@zkproofport-app/sdk 0.5.0-beta.3 → 0.5.0-beta.5

package/README.md

@@ -3,7 +3,7 @@
 [![npm version](https://img.shields.io/npm/v/@zkproofport-app/sdk)](https://www.npmjs.com/package/@zkproofport-app/sdk)
 [![license](https://img.shields.io/npm/l/@zkproofport-app/sdk)](./LICENSE)
 
-TypeScript SDK for requesting zero-knowledge proofs from the [ZKProofport](https://zkproofport.com) mobile app and verifying them on-chain. Three circuits are officially supported today — Coinbase KYC, Coinbase country attestation, and OIDC email-domain attestation (Google, Microsoft 365). Two more prove today against a testnet deployment and are marked experimental: GIWA attestation and Dojang Playground. The three Korean mobile ID (mDL) identifiers are reserved and planned. [Circuit Identifiers](#circuit-identifiers) has the full list and what each status means.
+TypeScript SDK for requesting zero-knowledge proofs from the [ZKProofport](https://zkproofport.com) mobile app and verifying them on-chain. Three circuits are officially supported today — Coinbase KYC, Coinbase country attestation, and OIDC email-domain attestation (Google, Microsoft 365). Two more prove today against a testnet deployment and are marked experimental: GIWA attestation and Dojang Playground. [Circuit Identifiers](#circuit-identifiers) has the full list and what each status means.
 
 ## How It Works
 
@@ -33,7 +33,7 @@ TypeScript SDK for requesting zero-knowledge proofs from the [ZKProofport](https
 ```
 
 1. Your app creates a proof request through the SDK
-2. The SDK asks the relay for a one-time challenge and a tracked request ID. For the Coinbase circuits it also signs that challenge with your wallet signer (EIP-191); the OIDC and mDL circuits need no signature
+2. The SDK asks the relay for a one-time challenge and a tracked request ID. For the Coinbase circuits it also signs that challenge with your wallet signer (EIP-191); the OIDC circuit needs no signature
 3. Your app shows the returned deep link as a QR code (desktop) or navigates to it (mobile)
 4. The user opens the ZKProofport app, which generates the ZK proof on-device
 5. The proof result flows back through the relay to your app over WebSocket (HTTP polling as fallback)
@@ -90,6 +90,7 @@ if (result.status === 'completed') {
     publicInputs: result.publicInputs,
     verifierAddress: result.verifierAddress,
     chainId: result.chainId,
+    signerVariant: result.signerVariant,
   };
 
   const verification = await sdk.verifyResponseOnChain(response);
@@ -99,7 +100,7 @@ if (result.status === 'completed') {
 
 ## Circuit Identifiers
 
-Circuit IDs are canonical, lowercase and case-sensitive: each one is the `name` field of that circuit's `Nargo.toml`, verbatim. Hyphenated spellings such as `coinbase-kyc` or `mdl-kr-age` are route and directory names from elsewhere — they are not circuit IDs, and passing one does not fail with a clear error. It produces a nullifier mismatch or a verifier lookup that finds nothing.
+Circuit IDs are canonical, lowercase and case-sensitive: each one is the `name` field of that circuit's `Nargo.toml`, verbatim. Hyphenated spellings such as `coinbase-kyc` or `oidc-domain` are route and directory names from elsewhere — they are not circuit IDs, and passing one does not fail with a clear error. It produces a nullifier mismatch or a verifier lookup that finds nothing.
 
 This SDK is the single source of truth for that list. Import the constants rather than typing the strings, and a rename becomes a compile error instead of a runtime surprise:
 
@@ -126,28 +127,23 @@ import { CIRCUIT_IDS, CIRCUIT_SUPPORT_STATUS } from '@zkproofport-app/sdk/circui
 | `CIRCUIT_IDS.OIDC_DOMAIN_ATTESTATION` | `oidc_domain_attestation` | **Supported** |
 | `CIRCUIT_IDS.GIWA_ATTESTATION` | `giwa_attestation` | _Experimental_ |
 | `CIRCUIT_IDS.DOJANG_PLAYGROUND` | `dojang_playground` | _Experimental_ |
-| `CIRCUIT_IDS.MDL_KR_OWNERSHIP` | `mdl_kr_ownership` | Planned |
-| `CIRCUIT_IDS.MDL_KR_AGE` | `mdl_kr_age` | Planned |
-| `CIRCUIT_IDS.MDL_KR_REGION` | `mdl_kr_region` | Planned |
 
 **Supported** means generally available — build a product on it.
 
 **Experimental** means you can prove it today and it verifies, but only against a testnet deployment. Inputs, public-input layout and the verifier address can change without a major version bump, and there is no mainnet to point at. Try it; do not ship on it.
 
-**Planned** means the identifier is reserved and the circuit exists, but it is not officially supported yet: availability, inputs and public-input layout can change without a major version bump.
+**Planned** marks an identifier reserved ahead of official support; inputs and public-input layout can change without a major version bump. No circuit has this status today.
 
-Every ID appears in `CircuitType` and in `sdk.getSupportedCircuits()`, planned ones included, so being assignable is not a support guarantee. Gate on the status, not on the type:
+Every ID appears in `CircuitType` and in `sdk.getSupportedCircuits()`, experimental ones included, so being assignable is not a support guarantee. Gate on the status, not on the type:
 
 ```typescript
 import { CIRCUIT_SUPPORT_STATUS, isSupportedCircuitId } from '@zkproofport-app/sdk';
 
 CIRCUIT_SUPPORT_STATUS.coinbase_attestation; // 'supported'
 CIRCUIT_SUPPORT_STATUS.giwa_attestation;     // 'experimental'
-CIRCUIT_SUPPORT_STATUS.mdl_kr_age;           // 'planned'
 
 isSupportedCircuitId('oidc_domain_attestation'); // true
 isSupportedCircuitId('giwa_attestation');        // false — experimental is not supported
-isSupportedCircuitId('mdl_kr_age');              // false
 isSupportedCircuitId('coinbase-kyc');            // false — not an ID at all
 ```
 
@@ -163,14 +159,14 @@ isSupportedCircuitId('coinbase-kyc');            // false — not an ID at all
 | `isCircuitId(value)` | `value is CircuitId` | Narrows an unknown value; `false` for hyphenated names |
 | `isSupportedCircuitId(value)` | `value is CircuitId` | The same, and additionally requires `supported` |
 | `getCircuitSupportStatus(id)` | `CircuitSupportStatus` | Status of one ID; throws on an unknown one |
-| `CircuitId` | type | Union of the eight IDs. `CircuitType` is an alias of it |
-| `CircuitSupportStatus` | type | `'supported' \| 'planned'` |
+| `CircuitId` | type | Union of the five IDs. `CircuitType` is an alias of it |
+| `CircuitSupportStatus` | type | `'supported' \| 'experimental' \| 'planned'` |
 
 Both objects and all three arrays are frozen. `ALL_CIRCUIT_IDS`, `SUPPORTED_CIRCUIT_IDS` and `PLANNED_CIRCUIT_IDS` are derived from `CIRCUIT_SUPPORT_STATUS` at load time, so they cannot disagree with it.
 
 ## Supported Circuits
 
-The circuits below are officially supported. Pass their IDs exactly as written, or use the `CIRCUIT_IDS` constants. `sdk.getSupportedCircuits()` returns every known ID at runtime, planned ones included — see [Circuit Identifiers](#circuit-identifiers).
+The circuits below are officially supported. Pass their IDs exactly as written, or use the `CIRCUIT_IDS` constants. `sdk.getSupportedCircuits()` returns every known ID at runtime, experimental ones included — see [Circuit Identifiers](#circuit-identifiers).
 
 ### `coinbase_attestation`
 
@@ -181,6 +177,7 @@ Proves that a user has completed Coinbase KYC identity verification without reve
 | `scope` | `string` | Yes | Application-specific identifier (e.g., your domain). Ensures proof uniqueness per app. |
 | `userAddress` | `string` | No | Address to prove the attestation for. Omit it and the mobile app asks the user to connect a wallet. |
 | `rawTransaction` | `string` | No | Pre-fetched attestation transaction data. Omit it and the app fetches the attestation itself. |
+| `action` | `TypedAction` | No | One EIP-712 action for the wallet to sign and the proof to carry. Without one the wallet signs the request's signal hash. See [Which circuits take an action](#which-circuits-take-an-action). |
 
 ```typescript
 const relay = await sdk.createRelayRequest('coinbase_attestation', {
@@ -188,6 +185,9 @@ const relay = await sdk.createRelayRequest('coinbase_attestation', {
 });
 ```
 
+Its nullifier is `keccak(keccak(wallet ++ keccak("coinbase_attestation")) ++ scope)`:
+one wallet in one scope has exactly one nullifier.
+
 ### `coinbase_country_attestation`
 
 Proves a user's country based on Coinbase verification, supporting inclusion and exclusion checks, without revealing the actual country. Requires a wallet signer.
@@ -267,7 +267,7 @@ const { deepLink } = await sdk.createRelayRequest(
 **An action is optional here.** Send one
 and the wallet signs EIP-712 typed data, so the person reads named fields and
 the proof carries what they approved. Send none and the wallet signs the
-request's signal hash, exactly as Coinbase KYC does. The circuit itself
+request's signal hash. Coinbase KYC branches the same way. The circuit itself
 branches, and it refuses a request that tries to be both: with an action the
 signal hash must be empty, without one the EIP-712 pair must be.
 
@@ -288,8 +288,8 @@ await sdk.createRelayRequest(
 ```
 
 Its public inputs are `signal_hash`, `domain_separator`, `action_hash`,
-`signer_list_merkle_root`, `scope`, `nullifier` — 64 bytes longer than the Coinbase layout it used to share. Anything holding the
-old offsets reads the Merkle root where the nullifier is.
+`signer_list_merkle_root`, `scope`, `nullifier`: Coinbase KYC's order without
+its final `attested_at`.
 
 One more difference worth knowing if you count people: its nullifier is
 `keccak(keccak(wallet ++ keccak("giwa_attestation")) ++ scope)`. The wallet and
@@ -333,76 +333,21 @@ circuit names are special:
 
 | What the circuit does with an action | Circuits |
 |---|---|
-| Signs it when present, signs the signal hash when not | `giwa_attestation`, `dojang_playground` |
-| Has no action inputs — sending one is refused, not ignored | Coinbase KYC, Coinbase country, OIDC domain, the three mDL circuits |
+| Signs it when present, signs the signal hash when not | `coinbase_attestation`, `giwa_attestation`, `dojang_playground` |
+| Has no action inputs — sending one is refused, not ignored | Coinbase country, OIDC domain |
 
 ```typescript
 import { circuitActionBinding } from '@zkproofport-app/sdk';
 
 circuitActionBinding('giwa_attestation');  // 'optional'
-circuitActionBinding('coinbase_attestation'); // 'none'
+circuitActionBinding('coinbase_attestation'); // 'optional'
+circuitActionBinding('coinbase_country_attestation'); // 'none'
 ```
 
 Sending an action to a circuit that cannot prove one is an error rather than a
 silent drop: a dropped action would leave you believing a proof authorized
 something the circuit never saw.
 
-## Planned Circuits
-
-ZKProofport is registered with the Ministry of the Interior and Safety as a Korea Mobile ID integration service (모바일 신분증 연계서비스). The three circuits below are in beta: `CIRCUIT_SUPPORT_STATUS` reports each of them as `planned`, and their input shape and public-input layout can change without a major version bump.
-
-### `mdl_kr_ownership`
-
-Proves the user holds a valid Korean mobile driver's license (모바일 신분증). The license data stays on-device; only the attributes selected by `discloseFlags` are revealed. No wallet signer is required.
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `scope` | `string` | Yes | Application-specific identifier for proof uniqueness. Non-empty, 256 characters or fewer, no control characters. |
-| `discloseFlags` | `number` | No | Attribute disclosure bitmask, integer 0–15 (`0x01` name, `0x02` birth, `0x04` sex, `0x08` phone). Omit or `0` for a fully anonymous ownership proof. |
-
-```typescript
-// Anonymous "holds a valid Korean mobile ID" proof
-const relay = await sdk.createRelayRequest('mdl_kr_ownership', {
-  scope: 'myapp.com',
-});
-```
-
-### `mdl_kr_age`
-
-Proves the user is at least `ageThreshold` years old according to their Korean mobile driver's license, without revealing the birth date. No wallet signer is required.
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `scope` | `string` | Yes | Application-specific identifier (same rules as above) |
-| `ageThreshold` | `number` | Yes | Minimum age to prove — integer between 1 and 150 (e.g. `19` for Korean adult verification) |
-
-```typescript
-const relay = await sdk.createRelayRequest('mdl_kr_age', {
-  scope: 'myapp.com',
-  ageThreshold: 19,
-});
-```
-
-### `mdl_kr_region`
-
-Proves the user's registered address is in the specified si/do region without revealing the full address. No wallet signer is required.
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `scope` | `string` | Yes | Application-specific identifier (same rules as above) |
-| `targetRegion` | `string` | Yes | Region (si/do) to prove residency in, in Korean (e.g. `'경기도'`, `'서울특별시'`). Non-empty, 256 characters or fewer, no control characters. |
-
-```typescript
-const relay = await sdk.createRelayRequest('mdl_kr_region', {
-  scope: 'myapp.com',
-  targetRegion: '경기도',
-});
-```
-
-> mDL inputs are checked before the request leaves your process: a missing `scope`, an out-of-range `discloseFlags`, a non-integer `ageThreshold` or an empty `targetRegion` throws locally instead of coming back as a relay error.
-
-> The mDL circuits do not require `setSigner()` — the proof is bound to the license via an on-device nullifier (`nullifier_value` public input), not a wallet address. Use `sdk.extractNullifier(publicInputs, circuit)` for sybil-resistant user identification.
-
 ## Integration Guide
 
 ### Step 1: Initialize
@@ -438,7 +383,7 @@ interface WalletSigner {
 
 Any ethers v5/v6 `Signer` is compatible.
 
-> **When you can skip this step:** the OIDC Domain and the three mDL circuits never sign a challenge. Calling `createRelayRequest` for those circuits without a signer works. Calling it for a Coinbase circuit without one throws `Signer not set. Call setSigner() first. Wallet signature is required for this circuit.`
+> **When you can skip this step:** the OIDC Domain circuit never signs a challenge. Calling `createRelayRequest` for it without a signer works. Calling it for a Coinbase circuit without one throws `Signer not set. Call setSigner() first. Wallet signature is required for this circuit.`
 
 #### About challenge-signature
 
@@ -625,7 +570,7 @@ if (ProofportSDK.isMobile()) {
 
 ```typescript
 const result = await sdk.waitForProof(relay.requestId, {
-  timeoutMs: 300000, // 5 minutes (default)
+  timeoutMs: 600000, // 10 minutes (default)
   onStatusChange: (update) => {
     console.log('Status:', update.status);
   },
@@ -658,7 +603,7 @@ const once = await sdk.pollResult(relay.requestId);
 // Poll until terminal state
 const result = await sdk.waitForResult(relay.requestId, {
   intervalMs: 2000,
-  timeoutMs: 300000,
+  timeoutMs: 600000,
   onStatusChange: (result) => console.log(result.status),
 });
 ```
@@ -675,7 +620,7 @@ When you are done, `sdk.disconnect()` closes any open socket.
   status: 'completed',
   circuit: 'coinbase_attestation',
   proof: '0x1f8b0a…',                       // proof bytes, opaque
-  publicInputs: ['0x00…2f', '0x00…a1', …],  // ordered — 128 entries for this circuit
+  publicInputs: ['0x00…2f', '0x00…a1', …],  // ordered — 193 entries for this circuit
   verifierAddress: '0x…',                   // the verifier the app reports (checked, not trusted)
   chainId: …,                               // the network the app reports (checked, not trusted)
   deepLink: 'zkproofport://proof-request?data=…',
@@ -738,7 +683,7 @@ switch (result.status) {
 
 `isTerminalRelayStatus(status)` and `RELAY_TERMINAL_STATUSES` are exported for code that drives `pollResult()` in a loop of its own.
 
-The relay answers `'expired'` before the SDK's default `timeoutMs` (300 000 ms) runs out, so with the defaults you get a result to branch on rather than a thrown timeout. If you pass a much shorter `timeoutMs`, the SDK's own timeout can still fire first and the promise rejects.
+The relay answers `'expired'` before the SDK's default `timeoutMs` (600 000 ms) runs out, so with the defaults you get a result to branch on rather than a thrown timeout. If you pass a much shorter `timeoutMs`, the SDK's own timeout can still fire first and the promise rejects.
 
 #### What is not on the result
 
@@ -772,6 +717,7 @@ The relay answers `'expired'` before the SDK's default `timeoutMs` (300 000 ms)
 | `publicInputs` | `string[]` | When completed | `result.publicInputs` |
 | `verifierAddress` | `string` | No | `result.verifierAddress`. Optional. When present it must match the SDK's own verifier for the circuit, or verification is refused |
 | `chainId` | `number` | No | `result.chainId`. Optional. When present it must match the network the SDK verifies the circuit on, or verification is refused |
+| `signerVariant` | `string` | No | `result.signerVariant`. Copy it unchanged whenever the relay sends it: some circuits are proved by more than one package, each with its own verifier, and this field says which one made the proof (`standard`, `android` or `android_factory`). When it is absent the circuit's standard verifier is used, and a proof that has another package's size is refused; an unrecognised value is refused by name |
 | `numPublicInputs` | `number` | No | Never delivered by the relay, and never read during verification — `publicInputs.length` is used instead. Omit it |
 | `timestamp` | `number` | No | Not delivered by the relay. Omit it |
 | `error` | `string` | On failure | `result.error`. Carried for your own logging; verification ignores it |
@@ -788,9 +734,9 @@ For OIDC domain proofs the SDK first checks what the proof says about the sign-i
 
 The SDK also checks that the proof was made with a signing key Google or Microsoft actually publishes. That key is part of the proof's public inputs, so a proof made with a self-generated key would otherwise pass the contract. The SDK fetches the provider's published keys, caches them as the provider's own cache headers allow, and returns `{ valid: false, error }` when the key is not among them or the keys cannot be fetched. Every verify method does this; there is nothing to call separately.
 
-For Coinbase KYC, Coinbase country and GIWA proofs the SDK checks that the attestation's signer belongs to the published signer set: the proof carries the root of the signer list it was made against, and a proof made against any other list is refused with `{ valid: false, error }`. This too runs in every verify method.
+For Coinbase KYC, Coinbase country and GIWA proofs the SDK checks that the attestation's signer belongs to the published signer set: the proof carries the root of the signer list it was made against, and a proof made against any other list is refused with `{ valid: false, error }`. A Coinbase KYC proof also names the time its attestation was confirmed unrevoked; it must be within the last 15 minutes (and not more than 5 minutes ahead of your clock), so verify a Coinbase KYC proof when you receive it rather than re-verifying a stored one later. This too runs in every verify method.
 
-The one limit: a proof made with a key the provider has already withdrawn, which this process never saw while it was published, cannot be checked and is refused. Keys seen while published stay acceptable for 24 hours after they disappear.
+The one limit: a proof made with a key the provider has already withdrawn, which this process never saw while it was published, cannot be checked and is refused. Keys seen while published stay acceptable for 1 hour after they were last listed.
 
 
 
@@ -806,6 +752,7 @@ if (result.status === 'completed') {
     publicInputs: result.publicInputs,
     verifierAddress: result.verifierAddress,
     chainId: result.chainId,
+    signerVariant: result.signerVariant,
   };
 
   const verification = await sdk.verifyResponseOnChain(response);
@@ -881,7 +828,7 @@ if (sdk.extractScope(publicInputs, circuit) !== expectedScope) {
 The nullifier is a deterministic hash over the user's credential and the scope:
 
 - **Deterministic** — same user, same scope, same nullifier, every time. That is what makes duplicate detection possible.
-- **Privacy-preserving** — the wallet address (Coinbase), the email (OIDC) and the licence (mDL) stay hidden. There is no way back from the nullifier to the person.
+- **Privacy-preserving** — the wallet address (Coinbase) and the email (OIDC) stay hidden. There is no way back from the nullifier to the person.
 - **Scope-bound** — the same user proving to a different scope produces an unrelated nullifier, so your users cannot be correlated across apps.
 
 On your side, it is the primary key of a verified user. Store it once verification succeeds, with a unique constraint, and check it before granting anything:
@@ -929,7 +876,7 @@ import {
   extractDomainFromPublicInputs,
 } from '@zkproofport-app/sdk';
 
-// Scope and nullifier work for all six circuits — the layout is picked from the
+// Scope and nullifier work for all five circuits — the layout is picked from the
 // circuit id, so always pass it:
 const scope = extractScopeFromPublicInputs(publicInputs, 'coinbase_attestation');
 const nullifier = extractNullifierFromPublicInputs(publicInputs, 'coinbase_attestation');
@@ -938,15 +885,12 @@ const nullifier = extractNullifierFromPublicInputs(publicInputs, 'coinbase_attes
 const oidcScope = extractScopeFromPublicInputs(publicInputs, 'oidc_domain_attestation');
 const oidcNullifier = extractNullifierFromPublicInputs(publicInputs, 'oidc_domain_attestation');
 
-// The three mDL circuits share one layout
-const mdlNullifier = extractNullifierFromPublicInputs(publicInputs, 'mdl_kr_age');
-
 // Extract domain from OIDC Domain Attestation
 const domain = extractDomainFromPublicInputs(publicInputs, 'oidc_domain_attestation');
 // domain: 'example.com', or null if the circuit doesn't match or inputs are insufficient
 ```
 
-Omitting the circuit argument falls back to the `coinbase_attestation` layout, which is why the examples above always pass it explicitly.
+The circuit argument is required: the layout differs per circuit, and an omitted or unknown circuit id throws an error naming the known ones.
 
 ## Complete Example
 
@@ -1051,9 +995,6 @@ import type {
   OidcDomainInputs,
   ActionBoundInputs,
   TypedAction,
-  MdlKrOwnershipInputs,
-  MdlKrAgeInputs,
-  MdlKrRegionInputs,
   CircuitInputs,
   ProofRequest,
   ProofResponse,
@@ -1069,20 +1010,17 @@ import type {
 
 | Type | Description |
 |------|-------------|
-| `CircuitId` | Union of the eight canonical circuit IDs — `'coinbase_attestation' \| 'coinbase_country_attestation' \| 'oidc_domain_attestation' \| 'giwa_attestation' \| 'dojang_playground' \| 'mdl_kr_ownership' \| 'mdl_kr_age' \| 'mdl_kr_region'`. Also exported from `@zkproofport-app/sdk/circuits` |
+| `CircuitId` | Union of the five canonical circuit IDs — `'coinbase_attestation' \| 'coinbase_country_attestation' \| 'oidc_domain_attestation' \| 'giwa_attestation' \| 'dojang_playground'`. Also exported from `@zkproofport-app/sdk/circuits` |
 | `TypedAction` | The EIP-712 action a `giwa_attestation` proof binds to: `{ domain, types, primaryType, message }` — the same object `eth_signTypedData_v4` takes |
-| `CircuitSupportStatus` | `'supported' \| 'planned'` — see [Circuit Identifiers](#circuit-identifiers) |
+| `CircuitSupportStatus` | `'supported' \| 'experimental' \| 'planned'` — see [Circuit Identifiers](#circuit-identifiers) |
 | `CircuitType` | Alias of `CircuitId`. Kept as the name used throughout `ProofRequest`, `ProofResponse` and the SDK methods |
 | `ProofRequestStatus` | `'pending' \| 'completed' \| 'error' \| 'cancelled'` — the status on a `ProofResponse` |
 | `CoinbaseKycInputs` | Inputs for `coinbase_attestation`: `{ scope, userAddress?, rawTransaction? }` |
 | `CoinbaseCountryInputs` | Inputs for `coinbase_country_attestation`: `{ scope, countryList, isIncluded, userAddress?, rawTransaction? }` |
 | `OidcDomainInputs` | Inputs for `oidc_domain_attestation`: `{ domain, scope, provider? }` |
-| `MdlKrOwnershipInputs` | Inputs for `mdl_kr_ownership`: `{ scope, discloseFlags? }` |
 | `ActionBoundInputs` | Inputs for the circuits that can bind an EIP-712 action: `{ scope, action?, userAddress?, rawTransaction? }`. Whether the action is required is the circuit's property, in `CIRCUIT_ACTION_BINDING` — optional for `giwa_attestation` and `dojang_playground` |
 | `GiwaAttestationInputs` | Alias of `ActionBoundInputs`, for `giwa_attestation` |
 | `DojangPlaygroundInputs` | Alias of `ActionBoundInputs`, for `dojang_playground` |
-| `MdlKrAgeInputs` | Inputs for `mdl_kr_age`: `{ scope, ageThreshold }` |
-| `MdlKrRegionInputs` | Inputs for `mdl_kr_region`: `{ scope, targetRegion }` |
 | `CircuitInputs` | Union of every input type above (plus an empty-input form for circuits that need nothing from the dApp) |
 | `ProofRequest` | Request object: `requestId`, `circuit`, `inputs`, `createdAt`, plus optional `message`, `dappName`, `dappIcon`, `returnScheme` (a bare scheme such as `mydapp://`), `expiresAt` |
 | `ProofResponse` | What `verifyResponseOnChain()` takes: `requestId`, `circuit`, `status`, and — when completed — `proof`, `publicInputs`, `verifierAddress`, `chainId`; `error` when it failed. `numPublicInputs` and `timestamp` also exist but the relay never fills them, so omit them. Field by field in [Step 6](#step-6-read-the-result) |
@@ -1116,14 +1054,13 @@ import {
   COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT,
   COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT,
   OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT,
-  MDL_KR_PUBLIC_INPUT_LAYOUT,
 } from '@zkproofport-app/sdk';
 ```
 
 Two rules hold for every table below:
 
 - **Every number is an index into `publicInputs`, and `_END` is inclusive.** Slice with `slice(START, END + 1)`.
-- **One entry is one field element, not one 32-byte value.** A `bytes32` such as a scope or a nullifier is spread over 32 consecutive entries, each holding a single byte in its low byte: `publicInputs[64] === '0x00…2f'` is the byte `0x2f`. Rebuild it by concatenating those 32 low bytes. The one exception is the OIDC RSA modulus, whose 18 entries each hold a 128-bit limb.
+- **One entry is one field element, not one 32-byte value.** A `bytes32` such as a scope or a nullifier is spread over 32 consecutive entries, each holding a single byte in its low byte: `publicInputs[128] === '0x00…2f'` is the byte `0x2f`. Rebuild it by concatenating those 32 low bytes. The one exception is the OIDC RSA modulus, whose 18 entries each hold a 128-bit limb.
 
 ```typescript
 const L = COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT;
@@ -1135,14 +1072,17 @@ const toBytes32 = (fields: string[]): string =>
 const signalHash = toBytes32(publicInputs.slice(L.SIGNAL_HASH_START, L.SIGNAL_HASH_END + 1));
 ```
 
-### `coinbase_attestation` — 128 entries
+### `coinbase_attestation` — 193 entries
 
 | Index | Constants | Circuit field | What it is |
 |-------|-----------|---------------|------------|
-| 0–31 | `SIGNAL_HASH_START` / `_END` | `signal_hash` | `bytes32` anti-replay challenge for the request |
-| 32–63 | `MERKLE_ROOT_START` / `_END` | `signer_list_merkle_root` | `bytes32` root of the Coinbase attestation-signer list the proof was checked against |
-| 64–95 | `SCOPE_START` / `_END` | `scope` | `bytes32` — `keccak256` of your scope string. Compare it (Step 8) |
-| 96–127 | `NULLIFIER_START` / `_END` | `nullifier` | `bytes32`, unique per user and scope |
+| 0–31 | `SIGNAL_HASH_START` / `_END` | `signal_hash` | `bytes32` anti-replay challenge for the request; zero when the wallet signed an EIP-712 action |
+| 32–63 | `DOMAIN_SEPARATOR_START` / `_END` | `domain_separator` | EIP-712 domain separator of the signed action; zero without one |
+| 64–95 | `ACTION_HASH_START` / `_END` | `action_hash` | EIP-712 struct hash of the signed action; zero without one |
+| 96–127 | `MERKLE_ROOT_START` / `_END` | `signer_list_merkle_root` | `bytes32` root of the Coinbase attestation-signer list the proof was checked against |
+| 128–159 | `SCOPE_START` / `_END` | `scope` | `bytes32` — `keccak256` of your scope string. Compare it (Step 8) |
+| 160–191 | `NULLIFIER_START` / `_END` | `nullifier` | `bytes32`, unique per wallet and scope |
+| 192 | `ATTESTED_AT` | `attested_at` | Unix seconds at which the attestation was confirmed unrevoked; checked against your clock by every verify method |
 
 ### `coinbase_country_attestation` — 150 entries
 
@@ -1179,34 +1119,6 @@ Proofs from the earlier 148-entry version of this circuit bind no audience, expi
 
 Index 147 tells you which issuer signed the token, not whether the account belongs to an organisation. Workspace and Microsoft 365 membership is checked on-device only when you set `provider` in the request; if you did not set it, do not read a membership guarantee out of this field.
 
-### Korea Mobile ID (mDL) — one layout, three circuits
-
-All three mDL circuits share the same first 64 entries and differ after that. Entries are single bytes, except `age_threshold` and `current_year`, which each hold their whole value in one entry.
-
-| Index | Constants | Circuit field | Applies to |
-|-------|-----------|---------------|------------|
-| 0–31 | `SCOPE_START` / `_END` | `scope` | all three |
-| 32–63 | `NULLIFIER_START` / `_END` | `nullifier_value` | all three |
-| 64 | `OWNERSHIP_DISCLOSE_FLAGS` | `disclose_flags` | `mdl_kr_ownership` (97 entries) — the bitmask that was actually proved (`0x01` name, `0x02` birth, `0x04` sex, `0x08` phone) |
-| 65–96 | `OWNERSHIP_OWNER_COMMIT_START` / `_END` | `owner_commit` | `mdl_kr_ownership` — `bytes32` commitment to the disclosed attributes. All zero when `disclose_flags` is `0`, which is the anonymous case |
-| 64 | `AGE_THRESHOLD` | `age_threshold` | `mdl_kr_age` (66 entries) — the age the proof actually clears. Read it back; it is a public input, so confirm it is the threshold you asked for |
-| 65 | `AGE_CURRENT_YEAR` | `current_year` | `mdl_kr_age` — the year the comparison was made in |
-| 64–95 | `REGION_CODE_START` / `_END` | `region_code` | `mdl_kr_region` (96 entries) — `bytes32`, not a readable region name. See below |
-
-`region_code` is `keccak256` over the region name, UTF-8 and zero-padded to 64 bytes. The circuit proves that the region on the licence hashes to this value, but the value itself is a public input — so recompute it from the region you asked for and compare, exactly as you do with the scope:
-
-```typescript
-import { keccak256 } from 'ethers';
-
-const regionCodeFor = (region: string): string => {
-  const padded = new Uint8Array(64);
-  padded.set(new TextEncoder().encode(region));
-  return keccak256(padded);
-};
-
-// regionCodeFor('경기도') — compare against indices 64–95, rebuilt with toBytes32()
-```
-
 ## Error Handling
 
 Async SDK methods throw standard `Error` objects. The messages are stable enough to log, not to switch on:
@@ -1220,9 +1132,9 @@ try {
 }
 
 try {
-  await sdk.createRelayRequest('mdl_kr_age', { scope: 'app.com', ageThreshold: 0 });
+  await sdk.createRelayRequest('coinbase-kyc', { scope: 'app.com' });
 } catch (err) {
-  // "ageThreshold is required and must be an integer between 1 and 150 (circuit: mdl_kr_age)"
+  // "Unknown circuit 'coinbase-kyc'. Expected: coinbase_attestation, ..."
 }
 
 try {

package/dist/ProofportSDK.d.ts

@@ -189,22 +189,6 @@ export declare class ProofportSDK {
      * falling through to another circuit's builder.
      */
     private static readonly REQUEST_BUILDERS;
-    /**
-     * @internal
-     * Creates a Korea Mobile ID (mDL) proof request for any of the three
-     * mDL predicate circuits (ownership / age / region).
-     *
-     * The mobile app collects the license data on-device; the dapp only
-     * supplies the predicate parameters validated here. No wallet signature
-     * is required for mDL circuits.
-     *
-     * @param circuit - 'mdl_kr_ownership' | 'mdl_kr_age' | 'mdl_kr_region'
-     * @param inputs - Predicate inputs (see MdlKr*Inputs types)
-     * @param options - Request configuration options
-     *
-     * @throws Error if the predicate inputs fail validation
-     */
-    private createMdlKrRequest;
     /**
      * @internal
      * Generates a deep link URL for a proof request.
@@ -509,6 +493,7 @@ export declare class ProofportSDK {
      */
     verifyOnChain(circuit: CircuitType, proof: string, publicInputs: string[], providerOrSigner?: any, options?: {
         request?: OidcRequestContext;
+        signerVariant?: string;
     }): Promise<{
         valid: boolean;
         error?: string;
@@ -924,7 +909,7 @@ export declare class ProofportSDK {
      * @param requestId - The relay-issued request ID
      * @param options - Polling options
      * @param options.intervalMs - Polling interval in milliseconds (default: 2000)
-     * @param options.timeoutMs - Maximum polling time in milliseconds (default: 300000 = 5 min)
+     * @param options.timeoutMs - Maximum polling time in milliseconds (default: 600000 = 10 min, `DEFAULT_RELAY_WAIT_MS`)
      * @param options.onStatusChange - Callback when status changes
      * @returns Promise resolving to final RelayProofResult
      * @throws Error if timeout or relay error
@@ -989,7 +974,7 @@ export declare class ProofportSDK {
      *
      * @param requestId - The relay-issued request ID
      * @param options - Configuration options
-     * @param options.timeoutMs - Maximum wait time in ms (default: 300000 = 5 min)
+     * @param options.timeoutMs - Maximum wait time in ms (default: 600000 = 10 min, `DEFAULT_RELAY_WAIT_MS`)
      * @param options.onStatusChange - Callback for status updates
      * @returns Promise resolving to final RelayProofResult
      */

package/dist/constants.d.ts

@@ -20,7 +20,7 @@ export declare const RELAY_URLS: Record<SDKEnvironment, string>;
  * Mirrors the mobile app's `CIRCUIT_NETWORKS` (proofport-app
  * src/config/contracts.ts), because a proof is checked where the app said its
  * verifier is: Base for the Coinbase and OIDC circuits, GIWA Sepolia for GIWA
- * and Dojang (testnet-only), Base Sepolia for Korea Mobile ID (testnet-only).
+ * and Dojang (testnet-only).
  * The ADDRESS on that chain always comes from core's pinned table, never from
  * a proof response.
  */
@@ -31,9 +31,6 @@ export declare const VERIFICATION_CHAINS: {
         readonly oidc_domain_attestation: 8453;
         readonly giwa_attestation: 91342;
         readonly dojang_playground: 91342;
-        readonly mdl_kr_ownership: 84532;
-        readonly mdl_kr_age: 84532;
-        readonly mdl_kr_region: 84532;
     };
     readonly staging: {
         readonly coinbase_attestation: 84532;
@@ -41,9 +38,6 @@ export declare const VERIFICATION_CHAINS: {
         readonly oidc_domain_attestation: 84532;
         readonly giwa_attestation: 91342;
         readonly dojang_playground: 91342;
-        readonly mdl_kr_ownership: 84532;
-        readonly mdl_kr_age: 84532;
-        readonly mdl_kr_region: 84532;
     };
     readonly local: {
         readonly coinbase_attestation: 84532;
@@ -51,9 +45,6 @@ export declare const VERIFICATION_CHAINS: {
         readonly oidc_domain_attestation: 84532;
         readonly giwa_attestation: 91342;
         readonly dojang_playground: 91342;
-        readonly mdl_kr_ownership: 84532;
-        readonly mdl_kr_age: 84532;
-        readonly mdl_kr_region: 84532;
     };
 };
 /**
@@ -92,7 +83,7 @@ export declare const DEEP_LINK_HOSTS: {
  * ```typescript
  * const metadata = CIRCUIT_METADATA['coinbase_attestation'];
  * console.log(metadata.name); // "Coinbase KYC"
- * console.log(metadata.publicInputsCount); // 128
+ * console.log(metadata.publicInputsCount); // 193
  * ```
  */
 export declare const CIRCUIT_METADATA: Record<CircuitType, {
@@ -132,4 +123,4 @@ export declare const DEFAULT_REQUEST_EXPIRY_MS: number;
  * ```
  */
 export declare const MAX_QR_DATA_SIZE = 2953;
-export { VERIFIER_ABI, RPC_ENDPOINTS, COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT, COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT, MDL_KR_PUBLIC_INPUT_LAYOUT, OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT, } from '@zkproofport-app/core';
+export { VERIFIER_ABI, RPC_ENDPOINTS, COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT, COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT, OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT, } from '@zkproofport-app/core';

package/dist/deeplink.d.ts

@@ -1,7 +1,7 @@
 /**
  * Deep Link utilities for ZKProofport SDK
  */
-import type { ProofRequest, ProofResponse, CircuitInputs, DeepLinkComponents } from './types';
+import type { ProofRequest, ProofResponse, DeepLinkComponents } from './types';
 /**
  * Generates a unique request ID for proof requests.
  *
@@ -170,23 +170,6 @@ export declare function parseDeepLink(url: string): DeepLinkComponents | null;
  * ```
  */
 export declare function isProofportDeepLink(url: string, scheme?: string): boolean;
-/**
- * Validates dapp-supplied inputs for the Korea Mobile ID (mDL) circuits.
- * Shared by deep-link request validation and relay request creation so the
- * same guards apply on every request path.
- *
- * Rules:
- * - `scope` — required non-empty string, ≤256 chars, no control characters
- * - `mdl_kr_ownership.discloseFlags` — optional integer 0–15 (0x0F bitmask)
- * - `mdl_kr_age.ageThreshold` — required integer 1–150
- * - `mdl_kr_region.targetRegion` — required non-empty string (Korean si/do),
- *   ≤256 chars, no control characters
- *
- * @param circuit - One of the three mDL circuit identifiers
- * @param inputs - Dapp-supplied circuit inputs
- * @returns Error message string, or null when the inputs are valid
- */
-export declare function validateMdlInputs(circuit: 'mdl_kr_ownership' | 'mdl_kr_age' | 'mdl_kr_region', inputs: CircuitInputs): string | null;
 /**
  * Longest accepted `returnScheme` value.
  * Kept in sync with proofport-relay `src/returnScheme.ts`.
@@ -273,6 +256,22 @@ export declare function validateReturnScheme(value: unknown): string | null;
  * @internal
  */
 export declare function detectReturnScheme(userAgent?: string): string | undefined;
+/**
+ * @internal
+ * Validates a proof request for completeness and correctness.
+ *
+ * Performs comprehensive validation including:
+ * - Required fields (requestId, circuit, callbackUrl)
+ * - Circuit type validity (must be a supported circuit)
+ * - Circuit-specific input validation (e.g., userAddress format, countryList structure)
+ * - Expiration check (if expiresAt is provided)
+ *
+ * Note: userAddress is optional for both circuits - the mobile app will prompt
+ * for wallet connection if not provided.
+ *
+ * @param request - Proof request to validate
+ * @returns Validation result with `valid` flag and optional `error` message
+ */
 export declare function validateProofRequest(request: ProofRequest): {
     valid: boolean;
     error?: string;

package/dist/index.d.ts

@@ -27,17 +27,17 @@
  */
 export { ProofportSDK, default } from './ProofportSDK';
 export { extractScopeFromPublicInputs, extractNullifierFromPublicInputs, extractDomainFromPublicInputs, } from './verifier';
-export { CIRCUIT_IDS, CIRCUIT_SUPPORT_STATUS, ALL_CIRCUIT_IDS, SUPPORTED_CIRCUIT_IDS, EXPERIMENTAL_CIRCUIT_IDS, PLANNED_CIRCUIT_IDS, isCircuitId, isSupportedCircuitId, getCircuitSupportStatus, CIRCUIT_VK_PATHS, } from './circuits';
+export { CIRCUIT_IDS, CIRCUIT_SUPPORT_STATUS, ALL_CIRCUIT_IDS, SUPPORTED_CIRCUIT_IDS, EXPERIMENTAL_CIRCUIT_IDS, PLANNED_CIRCUIT_IDS, isCircuitId, isSupportedCircuitId, getCircuitSupportStatus, CIRCUIT_VK_PATHS, CIRCUIT_PACKAGES, SIGNER_VARIANTS, isSignerVariant, signerVariantsOf, getCircuitPackage, resolveSignerVariant, evmProofByteLength, } from './circuits';
 export { verifyProofOffChain } from './offChainVerifier';
 export type { OffChainVerifyResult, OffChainVerifyOptions, } from './offChainVerifier';
-export { PINNED_VERIFIERS, getPinnedVerifier } from './verifier';
+export { PINNED_VERIFIERS, PINNED_VARIANT_VERIFIERS, getPinnedVerifier, getPinnedVariantVerifier } from './verifier';
 export type { PinnedVerifier } from './verifier';
 export { checkOidcPolicy, deriveOidcNonceBinding, oidcAudienceHash, OIDC_ALLOWED_AUDIENCES, OIDC_NONCE_DOMAIN, OIDC_NOW_MAX_AGE_SECONDS, OIDC_NOW_MAX_FUTURE_SECONDS, OIDC_V1_PUBLIC_INPUT_COUNT, OIDC_V2_PUBLIC_INPUT_COUNT, } from './verifier';
 export type { OidcRequestContext, OidcAudience, OidcNonceMode } from './verifier';
-export { COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT, COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT, OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT, MDL_KR_PUBLIC_INPUT_LAYOUT, } from './constants';
-export type { CircuitId, CircuitSupportStatus } from './circuits';
+export { COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT, COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT, OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT, } from './constants';
+export type { CircuitId, CircuitSupportStatus, SignerVariant, CircuitPackage } from './circuits';
 export { CIRCUIT_ACTION_BINDING, circuitActionBinding, } from './circuits';
 export type { CircuitActionBinding } from './circuits';
-export type { CircuitType, ProofRequestStatus, CoinbaseKycInputs, ActionBoundInputs, GiwaAttestationInputs, DojangPlaygroundInputs, TypedAction, CoinbaseCountryInputs, OidcDomainInputs, MdlKrOwnershipInputs, MdlKrAgeInputs, MdlKrRegionInputs, CircuitInputs, ProofRequest, ProofResponse, QRCodeOptions, VerifierContract, ProofportConfig, ChallengeResponse, WalletSigner, RelayProofRequest, RelayProofResult, RelayProofStatus, RelayTerminalStatus, SDKEnvironment, } from './types';
-export { RELAY_TERMINAL_STATUSES, isTerminalRelayStatus } from './relayStatus';
+export type { CircuitType, ProofRequestStatus, CoinbaseKycInputs, ActionBoundInputs, GiwaAttestationInputs, DojangPlaygroundInputs, TypedAction, CoinbaseCountryInputs, OidcDomainInputs, CircuitInputs, ProofRequest, ProofResponse, QRCodeOptions, VerifierContract, ProofportConfig, ChallengeResponse, WalletSigner, RelayProofRequest, RelayProofResult, RelayProofStatus, RelayTerminalStatus, SDKEnvironment, } from './types';
+export { RELAY_TERMINAL_STATUSES, isTerminalRelayStatus, DEFAULT_RELAY_WAIT_MS } from './relayStatus';
 export { validateTypedAction, parseTypedAction } from './typedAction';