@zkproofport-app/sdk 0.3.1 → 0.3.3

package/dist/index.js

@@ -96,16 +96,22 @@ const CIRCUIT_METADATA = {
     },
     // Planned circuit — the identifier is reserved and the circuit exists, but it
     // is not officially supported yet. See CIRCUIT_SUPPORT_STATUS in ./circuits.
-    // Forked from coinbase_attestation and shares its four public inputs, so the
-    // count is the byte-flattened total (4 x [u8; 32] = 128), matching the
-    // COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT indices below. The
-    // coinbase_attestation entry above reports a legacy logical count of 2 and is
-    // left as-is for backwards compatibility.
+    // Forked from coinbase_attestation, then given the EIP-712 pair and a
+    // branch: with an action the wallet signs the typed data and signal_hash is
+    // zero; without one it signs signal_hash and the pair is zero. Read off the
+    // compiled ABI (6 x [u8; 32] = 192): signal_hash 0-31, domain_separator
+    // 32-63, action_hash 64-95, signer_list_merkle_root 96-127, scope 128-159,
+    // nullifier 160-191 -- the same order as arc_eligibility.
+    //
+    // Unlike Arc, signal_hash is NOT part of this circuit's nullifier. That one
+    // derives its nullifier from a public input nobody signs and nothing
+    // constrains, so one wallet can mint as many nullifiers as it likes; here
+    // the secret is the address plus a constant compiled into the circuit.
     giwa_attestation: {
         name: 'GIWA Attestation',
-        description: 'Prove GIWA identity verification (planned — not officially supported yet)',
-        publicInputsCount: 128,
-        publicInputNames: ['signal_hash', 'signer_list_merkle_root', 'scope', 'nullifier'],
+        description: 'Prove GIWA identity verification, optionally authorizing one EIP-712 action (planned — not officially supported yet)',
+        publicInputsCount: 192,
+        publicInputNames: ['signal_hash', 'domain_separator', 'action_hash', 'signer_list_merkle_root', 'scope', 'nullifier'],
     },
     // Korea Mobile ID (mDL) circuits. Planned — not officially supported yet.
     // Counts are byte-flattened field totals from the compiled circuit ABIs:
@@ -384,7 +390,7 @@ const CIRCUIT_IDS = Object.freeze({
     COINBASE_COUNTRY_ATTESTATION: 'coinbase_country_attestation',
     /** OIDC email-domain attestation. Officially supported. */
     OIDC_DOMAIN_ATTESTATION: 'oidc_domain_attestation',
-    /** Arc eligibility: one EIP-712 action, authorized. Officially supported. */
+    /** Arc eligibility: exact EIP-712 action authorization. Experimental on Arc Testnet. */
     ARC_ELIGIBILITY: 'arc_eligibility',
     /** GIWA attestation. Planned — not officially supported yet. */
     GIWA_ATTESTATION: 'giwa_attestation',
@@ -415,7 +421,11 @@ const CIRCUIT_SUPPORT_STATUS = Object.freeze({
     coinbase_country_attestation: 'supported',
     oidc_domain_attestation: 'supported',
     arc_eligibility: 'experimental',
-    giwa_attestation: 'planned',
+    // Experimental, not planned: the circuit is built, its verifier is
+    // deployed on GIWA Sepolia and the demo requests it. What keeps it out of
+    // 'supported' is that it is testnet-only, so the app offers it behind
+    // Developer Mode and reads its files from main rather than a release tag.
+    giwa_attestation: 'experimental',
     mdl_kr_ownership: 'planned',
     mdl_kr_age: 'planned',
     mdl_kr_region: 'planned',
@@ -527,18 +537,44 @@ function getCircuitSupportStatus(circuit) {
     }
     return CIRCUIT_SUPPORT_STATUS[circuit];
 }
-/**
- * Whether a circuit's relay request must carry a wallet signature.
+const CIRCUIT_ACTION_BINDING = {
+    coinbase_attestation: 'none',
+    coinbase_country_attestation: 'none',
+    // The signature lives inside the identity token; no wallet, no action.
+    oidc_domain_attestation: 'none',
+    // Both branch in-circuit: with an action the wallet signs the typed data,
+    // without one it personal_signs the request's signal hash. Arc read
+    // 'required' until 2026-09-22 because its circuit had no second path -- a
+    // request without an action built a vector 64 bytes short and died inside
+    // the prover. The circuit gained the branch; the table follows it.
+    arc_eligibility: 'optional',
+    giwa_attestation: 'optional',
+    mdl_kr_ownership: 'none',
+    mdl_kr_age: 'none',
+    mdl_kr_region: 'none',
+};
+/*
+ * The union is declared above rather than derived from the table's values.
  *
- * The SDK checks this to fail fast — "Signer not set" locally beats a 401 from
- * the relay two round trips later, with nothing saying which circuit needed
- * what. The relay declares its OWN copy on purpose and does not import this
- * one: it is a security boundary, and an auth policy that a published package
- * can change is not a policy. A test in the relay asserts the two agree.
+ * Deriving it narrowed the type to whatever the table happens to hold today --
+ * 'none' | 'optional' -- and TypeScript then called every `=== 'required'`
+ * check impossible. The publish typecheck caught it; `rollup` and `vitest` did
+ * not. 'required' is a state a circuit can legitimately be in (an EIP-712 path
+ * and nothing else), so the union says so and the table is checked against it.
+ */
+/**
+ * How this circuit treats an action, or an error naming the id that is not one.
  *
- * `satisfies` and not an annotation, so a circuit added above is a compile
- * error here until somebody decides which it is.
+ * No default: a circuit nobody has classified must not inherit 'none', which
+ * would silently drop an action a dapp meant to bind.
  */
+function circuitActionBinding(circuit) {
+    const binding = CIRCUIT_ACTION_BINDING[circuit];
+    if (!binding) {
+        throw new Error(`Unknown circuit '${circuit}'. Expected: ${ALL_CIRCUIT_IDS.join(', ')}`);
+    }
+    return binding;
+}
 const CIRCUIT_NEEDS_WALLET_SIGNATURE = {
     coinbase_attestation: true,
     coinbase_country_attestation: true,
@@ -551,13 +587,22 @@ const CIRCUIT_NEEDS_WALLET_SIGNATURE = {
     mdl_kr_ownership: false,
     mdl_kr_age: false,
     mdl_kr_region: false,
-    giwa_attestation: false,
+    // A GIWA-attested wallet signing an EIP-712 action, the same shape as Arc.
+    // This read `false` while the circuit had always verified a wallet signature
+    // -- it sat under the Web2 comment above and was never revisited. A request
+    // for it would have reached the relay with no signer.
+    giwa_attestation: true,
 };
 
 const ADDRESS = /^0x[0-9a-fA-F]{40}$/;
 /**
  * The reason the value is not a usable action, or `null` when it is one.
  *
+ * Structural validation only, not application authorization policy. Consumers
+ * (e.g. EligibilityGate) must independently enforce the expected chain, verifying
+ * contract, actor, action parameters, nonce and deadline as applicable.
+ * EIP-712 signs only fields declared in types, not extra message properties.
+ *
  * A string rather than a boolean because every caller shows it to somebody —
  * a dapp developer reading a validation error, or a person looking at the
  * mobile app's demo screen.
@@ -1181,9 +1226,26 @@ function validateProofRequest(request) {
         if (inputs.userAddress && !/^0x[a-fA-F0-9]{40}$/.test(inputs.userAddress)) {
             return { valid: false, error: 'Invalid userAddress format' };
         }
-        const actionError = validateTypedAction(inputs.action);
-        if (actionError) {
-            return { valid: false, error: actionError };
+    }
+    // The action, decided by the circuit's own entry rather than by naming a
+    // circuit here. This used to be part of the arc_eligibility branch above,
+    // which is why a second action-capable circuit had nowhere to be checked.
+    {
+        const action = request.inputs?.action;
+        const binding = circuitActionBinding(request.circuit);
+        if (binding === 'none') {
+            if (action !== undefined) {
+                return {
+                    valid: false,
+                    error: `${request.circuit} has no action inputs, so an action sent with it would not be proved. Refusing rather than dropping it.`,
+                };
+            }
+        }
+        else if (binding === 'required' || action !== undefined) {
+            const actionError = validateTypedAction(action);
+            if (actionError) {
+                return { valid: false, error: actionError };
+            }
         }
     }
     // Check expiry
@@ -1617,8 +1679,10 @@ function getVerifierChainId(circuit, customVerifier) {
 const PUBLIC_INPUT_OFFSETS = Object.freeze({
     // signal_hash, signer_list_merkle_root, scope, nullifier
     coinbase_attestation: { scope: [64, 95], nullifier: [96, 127] },
-    // Same four fields in the same order as Coinbase.
-    giwa_attestation: { scope: [64, 95], nullifier: [96, 127] },
+    // No longer Coinbase's layout. The GIWA circuit gained the EIP-712 pair, so
+    // it reads like Arc: signal_hash, domain_separator, action_hash, merkle
+    // root, then scope and nullifier 64 bytes further along than Coinbase.
+    giwa_attestation: { scope: [128, 159], nullifier: [160, 191] },
     // country_list, country_list_length and is_included sit before scope.
     coinbase_country_attestation: { scope: [86, 117], nullifier: [118, 149] },
     // pubkey_modulus_limbs and the bounded domain sit before scope.
@@ -3027,15 +3091,26 @@ class ProofportSDK {
                 throw new Error(`${mdlError} (circuit: ${circuit})`);
             }
         }
-        // arc_eligibility: the action is what the proof binds to, so a request
-        // without a usable one cannot be honoured. Checked here, before a
-        // challenge is burned, because the alternative is a refusal from inside
-        // the mobile app -- a screen the dapp developer never sees, reached after
-        // the person has already scanned a QR code.
-        if (circuit === 'arc_eligibility') {
-            const actionError = validateTypedAction(inputs.action);
-            if (actionError) {
-                throw new Error(`${actionError} (circuit: ${circuit})`);
+        // The action, per the circuit's entry in CIRCUIT_ACTION_BINDING. Checked
+        // here, before a challenge is burned, because the alternative is a refusal
+        // from inside the mobile app -- a screen the dapp developer never sees,
+        // reached after the person has already scanned a QR code.
+        //
+        // This named arc_eligibility directly until giwa_attestation became the
+        // second circuit that can carry an action; the id belongs in the table,
+        // not in the check.
+        {
+            const action = inputs.action;
+            const binding = circuitActionBinding(circuit);
+            if (binding === 'none' && action !== undefined) {
+                throw new Error(`${circuit} has no action inputs, so an action sent with it would not be proved. ` +
+                    'Remove it, or use a circuit that binds one.');
+            }
+            if (binding === 'required' || (binding === 'optional' && action !== undefined)) {
+                const actionError = validateTypedAction(action);
+                if (actionError) {
+                    throw new Error(`${actionError} (circuit: ${circuit})`);
+                }
             }
         }
         // Return target: validated before we burn a challenge, so a typo surfaces
@@ -3364,6 +3439,7 @@ class ProofportSDK {
 }
 
 exports.ALL_CIRCUIT_IDS = ALL_CIRCUIT_IDS;
+exports.CIRCUIT_ACTION_BINDING = CIRCUIT_ACTION_BINDING;
 exports.CIRCUIT_IDS = CIRCUIT_IDS;
 exports.CIRCUIT_SUPPORT_STATUS = CIRCUIT_SUPPORT_STATUS;
 exports.CIRCUIT_VK_PATHS = CIRCUIT_VK_PATHS;
@@ -3375,6 +3451,7 @@ exports.OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT = OIDC_DOMAIN_ATTESTATION_PU
 exports.PLANNED_CIRCUIT_IDS = PLANNED_CIRCUIT_IDS;
 exports.ProofportSDK = ProofportSDK;
 exports.SUPPORTED_CIRCUIT_IDS = SUPPORTED_CIRCUIT_IDS;
+exports.circuitActionBinding = circuitActionBinding;
 exports.default = ProofportSDK;
 exports.extractDomainFromPublicInputs = extractDomainFromPublicInputs;
 exports.extractNullifierFromPublicInputs = extractNullifierFromPublicInputs;