@zkproofport-app/sdk 0.4.2 → 0.5.0-beta.0

package/dist/index.esm.js

@@ -1,4 +1,9 @@
-import { ethers } from 'ethers';
+import { parseProofForOnChain, verifyProofOnChain, getVerifierAddress, getVerifierChainId, extractScopeFromPublicInputs, extractNullifierFromPublicInputs, extractDomainFromPublicInputs } from '@zkproofport-app/core';
+export { COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT, COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT, MDL_KR_PUBLIC_INPUT_LAYOUT, OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT, extractDomainFromPublicInputs, extractNullifierFromPublicInputs, extractScopeFromPublicInputs } from '@zkproofport-app/core';
+import { isCircuitId, ALL_CIRCUIT_IDS, circuitActionBinding, CIRCUIT_VK_PATHS, CIRCUIT_NEEDS_WALLET_SIGNATURE } from '@zkproofport-app/core/circuits';
+export { ALL_CIRCUIT_IDS, CIRCUIT_ACTION_BINDING, CIRCUIT_IDS, CIRCUIT_SUPPORT_STATUS, CIRCUIT_VK_PATHS, EXPERIMENTAL_CIRCUIT_IDS, PLANNED_CIRCUIT_IDS, SUPPORTED_CIRCUIT_IDS, circuitActionBinding, getCircuitSupportStatus, isCircuitId, isSupportedCircuitId } from '@zkproofport-app/core/circuits';
+import { validateTypedAction } from '@zkproofport-app/core/typedAction';
+export { parseTypedAction, validateTypedAction } from '@zkproofport-app/core/typedAction';
 
 /**
  * ZKProofport SDK Constants
@@ -132,50 +137,6 @@ const CIRCUIT_METADATA = {
         publicInputNames: ['scope', 'nullifier_value', 'region_code'],
     },
 };
-/**
- * Standard verifier contract ABI shared across all Barretenberg-generated verifiers.
- * This ABI defines the interface for calling the verify function on deployed verifier contracts.
- *
- * Uses ethers v6 human-readable ABI format.
- *
- * @example
- * ```typescript
- * import { Contract } from 'ethers';
- *
- * const verifier = new Contract(verifierAddress, VERIFIER_ABI, provider);
- * const isValid = await verifier.verify(proofBytes, publicInputs);
- * ```
- */
-const VERIFIER_ABI = [
-    'function verify(bytes calldata _proof, bytes32[] calldata _publicInputs) external view returns (bool)',
-];
-/**
- * Public RPC endpoint URLs for supported blockchain networks.
- * Used as fallback when no custom provider is supplied.
- *
- * Supported networks:
- * - 84532: Base Sepolia (testnet)
- * - 8453: Base Mainnet (production)
- * - 91342: GIWA Sepolia (testnet) — where the GIWA account circuit verifies
- *
- * A chain missing from this map is not a quiet degradation: `getDefaultProvider`
- * throws "No RPC endpoint configured for chain N". That is what a caller saw
- * when verifying a GIWA proof on chain 91342 — the verifier contract had been
- * deployed and the proof was valid, but the SDK had no way to reach the chain
- * to ask. Deploying a verifier to a new network means adding it here too.
- *
- * @example
- * ```typescript
- * import { JsonRpcProvider } from 'ethers';
- *
- * const provider = new JsonRpcProvider(RPC_ENDPOINTS[84532]);
- * ```
- */
-const RPC_ENDPOINTS = {
-    84532: 'https://sepolia.base.org', // Base Sepolia
-    8453: 'https://mainnet.base.org', // Base Mainnet
-    91342: 'https://sepolia-rpc.giwa.io', // GIWA Sepolia
-};
 /**
  * Default proof request expiration time in milliseconds.
  * Requests older than this are considered expired and should not be processed.
@@ -207,458 +168,6 @@ const DEFAULT_REQUEST_EXPIRY_MS = 10 * 60 * 1000;
  * ```
  */
 const MAX_QR_DATA_SIZE = 2953; // Version 40 with L error correction
-/**
- * Coinbase Attestation circuit public input layout (byte offsets).
- * Defines the byte positions of each field in the flattened public inputs array.
- *
- * Public inputs are packed as bytes32 values:
- * - signal_hash: bytes 0-31
- * - merkle_root: bytes 32-63
- * - scope: bytes 64-95
- *
- * @example
- * ```typescript
- * const publicInputs = response.publicInputs;
- * const signalHash = publicInputs.slice(
- *   COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT.SIGNAL_HASH_START,
- *   COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT.SIGNAL_HASH_END + 1
- * );
- * ```
- */
-const COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT = {
-    SIGNAL_HASH_START: 0,
-    SIGNAL_HASH_END: 31,
-    MERKLE_ROOT_START: 32,
-    MERKLE_ROOT_END: 63,
-    SCOPE_START: 64,
-    SCOPE_END: 95,
-    NULLIFIER_START: 96,
-    NULLIFIER_END: 127,
-};
-/**
- * Coinbase Country Attestation circuit public input layout (byte offsets).
- * Defines the byte positions of each field in the flattened public inputs array.
- *
- * Public inputs are packed as bytes32 values:
- * - signal_hash: bytes 0-31
- * - merkle_root: bytes 32-63
- * - country_list: bytes 64-83 (20 bytes for 10 countries)
- * - country_list_length: byte 84
- * - is_included: byte 85
- * - scope: bytes 86-117
- *
- * @example
- * ```typescript
- * const publicInputs = response.publicInputs;
- * const countryList = publicInputs.slice(
- *   COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT.COUNTRY_LIST_START,
- *   COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT.COUNTRY_LIST_END + 1
- * );
- * ```
- */
-const COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT = {
-    SIGNAL_HASH_START: 0,
-    SIGNAL_HASH_END: 31,
-    MERKLE_ROOT_START: 32,
-    MERKLE_ROOT_END: 63,
-    COUNTRY_LIST_START: 64,
-    COUNTRY_LIST_END: 83,
-    COUNTRY_LIST_LENGTH: 84,
-    IS_INCLUDED: 85,
-    SCOPE_START: 86,
-    SCOPE_END: 117,
-    NULLIFIER_START: 118,
-    NULLIFIER_END: 149,
-};
-/**
- * Korea Mobile ID (mDL) circuit public input layout (field offsets).
- * All three mDL circuits share the same prefix: scope [0..31] and
- * nullifier_value [32..63], each stored one byte per field element.
- * The suffix differs per predicate circuit:
- * - mdl_kr_ownership (97 inputs): disclose_flags [64], owner_commit [65..96]
- * - mdl_kr_age (66 inputs): age_threshold [64], current_year [65]
- * - mdl_kr_region (96 inputs): region_code [64..95]
- *
- * @example
- * ```typescript
- * const nullifier = publicInputs.slice(
- *   MDL_KR_PUBLIC_INPUT_LAYOUT.NULLIFIER_START,
- *   MDL_KR_PUBLIC_INPUT_LAYOUT.NULLIFIER_END + 1
- * );
- * ```
- */
-const MDL_KR_PUBLIC_INPUT_LAYOUT = {
-    SCOPE_START: 0,
-    SCOPE_END: 31,
-    NULLIFIER_START: 32,
-    NULLIFIER_END: 63,
-    OWNERSHIP_DISCLOSE_FLAGS: 64,
-    OWNERSHIP_OWNER_COMMIT_START: 65,
-    OWNERSHIP_OWNER_COMMIT_END: 96,
-    AGE_THRESHOLD: 64,
-    AGE_CURRENT_YEAR: 65,
-    REGION_CODE_START: 64,
-    REGION_CODE_END: 95,
-};
-/**
- * OIDC Domain Attestation circuit public input layout (field offsets).
- * Defines the field positions in the flattened public inputs array (148 fields total).
- *
- * Circuit public inputs (from main.nr):
- * - pubkey_modulus_limbs: pub [u128; 18] → 18 fields (0–17)
- * - domain: pub BoundedVec<u8, 64> → 1 len + 64 storage = 65 fields (18–82)
- * - scope: pub [u8; 32] → 32 fields (83–114)
- * - nullifier: pub [u8; 32] → 32 fields (115–146)
- * - provider: pub u8 → 1 field (147)
- *
- * @example
- * ```typescript
- * const scope = publicInputs.slice(
- *   OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT.SCOPE_START,
- *   OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT.SCOPE_END + 1
- * );
- * ```
- */
-const OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT = {
-    PUBKEY_MODULUS_START: 0,
-    PUBKEY_MODULUS_END: 17,
-    DOMAIN_STORAGE_START: 18,
-    DOMAIN_STORAGE_END: 81,
-    DOMAIN_LEN: 82,
-    SCOPE_START: 83,
-    SCOPE_END: 114,
-    NULLIFIER_START: 115,
-    NULLIFIER_END: 146,
-    PROVIDER: 147,
-    /** @deprecated Use DOMAIN_STORAGE_START */
-    DOMAIN_START: 18,
-    /** @deprecated Use DOMAIN_LEN */
-    DOMAIN_END: 82,
-};
-
-/**
- * Canonical ZKProofport circuit identifiers.
- *
- * This module is the single source of truth for circuit IDs. Every other layer
- * — the mobile app, the demo, the relay, server-side provers — reads its list
- * from here instead of keeping a private copy that silently drifts.
- *
- * It has **no imports and no dependencies**, so it can be pulled in on its own:
- *
- * ```typescript
- * import { CIRCUIT_IDS, isCircuitId } from '@zkproofport-app/sdk/circuits';
- * ```
- *
- * The same names are also re-exported from the package root
- * (`@zkproofport-app/sdk`) for callers that already import the SDK.
- *
- * ## Identifiers are canonical and case-sensitive
- *
- * Each ID is the circuit's `name` in its `Nargo.toml`, verbatim. The format is
- * lowercase with underscores. Hyphenated spellings (`coinbase-kyc`,
- * `mdl-kr-age`) are directory or UI route names in other repositories — they
- * are **not** circuit IDs, and passing one produces a nullifier mismatch or a
- * failed on-chain lookup rather than a clear error.
- */
-/**
- * Canonical circuit identifiers, keyed by a stable constant name.
- *
- * Prefer these constants over string literals so a rename is a compile error
- * rather than a runtime surprise.
- *
- * @example
- * ```typescript
- * import { CIRCUIT_IDS } from '@zkproofport-app/sdk/circuits';
- *
- * const relay = await sdk.createRelayRequest(CIRCUIT_IDS.COINBASE_ATTESTATION, {
- *   scope: 'myapp.com',
- * });
- * ```
- */
-const CIRCUIT_IDS = Object.freeze({
-    /** Coinbase KYC attestation. Officially supported. */
-    COINBASE_ATTESTATION: 'coinbase_attestation',
-    /** Coinbase country attestation (inclusion / exclusion). Officially supported. */
-    COINBASE_COUNTRY_ATTESTATION: 'coinbase_country_attestation',
-    /** OIDC email-domain attestation. Officially supported. */
-    OIDC_DOMAIN_ATTESTATION: 'oidc_domain_attestation',
-    /** GIWA attestation. Planned — not officially supported yet. */
-    GIWA_ATTESTATION: 'giwa_attestation',
-    /** Dojang Playground on GIWA Sepolia. Experimental — testnet only. */
-    DOJANG_PLAYGROUND: 'dojang_playground',
-    /** Korea Mobile ID ownership. Planned — not officially supported yet. */
-    MDL_KR_OWNERSHIP: 'mdl_kr_ownership',
-    /** Korea Mobile ID age threshold. Planned — not officially supported yet. */
-    MDL_KR_AGE: 'mdl_kr_age',
-    /** Korea Mobile ID si/do region. Planned — not officially supported yet. */
-    MDL_KR_REGION: 'mdl_kr_region',
-});
-/**
- * Support status for every circuit.
- *
- * The record is exhaustive over {@link CircuitId}: adding an identifier without
- * giving it a status is a compile error, so this list cannot drift from
- * {@link CIRCUIT_IDS}.
- *
- * @example
- * ```typescript
- * import { CIRCUIT_SUPPORT_STATUS } from '@zkproofport-app/sdk/circuits';
- *
- * CIRCUIT_SUPPORT_STATUS.coinbase_attestation; // 'supported'
- * CIRCUIT_SUPPORT_STATUS.mdl_kr_age;           // 'planned'
- * ```
- */
-const CIRCUIT_SUPPORT_STATUS = Object.freeze({
-    coinbase_attestation: 'supported',
-    coinbase_country_attestation: 'supported',
-    oidc_domain_attestation: 'supported',
-    // Experimental, not planned: the circuit is built, its verifier is
-    // deployed on GIWA Sepolia and the demo requests it. What keeps it out of
-    // 'supported' is that it is testnet-only, so the app offers it behind
-    // Developer Mode and reads its files from main rather than a release tag.
-    giwa_attestation: 'experimental',
-    // Same footing as GIWA: built, verifier deployed on GIWA Sepolia, a real
-    // proof verifies there. Testnet only.
-    dojang_playground: 'experimental',
-    mdl_kr_ownership: 'planned',
-    mdl_kr_age: 'planned',
-    mdl_kr_region: 'planned',
-});
-/**
- * Where each circuit's verification key FILE lives inside the
- * `zkproofport/circuits` repository, relative to its root.
- *
- * Off-chain verification needs the verification key and nothing else — no
- * circuit bytecode, no witness. The key is public by nature: it is what anyone
- * checking a proof must already have, and the Solidity verifiers deployed
- * on-chain embed the same key.
- *
- * NOTE THE TRAILING `/vk` TWICE. In that repository `target/vk` is a DIRECTORY
- * holding `vk`, `vk_hash` and `SHA256SUMS`; the key itself is `target/vk/vk`.
- * These paths were first copied here from the mobile app, which keeps the
- * directory and the filename as two fields and joins them — so taking only the
- * directory produced a URL that answers 404, and the first browser to try
- * off-chain verification said "Could not fetch the verification key (HTTP 404)".
- *
- * Exhaustive over {@link CircuitId} on purpose. A new circuit whose key path is
- * not listed here fails to compile rather than failing at verification time,
- * where the only symptom would be a proof that cannot be checked.
- */
-const CIRCUIT_VK_PATHS = Object.freeze({
-    coinbase_attestation: 'coinbase-attestation/target/vk/vk',
-    coinbase_country_attestation: 'coinbase-country-attestation/target/vk/vk',
-    oidc_domain_attestation: 'oidc-domain-attestation/target/vk/vk',
-    giwa_attestation: 'giwa-attestation/target/vk/vk',
-    dojang_playground: 'dojang-playground/target/vk/vk',
-    mdl_kr_ownership: 'mdl/kr-ownership/target/vk/vk',
-    mdl_kr_age: 'mdl/kr-age/target/vk/vk',
-    mdl_kr_region: 'mdl/kr-region/target/vk/vk',
-});
-/**
- * Every canonical circuit identifier, in declaration order.
- *
- * Includes circuits that are still `planned`. Use {@link SUPPORTED_CIRCUIT_IDS}
- * when you only want the ones that are officially supported today.
- */
-const ALL_CIRCUIT_IDS = Object.freeze(Object.values(CIRCUIT_IDS));
-/**
- * Circuits that are officially supported today: the two Coinbase circuits and
- * OIDC domain attestation.
- *
- * Derived from {@link CIRCUIT_SUPPORT_STATUS}, so it cannot fall out of sync.
- */
-const SUPPORTED_CIRCUIT_IDS = Object.freeze(ALL_CIRCUIT_IDS.filter((id) => CIRCUIT_SUPPORT_STATUS[id] === 'supported'));
-/**
- * Circuits whose identifiers are reserved but which are not officially
- * supported yet: GIWA attestation and the three Korea Mobile ID circuits.
- *
- * Derived from {@link CIRCUIT_SUPPORT_STATUS}, so it cannot fall out of sync.
- */
-/**
- * Circuits you can prove today, on a testnet, with everything subject to change.
- *
- * `giwa_attestation` is in this state. Calling it `planned` would be wrong —
- * the circuit compiles, the verifier is deployed and a proof verifies against
- * it — and calling it `supported` would be worse, because the only deployment
- * is a testnet (GIWA Sepolia). Neither existing word was true, so the honest
- * move was a third word rather than picking the closer lie.
- */
-const EXPERIMENTAL_CIRCUIT_IDS = Object.freeze(ALL_CIRCUIT_IDS.filter(id => CIRCUIT_SUPPORT_STATUS[id] === 'experimental'));
-const PLANNED_CIRCUIT_IDS = Object.freeze(ALL_CIRCUIT_IDS.filter((id) => CIRCUIT_SUPPORT_STATUS[id] === 'planned'));
-/**
- * Narrows an unknown value to a canonical circuit identifier.
- *
- * Returns `false` for hyphenated route names such as `'coinbase-kyc'`, which
- * are not circuit IDs.
- *
- * @example
- * ```typescript
- * isCircuitId('coinbase_attestation'); // true
- * isCircuitId('coinbase-kyc');         // false
- * ```
- */
-function isCircuitId(value) {
-    return typeof value === 'string' && ALL_CIRCUIT_IDS.includes(value);
-}
-/**
- * Narrows an unknown value to a circuit identifier that is officially supported
- * today. Planned circuits return `false`.
- *
- * @example
- * ```typescript
- * isSupportedCircuitId('oidc_domain_attestation'); // true
- * isSupportedCircuitId('mdl_kr_age');              // false — planned
- * ```
- */
-function isSupportedCircuitId(value) {
-    return isCircuitId(value) && CIRCUIT_SUPPORT_STATUS[value] === 'supported';
-}
-/**
- * Returns the support status of a circuit.
- *
- * @param circuit - A canonical circuit identifier.
- * @throws Error when the value is not a canonical circuit identifier.
- *
- * @example
- * ```typescript
- * getCircuitSupportStatus('giwa_attestation'); // 'planned'
- * ```
- */
-function getCircuitSupportStatus(circuit) {
-    if (!isCircuitId(circuit)) {
-        throw new Error(`Unknown circuit '${String(circuit)}'. Expected one of: ${ALL_CIRCUIT_IDS.join(', ')}`);
-    }
-    return CIRCUIT_SUPPORT_STATUS[circuit];
-}
-const CIRCUIT_ACTION_BINDING = {
-    coinbase_attestation: 'none',
-    coinbase_country_attestation: 'none',
-    // The signature lives inside the identity token; no wallet, no action.
-    oidc_domain_attestation: 'none',
-    // Branches in-circuit: with an action the wallet signs the typed data,
-    // without one it personal_signs the request's signal hash.
-    giwa_attestation: 'optional',
-    // Same branch as GIWA; see dojang-playground/src/main.nr.
-    dojang_playground: 'optional',
-    mdl_kr_ownership: 'none',
-    mdl_kr_age: 'none',
-    mdl_kr_region: 'none',
-};
-/*
- * The union is declared above rather than derived from the table's values.
- *
- * Deriving it narrowed the type to whatever the table happens to hold today --
- * 'none' | 'optional' -- and TypeScript then called every `=== 'required'`
- * check impossible. The publish typecheck caught it; `rollup` and `vitest` did
- * not. 'required' is a state a circuit can legitimately be in (an EIP-712 path
- * and nothing else), so the union says so and the table is checked against it.
- */
-/**
- * How this circuit treats an action, or an error naming the id that is not one.
- *
- * No default: a circuit nobody has classified must not inherit 'none', which
- * would silently drop an action a dapp meant to bind.
- */
-function circuitActionBinding(circuit) {
-    const binding = CIRCUIT_ACTION_BINDING[circuit];
-    if (!binding) {
-        throw new Error(`Unknown circuit '${circuit}'. Expected: ${ALL_CIRCUIT_IDS.join(', ')}`);
-    }
-    return binding;
-}
-const CIRCUIT_NEEDS_WALLET_SIGNATURE = {
-    coinbase_attestation: true,
-    coinbase_country_attestation: true,
-    // The signature is inside the OIDC identity token, checked by the prover.
-    oidc_domain_attestation: false,
-    // Web2 (OmniOne CX) flows with no wallet binding at all.
-    mdl_kr_ownership: false,
-    mdl_kr_age: false,
-    mdl_kr_region: false,
-    // A GIWA-attested wallet signing an EIP-712 action (or its signal hash).
-    // This read `false` while the circuit had always verified a wallet signature
-    // -- it sat under the Web2 comment above and was never revisited. A request
-    // for it would have reached the relay with no signer.
-    giwa_attestation: true,
-    // The wallet signs the request, and the same key must have signed its
-    // Playground faucet transaction.
-    dojang_playground: true,
-};
-
-const ADDRESS = /^0x[0-9a-fA-F]{40}$/;
-/**
- * The reason the value is not a usable action, or `null` when it is one.
- *
- * Structural validation only, not application authorization policy. Consumers
- * (e.g. EligibilityGate) must independently enforce the expected chain, verifying
- * contract, actor, action parameters, nonce and deadline as applicable.
- * EIP-712 signs only fields declared in types, not extra message properties.
- *
- * A string rather than a boolean because every caller shows it to somebody —
- * a dapp developer reading a validation error, or a person looking at the
- * mobile app's demo screen.
- */
-function validateTypedAction(value) {
-    if (value === undefined || value === null) {
-        return 'action is required. The circuit proves that a wallet authorised ONE EIP-712 action; there is nothing to prove without it.';
-    }
-    if (typeof value !== 'object' || Array.isArray(value)) {
-        return 'action must be an object.';
-    }
-    const a = value;
-    const d = a.domain;
-    if (!d || typeof d !== 'object') {
-        return 'action.domain is required.';
-    }
-    for (const k of ['name', 'version', 'verifyingContract']) {
-        if (typeof d[k] !== 'string' || !d[k]) {
-            return `action.domain.${k} must be a non-empty string.`;
-        }
-    }
-    if (typeof d.chainId !== 'number' || !Number.isInteger(d.chainId)) {
-        return 'action.domain.chainId must be an integer.';
-    }
-    if (!ADDRESS.test(d.verifyingContract)) {
-        return 'action.domain.verifyingContract must be a 20-byte hex address.';
-    }
-    if (!a.types || typeof a.types !== 'object' || Array.isArray(a.types)) {
-        return 'action.types is required.';
-    }
-    if (typeof a.primaryType !== 'string' || !a.primaryType) {
-        return 'action.primaryType is required.';
-    }
-    if (!(a.primaryType in a.types)) {
-        return `action.primaryType '${a.primaryType}' is not one of the structs in action.types.`;
-    }
-    if (!a.message || typeof a.message !== 'object' || Array.isArray(a.message)) {
-        return 'action.message is required.';
-    }
-    // Every field the struct declares must be present, or the wallet signs a
-    // different message than the one the caller described.
-    const fields = a.types[a.primaryType];
-    if (!Array.isArray(fields) || fields.length === 0) {
-        return `action.types.${a.primaryType} declares no fields.`;
-    }
-    const missing = fields
-        .map(f => f?.name)
-        .filter(n => typeof n === 'string' && !(n in a.message));
-    if (missing.length) {
-        return `action.message is missing: ${missing.join(', ')}`;
-    }
-    return null;
-}
-/** The action, or the reason it is not one. For text a person typed. */
-function parseTypedAction(text) {
-    let raw;
-    try {
-        raw = JSON.parse(text);
-    }
-    catch (e) {
-        return { error: `Not valid JSON: ${e.message}` };
-    }
-    const error = validateTypedAction(raw);
-    return error ? { error } : { action: raw };
-}
 
 /**
  * Deep Link utilities for ZKProofport SDK
@@ -4293,370 +3802,6 @@ function estimateQRDataSize(requestOrUrl, scheme = DEFAULT_SCHEME) {
     };
 }
 
-/**
- * On-chain verification utilities for ZKProofport SDK
- *
- * Compatible with both ethers v5 and v6.
- */
-// ethers v5/v6 compatibility shims
-const _ethers = ethers;
-/** @internal ethers v5/v6 compatibility shim */
-function hexZeroPad(value, length) {
-    // v6: ethers.zeroPadValue, v5: ethers.utils.hexZeroPad
-    if (typeof _ethers.zeroPadValue === 'function')
-        return _ethers.zeroPadValue(value, length);
-    if (_ethers.utils?.hexZeroPad)
-        return _ethers.utils.hexZeroPad(value, length);
-    // manual fallback
-    const hex = value.startsWith('0x') ? value.slice(2) : value;
-    return '0x' + hex.padStart(length * 2, '0');
-}
-/** @internal ethers v5/v6 compatibility shim */
-function createJsonRpcProvider(url) {
-    // v6: ethers.JsonRpcProvider, v5: ethers.providers.JsonRpcProvider
-    if (typeof _ethers.JsonRpcProvider === 'function')
-        return new _ethers.JsonRpcProvider(url);
-    if (_ethers.providers?.JsonRpcProvider)
-        return new _ethers.providers.JsonRpcProvider(url);
-    throw new Error('No JsonRpcProvider found in ethers');
-}
-/**
- * @internal Resolve verifier from SDK config or proof response.
- * SDK config (customVerifier) takes priority over response-provided verifier.
- */
-function resolveVerifier(customVerifier, responseVerifier) {
-    if (customVerifier)
-        return customVerifier;
-    if (responseVerifier?.verifierAddress) {
-        return {
-            address: responseVerifier.verifierAddress,
-            chainId: responseVerifier.chainId ?? 0,
-            abi: VERIFIER_ABI,
-        };
-    }
-    return null;
-}
-/**
- * Get verifier contract instance for interacting with on-chain verifier contracts.
- *
- * @param providerOrSigner - ethers.js Provider or Signer instance (v5 or v6 compatible)
- * @param verifier - Verifier contract configuration containing address and ABI
- * @returns ethers.Contract instance connected to the verifier
- *
- * @example
- * ```typescript
- * const provider = new ethers.JsonRpcProvider(rpcUrl);
- * const contract = getVerifierContract(provider, {
- *   address: '0x...',
- *   chainId: 11155111,
- *   abi: VERIFIER_ABI
- * });
- * ```
- */
-function getVerifierContract(providerOrSigner, verifier) {
-    return new ethers.Contract(verifier.address, verifier.abi, providerOrSigner);
-}
-/**
- * Get default JSON-RPC provider for a chain using pre-configured RPC endpoints.
- *
- * @param chainId - The chain ID (e.g., 11155111 for Sepolia, 84532 for Base Sepolia)
- * @returns ethers.JsonRpcProvider instance for the specified chain
- * @throws Error if no RPC endpoint is configured for the chain
- *
- * @example
- * ```typescript
- * const provider = getDefaultProvider(11155111); // Sepolia
- * ```
- */
-function getDefaultProvider(chainId) {
-    const rpcUrl = RPC_ENDPOINTS[chainId];
-    if (!rpcUrl) {
-        throw new Error(`No RPC endpoint configured for chain ${chainId}. Known chains: ${Object.keys(RPC_ENDPOINTS).join(', ')}`);
-    }
-    return createJsonRpcProvider(rpcUrl);
-}
-/**
- * Verify a zero-knowledge proof on-chain by calling the verifier smart contract.
- *
- * This function resolves the verifier contract from SDK config or proof response,
- * connects to the blockchain, and calls the verify() method with the proof and public inputs.
- *
- * @param circuit - The canonical circuit identifier. REQUIRED.
- * @param parsedProof - Parsed proof object containing proofHex and publicInputsHex
- * @param providerOrSigner - Optional ethers.js Provider or Signer instance. If not provided, uses default RPC for the chain
- * @param customVerifier - Optional custom verifier contract config (takes priority over responseVerifier)
- * @param responseVerifier - Optional verifier info from proof generation response
- * @returns Promise resolving to verification result with valid flag and optional error message
- *
- * @example
- * ```typescript
- * const parsed = parseProofForOnChain(proof, publicInputs, numPublicInputs);
- * const result = await verifyProofOnChain(
- *   'coinbase_attestation',
- *   parsed,
- *   provider,
- *   { address: '0x...', chainId: 11155111, abi: VERIFIER_ABI }
- * );
- *
- * if (result.valid) {
- *   console.log('Proof is valid!');
- * } else {
- *   console.error('Verification failed:', result.error);
- * }
- * ```
- */
-async function verifyProofOnChain(circuit, parsedProof, providerOrSigner, customVerifier, responseVerifier) {
-    const verifier = resolveVerifier(customVerifier, responseVerifier);
-    if (!verifier) {
-        return {
-            valid: false,
-            error: 'No verifier address provided. Configure via SDK or ensure proof response includes verifierAddress.',
-        };
-    }
-    const provider = providerOrSigner || (verifier.chainId > 0 ? getDefaultProvider(verifier.chainId) : null);
-    if (!provider) {
-        return {
-            valid: false,
-            error: 'No provider available. Provide a provider or ensure chainId is set for RPC lookup.',
-        };
-    }
-    const contract = getVerifierContract(provider, verifier);
-    try {
-        const isValid = await contract.verify(parsedProof.proofHex, parsedProof.publicInputsHex);
-        return { valid: isValid };
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        return { valid: false, error: errorMessage };
-    }
-}
-/** @internal Ensure a hex string has the 0x prefix */
-function ensureHexPrefix(hex) {
-    return hex.startsWith('0x') ? hex : `0x${hex}`;
-}
-/**
- * Parse proof response into format suitable for on-chain verification.
- *
- * Converts proof and public inputs from relay response format to the format
- * expected by Solidity verifier contracts. Public inputs are zero-padded to
- * 32 bytes (bytes32) to match Solidity's bytes32[] type.
- *
- * @param proof - Proof bytes as hex string (with or without 0x prefix)
- * @param publicInputs - Array of public input values as hex strings
- * @param numPublicInputs - Number of public inputs (for validation)
- * @returns Parsed proof object ready for on-chain verification
- *
- * @example
- * ```typescript
- * const parsed = parseProofForOnChain(
- *   '0x1a2b3c...',
- *   ['0x01', '0x02', '0x03'],
- *   3
- * );
- *
- * // parsed.proofHex: '0x1a2b3c...'
- * // parsed.publicInputsHex: ['0x0000...01', '0x0000...02', '0x0000...03']
- * ```
- */
-function parseProofForOnChain(proof, publicInputs, numPublicInputs) {
-    const proofHex = ensureHexPrefix(proof);
-    const publicInputsHex = publicInputs.map((input) => {
-        return hexZeroPad(ensureHexPrefix(input), 32);
-    });
-    return {
-        proofHex,
-        publicInputsHex,
-        numPublicInputs,
-    };
-}
-/** @internal Require a verifier or throw with a helpful message */
-function requireVerifier(circuit, verifier) {
-    if (!verifier) {
-        throw new Error(`No verifier configured for circuit '${circuit}'. Configure via SDK verifiers option.`);
-    }
-    return verifier;
-}
-/**
- * Get verifier contract address for a circuit.
- *
- * @param circuit - The canonical circuit identifier. REQUIRED.
- * @param customVerifier - Optional custom verifier contract config
- * @returns Verifier contract address as hex string
- * @throws Error if no verifier is configured for the circuit
- *
- * @example
- * ```typescript
- * const address = getVerifierAddress('coinbase_attestation', verifierConfig);
- * console.log(address); // '0x1234...'
- * ```
- */
-function getVerifierAddress(circuit, customVerifier) {
-    return requireVerifier(circuit, customVerifier).address;
-}
-/**
- * Get chain ID for a circuit's verifier contract.
- *
- * @param circuit - The canonical circuit identifier. REQUIRED.
- * @param customVerifier - Optional custom verifier contract config
- * @returns Chain ID number (e.g., 11155111 for Sepolia, 84532 for Base Sepolia)
- * @throws Error if no verifier is configured for the circuit
- *
- * @example
- * ```typescript
- * const chainId = getVerifierChainId('coinbase_attestation', verifierConfig);
- * console.log(chainId); // 11155111
- * ```
- */
-function getVerifierChainId(circuit, customVerifier) {
-    return requireVerifier(circuit, customVerifier).chainId;
-}
-/**
- * Where `scope` and `nullifier` sit in each circuit's public inputs.
- *
- * Keyed by `CircuitId`, which is the point: adding a circuit to the SDK makes
- * this object a compile error until somebody opens that circuit's `fn main`
- * and writes its offsets down. Nothing here can be inferred from the proof —
- * the public inputs are a flat array of bytes with no framing.
- *
- * It replaced an `if / else if / else` chain whose final `else` handed every
- * unrecognised circuit — and every call that named no circuit at all —
- * Coinbase's offsets. For `giwa_attestation` that is not a near miss: its
- * public inputs are signal_hash, domain_separator, action_hash, merkle root,
- * scope, nullifier, so the nullifier slot under Coinbase's offsets holds the
- * MERKLE ROOT, a value identical for every user. Duplicate detection built on
- * it would report one person.
- */
-const PUBLIC_INPUT_OFFSETS = Object.freeze({
-    // signal_hash, signer_list_merkle_root, scope, nullifier
-    coinbase_attestation: { scope: [64, 95], nullifier: [96, 127] },
-    // No longer Coinbase's layout. The GIWA circuit gained the EIP-712 pair, so
-    // it reads: signal_hash, domain_separator, action_hash, merkle root, then
-    // scope and nullifier 64 bytes further along than Coinbase.
-    giwa_attestation: { scope: [128, 159], nullifier: [160, 191] },
-    // signal_hash, domain_separator, action_hash, scope, nullifier: GIWA's
-    // order without the merkle root, since there is no issuer list.
-    dojang_playground: { scope: [96, 127], nullifier: [128, 159] },
-    // country_list, country_list_length and is_included sit before scope.
-    coinbase_country_attestation: { scope: [86, 117], nullifier: [118, 149] },
-    // pubkey_modulus_limbs and the bounded domain sit before scope.
-    oidc_domain_attestation: { scope: [83, 114], nullifier: [115, 146] },
-    // The Korea mDL circuits open with the pair; signal_hash is commented out.
-    mdl_kr_ownership: { scope: [0, 31], nullifier: [32, 63] },
-    mdl_kr_age: { scope: [0, 31], nullifier: [32, 63] },
-    mdl_kr_region: { scope: [0, 31], nullifier: [32, 63] },
-});
-/**
- * The offsets for a circuit, or an error naming what was asked for.
- *
- * Throwing is the whole point. A caller that omits the circuit, or names one
- * this SDK has never heard of, is asking a question with no answer; returning
- * a guess produced a scope and a nullifier that belong to different bytes and
- * looked exactly like real ones.
- */
-function offsetsFor(circuit) {
-    if (circuit === undefined) {
-        throw new Error(`A circuit id is required to read public inputs: the layout differs per circuit and cannot be inferred from the proof. Pass one of: ${ALL_CIRCUIT_IDS.join(', ')}`);
-    }
-    if (!isCircuitId(circuit)) {
-        throw new Error(`Unknown circuit '${circuit}'. Expected one of: ${ALL_CIRCUIT_IDS.join(', ')}`);
-    }
-    return PUBLIC_INPUT_OFFSETS[circuit];
-}
-/**
- * Extract scope value from public inputs array.
- *
- * The scope is a bytes32 value encoded across 32 consecutive field elements
- * in the public inputs. The exact position depends on the circuit type.
- *
- * @param publicInputsHex - Array of public input hex strings (zero-padded to 32 bytes)
- * @param circuit - Optional circuit identifier to determine field positions
- * @returns Reconstructed scope as hex string with 0x prefix, or null if inputs are insufficient
- *
- * @example
- * ```typescript
- * const scope = extractScopeFromPublicInputs(publicInputsHex, 'coinbase_attestation');
- * console.log(scope); // '0x7a6b70726f6f66706f72742e636f6d...'
- * ```
- */
-function extractScopeFromPublicInputs(publicInputsHex, circuit) {
-    const [start, end] = offsetsFor(circuit).scope;
-    if (publicInputsHex.length <= end)
-        return null;
-    const scopeFields = publicInputsHex.slice(start, end + 1);
-    return reconstructBytes32FromFields(scopeFields);
-}
-/**
- * Extracts the nullifier (bytes32) from public inputs based on circuit type.
- *
- * The nullifier is a unique, deterministic hash derived from the user's attestation
- * and scope. It serves as a privacy-preserving user identifier — the same user
- * with the same scope always produces the same nullifier, enabling duplicate
- * detection without revealing the wallet address.
- *
- * @param publicInputsHex - Array of hex-encoded field elements
- * @param circuit - Circuit id. REQUIRED: the layout differs per circuit and
- *   cannot be inferred from the proof. It used to default to
- *   `coinbase_attestation`, which returned the right-shaped bytes read from
- *   the wrong place for every other circuit.
- * @returns Nullifier as hex string (bytes32), or null if publicInputs too short
- *
- * @example
- * ```typescript
- * const nullifier = extractNullifierFromPublicInputs(publicInputs, 'coinbase_attestation');
- * console.log(nullifier); // '0xabc123...'
- * ```
- */
-function extractNullifierFromPublicInputs(publicInputsHex, circuit) {
-    const [start, end] = offsetsFor(circuit).nullifier;
-    if (publicInputsHex.length <= end)
-        return null;
-    const nullifierFields = publicInputsHex.slice(start, end + 1);
-    return reconstructBytes32FromFields(nullifierFields);
-}
-/**
- * Extract domain string from OIDC Domain Attestation public inputs.
- *
- * The domain is stored as a Noir BoundedVec<u8, 64>, which serializes as
- * [storage[0..64], len]. Each storage element is a u8 value in a field element.
- *
- * @param publicInputsHex - Array of public input hex strings
- * @param circuit - Circuit identifier (must be 'oidc_domain_attestation')
- * @returns Domain as ASCII string, or null if circuit doesn't match or inputs are insufficient
- *
- * @example
- * ```typescript
- * const domain = extractDomainFromPublicInputs(publicInputs, 'oidc_domain_attestation');
- * console.log(domain); // 'example.com'
- * ```
- */
-function extractDomainFromPublicInputs(publicInputsHex, circuit) {
-    if (circuit !== 'oidc_domain_attestation')
-        return null;
-    const layout = OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT;
-    if (publicInputsHex.length <= layout.DOMAIN_LEN)
-        return null;
-    const len = Number(BigInt(publicInputsHex[layout.DOMAIN_LEN]) & 0xffn);
-    if (len === 0 || len > 64)
-        return null;
-    const storageFields = publicInputsHex.slice(layout.DOMAIN_STORAGE_START, layout.DOMAIN_STORAGE_START + len);
-    const chars = storageFields.map(f => {
-        const byte = Number(BigInt(f) & 0xffn);
-        return String.fromCharCode(byte);
-    });
-    return chars.join('');
-}
-/** @internal Reconstruct a bytes32 value from 32 individual field elements */
-function reconstructBytes32FromFields(fields) {
-    if (fields.length !== 32) {
-        throw new Error(`Expected 32 fields, got ${fields.length}`);
-    }
-    const bytes = fields.map(f => {
-        const byte = BigInt(f) & 0xffn;
-        return byte.toString(16).padStart(2, '0');
-    }).join('');
-    return '0x' + bytes;
-}
-
 /**
  * Off-chain proof verification — checking a proof against its verification key,
  * with no chain, no RPC, and no gas.
@@ -4670,27 +3815,28 @@ function reconstructBytes32FromFields(fields) {
  * (through mopro's native Barretenberg); it was only the JavaScript side that
  * had no such thing.
  *
- * HOW IT WORKS. Proofs here are made with `--oracle_hash keccak` and ZK on, so
- * the matching check is `acirVerifyUltraKeccakZkHonk(proof, vk)`. Two things
- * have to line up:
+ * HOW IT WORKS. Proofs here are made for the EVM target (`bb prove -t evm`:
+ * keccak transcript, ZK on), so the matching check is bb.js's
+ * `UltraHonkVerifierBackend.verifyProof(..., { verifierTarget: 'evm' })`. Two
+ * things have to line up:
  *
- *   The version. `@aztec/bb.js@1.0.0-nightly.20250723` is the WASM build of the
- *   same bb the circuits are compiled with. Versions are not interchangeable:
- *   measured on the Korea Mobile ID age circuit, the pinned bb writes a 16256-
- *   byte proof where bb 1.2.0 writes 16224 for the identical circuit and
- *   witness — and the verification key comes out the SAME either way, so the
- *   key cannot warn you. A mismatch shows up only as verification failing.
+ *   The version. `@aztec/bb.js` must be the WASM build of the same bb the
+ *   circuits are compiled with -- `BB_VERSION` in circuits/toolchain.env,
+ *   4.2.0-aztecnr-rc.2 since the beta.19 toolchain. Versions are not
+ *   interchangeable: on the Korea Mobile ID age circuit the 2025 nightly wrote
+ *   a 16256-byte proof where bb 1.2.0 wrote 16224 for the identical circuit and
+ *   witness, with the SAME verification key, so the key cannot warn you. A
+ *   mismatch shows up only as verification failing.
  *
- *   The flavour. There are four verify entry points and picking the wrong one
- *   is not a polite false. `acirVerifyUltraZKHonk` (poseidon) answers false for
- *   a perfectly good proof, and `acirVerifyUltraKeccakHonk` — keccak without ZK
- *   — TRAPS the WebAssembly with a bare "unreachable", which looks exactly like
- *   a corrupt proof, a mismatched key, or a missing SRS.
+ *   The target. Verifying an EVM proof as any other target is not a polite
+ *   false. With the 2025 nightly, keccak-without-ZK trapped the WebAssembly
+ *   with a bare "unreachable" and the poseidon flavour answered false for a
+ *   good proof.
  *
  * THE PROOF ARRIVES IN TWO PIECES. The mobile app splits what Barretenberg
  * produced into `proof` and `publicInputs` before sending it, because the
- * Solidity verifier takes them separately. Verifying needs them joined back, in
- * that order, which is what `reconstructHonkProof` does.
+ * Solidity verifier takes them separately. bb.js 4.x's verifier takes the same
+ * two pieces, so nothing is joined back here.
  */
 /**
  * Where verification keys are published.
@@ -4754,8 +3900,8 @@ function hexToBytes(hex) {
     return out;
 }
 /**
- * @internal Public inputs as the flat byte run Barretenberg expects: each one a
- * 32-byte big-endian field element, concatenated in order.
+ * @internal Public inputs as 32-byte big-endian field elements in hex, the
+ * shape bb.js's verifier takes.
  *
  * The relay carries them as hex strings that are USUALLY already 32 bytes, but
  * a value that happens to have leading zeros can arrive short (`0x01`). Left-
@@ -4763,16 +3909,16 @@ function hexToBytes(hex) {
  * verification that works and one that fails on roughly one proof in a hundred,
  * for no reason the caller can see.
  */
-function packPublicInputs(publicInputs) {
-    const out = new Uint8Array(publicInputs.length * 32);
-    publicInputs.forEach((input, i) => {
+function normalisePublicInputs(publicInputs) {
+    return publicInputs.map((input, i) => {
         const bytes = hexToBytes(input);
         if (bytes.length > 32) {
             throw new Error(`Public input ${i} is ${bytes.length} bytes; a field element is at most 32`);
         }
-        out.set(bytes, i * 32 + (32 - bytes.length));
+        const padded = new Uint8Array(32);
+        padded.set(bytes, 32 - bytes.length);
+        return '0x' + Array.from(padded, b => b.toString(16).padStart(2, '0')).join('');
     });
-    return out;
 }
 /**
  * Fetch a circuit's verification key, with a small cache.
@@ -4868,35 +4014,15 @@ async function verifyProofOffChain(circuit, proof, publicInputs, options = {}) {
         if (proofBytes.length === 0) {
             return { valid: false, error: 'Proof is empty' };
         }
-        const publicInputBytes = packPublicInputs(publicInputs);
+        // Normalised to 32-byte big-endian fields before handing them over: the
+        // relay can deliver a short value (`0x01`), and the check below must see
+        // exactly what the circuit committed to.
+        const fields = normalisePublicInputs(publicInputs);
         const vk = options.verificationKey ?? (await fetchVerificationKey(circuit, timeoutMs));
-        // Public inputs first, then the proof — the order Barretenberg wrote them in
-        // before the mobile app split them apart for the Solidity verifier.
-        const full = bb.reconstructHonkProof(publicInputBytes, proofBytes);
-        api = (await bb.Barretenberg.new({ threads: 1 }));
-        // THE VERIFY MUST MATCH HOW THE PROOF WAS MADE, AND THERE ARE FOUR OF THEM.
-        //
-        // `scripts/build.sh` in the circuits repo proves with `--oracle_hash keccak`
-        // and ZK on — so the only entry point that answers correctly is the one that
-        // is BOTH. Measured against a real proof of the Korea Mobile ID age circuit,
-        // freshly generated against its own key:
-        //
-        //   acirVerifyUltraKeccakZkHonk    true     ← the right one
-        //   acirVerifyUltraKeccakHonk      TRAPS with a bare "unreachable"
-        //   acirVerifyUltraZKHonk          false    (poseidon: wrong oracle hash)
-        //
-        // The middle row is why this took a while: picking keccak-without-ZK does
-        // not return false, it kills the WebAssembly instance with a message that
-        // names nothing. It looks identical to a malformed proof, to a mismatched
-        // key, and to a missing SRS.
-        //
-        // Two more things that produce that same trap, both required:
-        //   initSRSForCircuitSize must be called before the first verify.
-        //   The key must be a RawBuffer — a plain Uint8Array is marshalled as a
-        //   length-prefixed vector, so its length is read as key material.
-        // Both are what bb.js's own BarretenbergVerifier does before verifying.
-        await api.initSRSForCircuitSize(0);
-        const valid = await api.acirVerifyUltraKeccakZkHonk(full, new bb.RawBuffer(vk));
+        const barretenberg = await bb.Barretenberg.new({ threads: 1 });
+        api = barretenberg;
+        const verifier = new bb.UltraHonkVerifierBackend(barretenberg);
+        const valid = await verifier.verifyProof({ proof: proofBytes, publicInputs: fields, verificationKey: vk }, { verifierTarget: 'evm' });
         return { valid };
     }
     catch (error) {
@@ -5989,6 +5115,13 @@ class ProofportSDK {
             inputs,
             challenge,
         };
+        // The relay never reads `inputs`, so the scope is also sent on the envelope,
+        // where the relay counts requests per scope. The app proves the scope inside
+        // `inputs` and uses the envelope copy only when `inputs` has none; both are
+        // the same string here.
+        const scope = inputs.scope;
+        if (typeof scope === 'string' && scope.length > 0)
+            body.scope = scope;
         // Sign challenge for circuits that require wallet signature
         if (needsSignature && this.signer) {
             body.signature = await this.signer.signMessage(challenge);
@@ -6303,5 +5436,5 @@ class ProofportSDK {
     }
 }
 
-export { ALL_CIRCUIT_IDS, CIRCUIT_ACTION_BINDING, CIRCUIT_IDS, CIRCUIT_SUPPORT_STATUS, CIRCUIT_VK_PATHS, COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT, COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT, EXPERIMENTAL_CIRCUIT_IDS, MDL_KR_PUBLIC_INPUT_LAYOUT, OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT, PLANNED_CIRCUIT_IDS, ProofportSDK, RELAY_TERMINAL_STATUSES, SUPPORTED_CIRCUIT_IDS, circuitActionBinding, ProofportSDK as default, extractDomainFromPublicInputs, extractNullifierFromPublicInputs, extractScopeFromPublicInputs, getCircuitSupportStatus, isCircuitId, isSupportedCircuitId, isTerminalRelayStatus, parseTypedAction, validateTypedAction, verifyProofOffChain };
+export { ProofportSDK, RELAY_TERMINAL_STATUSES, ProofportSDK as default, isTerminalRelayStatus, verifyProofOffChain };
 //# sourceMappingURL=index.esm.js.map