@coordination-network/credential 0.0.1 → 0.0.2

package/README.md

@@ -1,9 +1,6 @@
 # @coordination-network/credential
 
-The credential SDK for the coordination network: issuing, verifying and presenting the delegated user approval credential, in both of the forms the network uses.
-
-- **SD-JWT VC**, for selective disclosure. The holder chooses which claims to reveal, and a key-binding JWT proves the presentation came from the device the credential was bound to.
-- **ZK credential**, for unlinkable presentation. The holder proves in zero knowledge that an approved issuer signed a credential that has not been revoked, without revealing the credential, the issuer or themselves.
+The zero-knowledge credential SDK for the Coordination Network. It issues signed credentials and builds or verifies presentations that prove approval and non-revocation without revealing the credential, its holder, or its issuer.
 
 ## Install
 
@@ -11,57 +8,31 @@ The credential SDK for the coordination network: issuing, verifying and presenti
 yarn add @coordination-network/credential
 ```
 
-The zero-knowledge paths load [`@noir-lang/noir_js`](https://noir-lang.org) and [`@aztec/bb.js`](https://github.com/AztecProtocol/aztec-packages) lazily, so an application that only issues or verifies SD-JWT credentials never pulls the proving stack into its startup path.
-
-## Usage
-
-### Issuing
-
-```ts
-import { issueSdJwtCredential } from "@coordination-network/credential"
-
-const token = await issueSdJwtCredential(params, signer, approvalResolver)
-```
-
-### Verifying
+## Supported credential flow
 
-```ts
-import { verifySdJwtCredential } from "@coordination-network/credential"
+- `issueZkCredential` validates the holder bindings and signs the credential commitments.
+- `buildZkPresentationInputs` constructs private circuit inputs on the holder device.
+- `ZkCredentialProofSystem` creates and verifies the zero-knowledge presentation.
+- `ApprovedIssuerSet` and the revocation helpers provide the membership witnesses used by the circuit.
 
-const result = await verifySdJwtCredential(token, resolver)
-```
+The previous SD-JWT prototype is intentionally not part of this package. It exposed stable subject, issuer, device-key, and revocation identifiers and did not provide the privacy properties of the supported ZK flow.
 
-### Presenting
+## Verifying a presentation
 
 ```ts
-import { presentSdJwtCredential, verifySdJwtPresentation } from "@coordination-network/credential"
-
-const presentation = await presentSdJwtCredential(token, deviceSigner, {
-    audience: verifierId,
-    nonce,
-    disclose: ["programme", "country"]
-})
+import { verifyZkPresentationProof } from "@coordination-network/credential"
 
-const result = await verifySdJwtPresentation(presentation, resolver, { audience: verifierId, nonce })
+const result = await verifyZkPresentationProof(circuit, proof, expected)
 ```
 
-### Revocation
+On success the result carries `approvedIssuerRoot` and `revocationRoot`, the proof's public outputs. The function does not check them, so check them against the registries before accepting the presentation: the issuer root against the approved-issuer set, and the revocation root with the revocation registry's `isValidRoot`.
 
-```ts
-import {
-    generateRevocationSecret,
-    deriveRevocationCommitment,
-    buildStatusClaim
-} from "@coordination-network/credential"
-
-const secret = generateRevocationSecret()
-const commitment = deriveRevocationCommitment(secret)
-```
+## Revocation
 
-The holder generates the secret and shows the issuer the commitment, with `signCommitmentOwnership` / `verifyCommitmentOwnership` proving they hold the preimage. The issuer embeds the commitment in the credential's status claim. Revoking later means inserting that commitment into [`@coordination-network/revocation-registry`](../revocation-registry), and proving a credential is still valid means proving the commitment is absent from it. |
+The holder generates a secret with `generateRevocationSecret` and sends only its commitment to the issuer. `signCommitmentOwnership` and `verifyCommitmentOwnership` prove control of the commitment during issuance. A presentation later proves that commitment is absent from the revocation registry without disclosing it.
 
 ## Notes
 
-- The signer interfaces are structural, so keys can live in a KMS, a hardware wallet or a device keystore without this package knowing.
-- `ApprovalResolver` and `IssuerSet` are the two seams onto network membership. [`@coordination-network/issuer-set`](../issuer-set) provides an implementation of the latter.
-- This package ships a CommonJS build. Both `import` and `require` work.
+- Device signer interfaces are structural, so keys can remain in a hardware-backed keystore.
+- Noir and Barretenberg are loaded lazily by the proof-system helpers.
+- This package ships a CommonJS build; both `import` and `require` are supported.

package/dist/crypto.d.ts

@@ -1,6 +1,6 @@
 import { bytesToBase64url } from "@coordination-network/identity";
 import { Jwk } from "./types";
-import { DeviceSigner, Signer } from "./signer";
+import { DeviceSigner } from "./signer";
 export { bytesToBase64url };
 /**
  * Padding is optional under RFC 4648 §5 and some clients send it anyway (Python's
@@ -25,23 +25,15 @@ export declare function jwkThumbprint(jwk: Jwk): Uint8Array;
  * and JWS does not require it.
  */
 export declare function verifyP256(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): boolean;
-/** Bridges a Signer to the @sd-jwt signer callback (base64url over utf8 input). */
-export declare function createSdJwtSigner(signer: Signer): (data: string) => Promise<string>;
-/** Builds the @sd-jwt verifier callback from a resolved issuer JWK. */
-export declare function createSdJwtVerifier(jwk: Jwk): (data: string, signature: string) => boolean;
-/** The sha-256 hasher the @sd-jwt config takes. */
-export declare function sdJwtHasher(data: string | ArrayBuffer): Uint8Array;
-/** Hex salts for disclosure digests. */
-export declare function sdJwtSaltGenerator(length: number): string;
 /** RFC 4122 v4 UUID from CSPRNG bytes — node:crypto is unavailable under React Native. */
 export declare function randomUuid(): string;
 /**
  * Software P-256 signer. The issuer demo and every test use it; production
  * issuers replace it with a KMS-backed Signer, apps with a secure-element
  * DeviceSigner. Signs in message mode with low-s, raw 64-byte output —
- * exactly the Signer contract.
+ * exactly the DeviceSigner contract.
  */
-export declare class LocalP256Signer implements Signer, DeviceSigner {
+export declare class LocalP256Signer implements DeviceSigner {
     private readonly privateKey;
     constructor(privateKey: Uint8Array);
     static generate(): LocalP256Signer;

package/dist/crypto.js

@@ -7,18 +7,12 @@ exports.compressedPointToJwk = compressedPointToJwk;
 exports.jwkToCompressedPoint = jwkToCompressedPoint;
 exports.jwkThumbprint = jwkThumbprint;
 exports.verifyP256 = verifyP256;
-exports.createSdJwtSigner = createSdJwtSigner;
-exports.createSdJwtVerifier = createSdJwtVerifier;
-exports.sdJwtHasher = sdJwtHasher;
-exports.sdJwtSaltGenerator = sdJwtSaltGenerator;
 exports.randomUuid = randomUuid;
 const nist_js_1 = require("@noble/curves/nist.js");
 const sha2_1 = require("@noble/hashes/sha2");
 const utils_1 = require("@noble/hashes/utils");
 const identity_1 = require("@coordination-network/identity");
 Object.defineProperty(exports, "bytesToBase64url", { enumerable: true, get: function () { return identity_1.bytesToBase64url; } });
-/** Bridges the KMS-shaped Signer interface, the noble primitives, and the callback shapes @sd-jwt expects. */
-const utf8 = (data) => new TextEncoder().encode(data);
 /**
  * Padding is optional under RFC 4648 §5 and some clients send it anyway (Python's
  * urlsafe_b64encode, Java's URL encoder), so JWK coordinates are stripped before the strict decode
@@ -78,30 +72,6 @@ function verifyP256(message, signature, publicKey) {
         return false;
     }
 }
-/** Bridges a Signer to the @sd-jwt signer callback (base64url over utf8 input). */
-function createSdJwtSigner(signer) {
-    return async (data) => (0, identity_1.bytesToBase64url)(await signer.sign(utf8(data)));
-}
-/** Builds the @sd-jwt verifier callback from a resolved issuer JWK. */
-function createSdJwtVerifier(jwk) {
-    const publicKey = jwkToPublicKeyBytes(jwk);
-    return (data, signature) => {
-        try {
-            return verifyP256(utf8(data), base64urlToBytes(signature), publicKey);
-        }
-        catch {
-            return false;
-        }
-    };
-}
-/** The sha-256 hasher the @sd-jwt config takes. */
-function sdJwtHasher(data) {
-    return (0, sha2_1.sha256)(typeof data === "string" ? data : new Uint8Array(data));
-}
-/** Hex salts for disclosure digests. */
-function sdJwtSaltGenerator(length) {
-    return (0, utils_1.bytesToHex)((0, utils_1.randomBytes)(length));
-}
 /** RFC 4122 v4 UUID from CSPRNG bytes — node:crypto is unavailable under React Native. */
 function randomUuid() {
     const bytes = (0, utils_1.randomBytes)(16);
@@ -114,7 +84,7 @@ function randomUuid() {
  * Software P-256 signer. The issuer demo and every test use it; production
  * issuers replace it with a KMS-backed Signer, apps with a secure-element
  * DeviceSigner. Signs in message mode with low-s, raw 64-byte output —
- * exactly the Signer contract.
+ * exactly the DeviceSigner contract.
  */
 class LocalP256Signer {
     constructor(privateKey) {

package/dist/index.d.ts

@@ -11,9 +11,4 @@ export * from "./zk-proof";
 export * from "./resolver";
 export * from "./registry-client";
 export * from "./crypto";
-export * from "./decode";
-export * from "./profile";
-export * from "./issue";
-export * from "./verify";
-export * from "./present";
 export * from "./revocation";

package/dist/index.js

@@ -27,9 +27,4 @@ __exportStar(require("./zk-proof"), exports);
 __exportStar(require("./resolver"), exports);
 __exportStar(require("./registry-client"), exports);
 __exportStar(require("./crypto"), exports);
-__exportStar(require("./decode"), exports);
-__exportStar(require("./profile"), exports);
-__exportStar(require("./issue"), exports);
-__exportStar(require("./verify"), exports);
-__exportStar(require("./present"), exports);
 __exportStar(require("./revocation"), exports);

package/dist/issue-credential.d.ts

@@ -1,4 +1,8 @@
 import { CredentialSigner } from "./credential-signer";
 import { ApprovalResolver } from "./resolver";
-import { ZkCredential, ZkCredentialIssueParams } from "./types";
+import { ZkCredential, ZkCredentialBody, ZkCredentialIssueParams } from "./types";
+/** Validates an issuance request without signing it. */
+export declare function validateZkCredentialIssue(params: ZkCredentialIssueParams, approval: ApprovalResolver): Promise<ZkCredentialBody>;
+/** Signs a request that has already passed {@link validateZkCredentialIssue}. */
+export declare function signValidatedZkCredential(body: ZkCredentialBody, signer: CredentialSigner): Promise<ZkCredential>;
 export declare function issueZkCredential(params: ZkCredentialIssueParams, signer: CredentialSigner, approval: ApprovalResolver): Promise<ZkCredential>;

package/dist/issue-credential.js

@@ -1,20 +1,27 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateZkCredentialIssue = validateZkCredentialIssue;
+exports.signValidatedZkCredential = signValidatedZkCredential;
 exports.issueZkCredential = issueZkCredential;
 const identity_1 = require("@coordination-network/identity");
+const issuer_set_1 = require("@coordination-network/issuer-set");
 const utils_1 = require("@noble/hashes/utils");
 const identity_2 = require("@semaphore-protocol/identity");
 const credential_message_1 = require("./credential-message");
 const crypto_1 = require("./crypto");
 const errors_1 = require("./errors");
 const revocation_1 = require("./revocation");
-async function issueZkCredential(params, signer, approval) {
+/** Validates an issuance request without signing it. */
+async function validateZkCredentialIssue(params, approval) {
     if (!(await approval.isApprovedNetworkMember(params.issuerNetworkId))) {
         throw new errors_1.IssuanceError("ISSUER_NOT_APPROVED", `issuer ${params.issuerNetworkId} is not an approved network member`);
     }
     if (!(params.validFrom < params.validUntil)) {
         throw new errors_1.IssuanceError("INVALID_PARAMS", "validFrom must be before validUntil");
     }
+    if (!(0, issuer_set_1.inPrimeOrderSubgroup)(params.identityPublicKey)) {
+        throw new errors_1.IssuanceError("INVALID_PARAMS", "identity public key is not in the prime-order subgroup");
+    }
     const holderKeyCommitment = identity_2.Identity.generateCommitment(params.identityPublicKey);
     const holderKeyCommitmentBytes = (0, utils_1.hexToBytes)(holderKeyCommitment.toString(16).padStart(64, "0"));
     let binding;
@@ -49,7 +56,7 @@ async function issueZkCredential(params, signer, approval) {
     if (!ownershipOk) {
         throw new errors_1.IssuanceError("COMMITMENT_OWNERSHIP_INVALID", "revocation commitment ownership proof failed");
     }
-    const body = {
+    return {
         programmeHash: (0, credential_message_1.programmeHash)(params.approvalScope.programme),
         countryCode: (0, credential_message_1.countryCode)(params.approvalScope.country),
         notBefore: params.validFrom,
@@ -58,9 +65,15 @@ async function issueZkCredential(params, signer, approval) {
         holderKeyCommitment,
         revocationCommitment: params.revocation.commitment
     };
+}
+/** Signs a request that has already passed {@link validateZkCredentialIssue}. */
+async function signValidatedZkCredential(body, signer) {
     return {
         body,
         issuerPublicKey: await signer.getPublicKey(),
         signature: await signer.sign((0, credential_message_1.zkCredentialCommitment)(body))
     };
 }
+async function issueZkCredential(params, signer, approval) {
+    return signValidatedZkCredential(await validateZkCredentialIssue(params, approval), signer);
+}

package/dist/revocation.d.ts

@@ -1,4 +1,4 @@
-import { EddsaPublicKey, EddsaSignature, StatusClaim } from "./types";
+import { EddsaPublicKey, EddsaSignature } from "./types";
 /** Generates a fresh 32-byte revocation secret r. Device-side only. */
 export declare function generateRevocationSecret(): Uint8Array;
 /** commitment = new Identity(r).commitment (Semaphore V4). */
@@ -12,8 +12,10 @@ export declare function signCommitmentOwnership(r: Uint8Array, nonce: Uint8Array
     signature: EddsaSignature;
 };
 /**
- * Issuer-side check: verifies the EdDSA signature over the nonce, recomputes
- * the commitment from the public key, and compares it to the claimed one.
+ * Issuer-side check: requires a prime-order public key, verifies the EdDSA
+ * signature over the nonce, recomputes the commitment from the public key, and
+ * compares it to the claimed one. A low-order key is refused because its
+ * signatures need no secret.
  */
 export declare function verifyCommitmentOwnership(params: {
     commitment: bigint;
@@ -21,5 +23,3 @@ export declare function verifyCommitmentOwnership(params: {
     signature: EddsaSignature;
     nonce: Uint8Array;
 }): boolean;
-/** Builds the status.cn_zk_revocation claim for the signed body (spec 07). */
-export declare function buildStatusClaim(commitment: bigint, revocationRegistry: string): StatusClaim;

package/dist/revocation.js

@@ -4,7 +4,7 @@ exports.generateRevocationSecret = generateRevocationSecret;
 exports.deriveRevocationCommitment = deriveRevocationCommitment;
 exports.signCommitmentOwnership = signCommitmentOwnership;
 exports.verifyCommitmentOwnership = verifyCommitmentOwnership;
-exports.buildStatusClaim = buildStatusClaim;
+const issuer_set_1 = require("@coordination-network/issuer-set");
 const identity_1 = require("@semaphore-protocol/identity");
 const utils_1 = require("@noble/hashes/utils");
 /**
@@ -47,11 +47,16 @@ function signCommitmentOwnership(r, nonce) {
     };
 }
 /**
- * Issuer-side check: verifies the EdDSA signature over the nonce, recomputes
- * the commitment from the public key, and compares it to the claimed one.
+ * Issuer-side check: requires a prime-order public key, verifies the EdDSA
+ * signature over the nonce, recomputes the commitment from the public key, and
+ * compares it to the claimed one. A low-order key is refused because its
+ * signatures need no secret.
  */
 function verifyCommitmentOwnership(params) {
     try {
+        if (!(0, issuer_set_1.inPrimeOrderSubgroup)(params.publicKey)) {
+            return false;
+        }
         if (!identity_1.Identity.verifySignature(nonceToBigint(params.nonce), params.signature, params.publicKey)) {
             return false;
         }
@@ -61,12 +66,3 @@ function verifyCommitmentOwnership(params) {
         return false;
     }
 }
-/** Builds the status.cn_zk_revocation claim for the signed body (spec 07). */
-function buildStatusClaim(commitment, revocationRegistry) {
-    return {
-        cn_zk_revocation: {
-            revocationRegistry,
-            revocationCommitment: commitment.toString(10)
-        }
-    };
-}

package/dist/signer.d.ts

@@ -1,19 +1,8 @@
 import { Jwk } from "./types";
-/**
- * Issuer signing key, KMS-shaped. sign receives the JWS signing input in
- * message mode (the service applies SHA-256 itself, never a precomputed
- * digest) and returns the raw 64-byte r||s signature.
- */
-export interface Signer {
+/** Holder P-256 device key backed by a secure element in production. */
+export interface DeviceSigner {
     getPublicKeyJwk(): Promise<Jwk>;
     sign(message: Uint8Array): Promise<Uint8Array>;
-}
-/**
- * Holder P-256 device key: the secure element in the app, a software key in
- * tests. Same contract as Signer; a separate type because the two keys must
- * never be interchangeable in signatures.
- */
-export interface DeviceSigner extends Signer {
     /** Signs an already-computed 32-byte digest, without hashing it again. */
     signDigest(digest: Uint8Array): Promise<Uint8Array>;
 }

package/dist/types.d.ts

@@ -21,31 +21,6 @@ export interface EddsaSignature {
     R8: [bigint, bigint];
     S: bigint;
 }
-/**
- * The custom status member inside the signed body (spec 07). The commitment
- * is issuer-attested and visible to WS1 verifiers by design.
- */
-export interface StatusClaim {
-    cn_zk_revocation: {
-        /** urn:cn:contract: URN of the on-chain revocation registry. */
-        revocationRegistry: string;
-        revocationCommitment: string;
-    };
-}
-/** The reconstructed claim set of a verified credential. */
-export interface ApprovalCredentialClaims {
-    vct: string;
-    iss: string;
-    sub: string;
-    jti: string;
-    nbf: number;
-    exp: number;
-    cnf: {
-        jwk: Jwk;
-    };
-    status: StatusClaim;
-    approvalScope: ApprovalScope;
-}
 export interface IssuanceRequest {
     issuerNetworkId: Hex32;
     subjectNetworkId: Hex32;
@@ -63,9 +38,6 @@ export interface IssuanceRequest {
         ownershipSignature: EddsaSignature;
     };
 }
-export interface SdJwtIssueParams extends IssuanceRequest {
-    revocationRegistry: string;
-}
 export interface ZkCredentialIssueParams extends IssuanceRequest {
     identityPublicKey: EddsaPublicKey;
 }
@@ -99,13 +71,3 @@ export interface SerializedZkCredential {
         S: string;
     };
 }
-export type VerifyErrorCode = "MALFORMED" | "ISSUER_NOT_APPROVED" | "KEY_NOT_FOUND" | "PROOF_INVALID" | "EXPIRED" | "NOT_YET_VALID" | "REVOKED";
-/** Checks run in spec order (07, verification flow) and the first failure wins. */
-export type VerifyResult = {
-    ok: true;
-    claims: ApprovalCredentialClaims;
-} | {
-    ok: false;
-    code: VerifyErrorCode;
-    message: string;
-};

package/dist/zk-proof.d.ts

@@ -12,6 +12,12 @@ export interface ExpectedZkPresentation {
     programme: string;
     country: string;
 }
+/**
+ * `approvedIssuerRoot` and `revocationRoot` are the proof's public outputs and are
+ * not checked here. Check them against the registries before accepting the presentation:
+ * the issuer root against the approved-issuer set, the revocation root with the revocation
+ * registry's `isValidRoot`.
+ */
 export type ZkPresentationVerifyResult = {
     ok: true;
     approvedIssuerRoot: bigint;
@@ -41,5 +47,9 @@ export declare class ZkCredentialProofSystem {
     destroy(): Promise<void>;
 }
 export declare function generateZkPresentationProof(circuit: CompiledCircuit, inputs: ZkPresentationInputs, options?: ZkProofSystemOptions): Promise<ZkPresentationProof>;
+/**
+ * Verifies a presentation proof against the expected public inputs and returns the roots
+ * from the proof. Check those roots against the registries; see {@link ZkPresentationVerifyResult}.
+ */
 export declare function verifyZkPresentationProof(circuit: CompiledCircuit, proof: ZkPresentationProof, expected: ExpectedZkPresentation, options?: ZkProofSystemOptions): Promise<ZkPresentationVerifyResult>;
 export {};

package/dist/zk-proof.js

@@ -119,6 +119,10 @@ async function generateZkPresentationProof(circuit, inputs, options = {}) {
         await proofSystem.destroy();
     }
 }
+/**
+ * Verifies a presentation proof against the expected public inputs and returns the roots
+ * from the proof. Check those roots against the registries; see {@link ZkPresentationVerifyResult}.
+ */
 async function verifyZkPresentationProof(circuit, proof, expected, options = {}) {
     const proofSystem = await ZkCredentialProofSystem.create(circuit, options);
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coordination-network/credential",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Verifiable credential SDK for the coordination network: issuance, verification, holder binding and revocation helpers.",
   "license": "MIT",
   "repository": {
@@ -30,24 +30,21 @@
     "test": "jest"
   },
   "devDependencies": {
-    "@coordination-network/zk-artifacts": "^0.0.1",
-    "@sd-jwt/core": "^0.19.0",
-    "@sd-jwt/types": "^0.19.0",
+    "@coordination-network/zk-artifacts": "^0.0.2",
     "@types/jest": "^30.0.0",
     "@types/node": "^24.0.0",
+    "@zk-kit/baby-jubjub": "1.0.3",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11",
     "typescript": "^6.0.3"
   },
   "dependencies": {
     "@aztec/bb.js": "5.0.0",
-    "@coordination-network/identity": "^0.0.1",
-    "@coordination-network/issuer-set": "^0.0.1",
+    "@coordination-network/identity": "^0.0.2",
+    "@coordination-network/issuer-set": "^0.0.2",
     "@noble/curves": "^1.9.7",
     "@noble/hashes": "^1.8.0",
     "@noir-lang/noir_js": "1.0.0-beta.22",
-    "@sd-jwt/decode": "^0.19.0",
-    "@sd-jwt/sd-jwt-vc": "^0.19.0",
     "@semaphore-protocol/identity": "^4.14.3",
     "poseidon-lite": "0.3.0",
     "viem": "^2.55.11"

package/src/crypto.ts

@@ -3,11 +3,7 @@ import { sha256 } from "@noble/hashes/sha2"
 import { bytesToHex, randomBytes } from "@noble/hashes/utils"
 import { base64urlToBytes as strictBase64urlToBytes, bytesToBase64url } from "@coordination-network/identity"
 import { Jwk } from "./types"
-import { DeviceSigner, Signer } from "./signer"
-
-/** Bridges the KMS-shaped Signer interface, the noble primitives, and the callback shapes @sd-jwt expects. */
-
-const utf8 = (data: string): Uint8Array => new TextEncoder().encode(data)
+import { DeviceSigner } from "./signer"
 
 export { bytesToBase64url }
 
@@ -74,33 +70,6 @@ export function verifyP256(message: Uint8Array, signature: Uint8Array, publicKey
     }
 }
 
-/** Bridges a Signer to the @sd-jwt signer callback (base64url over utf8 input). */
-export function createSdJwtSigner(signer: Signer): (data: string) => Promise<string> {
-    return async (data: string) => bytesToBase64url(await signer.sign(utf8(data)))
-}
-
-/** Builds the @sd-jwt verifier callback from a resolved issuer JWK. */
-export function createSdJwtVerifier(jwk: Jwk): (data: string, signature: string) => boolean {
-    const publicKey = jwkToPublicKeyBytes(jwk)
-    return (data: string, signature: string) => {
-        try {
-            return verifyP256(utf8(data), base64urlToBytes(signature), publicKey)
-        } catch {
-            return false
-        }
-    }
-}
-
-/** The sha-256 hasher the @sd-jwt config takes. */
-export function sdJwtHasher(data: string | ArrayBuffer): Uint8Array {
-    return sha256(typeof data === "string" ? data : new Uint8Array(data))
-}
-
-/** Hex salts for disclosure digests. */
-export function sdJwtSaltGenerator(length: number): string {
-    return bytesToHex(randomBytes(length))
-}
-
 /** RFC 4122 v4 UUID from CSPRNG bytes — node:crypto is unavailable under React Native. */
 export function randomUuid(): string {
     const bytes = randomBytes(16)
@@ -115,9 +84,9 @@ export function randomUuid(): string {
  * Software P-256 signer. The issuer demo and every test use it; production
  * issuers replace it with a KMS-backed Signer, apps with a secure-element
  * DeviceSigner. Signs in message mode with low-s, raw 64-byte output —
- * exactly the Signer contract.
+ * exactly the DeviceSigner contract.
  */
-export class LocalP256Signer implements Signer, DeviceSigner {
+export class LocalP256Signer implements DeviceSigner {
     private readonly privateKey: Uint8Array
 
     constructor(privateKey: Uint8Array) {

package/src/index.ts

@@ -11,9 +11,4 @@ export * from "./zk-proof"
 export * from "./resolver"
 export * from "./registry-client"
 export * from "./crypto"
-export * from "./decode"
-export * from "./profile"
-export * from "./issue"
-export * from "./verify"
-export * from "./present"
 export * from "./revocation"

package/src/issue-credential.ts

@@ -1,4 +1,5 @@
 import { InvalidBindingInputError, verifyCredentialBinding } from "@coordination-network/identity"
+import { inPrimeOrderSubgroup } from "@coordination-network/issuer-set"
 import { hexToBytes } from "@noble/hashes/utils"
 import { Identity } from "@semaphore-protocol/identity"
 import { CredentialSigner } from "./credential-signer"
@@ -7,13 +8,13 @@ import { jwkToPublicKeyBytes } from "./crypto"
 import { IssuanceError } from "./errors"
 import { ApprovalResolver } from "./resolver"
 import { verifyCommitmentOwnership } from "./revocation"
-import { ZkCredential, ZkCredentialIssueParams } from "./types"
+import { ZkCredential, ZkCredentialBody, ZkCredentialIssueParams } from "./types"
 
-export async function issueZkCredential(
+/** Validates an issuance request without signing it. */
+export async function validateZkCredentialIssue(
     params: ZkCredentialIssueParams,
-    signer: CredentialSigner,
     approval: ApprovalResolver
-): Promise<ZkCredential> {
+): Promise<ZkCredentialBody> {
     if (!(await approval.isApprovedNetworkMember(params.issuerNetworkId))) {
         throw new IssuanceError(
             "ISSUER_NOT_APPROVED",
@@ -24,6 +25,10 @@ export async function issueZkCredential(
         throw new IssuanceError("INVALID_PARAMS", "validFrom must be before validUntil")
     }
 
+    if (!inPrimeOrderSubgroup(params.identityPublicKey)) {
+        throw new IssuanceError("INVALID_PARAMS", "identity public key is not in the prime-order subgroup")
+    }
+
     const holderKeyCommitment = Identity.generateCommitment(params.identityPublicKey)
     const holderKeyCommitmentBytes = hexToBytes(holderKeyCommitment.toString(16).padStart(64, "0"))
     let binding: ReturnType<typeof verifyCredentialBinding>
@@ -60,7 +65,7 @@ export async function issueZkCredential(
         throw new IssuanceError("COMMITMENT_OWNERSHIP_INVALID", "revocation commitment ownership proof failed")
     }
 
-    const body = {
+    return {
         programmeHash: programmeHash(params.approvalScope.programme),
         countryCode: countryCode(params.approvalScope.country),
         notBefore: params.validFrom,
@@ -69,10 +74,24 @@ export async function issueZkCredential(
         holderKeyCommitment,
         revocationCommitment: params.revocation.commitment
     }
+}
 
+/** Signs a request that has already passed {@link validateZkCredentialIssue}. */
+export async function signValidatedZkCredential(
+    body: ZkCredentialBody,
+    signer: CredentialSigner
+): Promise<ZkCredential> {
     return {
         body,
         issuerPublicKey: await signer.getPublicKey(),
         signature: await signer.sign(zkCredentialCommitment(body))
     }
 }
+
+export async function issueZkCredential(
+    params: ZkCredentialIssueParams,
+    signer: CredentialSigner,
+    approval: ApprovalResolver
+): Promise<ZkCredential> {
+    return signValidatedZkCredential(await validateZkCredentialIssue(params, approval), signer)
+}