Verification flow and application policy

Use Verify with the Entros popup for this policy contract, and Pulse for server-side evidence reads.

EntrosVerify hosts wallet connection and capture in an Entros popup. Integrator Policy v1 separates current wallet continuity, accepted verification evidence, assurance, and uniqueness status. Applications choose their requirements and enforce them where their protected action executes.

Policy request

import { EntrosVerify } from "@entros/verify";
import { normalizePolicyRequest } from "@entros/verify/policy";

const policy = normalizePolicyRequest({
  id: "claim-access",
  version: 1,
  minTrustScore: 100,
  maxVerificationAgeSeconds: 300,
  maxEvaluationAgeSeconds: 90,
  requiredAssurance: "browser_unattested",
  uniquenessRequirement: "allow_unmeasured",
  requireAttestation: false,
  cluster: "devnet",
});

<EntrosVerify
  integratorKey="your-integrator-key"
  policy={policy}
  onVerified={(result) => setVerificationResult(result)}
  onError={(error) => setVerificationError(error.policyReason ?? error.reason)}
  onProgress={(progress) => setStatus(progress.status)}
/>;

Without an explicit policy, the upgraded consumer uses a one-day verification age and a 90-second evaluation lifetime. minTrustScore remains a shorthand for the score floor. A conflicting policy floor fails before the popup opens.

Version 1 supports devnet, browser_unattested assurance, and allow_unmeasured uniqueness only. Unsupported requirements and unknown versions fail closed. No policy request changes protocol scoring or projection policy.

Policy result

onVerified receives a typed allow result with its evaluated policy. The result preserves walletPubkey, txSig, trustScore, and cluster. It adds policy and makes attestationPda nullable for negotiated policy requests.

A required missing attestation denies access. An unavailable required attestation returns unavailable state. An optional missing or unavailable attestation carries no issued address. An invalid attestation denies access even when optional.

The reader checks account ownership, discriminator, supported layout, wallet binding, and field ranges. It binds current commitment and recency to a qualifying confirmed transaction. RPC failure never becomes a valid zero score.

The result expires when its verification age, evaluation lifetime, or required attestation expiry reaches its limit. The browser callback cannot authenticate evidence for a protected server action.

Settlement checks

Your server owns the policy, RPC connection, and expected program identities. It must ignore callback-supplied scores, clocks, assurance claims, and network configuration.

1. Authenticate a wallet-signed action with its canonical parameters, audience, nonce, and expiry.
2. Read current evidence with readIntegratorEvidence from Pulse.
3. Evaluate it with evaluatePolicy from @entros/verify/policy and the server clock.
4. Consume the nonce atomically with the protected action only when the decision is allow.

For an on-chain action, assert the relevant account state and policy within the same transaction. A browser callback or earlier server response cannot replace that check.

Read Trust Score from current IdentityState when the protected action executes. Run the protected-action example to test signed requests, current evidence, expiry, and replay protection locally.

Compatibility

The message envelope remains version 1. The additive policy object has its own version.

Release the upgraded popup before distributing consumers that require its policy object. A popup rollback causes upgraded consumers to fail closed. Review and pin the matching package versions before deployment.

Errors and presentation

onError retains the existing opaque reason categories. An additive policyReason explains application-policy failures without exposing private detector findings. It can report an unmet score floor, stale evidence, required attestation, unsupported policy, invalid evidence, or unavailable state.

A higher score requirement does not mean another immediate capture will satisfy it. Show the unmet requirement instead of automatically repeating verification.

children, className, and style customize the trigger button. Popup dimensions default to 480 by 720 pixels. The default timeout is nine minutes. The popup reports capture, proof, submission, and attestation progress through onProgress.

Integrator registration

Register the integrator key and production origins with Entros before using the hosted popup. Local development accepts registered origins or the popup host's localhost development rule. The production route requires its configured origin allowlist.

For a custom capture interface, see the SDK reference.