feat: expose Flamingo matching on wasm through uniffi

.github/workflows/ci.yml

@@ -112,7 +112,7 @@ jobs:
           llvm-ar-18 --version | head -n1
 
       - name: Run WASM compile check
-        run: cargo check -p walletkit --features embed-zkeys --target wasm32-unknown-unknown
+        run: cargo check -p walletkit --features embed-zkeys --locked --target wasm32-unknown-unknown
 
       # Keep this version aligned with the wasm-bindgen version in Cargo.lock.
       - name: Install WASM browser test runner
@@ -121,7 +121,7 @@ jobs:
       - name: Test walletkit-sqlite in a browser runner
         run: |
           CHROMEDRIVER="$CHROMEWEBDRIVER/chromedriver" \
-            cargo test -p walletkit-sqlite --target wasm32-unknown-unknown
+            cargo test -p walletkit-sqlite --locked --target wasm32-unknown-unknown
 
   swift-build:
     name: Build Swift

Cargo.toml

@@ -41,10 +41,17 @@ clap = "4"
 ctor = "0.2"
 dirs = "6"
 dotenvy = "0.15.7"
-flamingo-verifier-api-types = "0.4.0"
-flamingo-verifier-client = "0.4.0"
-flamingo-verifier-protocol = "0.4.0"
-flamingo-verifier-sealed-types = "0.4.0"
+# crates.io `flamingo-verifier-*` 0.4.0 and `pontifex` 2.0.0 are not browser-safe:
+# pontifex 2.0.0 calls `std::time::SystemTime::now()`, which panics in browsers.
+# Pin the browser-compatible 0.4 line at worldcoin/flamingo#116's branch head and
+# the merged browser-compat `pontifex` rev (worldcoin/pontifex#47), both in lockstep
+# with flamingo's own manifests. Move to a merged rev/tag once flamingo#116 lands.
+flamingo-verifier-api-types = { version = "0.4.0", git = "https://github.com/worldcoin/flamingo", rev = "00bdb03bad1229a875ebc6772baff1f18e5b6629" }
+flamingo-verifier-client = { version = "0.4.0", git = "https://github.com/worldcoin/flamingo", rev = "00bdb03bad1229a875ebc6772baff1f18e5b6629" }
+flamingo-verifier-protocol = { version = "0.4.0", git = "https://github.com/worldcoin/flamingo", rev = "00bdb03bad1229a875ebc6772baff1f18e5b6629" }
+flamingo-verifier-sealed-types = { version = "0.4.0", git = "https://github.com/worldcoin/flamingo", rev = "00bdb03bad1229a875ebc6772baff1f18e5b6629" }
+# Merged browser-compat rev (worldcoin/pontifex#47), pinned in lockstep with flamingo's own manifests.
+pontifex = { version = "2.0.0", git = "https://github.com/worldcoin/pontifex", rev = "51d3b1171d8f9d6c915ce1a6ff537058e3292072" }
 eyre = "0.6"
 getrandom = "0.3"
 hex = "0.4"

crates/walletkit-core/Cargo.toml

@@ -22,9 +22,14 @@ name = "walletkit_core"
 
 [dependencies]
 alloy-core = { workspace = true }
+async-trait = { workspace = true }
 backon = { workspace = true }
 base64 = { workspace = true }
 ciborium = { workspace = true }
+flamingo-verifier-api-types = { workspace = true }
+flamingo-verifier-client = { workspace = true }
+flamingo-verifier-protocol = { workspace = true }
+flamingo-verifier-sealed-types = { workspace = true }
 hex = { workspace = true }
 hkdf = { workspace = true }
 log = { workspace = true }
@@ -57,12 +62,7 @@ getrandom = { workspace = true, features = ["wasm_js"] }
 
 # Native-only dependencies (not available on wasm32)
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
-async-trait = { workspace = true }
 ctor = { workspace = true }
-flamingo-verifier-api-types = { workspace = true }
-flamingo-verifier-client = { workspace = true }
-flamingo-verifier-protocol = { workspace = true }
-flamingo-verifier-sealed-types = { workspace = true }
 reqwest = { workspace = true, features = ["brotli", "rustls-tls"] }
 rustls = { workspace = true, features = ["ring"] }
 

crates/walletkit-core/src/flamingo/mod.rs

@@ -40,7 +40,8 @@ pub struct FlamingoMatcher {
     client: OnceCell<FlamingoVerifierClient>,
 }
 
-#[async_trait]
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 trait MatchClient: Sync {
     type Assignment: Send + Sync;
 
@@ -53,7 +54,8 @@ trait MatchClient: Sync {
     ) -> Result<MatchResult, ClientError>;
 }
 
-#[uniffi::export(async_runtime = "tokio")]
+#[cfg_attr(feature = "uniffi-wasm", uniffi::export)]
+#[cfg_attr(not(feature = "uniffi-wasm"), uniffi::export(async_runtime = "tokio"))]
 impl FlamingoMatcher {
     /// Creates an instance with default values, use `with_measurements` and `with_headers` for customization.
     ///
@@ -154,7 +156,8 @@ impl FlamingoMatcher {
     }
 }
 
-#[async_trait]
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 impl MatchClient for FlamingoVerifierClient {
     type Assignment = VerifiedAssignment;
 
@@ -258,7 +261,7 @@ fn verifier_error(error: &ClientError) -> FlamingoError {
     FlamingoError::Verifier(error.to_string())
 }
 
-#[cfg(test)]
+#[cfg(all(test, not(target_arch = "wasm32")))]
 mod tests {
     use std::{
         collections::{HashMap, VecDeque},

crates/walletkit-core/src/flamingo/types.rs

@@ -243,7 +243,7 @@ impl From<VerifiedMatch> for VerifiedMatchToken {
     }
 }
 
-#[cfg(test)]
+#[cfg(all(test, not(target_arch = "wasm32")))]
 mod tests {
     use super::{FlamingoLiveCapture, FlamingoMatchRequest, MatchInputs};
 

crates/walletkit-core/src/lib.rs

@@ -103,7 +103,6 @@ pub enum Region {
 }
 
 /// Attested Flamingo matching in preparation for zero-knowledge proof generation.
-#[cfg(not(target_arch = "wasm32"))]
 pub mod flamingo;
 
 /// Contains error outputs from `WalletKit`

deny.toml

@@ -4,6 +4,12 @@ all-features = true
 
 [sources]
 unknown-registry = "deny"
+# Git dependencies must pin an exact commit.
+required-git-spec = "rev"
+allow-git = [
+  "https://github.com/worldcoin/flamingo",
+  "https://github.com/worldcoin/pontifex",
+]
 
 [bans]
 deny = [