--pay-with key` needs `PAYMENT_PRIVATE_KEY`. These are
+the only two payment wallets. With exactly one of them configured you can omit
 the flag. With more than one, naming it is required — a wallet is money, and
 guessing which account it leaves is not a default worth having.
 
@@ -79,7 +76,7 @@ guessing which account it leaves is not a default worth having.
 
 When the selected endpoint supplies a supported attested `teePublicKey`, the SDK encrypts inputs with X25519 ECDH + AES-256-GCM. The host relays ciphertext to the enclave; Nitro mode rejects plaintext inputs. Validate the returned attestation against the required trust policy.
 
-An endpoint without that key receives readable circuit inputs over HTTPS and provides no hardware-attestation guarantee. The current Arc staging demo uses that mode. HTTPS transport encryption does not make the prover a blind relay. A valid public proof can hide the credential-holder address from the relying dApp without establishing enclave execution. Only claim hardware-attested proving when the actual attestation supports it.
+An endpoint without that key receives readable circuit inputs over HTTPS and provides no hardware-attestation guarantee. The current GCP Cloud Run deployments use that mode. HTTPS transport encryption does not make the prover a blind relay. A valid public proof can hide the credential-holder address from the relying dApp without establishing enclave execution. Only claim hardware-attested proving when the actual attestation supports it.
 
 ## Installation
 
@@ -87,7 +84,7 @@ An endpoint without that key receives readable circuit inputs over HTTPS and pro
 npm install @zkproofport-ai/sdk@latest ethers
 ```
 
-Use **SDK 0.2.14 or later** and **MCP 0.2.15 or later** for both Arc/GIWA signature modes, including stepwise preparation. Install from npm and check the resolved version. Release Please manages package versions and the release workflow publishes them; repository source changes alone do not update `@latest`.
+Use **SDK 0.2.14 or later** and **MCP 0.2.15 or later** for both GIWA signature modes, including stepwise preparation. Install from npm and check the resolved version. Release Please manages package versions and the release workflow publishes them; repository source changes alone do not update `@latest`.
 
 ## Prerequisites
 
@@ -95,15 +92,15 @@ Use **SDK 0.2.14 or later** and **MCP 0.2.15 or later** for both Arc/GIWA signat
 
 1. **Coinbase account with KYC verification** — Complete identity verification on [Coinbase](https://www.coinbase.com/)
 2. **Coinbase KYC EAS attestation on Base** — Obtain an attestation via [Coinbase Verifications](https://www.coinbase.com/onchain-verify). This creates an on-chain EAS attestation on Base linked to your wallet address.
-3. **Credential signer for proofs without an action** — A local signer for the wallet holding the EAS attestation. The CLI uses `ATTESTATION_KEY`; programmatic callers can supply a compatible `ProofportSigner`. An Arc/GIWA action instead requires the credential holder to connect a wallet and sign through the approval page. Keep key material outside model context.
+3. **Credential signer for proofs without an action** — A local signer for the wallet holding the EAS attestation. The CLI uses `ATTESTATION_KEY`; programmatic callers can supply a compatible `ProofportSigner`. A GIWA action instead requires the credential holder to connect a wallet and sign through the approval page. Keep key material outside model context.
 
 **For OIDC circuits** (`oidc_domain`): No wallet or attestation needed — just a JWT `id_token` from your OIDC provider.
 
 **For GIWA** (`giwa_attestation`): an attestation from GIWA's attester on **GIWA Sepolia**, and control of that wallet. Without an action, supply its local signer; with an action, the person connects that wallet on the approval page. The attestation must belong to the wallet signing the proof request on the chain the circuit reads.
 
-**For the circuits that can bind an action** (`arc_eligibility`, `giwa_attestation`): the attestation above for whichever one you ask for. What differs is what the wallet signs, and the action is **optional** — see below.
+**For the circuit that can bind an action** (`giwa_attestation`): the GIWA attestation above. What differs is what the wallet signs, and the action is **optional** — see below.
 
-**One wallet has a different nullifier per circuit, and for the circuits above it does not depend on what you signed.** `arc_eligibility` and `giwa_attestation` derive it from your address, the circuit's own identifier and the scope, so the same wallet in the same scope gives the same nullifier whether or not you bind an action. The Coinbase circuits derive theirs from the signed challenge instead. Nothing to configure — the SDK picks the rule the circuit expects, and refuses a circuit it has no rule for rather than guessing one. Requires **0.2.14 or later**; earlier versions sent the Coinbase rule for every circuit, which a GIWA proof rejects as a nullifier mismatch.
+**One wallet has a different nullifier per circuit, and for `giwa_attestation` it does not depend on what you signed.** `giwa_attestation` derives it from your address, the circuit's own identifier and the scope, so the same wallet in the same scope gives the same nullifier whether or not you bind an action. The Coinbase circuits derive theirs from the signed challenge instead. Nothing to configure — the SDK picks the rule the circuit expects, and refuses a circuit it has no rule for rather than guessing one. Requires **0.2.14 or later**; earlier versions sent the Coinbase rule for every circuit, which a GIWA proof rejects as a nullifier mismatch.
 
 ## Quick Start
 
@@ -128,16 +125,15 @@ console.log('Valid:', verification.valid);
 
 > **Experimental. Testnet only.**
 >
-> Two circuits can bind an action, both on testnets and neither generally available:
+> One circuit can bind an action, on a testnet and not generally available:
 >
 > | Circuit | Chain | Verifier |
 > |---|---|---|
-> | `arc_eligibility` | Arc Testnet, 5042002 | `0x2aEB66292f631ceb6225ffA2439B1f2b4b15e44a` |
 > | `giwa_attestation` | GIWA Sepolia, 91342 | `0x5Da234546874304F8c51BBEed00fC632938211c1` |
 >
-> The Ledger House EligibilityGate on Arc is `0xD0F3eE648386B59B484157332E736388Fcc41F47`. Public-input layouts and deployments may change; do not put either in front of real funds. Generally available: `coinbase_kyc`, `coinbase_country`, `oidc_domain`.
+> Public-input layouts and deployments may change; do not put it in front of real funds. Generally available: `coinbase_kyc`, `coinbase_country`, `oidc_domain`.
 >
-> **The action is optional on both.** Send one and the SDK pauses for a human to connect a wallet and sign the exact typed data. Send none and the supplied credential signer signs the request's signal hash as before. Supplying `ATTESTATION_KEY` does not bypass action approval.
+> **The action is optional.** Send one and the SDK pauses for a human to connect a wallet and sign the exact typed data. Send none and the supplied credential signer signs the request's signal hash as before. Supplying `ATTESTATION_KEY` does not bypass action approval.
 
 ### The problem it solves
 
@@ -168,13 +164,13 @@ import {
 } from '@zkproofport-ai/sdk';
 
 const params: ProofParams = {
-    circuit: 'arc_eligibility',
+    circuit: 'giwa_attestation',
     scope: 'my-app',
     action: {
       domain: {
         name: 'MyVault',
         version: '1',
-        chainId: 5042002,
+        chainId: 91342,
         verifyingContract: vaultAddress,   // binds the signature to ONE contract
       },
       types: {
@@ -231,14 +227,14 @@ not expire the EIP-712 signature on chain. The relying contract must enforce
 the action's own nonce and deadline. This flow supports EOA credential wallets;
 contract-wallet signature verification is outside the current circuit.
 
-Ask for `giwa_attestation` instead to use the credential wallet's GIWA Sepolia
-attestation. The action domain names the relying contract's execution chain;
+`giwa_attestation` uses the credential wallet's GIWA Sepolia attestation. The
+action domain names the relying contract's execution chain;
 it is independent of the chain used for attestation lookup or proof payment.
 The approval page asks the wallet to use the action's declared chain.
 
 The wallet renders `amount`, `nonce` and `expiry` by name for the person to
 read. Two 32-byte hashes reach the circuit — the EIP-712 domain separator and
-the hash of the action — and the circuit proves the KYC'd key signed them. It
+the hash of the action — and the circuit proves the attested key signed them. It
 never learns what the action was, so nothing about vaults or USDC is baked into
 it: a grant of authority or an agreement in prose works the same way.
 
@@ -278,63 +274,29 @@ one byte each:
 | `scope` | 128–159 |
 | `nullifier` | 160–191 |
 
-`signal_hash` is still present, and nobody signs it: the nullifier derives from
-it, exactly as on the other Coinbase circuits. Deriving the nullifier from the
-signed action instead would give a different nullifier per action and destroy
-the one-per-person property it exists for.
+`signal_hash` is zero when an action is bound. The nullifier derives from the
+wallet, the circuit id and the scope, not from the signed action: deriving it
+from the action would give a different nullifier per action and destroy the
+one-per-person property it exists for.
 
 ### Omitting `action`
 
-Both `arc_eligibility` and `giwa_attestation` accept an omitted action and retain their local `personal_sign` path. Coinbase circuits reject `action` and retain their existing signing path; OIDC rejects `action` and uses its JWT flow without wallet signing. For action proofs, the application must verify the exact target, operational wallet, amount, nonce and deadline as well as the proof.
+`giwa_attestation` accepts an omitted action and retains its local `personal_sign` path. Coinbase circuits reject `action` and retain their existing signing path; OIDC rejects `action` and uses its JWT flow without wallet signing. For action proofs, the application must verify the exact target, actor, amount, nonce and deadline as well as the proof.
 
-## Arc Circle Agent Wallet path — EXPERIMENTAL
+### Approving the exact payment
 
-Use the existing Circle CLI login and selected Arc Agent Wallet; do not create or switch wallets as part of proof generation. Install the CLI if needed, then let the user complete any missing login locally. Credential holder A connects their wallet on the human approval page; this action flow does not load A's `ATTESTATION_KEY`. Keep credential data and Circle login secrets outside model context and ordinary logs.
-
-```bash
-npm install -g @circle-fin/cli
-circle wallet list --chain ARC-TESTNET --type agent
-# Set ARC_AGENT_WALLET to the user's existing, approved wallet B address.
-circle gateway balance --address "$ARC_AGENT_WALLET" --chain ARC-TESTNET --output json
-# Only when the user has approved this funding amount:
-circle gateway deposit --amount 0.1 --address "$ARC_AGENT_WALLET" --chain ARC-TESTNET --method direct
-```
-
-For the live Gateway batched offer, SDK `signPayment` uses `@circle-fin/x402-batching` and the Circle CLI wallet adapter. It signs the Gateway authorization against the offer’s Gateway signing domain and spends the existing funded Gateway balance. The payment adapter uses the agent smart-wallet address for direct USDC payments (`arc-testnet`, verified through ERC-1271) and Circle's backing EOA for Gateway authorization (`arc-testnet-nano`). `wallet.address` is the on-chain owner; `wallet.gatewayAddress` identifies the separate Gateway depositor, and `signPayment` selects the correct owner for the chosen offer. The operational smart-wallet address remains Wallet B for the action and stake; do not substitute the backing EOA into the action's `delegate` field. `walletFromArcAgent({address: process.env.ARC_AGENT_WALLET, chain: 'ARC-TESTNET'})` and `walletFor('arc')` provide the same payment path.
-
-After the user reviews the action and the live x402 offer, save those exact approved objects locally as `approved-action.json` and `approved-payment.json`:
-
-```typescript
-import { readFile } from 'node:fs/promises';
-import {
-  createConfig, verifyProof, walletFor,
-  type ProofParams, type ApprovedPayment,
-} from '@zkproofport-ai/sdk';
-
-const config = createConfig({baseUrl: 'https://stg-ai.zkproofport.app'});
-const action: NonNullable<ProofParams['action']> = JSON.parse(await readFile('approved-action.json', 'utf8'));
-const approvedPayment: ApprovedPayment = JSON.parse(await readFile('approved-payment.json', 'utf8'));
-// generateWithHumanApproval is the bounded catch/poll/resume helper above.
-const result = await generateWithHumanApproval(config, await walletFor('arc'), {
-  circuit: 'arc_eligibility', scope: 'ledger-house', action,
-  payOn: 'arc-testnet-nano', maxPayment: '0.001', approvedPayment,
-});
-const verification = await verifyProof(result);
-if (!verification.valid) throw new Error('Arc verifier rejected the proof');
-```
-
-`approvedPayment` pins the selected live offer's `network`, `scheme`, `amount`, `asset`, `payTo`, and signing domain `extra: {name, version, verifyingContract}`. For direct `exact` EIP-3009 payments (Base, Ethereum and Arc), set the approved `extra.verifyingContract` to the offer's `asset`: the standard offer may omit `extra.verifyingContract` because the token is the signing contract. For Circle Gateway (`GatewayWalletBatched`, version `1`), copy the required `extra.verifyingContract` from the offer; never substitute the token address. Missing or conflicting domain information and unsupported transfer methods such as Permit2 are rejected. `amount` is an integer string in USDC base units (`"1000"` is 0.001 USDC); `maxPayment` is a decimal USDC string (`"0.001"`). A changed fee, recipient, asset, network or signing domain is rejected before payment signing. Approve the actual offer; do not manufacture its recipient or domain from a documentation example.
+Pass `maxPayment` and `approvedPayment` in `ProofParams`. `approvedPayment` pins the selected live offer's `network`, `scheme`, `amount`, `asset`, `payTo`, and signing domain `extra: {name, version, verifyingContract}`. For `exact` EIP-3009 payments (Base and Ethereum), set the approved `extra.verifyingContract` to the offer's `asset`: the standard offer may omit `extra.verifyingContract` because the token is the signing contract. Missing or conflicting domain information, Circle Gateway batched domains and unsupported transfer methods such as Permit2 are rejected. `amount` is an integer string in USDC base units (`"1000"` is 0.001 USDC); `maxPayment` is a decimal USDC string (`"0.001"`). A changed fee, recipient, asset, network or signing domain is rejected before payment signing. Approve the actual offer; do not manufacture its recipient or domain from a documentation example.
 
 ### Action object: caller-owned types, keys and values
 
-Both `generateProof`/`generate_proof` and Arc input preparation use this complete `TypedAction` shape:
+Both `generateProof`/`generate_proof` and stepwise input preparation use this complete `TypedAction` shape:
 
 | Field | Type | Meaning |
 |---|---|---|
 | `domain` | object | EIP-712 signing context; all four fields below are required. |
 | `domain.name` | non-empty string | Application/domain name agreed with the verifier. |
 | `domain.version` | non-empty string | Signing-domain version. |
-| `domain.chainId` | integer number | Target chain ID, such as `5042002`. |
+| `domain.chainId` | integer number | Target chain ID, such as `91342`. |
 | `domain.verifyingContract` | string | 20-byte `0x` contract address bound by the signature. |
 | `types` | object | Map from caller-chosen struct names to arrays of field declarations. Omit `EIP712Domain`; ethers derives it from `domain`. |
 | `types[structName]` | array of objects | Ordered fields; each declaration has `name` and `type`. Include referenced nested structs. |
@@ -347,47 +309,6 @@ No SDK action registry restricts business-specific struct names, field names or
 
 Use decimal **integer strings** for JSON integer message values, especially `uint256` (for example `"10000000"`); JSON cannot represent `bigint`, and large JavaScript numbers can lose precision. Addresses/bytes are `0x` strings, booleans remain JSON booleans, and nested values follow their declared types. `domain.chainId` remains an integer JSON number.
 
-### Full 10-USDC Ledger House Gate action
-
-This valid JSON shows the Gate's exact five-field schema. The example delegate is a public placeholder for Wallet B: replace it with the approved operational smart-wallet address, choose a future approved Unix-seconds deadline and a fresh nonce, then review the whole object. Never include the private credential-holder A's address or key in it.
-
-```json
-{
-  "domain": {
-    "name": "Ledger House Staking",
-    "version": "1",
-    "chainId": 5042002,
-    "verifyingContract": "0xD0F3eE648386B59B484157332E736388Fcc41F47"
-  },
-  "types": {
-    "CredentialDelegation": [
-      { "name": "delegate", "type": "address" },
-      { "name": "action", "type": "string" },
-      { "name": "amount", "type": "uint256" },
-      { "name": "expiresAt", "type": "uint256" },
-      { "name": "nonce", "type": "string" }
-    ]
-  },
-  "primaryType": "CredentialDelegation",
-  "message": {
-    "delegate": "0x0000000000000000000000000000000000000001",
-    "action": "stake",
-    "amount": "10000000",
-    "expiresAt": "2000000000",
-    "nonce": "replace-with-fresh-user-approved-nonce"
-  }
-}
-```
-
-`"10000000"` means **10 USDC** (6 decimals). The proof fee is separate: **0.001 USDC**, or `"1000"` base units. `delegate` and `CredentialDelegation` are established wire names for exact-action authorization: A authorizes this operation by B; B does not inherit A's identity or KYC credential. User approval covers the exact action and live proof-payment terms, followed by separate approval of the actual stake transaction.
-
-The exported SDK `buildDelegationAction` helper is a legacy generic four-field schema (`delegate`, `action`, `expiresAt`, `nonce`). It **does not include `amount` and is not compatible with this staking Gate**. Its existing wire hash remains unchanged. Build the explicit five-field `TypedAction` above for the Gate; arbitrary custom actions remain valid SDK inputs but require a verifier that understands them.
-
-
-Generating and verifying a proof does not submit a stake. After a separate stake approval, the operational wallet calls the dApp gate, which verifies the proof and enforces its policy, exact action, unused nonce and deadline atomically. Check the receipt before reporting a position change.
-
-The MCP `gateway_balance` and `deposit_to_gateway` helpers currently require `PAYMENT_PRIVATE_KEY`; they do not operate the Circle Agent Wallet. Use the Circle CLI commands above for that wallet. SDK `gatewayBalance` / `ensureGatewayBalance` likewise accept the private-key `NanopaymentWallet` shape. This path documents the supported Arc Testnet offer, not a guarantee for every wallet on every chain.
-
 ## Configuration
 
 ```typescript
@@ -485,7 +406,7 @@ if (verification.valid) {
 
 ## Step-by-Step API
 
-For Arc/GIWA actions, obtain human approval before preparing inputs. `prepareInputs` needs the camelCase hashes to recover A's public key from the approved EIP-712 digest; it does not add those hashes to its returned object. Attach the snake_case fields for submission. `signal_hash` is still computed internally for nullifier derivation and is not the action signing message. Low-level witness APIs accept signatures but cannot establish who operated the signing wallet.
+For GIWA actions, obtain human approval before preparing inputs. `prepareInputs` needs the camelCase hashes to recover A's public key from the approved EIP-712 digest; it does not add those hashes to its returned object. Attach the snake_case fields for submission. `signal_hash` is still computed internally for nullifier derivation and is not the action signing message. Low-level witness APIs accept signatures but cannot establish who operated the signing wallet.
 
 Prepared inputs are **private witness data**: they include A's public key, signature and attestation data. Keep them inside trusted local code and send them only to the chosen prover (encrypted when a supported TEE key is provided). Do not forward them to the dApp, model, UI or logs. The `generateProof` public result is the boundary for sharing a proof; step callbacks and `proofport://config` can contain sensitive signer data and must not be forwarded wholesale.
 
@@ -494,18 +415,18 @@ import { readFile } from 'node:fs/promises';
 import {
   createConfig, createActionApproval, resolveActionApproval, hashTypedAction, prepareInputs,
   requestChallenge, signPayment, submitProof, submitEncryptedProof,
-  encryptForTee, walletFor, CIRCUIT_IDS,
+  encryptForTee, walletFromEnv, CIRCUIT_IDS,
   type TypedAction, type ApprovedPayment,
 } from '@zkproofport-ai/sdk';
 
 const config = createConfig({ baseUrl: 'https://stg-ai.zkproofport.app' });
 const action: TypedAction = JSON.parse(await readFile('approved-action.json', 'utf8'));
 const approvedPayment: ApprovedPayment = JSON.parse(await readFile('approved-payment.json', 'utf8'));
-const scope = 'ledger-house';
+const scope = 'myapp:membership';
 
 // 1. Create an immutable request, then let the person connect and sign.
 const { domainSeparator, actionHash } = hashTypedAction(action);
-const request = { circuit: 'arc_eligibility' as const, scope, action };
+const request = { circuit: 'giwa_attestation' as const, scope, action };
 const approval = await createActionApproval(config, request);
 console.error('Review and sign:', approval.approvalUrl);
 await waitForHumanApproval(config, approval); // bounded helper from the example above
@@ -513,33 +434,34 @@ const approved = await resolveActionApproval(config, request, approval);
 
 // 2. The signature has been verified and consumed. Build the private witness.
 const prepared = await prepareInputs(config, {
-  circuitId: CIRCUIT_IDS.ARC_ELIGIBILITY,
+  circuitId: CIRCUIT_IDS.GIWA_ATTESTATION,
   userAddress: approved.address, userSignature: approved.signature, scope,
   domainSeparator, actionHash,
 });
 const inputs = { ...prepared, domain_separator: domainSeparator, action_hash: actionHash };
 
 // 3. Fetch a fresh nonce/offer/TEE key without sending the witness yet.
-const challenge = await requestChallenge(config, 'arc_eligibility');
+const challenge = await requestChallenge(config, 'giwa_attestation');
 const paymentHeaders = challenge.requiresPayment
-  ? (await signPayment(challenge, await walletFor('arc'), {
-      network: 'arc-testnet-nano', maxPayment: '0.001', approvedPayment,
+  ? (await signPayment(challenge, await walletFromEnv(), {
+      network: approvedPayment.network, maxPayment: '0.001', approvedPayment,
     })).headers
   : undefined;
 
 // 4. Submit with the same nonce and approved payment; preserve TEE encryption.
 const result = challenge.teePublicKey
   ? await submitEncryptedProof(config, {
-      circuit: 'arc_eligibility', nonce: challenge.nonce, paymentHeaders,
+      circuit: 'giwa_attestation', nonce: challenge.nonce, paymentHeaders,
       encryptedPayload: encryptForTee(
-        JSON.stringify({ circuitId: CIRCUIT_IDS.ARC_ELIGIBILITY, inputs }),
+        JSON.stringify({ circuitId: CIRCUIT_IDS.GIWA_ATTESTATION, inputs }),
         challenge.teePublicKey.publicKey,
       ),
     })
   : await submitProof(config, {
-      circuit: 'arc_eligibility', inputs, nonce: challenge.nonce, paymentHeaders,
+      circuit: 'giwa_attestation', inputs, nonce: challenge.nonce, paymentHeaders,
     });
-// Share only the public result, verify it, then separately approve the stake.
+// Share only the public result and verify it. Any application transaction
+// that relies on the proof needs its own approval.
 ```
 
 `hashTypedAction(action)` returns `{domainSeparator: string, actionHash: string}` as 32-byte `0x` hashes. For Coinbase KYC/country, sign `computeSignalHash(address, scope, circuitId)` with `signMessage`, call `prepareInputs` without action hashes, then use the same challenge/payment/submission sequence. OIDC uses `prepareOidcPayload` and no attestation-wallet signature. The all-in-one `generateProof` already handles these distinctions.
@@ -663,8 +585,8 @@ The proof contains 148 public input fields (32 bytes each):
 **Circuit Types:**
 
 ```typescript
-type CircuitName = 'coinbase_kyc' | 'coinbase_country' | 'oidc_domain' | 'arc_eligibility' | 'giwa_attestation';
-type CircuitId = 'coinbase_attestation' | 'coinbase_country_attestation' | 'oidc_domain_attestation' | 'arc_eligibility' | 'giwa_attestation';
+type CircuitName = 'coinbase_kyc' | 'coinbase_country' | 'oidc_domain' | 'giwa_attestation';
+type CircuitId = 'coinbase_attestation' | 'coinbase_country_attestation' | 'oidc_domain_attestation' | 'giwa_attestation';
 ```
 
 **Configuration:**
@@ -697,7 +619,7 @@ function fromSigner(signer: ethers.Signer): ProofportSigner;
 ```typescript
 interface ProofParams {
   circuit: CircuitName;
-  action?: { domain: { name: string; version: string; chainId: number; verifyingContract: string }; types: Record<string, Array<{name: string; type: string}>>; primaryType: string; message: Record<string, unknown> }; // optional for arc_eligibility and giwa_attestation
+  action?: { domain: { name: string; version: string; chainId: number; verifyingContract: string }; types: Record<string, Array<{name: string; type: string}>>; primaryType: string; message: Record<string, unknown> }; // optional for giwa_attestation
   actionApproval?: ActionApproval; // private handle; resume the original action after human approval
   payOn?: string;
   maxPayment?: string; // decimal USDC
@@ -808,21 +730,17 @@ npm run test:e2e:published -- --sdk-version 0.2.16 --mcp-version 0.2.16
 ```
 
 It installs those exact npm versions outside the workspace, resolves SDK imports
-and the MCP process to that installation, and removes it afterwards. The runner
-also installs and verifies Circle CLI 1.1.4, automatically putting it on the test
-subprocess PATH without changing the global installation. Optional CDP/x402 and
-Circle developer wallet dependencies are installed at tested exact versions,
+and the MCP process to that installation, and removes it afterwards. Optional CDP/x402
+wallet dependencies are installed at tested exact versions,
 and their imports are verified before paid tests start. A normal
 workspace test run exercises local packages and is not published-package evidence.
 The full suite creates paid testnet proofs. It requires the attestation and payer
 credentials loaded by `tests/setup.ts`; GIWA uses `GIWA_ATTESTATION_KEY`, and OIDC
 uses `E2E_OIDC_JWT` or an authenticated gcloud account. The payment matrix checks
-Base Sepolia, Arc immediate settlement, Ethereum Sepolia, and Arc Gateway nano
-separately, so each needs a funded payer on its selected network. Optional
-`E2E_PAYER_KEY_<NETWORK>` overrides use uppercase names with underscores, for
-example `E2E_PAYER_KEY_ETHEREUM_SEPOLIA`. `E2E_ARC_AGENT_ADDRESS` selects an
-existing Circle Agent Wallet for both Arc cases; the supported Circle CLI,
-on-chain USDC for immediate settlement, and Gateway USDC for nano are required. The runner never deposits or transfers funds.
+Base Sepolia and Ethereum Sepolia separately, so each needs a funded payer on its
+selected network. Optional `E2E_PAYER_KEY_<NETWORK>` overrides use uppercase names
+with underscores, for example `E2E_PAYER_KEY_ETHEREUM_SEPOLIA`. The runner never
+transfers funds.
 
 For a non-paying package/discovery check, append
-`-t 'should list all 5 circuits'`. This checks discovery only, not proof generation.
+`-t 'should list all 4 circuits'`. This checks discovery only, not proof generation.

package/dist/action.js

@@ -1,5 +1,5 @@
 import { ethers } from 'ethers';
-import { validateTypedAction } from './typedAction.js';
+import { validateTypedAction } from '@zkproofport-app/core/typedAction';
 /**
  * Validate and hash a caller-owned EIP-712 action before asking a wallet to sign.
  * `types` must omit EIP712Domain and have one root matching `primaryType`.

package/dist/action.js.map

@@ -1 +1 @@
-{"version":3,"file":"action.js","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB;IAIjD,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAElC,IAAI,cAAc,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,UAAU,KAAK,mCAAmC,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,UAAU,KAAK,mCAAmC,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,uBAAuB,MAAM,CAAC,WAAW,0CAA0C,OAAO,CAAC,WAAW,IAAI,CAC3G,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,mEAAmE;IACnE,SAAS,aAAa,CAAC,IAAY,EAAE,KAAc,EAAE,IAAY;QAC/D,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;YACxE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;gBAClD,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,IAAI,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,eAAe,CAAC,CAAC;gBACpF,aAAa,CAAC,KAAK,CAAC,IAAI,EAAG,KAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAEpE,OAAO;QACL,eAAe,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QAClE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;KACzC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"action.js","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmB;IAIjD,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAElC,IAAI,cAAc,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,UAAU,KAAK,mCAAmC,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,UAAU,KAAK,mCAAmC,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,uBAAuB,MAAM,CAAC,WAAW,0CAA0C,OAAO,CAAC,WAAW,IAAI,CAC3G,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,mEAAmE;IACnE,SAAS,aAAa,CAAC,IAAY,EAAE,KAAc,EAAE,IAAY;QAC/D,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;YACxE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;gBAClD,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,0BAA0B,IAAI,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,eAAe,CAAC,CAAC;gBACpF,aAAa,CAAC,KAAK,CAAC,IAAI,EAAG,KAAiC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAEpE,OAAO;QACL,eAAe,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;QAClE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;KACzC,CAAC;AACJ,CAAC"}

package/dist/actionApproval.js

@@ -54,7 +54,7 @@ function address(value) {
 function snapshotRequest(request) {
     try {
         const copy = structuredClone(request);
-        if (copy.circuit !== 'giwa_attestation' && copy.circuit !== 'arc_eligibility')
+        if (copy.circuit !== 'giwa_attestation')
             throw invalid();
         if (typeof copy.scope !== 'string' || !copy.scope.trim())
             throw invalid();

package/dist/actionApproval.js.map

@@ -1 +1 @@
-{"version":3,"file":"actionApproval.js","sourceRoot":"","sources":["../src/actionApproval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAkC9C,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAChB;IAA5B,YAA4B,IAA6B,EAAE,OAAe;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAyB;QAEvD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,IAAI,GAAG,0BAA0B,CAAC;IAG3C,YAAY,QAAwB;QAClC,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,wEAAwE;QACxE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,CAAC;CACF;AAED,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,yBAAyB,EAAE,iFAAiF,CAAC,CAAC;AAC5J,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,yBAAyB,EAAE,4DAA4D,CAAC,CAAC;AAEvI,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACjF,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC1C,IAAI,KAAK,GAAG,EAAE;QAAE,MAAM,OAAO,EAAE,CAAC;IAChC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5G,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACrG,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5F,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,SAAS,CAAE,KAAiC,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC/J,CAAC;IACD,2FAA2F;IAC3F,MAAM,OAAO,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,OAAO,EAAE,CAAC;IAC/C,IAAI,CAAC;QAAC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CAAC,OAA8B;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB,IAAI,IAAI,CAAC,OAAO,KAAK,iBAAiB;YAAE,MAAM,OAAO,EAAE,CAAC;QAC/F,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,MAAM,OAAO,EAAE,CAAC;QAC1E,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS;YAAE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;AAC9B,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAqB;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC5G,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACtH,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAAE,MAAM,OAAO,EAAE,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;YAAE,MAAM,OAAO,EAAE,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;IAC5B,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QACjE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,SAAmB,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,UAAU,CAAC,QAAwB;IAC1C,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,MAAM,OAAO,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,QAAiC,EAAE,OAA8B;IACtF,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC1J,sFAAsF;IACtF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAqB,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;YAAE,MAAM,OAAO,EAAE,CAAC;IACxH,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,MAAoB,EAAE,IAAY,EAAE,MAAc,EAAE,KAAc,EAAE,IAAc;IACnG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,IAAI,EAAE,EAAE;YAClG,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,EAAE;YACnG,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,aAAa;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,6EAA6E;YAC7E,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,EAAE,wCAAwC,QAAQ,CAAC,MAAM,0CAA0C,CAAC,CAAC;QAClK,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAC;QACtD,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,EAAE,uFAAuF,CAAC,CAAC;IACxJ,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAoB,EAAE,OAA8B;IAC7F,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,OAAO,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAqC,CAAC,CAAC;IACzE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAAoB,EAAE,QAAwB;IAC1F,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9G,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAChI,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,OAAO,EAAE,CAAC;IACxI,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACzG,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,EAA2B,CAAC,CAAC;IACxH,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtF,IAAI,KAAK,KAAK,UAAU,IAAI,CAAC,MAAM;QAAE,MAAM,OAAO,EAAE,CAAC;IACrD,IAAI,MAAM,IAAI,OAAO,CAAC,cAAc,IAAI,MAAM,KAAK,OAAO,CAAC,cAAc;QAAE,MAAM,OAAO,EAAE,CAAC;IAC3F,OAAO,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC5F,GAAG,CAAC,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAoB,EAAE,OAA8B,EAAE,QAAwB;IACxH,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,EACnH,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,KAAK,MAAM,CAAC,cAAc;QAAE,MAAM,OAAO,EAAE,CAAC;IAC/E,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAChH,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACxH,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,MAAM;YAAE,MAAM,OAAO,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;IAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;AAC5D,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAoB,EAAE,OAA8B,EAAE,QAAyB;IACzH,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,2BAA2B,CAAC,MAAM,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7D,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,aAAa,CAAC,MAA4C,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAAE,MAAM,OAAO,EAAE,CAAC;IAC9F,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,SAAS,CAAC,CAAC,MAAM,IAAI,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAC9D,KAAK,UAAU,CAAC,CAAC,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,EAAE,2CAA2C,CAAC,CAAC;QACxH,KAAK,SAAS,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC;QAChC,KAAK,UAAU,CAAC,CAAC,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,EAAE,uHAAuH,CAAC,CAAC;QACpM,KAAK,UAAU,CAAC,CAAC,OAAO,qBAAqB,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,OAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9G,OAAO,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC"}
+{"version":3,"file":"actionApproval.js","sourceRoot":"","sources":["../src/actionApproval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAkC9C,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAChB;IAA5B,YAA4B,IAA6B,EAAE,OAAe;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAyB;QAEvD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,0EAA0E;AAC1E,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,IAAI,GAAG,0BAA0B,CAAC;IAG3C,YAAY,QAAwB;QAClC,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,wEAAwE;QACxE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,CAAC;CACF;AAED,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,yBAAyB,EAAE,iFAAiF,CAAC,CAAC;AAC5J,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,mBAAmB,CAAC,yBAAyB,EAAE,4DAA4D,CAAC,CAAC;AAEvI,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACjF,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC1C,IAAI,KAAK,GAAG,EAAE;QAAE,MAAM,OAAO,EAAE,CAAC;IAChC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5G,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACrG,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5F,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,SAAS,CAAE,KAAiC,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC/J,CAAC;IACD,2FAA2F;IAC3F,MAAM,OAAO,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,OAAO,EAAE,CAAC;IAC/C,IAAI,CAAC;QAAC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CAAC,OAA8B;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAkB;YAAE,MAAM,OAAO,EAAE,CAAC;QACzD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,MAAM,OAAO,EAAE,CAAC;QAC1E,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS;YAAE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;AAC9B,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAqB;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC5G,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACtH,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAAE,MAAM,OAAO,EAAE,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;YAAE,MAAM,OAAO,EAAE,CAAC;IACnG,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;IAC5B,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1B,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QACjE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,SAAmB,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,UAAU,CAAC,QAAwB;IAC1C,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,MAAM,OAAO,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,QAAiC,EAAE,OAA8B;IACtF,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAC1J,sFAAsF;IACtF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAqB,CAAC,CAAC;QAC/D,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;YAAE,MAAM,OAAO,EAAE,CAAC;IACxH,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,MAAoB,EAAE,IAAY,EAAE,MAAc,EAAE,KAAc,EAAE,IAAc;IACnG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,IAAI,EAAE,EAAE;YAClG,MAAM;YACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,EAAE;YACnG,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,aAAa;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,6EAA6E;YAC7E,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,EAAE,wCAAwC,QAAQ,CAAC,MAAM,0CAA0C,CAAC,CAAC;QAClK,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAC;QACtD,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,EAAE,uFAAuF,CAAC,CAAC;IACxJ,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAoB,EAAE,OAA8B;IAC7F,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,OAAO,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAqC,CAAC,CAAC;IACzE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAAoB,EAAE,QAAwB;IAC1F,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9G,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAChI,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,OAAO,EAAE,CAAC;IACxI,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACzG,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,EAA2B,CAAC,CAAC;IACxH,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtF,IAAI,KAAK,KAAK,UAAU,IAAI,CAAC,MAAM;QAAE,MAAM,OAAO,EAAE,CAAC;IACrD,IAAI,MAAM,IAAI,OAAO,CAAC,cAAc,IAAI,MAAM,KAAK,OAAO,CAAC,cAAc;QAAE,MAAM,OAAO,EAAE,CAAC;IAC3F,OAAO,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC5F,GAAG,CAAC,MAAM,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAoB,EAAE,OAA8B,EAAE,QAAwB;IACxH,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,cAAc,EACnH,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,KAAK,MAAM,CAAC,cAAc;QAAE,MAAM,OAAO,EAAE,CAAC;IAC/E,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IAChH,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACxH,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,MAAM;YAAE,MAAM,OAAO,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,OAAO,EAAE,CAAC;IAAC,CAAC;IAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;AAC5D,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAoB,EAAE,OAA8B,EAAE,QAAyB;IACzH,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,2BAA2B,CAAC,MAAM,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7D,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,aAAa,CAAC,MAA4C,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;QAAE,MAAM,OAAO,EAAE,CAAC;IAC9F,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,SAAS,CAAC,CAAC,MAAM,IAAI,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAC9D,KAAK,UAAU,CAAC,CAAC,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,EAAE,2CAA2C,CAAC,CAAC;QACxH,KAAK,SAAS,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC;QAChC,KAAK,UAAU,CAAC,CAAC,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,EAAE,uHAAuH,CAAC,CAAC;QACpM,KAAK,UAAU,CAAC,CAAC,OAAO,qBAAqB,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,OAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9G,OAAO,CAAC,CAAC,MAAM,OAAO,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/attestation.d.ts

@@ -1,4 +1,9 @@
 import type { CircuitId, EASAttestation, AttestationData, ClientConfig } from './types.js';
+/**
+ * GET a URL, retrying a transient network failure or a 429/5xx answer.
+ * Any other answer, including a 4xx, is returned to the caller on the first try.
+ */
+export declare function fetchWithTransientRetry(url: string): Promise<Response>;
 /**
  * Query EAS GraphQL for the latest attestation matching schemaId + recipient.
  */
@@ -7,7 +12,7 @@ export declare function fetchAttestationFromEAS(easGraphqlUrl: string, circuitId
  * Fetch raw transaction via eth_getTransactionByHash from an RPC endpoint.
  *
  * Retry policy:
- *   - HTTP 429/5xx, ECONNRESET, ETIMEDOUT: MAX_RETRIES (3) attempts, 1s base delay (transient network).
+ *   - HTTP 429/5xx or a TRANSIENT_NETWORK_CODES failure: MAX_RETRIES (3) attempts, 1s base delay.
  *   - data.result === null (tx not yet indexed): TX_INDEX_MAX_RETRIES (15) attempts, 2s delay.
  *     Public RPCs (base.org, base-sepolia) need 5-30s to index a freshly submitted attestation tx.
  */

package/dist/attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAyC3F;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,cAAc,CAAC,CAkCzB;AAID;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CA2DjB;AAID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAChE,GAAG,MAAM,CAuBT;AAID;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,SAAS,GACnB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAwBpC;AAID;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CA0BpE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAsED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,eAAe,CAAC,CAiC1B"}
+{"version":3,"file":"attestation.d.ts","sourceRoot":"","sources":["../src/attestation.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAiD3F;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAe5E;AAWD;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,cAAc,CAAC,CAkCzB;AAID;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAID;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAChE,GAAG,MAAM,CAuBT;AAID;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,SAAS,GACnB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAwBpC;AAID;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CA0BpE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAsED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,eAAe,CAAC,CAiC1B"}

package/dist/attestation.js

@@ -26,6 +26,44 @@ const EAS_ATTESTATIONS_QUERY = `
 const MAX_RETRIES = 3;
 const RETRY_DELAY_MS = 1000;
 const RETRYABLE_STATUS = new Set([429, 500, 502, 503, 504]);
+/**
+ * Network failures worth another attempt. `UND_ERR_CONNECT_TIMEOUT` is what
+ * Node's fetch reports when a TCP connect never completes; it was missing, so a
+ * single slow handshake to the GIWA explorer failed a whole proof.
+ */
+const TRANSIENT_NETWORK_CODES = new Set([
+    'ECONNRESET',
+    'ETIMEDOUT',
+    'EAI_AGAIN',
+    'UND_ERR_CONNECT_TIMEOUT',
+    'UND_ERR_SOCKET',
+]);
+function isTransientNetworkError(err) {
+    const code = err?.cause?.code;
+    return typeof code === 'string' && TRANSIENT_NETWORK_CODES.has(code);
+}
+/**
+ * GET a URL, retrying a transient network failure or a 429/5xx answer.
+ * Any other answer, including a 4xx, is returned to the caller on the first try.
+ */
+export async function fetchWithTransientRetry(url) {
+    for (let attempt = 0;; attempt++) {
+        const last = attempt === MAX_RETRIES - 1;
+        try {
+            const response = await fetch(url);
+            if (!last && RETRYABLE_STATUS.has(response.status)) {
+                await new Promise(r => setTimeout(r, RETRY_DELAY_MS * (attempt + 1)));
+                continue;
+            }
+            return response;
+        }
+        catch (err) {
+            if (last || !isTransientNetworkError(err))
+                throw err;
+            await new Promise(r => setTimeout(r, RETRY_DELAY_MS * (attempt + 1)));
+        }
+    }
+}
 // Public RPCs (e.g. base.org, base-sepolia) can take 5-30s to index a freshly
 // submitted attestation tx. Retry the "result is null" case separately with a
 // larger budget so generateProof doesn't fail immediately after the customer
@@ -68,7 +106,7 @@ export async function fetchAttestationFromEAS(easGraphqlUrl, circuitId, recipien
  * Fetch raw transaction via eth_getTransactionByHash from an RPC endpoint.
  *
  * Retry policy:
- *   - HTTP 429/5xx, ECONNRESET, ETIMEDOUT: MAX_RETRIES (3) attempts, 1s base delay (transient network).
+ *   - HTTP 429/5xx or a TRANSIENT_NETWORK_CODES failure: MAX_RETRIES (3) attempts, 1s base delay.
  *   - data.result === null (tx not yet indexed): TX_INDEX_MAX_RETRIES (15) attempts, 2s delay.
  *     Public RPCs (base.org, base-sepolia) need 5-30s to index a freshly submitted attestation tx.
  */
@@ -114,8 +152,7 @@ export async function fetchRawTransaction(rpcUrl, txHash) {
         }
         catch (err) {
             lastError = err;
-            const cause = err?.cause?.code;
-            if (attempt < MAX_RETRIES - 1 && (cause === 'ECONNRESET' || cause === 'ETIMEDOUT')) {
+            if (attempt < MAX_RETRIES - 1 && isTransientNetworkError(err)) {
                 await new Promise(r => setTimeout(r, RETRY_DELAY_MS * (attempt + 1)));
                 continue;
             }
@@ -234,7 +271,7 @@ async function fetchGiwaAttestation(source, recipientAddress) {
     const wanted = ethers.getAddress(recipientAddress);
     const listUrl = `${source.explorer}/api?module=account&action=txlist` +
         `&address=${attester}&sort=desc&page=1&offset=100`;
-    const listResponse = await fetch(listUrl);
+    const listResponse = await fetchWithTransientRetry(listUrl);
     if (!listResponse.ok) {
         throw new Error(`GIWA explorer request failed: HTTP ${listResponse.status}`);
     }