@zkproofport-app/sdk 0.5.0-beta.8 → 0.5.0-beta.9

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { countryListError, checkProofIssuer, parseProofForOnChain, verifyProofOnChain, getPinnedVerifier, extractScopeFromPublicInputs, extractNullifierFromPublicInputs, extractDomainFromPublicInputs } from '@zkproofport-app/core';
-export { COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT, COINBASE_COUNTRY_PUBLIC_INPUT_COUNT, COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT, OIDC_ALLOWED_AUDIENCES, OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT, OIDC_NONCE_DOMAIN, OIDC_NOW_MAX_AGE_SECONDS, OIDC_NOW_MAX_FUTURE_SECONDS, OIDC_V1_PUBLIC_INPUT_COUNT, OIDC_V2_PUBLIC_INPUT_COUNT, PINNED_VARIANT_VERIFIERS, PINNED_VERIFIERS, checkOidcPolicy, deriveOidcNonceBinding, extractDomainFromPublicInputs, extractNullifierFromPublicInputs, extractScopeFromPublicInputs, getPinnedVariantVerifier, getPinnedVerifier, oidcAudienceHash } from '@zkproofport-app/core';
-import { isCircuitId, ALL_CIRCUIT_IDS, circuitActionBinding, resolveSignerVariant, getCircuitPackage, CIRCUIT_NEEDS_WALLET_SIGNATURE } from '@zkproofport-app/core/circuits';
-export { ALL_CIRCUIT_IDS, CIRCUIT_ACTION_BINDING, CIRCUIT_IDS, CIRCUIT_PACKAGES, CIRCUIT_SUPPORT_STATUS, CIRCUIT_VK_PATHS, EXPERIMENTAL_CIRCUIT_IDS, PLANNED_CIRCUIT_IDS, SIGNER_VARIANTS, SUPPORTED_CIRCUIT_IDS, circuitActionBinding, evmProofByteLength, getCircuitPackage, getCircuitSupportStatus, isCircuitId, isSignerVariant, isSupportedCircuitId, resolveSignerVariant, signerVariantsOf } from '@zkproofport-app/core/circuits';
+export { COINBASE_ATTESTATION_PUBLIC_INPUT_LAYOUT, COINBASE_COUNTRY_PUBLIC_INPUT_COUNT, COINBASE_COUNTRY_PUBLIC_INPUT_LAYOUT, HUMAN_PASSPORT_SCORE_PUBLIC_INPUT_COUNT, HUMAN_PASSPORT_SCORE_PUBLIC_INPUT_LAYOUT, OIDC_ALLOWED_AUDIENCES, OIDC_DOMAIN_ATTESTATION_PUBLIC_INPUT_LAYOUT, OIDC_NONCE_DOMAIN, OIDC_NOW_MAX_AGE_SECONDS, OIDC_NOW_MAX_FUTURE_SECONDS, OIDC_V1_PUBLIC_INPUT_COUNT, OIDC_V2_PUBLIC_INPUT_COUNT, PINNED_VARIANT_VERIFIERS, PINNED_VERIFIERS, checkOidcPolicy, deriveOidcNonceBinding, extractDomainFromPublicInputs, extractNullifierFromPublicInputs, extractScopeFromPublicInputs, getPinnedVariantVerifier, getPinnedVerifier, oidcAudienceHash } from '@zkproofport-app/core';
+import { isCircuitId, ALL_CIRCUIT_IDS, humanPassportScoreUnits, circuitActionBinding, resolveSignerVariant, getCircuitPackage, CIRCUIT_NEEDS_WALLET_SIGNATURE } from '@zkproofport-app/core/circuits';
+export { ALL_CIRCUIT_IDS, CIRCUIT_ACTION_BINDING, CIRCUIT_IDS, CIRCUIT_PACKAGES, CIRCUIT_SUPPORT_STATUS, CIRCUIT_VK_PATHS, EXPERIMENTAL_CIRCUIT_IDS, HUMAN_PASSPORT_ISSUER, HUMAN_PASSPORT_ISSUER_ROOT, HUMAN_PASSPORT_SCORER_ID, HUMAN_PASSPORT_SCORE_SCHEMA, PLANNED_CIRCUIT_IDS, SIGNER_VARIANTS, SUPPORTED_CIRCUIT_IDS, circuitActionBinding, evmProofByteLength, getCircuitPackage, getCircuitSupportStatus, humanPassportScoreUnits, isCircuitId, isSignerVariant, isSupportedCircuitId, resolveSignerVariant, signerVariantsOf } from '@zkproofport-app/core/circuits';
 import { validateTypedAction } from '@zkproofport-app/core/typedAction';
 export { parseTypedAction, validateTypedAction } from '@zkproofport-app/core/typedAction';
 
@@ -41,6 +41,7 @@ const VERIFICATION_CHAINS = {
         oidc_domain_attestation: 8453,
         giwa_attestation: 91342,
         dojang_playground: 91342,
+        human_passport_score: 8453,
     },
     staging: {
         coinbase_attestation: 84532,
@@ -48,6 +49,7 @@ const VERIFICATION_CHAINS = {
         oidc_domain_attestation: 84532,
         giwa_attestation: 91342,
         dojang_playground: 91342,
+        human_passport_score: 84532,
     },
     local: {
         coinbase_attestation: 84532,
@@ -55,6 +57,7 @@ const VERIFICATION_CHAINS = {
         oidc_domain_attestation: 84532,
         giwa_attestation: 91342,
         dojang_playground: 91342,
+        human_passport_score: 84532,
     },
 };
 /**
@@ -156,6 +159,14 @@ const CIRCUIT_METADATA = {
         publicInputsCount: 160,
         publicInputNames: ['signal_hash', 'domain_separator', 'action_hash', 'scope', 'nullifier'],
     },
+    // human-passport-score/src/main.nr: GIWA's six `pub [u8; 32]`, then
+    // min_score (u32, score x 10^4), scorer_id and now (u64) = 195 fields.
+    human_passport_score: {
+        name: 'Human Passport',
+        description: 'Prove a Human Passport score at or above a threshold, optionally authorizing one EIP-712 action',
+        publicInputsCount: 195,
+        publicInputNames: ['signal_hash', 'domain_separator', 'action_hash', 'signer_list_merkle_root', 'scope', 'nullifier', 'min_score', 'scorer_id', 'now'],
+    },
 };
 /**
  * Default proof request expiration time in milliseconds.
@@ -652,6 +663,21 @@ function validateProofRequest(request) {
             return { valid: false, error: 'isIncluded is required and must be a boolean' };
         }
     }
+    else if (request.circuit === 'human_passport_score') {
+        const inputs = request.inputs;
+        if (inputs.userAddress && !/^0x[a-fA-F0-9]{40}$/.test(inputs.userAddress)) {
+            return { valid: false, error: 'Invalid userAddress format' };
+        }
+        if (!inputs.scope || typeof inputs.scope !== 'string' || inputs.scope.trim() === '') {
+            return { valid: false, error: 'scope is required and must be a non-empty string' };
+        }
+        try {
+            humanPassportScoreUnits(inputs.minScore);
+        }
+        catch (error) {
+            return { valid: false, error: error instanceof Error ? error.message : String(error) };
+        }
+    }
     else if (request.circuit === 'oidc_domain_attestation') {
         const inputs = request.inputs;
         if (!inputs.domain || typeof inputs.domain !== 'string' || inputs.domain.trim() === '') {
@@ -3940,7 +3966,7 @@ async function verifyProofOffChain(circuit, proof, publicInputs, options = {}) {
     // their trust anchor as a public input the prover chooses. For OIDC that is
     // the RSA key -- see core's oidcProviderKeys. Checked here so a dApp that
     // verifies off-chain gets the same answer as one that verifies on-chain.
-    const issuer = await checkProofIssuer(circuit, publicInputs, { request: options.request, countryCondition: options.countryCondition });
+    const issuer = await checkProofIssuer(circuit, publicInputs, { request: options.request, countryCondition: options.countryCondition, minScore: options.minScore });
     if (!issuer.ok) {
         return { valid: false, error: issuer.error };
     }
@@ -4106,6 +4132,12 @@ class ProofportSDK {
          * them. Bounded like {@link relayRequests}.
          */
         this.countryRequests = new Map();
+        /**
+         * requestId -> the score threshold of the Human Passport relay requests this
+         * instance created, so verifyResponse* can hold the proof's min_score to it.
+         * Bounded like {@link relayRequests}.
+         */
+        this.passportRequests = new Map();
         this.signer = null;
         this.socket = null;
         /**
@@ -4298,6 +4330,16 @@ class ProofportSDK {
         switch (builder) {
             case 'country':
                 return this.createCoinbaseCountryRequest(inputs, options);
+            case 'passport': {
+                const minScore = inputs.minScore;
+                try {
+                    humanPassportScoreUnits(minScore);
+                }
+                catch (error) {
+                    throw new Error(`${error instanceof Error ? error.message : String(error)} (circuit: ${circuit})`);
+                }
+                return this.createScopedRequest(circuit, inputs, options);
+            }
             case 'scoped':
                 return this.createScopedRequest(circuit, inputs, options);
         }
@@ -4647,6 +4689,7 @@ class ProofportSDK {
             request: options.request,
             signerVariant: options.signerVariant,
             countryCondition: options.countryCondition,
+            minScore: options.minScore,
         });
     }
     /**
@@ -4712,6 +4755,42 @@ class ProofportSDK {
                 'isIncluded } } -- the list and direction of the request you created.',
         };
     }
+    /**
+     * The score threshold a `human_passport_score` response must carry: the one
+     * the caller passed, else the relay request this instance created under the
+     * response's requestId, else the deep-link request still pending under it.
+     * `{ error }` when there is none: the proof's threshold is the prover's
+     * choice, so a response this SDK cannot place is refused rather than
+     * accepted for whatever threshold it carries.
+     */
+    passportMinScoreFor(response, explicit) {
+        if (explicit !== undefined)
+            return { minScore: explicit };
+        const remembered = this.passportRequests.get(response.requestId);
+        if (remembered !== undefined)
+            return { minScore: remembered };
+        const pending = this.pendingRequests.get(response.requestId);
+        const inputs = pending?.circuit === 'human_passport_score' ? pending.inputs : undefined;
+        if (inputs && typeof inputs.minScore === 'number')
+            return { minScore: inputs.minScore };
+        return {
+            error: `No Human Passport request ${JSON.stringify(response.requestId)} was created by this SDK instance, so the ` +
+                "proof's score threshold cannot be checked against what was asked. Pass { minScore } -- the threshold of " +
+                'the request you created.',
+        };
+    }
+    /** @internal Remember a Human Passport relay request's threshold for verifyResponse*. */
+    rememberPassportRequest(requestId, inputs) {
+        const minScore = inputs?.minScore;
+        if (typeof requestId !== 'string' || typeof minScore !== 'number')
+            return;
+        this.passportRequests.delete(requestId);
+        this.passportRequests.set(requestId, minScore);
+        while (this.passportRequests.size > ProofportSDK.MAX_REMEMBERED_RELAY_REQUESTS) {
+            const oldest = this.passportRequests.keys().next().value;
+            this.passportRequests.delete(oldest);
+        }
+    }
     /** @internal Remember a Coinbase Country relay request's list and direction for verifyResponse*. */
     rememberCountryRequest(requestId, inputs) {
         const i = inputs;
@@ -4800,6 +4879,13 @@ class ProofportSDK {
                 return { valid: false, error: found.error };
             countryCondition = found.condition;
         }
+        let minScore;
+        if (response.circuit === 'human_passport_score') {
+            const found = this.passportMinScoreFor(response, options.minScore);
+            if ('error' in found)
+                return { valid: false, error: found.error };
+            minScore = found.minScore;
+        }
         const parsedProof = parseProofForOnChain(response.proof, response.publicInputs, response.publicInputs.length);
         // The response's verifierAddress and chainId are a claim to check, never
         // the contract to call: whoever wrote the response would otherwise pick
@@ -4808,7 +4894,7 @@ class ProofportSDK {
         return verifyProofOnChain(response.circuit, parsedProof, providerOrSigner, this.verifierTarget(response.circuit), {
             verifierAddress: response.verifierAddress,
             chainId: response.chainId,
-        }, { request, signerVariant: response.signerVariant, countryCondition });
+        }, { request, signerVariant: response.signerVariant, countryCondition, minScore });
     }
     /**
      * Verifies a proof response off-chain, against the circuit's verification key.
@@ -4852,7 +4938,14 @@ class ProofportSDK {
                 return { valid: false, error: found.error };
             countryCondition = found.condition;
         }
-        return verifyProofOffChain(response.circuit, response.proof, response.publicInputs, { ...options, request, countryCondition, signerVariant: response.signerVariant });
+        let minScore;
+        if (response.circuit === 'human_passport_score') {
+            const found = this.passportMinScoreFor(response, options?.minScore);
+            if ('error' in found)
+                return { valid: false, error: found.error };
+            minScore = found.minScore;
+        }
+        return verifyProofOffChain(response.circuit, response.proof, response.publicInputs, { ...options, request, countryCondition, minScore, signerVariant: response.signerVariant });
     }
     // ============ Utility Methods ============
     /**
@@ -5230,6 +5323,15 @@ class ProofportSDK {
                 }
             }
         }
+        // A Human Passport threshold the circuit cannot carry is refused here too.
+        if (circuit === 'human_passport_score') {
+            try {
+                humanPassportScoreUnits(inputs.minScore);
+            }
+            catch (error) {
+                throw new Error(`${error instanceof Error ? error.message : String(error)} (circuit: ${circuit})`);
+            }
+        }
         // A Coinbase Country list the circuit would refuse is refused here, before a
         // challenge is burned, as createProofRequest does.
         if (circuit === 'coinbase_country_attestation') {
@@ -5297,6 +5399,8 @@ class ProofportSDK {
         this.rememberRelayRequest(created.requestId, scope);
         if (circuit === 'coinbase_country_attestation')
             this.rememberCountryRequest(created.requestId, inputs);
+        if (circuit === 'human_passport_score')
+            this.rememberPassportRequest(created.requestId, inputs);
         return created;
     }
     /**
@@ -5593,6 +5697,8 @@ ProofportSDK.REQUEST_BUILDERS = {
     oidc_domain_attestation: 'scoped',
     giwa_attestation: 'scoped',
     dojang_playground: 'scoped',
+    // Scoped, plus the score threshold the proof must carry.
+    human_passport_score: 'passport',
 };
 
 export { DEFAULT_RELAY_WAIT_MS, ProofportSDK, RELAY_TERMINAL_STATUSES, ProofportSDK as default, isTerminalRelayStatus, verifyProofOffChain };