blindseal-sdk 0.5.0 → 0.5.1

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { Connection, Keypair, PublicKey, type Signer } from '@solana/web3.js';
-import { type Attestation } from './ix.js';
+import { type Attestation, type DecodedPublicInputs } from './ix.js';
 export * from './ix.js';
 export declare class WrongClusterError extends Error {
     readonly got: string;
@@ -21,9 +21,43 @@ export interface SubmitOptions {
 export declare function submit(att: Attestation, opts: SubmitOptions): Promise<string>;
 /** Has this attestation's nullifier been consumed on chain? */
 export declare function isConsumed(att: Attestation, conn: Connection, programId?: PublicKey): Promise<boolean>;
-export interface VerifyResult {
+/** Labeled top-level fields that must equal the committed public inputs. */
+export declare const LABELED_FIELDS: readonly ["payloadHash", "policyRoot", "detectorVersion", "actionHash", "nullifier", "expirySlot"];
+export type LabeledField = (typeof LABELED_FIELDS)[number];
+/**
+ * Result of `verifyOffchain`.
+ * - `ok`: true only if the Groth16 proof verifies AND every labeled field equals its decoded value.
+ * - `reason`: present when `ok` is false — the wasm verifier's reason if the proof failed, otherwise
+ *   `label mismatch: <field>[, <field>…]` (or the decode error if the blob is not 168 bytes).
+ * - `decoded`: the six fields decoded from `publicInputs[0]`; present whenever the blob parses,
+ *   even when the proof or the labels fail. Hex fields are 0x-prefixed lower-case; `expirySlot`
+ *   is a decimal u64 string.
+ * - `mismatches`: the labeled fields that differ from `decoded` (empty when none, or when the blob
+ *   did not parse).
+ */
+export interface VerifyOffchainResult {
     ok: boolean;
-    reason: string | null;
+    reason?: string;
+    decoded?: DecodedPublicInputs;
+    mismatches: string[];
 }
-/** Off-chain Groth16 verify via the same wasm the verify pages use. */
-export declare function verifyOffchain(att: Attestation): Promise<VerifyResult>;
+/** @deprecated Use `VerifyOffchainResult`. */
+export type VerifyResult = VerifyOffchainResult;
+/**
+ * Compare the six labeled top-level fields of an attestation to the decoded committed blob.
+ * Hex is compared case-insensitively with or without `0x`; `expirySlot` may be a number, bigint or
+ * decimal string. A missing or malformed label counts as a mismatch. Returns the differing field
+ * names in canonical order.
+ */
+export declare function labelMismatches(att: Partial<Record<LabeledField, unknown>>, decoded: DecodedPublicInputs): string[];
+/**
+ * Off-chain verify via the same wasm the verify pages use, then cross-check the labels.
+ * 1. Decode `publicInputs[0]` into its six fields (see `decodePublicInputs`).
+ * 2. Groth16 verify of `proof.bytes` against `publicInputs[0]`, using the DECODED `detectorVersion`
+ *    as the vkey hash (the committed one — same as the on-chain program, which checks the vkey it
+ *    verified with equals the blob's). The proof therefore stands or falls on the blob alone.
+ * 3. Compare each labeled top-level field to the decoded value; any difference fails the result,
+ *    because the proof binds only the blob — a tampered label would otherwise pass unnoticed.
+ * Does NOT check expiry against the current slot, nullifier consumption or the on-chain allowlists.
+ */
+export declare function verifyOffchain(att: Attestation): Promise<VerifyOffchainResult>;

package/dist/index.js

@@ -41,12 +41,69 @@ export async function isConsumed(att, conn, programId = PROGRAM_ID) {
     const info = await conn.getAccountInfo(nullifierPda(nullifier, programId), 'confirmed');
     return info !== null;
 }
-/** Off-chain Groth16 verify via the same wasm the verify pages use. */
-export async function verifyOffchain(att) {
+/** Labeled top-level fields that must equal the committed public inputs. */
+export const LABELED_FIELDS = ['payloadHash', 'policyRoot', 'detectorVersion', 'actionHash', 'nullifier', 'expirySlot'];
+const normHex = (v) => '0x' + String(v ?? '').trim().replace(/^0x/i, '').toLowerCase();
+const normSlot = (v) => {
+    if (typeof v === 'bigint')
+        return v.toString();
+    if (typeof v === 'number')
+        return Number.isInteger(v) && v >= 0 ? String(v) : null;
+    if (typeof v === 'string' && /^\d+$/.test(v.trim()))
+        return BigInt(v.trim()).toString();
+    return null;
+};
+/**
+ * Compare the six labeled top-level fields of an attestation to the decoded committed blob.
+ * Hex is compared case-insensitively with or without `0x`; `expirySlot` may be a number, bigint or
+ * decimal string. A missing or malformed label counts as a mismatch. Returns the differing field
+ * names in canonical order.
+ */
+export function labelMismatches(att, decoded) {
+    const out = [];
+    for (const k of LABELED_FIELDS) {
+        const same = k === 'expirySlot' ? normSlot(att.expirySlot) === decoded.expirySlot : normHex(att[k]) === decoded[k];
+        if (!same)
+            out.push(k);
+    }
+    return out;
+}
+let wasmReady = null;
+const loadWasm = () => (wasmReady ??= (async () => {
     const wasm = await import('blindseal-verifier-wasm');
     const { readFileSync } = await import('node:fs');
     const req = createRequire(import.meta.url);
-    const bytes = readFileSync(req.resolve('blindseal-verifier-wasm/bg.wasm'));
-    wasm.initSync({ module: bytes });
-    return JSON.parse(wasm.verify_attestation_json(JSON.stringify(att)));
+    wasm.initSync({ module: readFileSync(req.resolve('blindseal-verifier-wasm/bg.wasm')) });
+    return wasm;
+})().catch((e) => { wasmReady = null; throw e; }));
+/**
+ * Off-chain verify via the same wasm the verify pages use, then cross-check the labels.
+ * 1. Decode `publicInputs[0]` into its six fields (see `decodePublicInputs`).
+ * 2. Groth16 verify of `proof.bytes` against `publicInputs[0]`, using the DECODED `detectorVersion`
+ *    as the vkey hash (the committed one — same as the on-chain program, which checks the vkey it
+ *    verified with equals the blob's). The proof therefore stands or falls on the blob alone.
+ * 3. Compare each labeled top-level field to the decoded value; any difference fails the result,
+ *    because the proof binds only the blob — a tampered label would otherwise pass unnoticed.
+ * Does NOT check expiry against the current slot, nullifier consumption or the on-chain allowlists.
+ */
+export async function verifyOffchain(att) {
+    const wasm = await loadWasm();
+    let decoded;
+    let decodeError;
+    try {
+        decoded = decodePublicInputs(String(att.publicInputs?.[0] ?? ''));
+    }
+    catch (e) {
+        decodeError = e instanceof Error ? e.message : String(e);
+    }
+    const forWasm = decoded ? { ...att, detectorVersion: decoded.detectorVersion } : att;
+    const proof = JSON.parse(wasm.verify_attestation_json(JSON.stringify(forWasm)));
+    const mismatches = decoded ? labelMismatches(att, decoded) : [];
+    if (!proof.ok)
+        return { ok: false, reason: proof.reason ?? 'proof did not verify', decoded, mismatches };
+    if (!decoded)
+        return { ok: false, reason: decodeError ?? 'publicInputs did not decode', mismatches };
+    if (mismatches.length)
+        return { ok: false, reason: `label mismatch: ${mismatches.join(', ')}`, decoded, mismatches };
+    return { ok: true, decoded, mismatches };
 }

package/dist/ix.d.ts

@@ -54,15 +54,34 @@ export declare const policyRootPda: (root: Uint8Array, programId?: PublicKey) =>
 export declare const nullifierPda: (nullifier: Uint8Array, programId?: PublicKey) => PublicKey;
 export declare function computeActionHash(a: ActionArgs, payloadHash: Uint8Array, policyRoot: Uint8Array, detectorVersion: Uint8Array, expirySlot: bigint): Buffer;
 export declare const computeNullifier: (actionHash: Uint8Array) => Buffer;
-/** Decode the 168-byte committed blob into its six fields. */
-export declare function decodePublicInputs(blob: Uint8Array): {
+export declare const PUBLIC_INPUTS_LEN = 168;
+/** The six committed fields as 0x-prefixed lower-case hex; `expirySlot` is a decimal u64 string. */
+export interface DecodedPublicInputs {
+    payloadHash: string;
+    policyRoot: string;
+    detectorVersion: string;
+    actionHash: string;
+    nullifier: string;
+    expirySlot: string;
+}
+/** Byte-level view of the same six fields (used by the instruction builders). */
+export interface DecodedPublicInputsBytes {
     payloadHash: Buffer;
     policyRoot: Buffer;
     detectorVersion: Buffer;
     actionHash: Buffer;
     nullifier: Buffer;
     expirySlot: bigint;
-};
+}
+/**
+ * Decode the 168-byte committed blob into its six fields.
+ * - Given a hex string (`publicInputs[0]`, with or without `0x`), returns 0x-prefixed lower-case
+ *   hex fields and `expirySlot` as a decimal string — the shape `verifyOffchain` reports as `decoded`.
+ * - Given raw bytes, returns Buffers and a bigint expiry (the form the instruction builders use).
+ * Throws if the input is not exactly 168 bytes (or not valid hex).
+ */
+export declare function decodePublicInputs(blobHex: string): DecodedPublicInputs;
+export declare function decodePublicInputs(blob: Uint8Array): DecodedPublicInputsBytes;
 export declare const discriminator: (name: string) => Buffer;
 export declare function encodeActionArgs(a: ActionArgs): Buffer;
 export interface VerifyAccounts {

package/dist/ix.js

@@ -43,10 +43,30 @@ export function computeActionHash(a, payloadHash, policyRoot, detectorVersion, e
         .digest();
 }
 export const computeNullifier = (actionHash) => createHash('sha256').update(NULLIFIER_DOMAIN).update(actionHash).digest();
-/** Decode the 168-byte committed blob into its six fields. */
+// ---- the committed public-input blob ----
+// `publicInputs[0]` is the guest's public values in commit order (crates/guest/src/main.rs):
+//   [0..32)    payloadHash      [32..64)   policyRoot      [64..96)   detectorVersion
+//   [96..128)  actionHash       [128..160) nullifier       [160..168) expirySlot (u64 LE)
+// 168 bytes = 336 hex chars. This is the ONLY data the proof binds; the six labeled top-level
+// fields of attestation.json are convenience copies and must be checked against it.
+export const PUBLIC_INPUTS_LEN = 168;
 export function decodePublicInputs(blob) {
-    if (blob.length !== 168)
-        throw new Error(`publicInputs must be 168 bytes, got ${blob.length}`);
+    if (typeof blob === 'string') {
+        const h = blob.trim().replace(/^0x/i, '').toLowerCase();
+        if (!/^[0-9a-f]*$/.test(h) || h.length % 2 !== 0)
+            throw new Error('publicInputs is not a hex string');
+        const b = decodeBytes(Buffer.from(h, 'hex'));
+        const hx = (x) => '0x' + x.toString('hex');
+        return {
+            payloadHash: hx(b.payloadHash), policyRoot: hx(b.policyRoot), detectorVersion: hx(b.detectorVersion),
+            actionHash: hx(b.actionHash), nullifier: hx(b.nullifier), expirySlot: b.expirySlot.toString(),
+        };
+    }
+    return decodeBytes(blob);
+}
+function decodeBytes(blob) {
+    if (blob.length !== PUBLIC_INPUTS_LEN)
+        throw new Error(`publicInputs must be ${PUBLIC_INPUTS_LEN} bytes, got ${blob.length}`);
     const b = Buffer.from(blob);
     return {
         payloadHash: b.subarray(0, 32), policyRoot: b.subarray(32, 64), detectorVersion: b.subarray(64, 96),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blindseal-sdk",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "type": "module",
   "license": "MIT",
   "description": "Blindseal SDK — build the on-chain verify instruction, submit attestations to Solana mainnet, verify attestations and disclosures off-chain.",
@@ -19,7 +19,7 @@
   },
   "dependencies": {
     "@solana/web3.js": "1.98.0",
-    "blindseal-verifier-wasm": "0.5.0"
+    "blindseal-verifier-wasm": "0.5.1"
   },
   "devDependencies": {
     "typescript": "5.6.3",