@coordination-network/credential 0.0.1 → 0.1.0

package/README.md

@@ -1,9 +1,6 @@
 # @coordination-network/credential
 
-The credential SDK for the coordination network: issuing, verifying and presenting the delegated user approval credential, in both of the forms the network uses.
-
-- **SD-JWT VC**, for selective disclosure. The holder chooses which claims to reveal, and a key-binding JWT proves the presentation came from the device the credential was bound to.
-- **ZK credential**, for unlinkable presentation. The holder proves in zero knowledge that an approved issuer signed a credential that has not been revoked, without revealing the credential, the issuer or themselves.
+The zero-knowledge credential SDK for the Coordination Network. It issues signed credentials and builds or verifies presentations that prove approval and non-revocation without revealing the credential, its holder, or its issuer.
 
 ## Install
 
@@ -11,57 +8,32 @@ The credential SDK for the coordination network: issuing, verifying and presenti
 yarn add @coordination-network/credential
 ```
 
-The zero-knowledge paths load [`@noir-lang/noir_js`](https://noir-lang.org) and [`@aztec/bb.js`](https://github.com/AztecProtocol/aztec-packages) lazily, so an application that only issues or verifies SD-JWT credentials never pulls the proving stack into its startup path.
-
-## Usage
-
-### Issuing
-
-```ts
-import { issueSdJwtCredential } from "@coordination-network/credential"
-
-const token = await issueSdJwtCredential(params, signer, approvalResolver)
-```
-
-### Verifying
+## Supported credential flow
 
-```ts
-import { verifySdJwtCredential } from "@coordination-network/credential"
+- `issueZkCredential` validates the holder bindings and signs the credential commitments.
+- `issuanceRequestCommitment` hashes the issuer and the approval scope into the value the wallet's device signature covers; `issueZkCredential` recomputes it from its own id and the scope it signs.
+- `buildZkPresentationInputs` constructs private circuit inputs on the holder device.
+- `ZkCredentialProofSystem` creates and verifies the zero-knowledge presentation.
+- `ApprovedIssuerSet` and the revocation helpers provide the membership witnesses used by the circuit.
 
-const result = await verifySdJwtCredential(token, resolver)
-```
+The previous SD-JWT prototype is intentionally not part of this package. It exposed stable subject, issuer, device-key, and revocation identifiers and did not provide the privacy properties of the supported ZK flow.
 
-### Presenting
+## Verifying a presentation
 
 ```ts
-import { presentSdJwtCredential, verifySdJwtPresentation } from "@coordination-network/credential"
-
-const presentation = await presentSdJwtCredential(token, deviceSigner, {
-    audience: verifierId,
-    nonce,
-    disclose: ["programme", "country"]
-})
+import { verifyZkPresentationProof } from "@coordination-network/credential"
 
-const result = await verifySdJwtPresentation(presentation, resolver, { audience: verifierId, nonce })
+const result = await verifyZkPresentationProof(circuit, proof, expected)
 ```
 
-### Revocation
+On success the result carries `approvedIssuerRoot` and `revocationRoot`, the proof's public outputs. The function does not check them, so check them against the registries before accepting the presentation: the issuer root against the approved-issuer set, and the revocation root with the revocation registry's `isValidRoot`.
 
-```ts
-import {
-    generateRevocationSecret,
-    deriveRevocationCommitment,
-    buildStatusClaim
-} from "@coordination-network/credential"
-
-const secret = generateRevocationSecret()
-const commitment = deriveRevocationCommitment(secret)
-```
+## Revocation
 
-The holder generates the secret and shows the issuer the commitment, with `signCommitmentOwnership` / `verifyCommitmentOwnership` proving they hold the preimage. The issuer embeds the commitment in the credential's status claim. Revoking later means inserting that commitment into [`@coordination-network/revocation-registry`](../revocation-registry), and proving a credential is still valid means proving the commitment is absent from it. |
+The holder generates a secret with `generateRevocationSecret` and sends only its commitment to the issuer. `signCommitmentOwnership` and `verifyCommitmentOwnership` prove control of the commitment during issuance. A presentation later proves that commitment is absent from the revocation registry without disclosing it.
 
 ## Notes
 
-- The signer interfaces are structural, so keys can live in a KMS, a hardware wallet or a device keystore without this package knowing.
-- `ApprovalResolver` and `IssuerSet` are the two seams onto network membership. [`@coordination-network/issuer-set`](../issuer-set) provides an implementation of the latter.
-- This package ships a CommonJS build. Both `import` and `require` work.
+- Device signer interfaces are structural, so keys can remain in a hardware-backed keystore.
+- Noir and Barretenberg are loaded lazily by the proof-system helpers.
+- This package ships a CommonJS build; both `import` and `require` are supported.

package/dist/credential-message.d.ts

@@ -1,9 +1,13 @@
-import { Jwk, SerializedZkCredential, ZkCredential, ZkCredentialBody } from "./types";
+import { ApprovalScope, Hex32, Jwk, SerializedZkCredential, ZkCredential, ZkCredentialBody } from "./types";
 export declare const CREDENTIAL_DOMAIN = 363566488821926773809509531830640889725124777157045803797738936823559174026n;
+export declare const ISSUANCE_REQUEST_DOMAIN = "urn:cn:issuance-request:v1";
+export declare const DEVICE_ATTESTATION_CHALLENGE = "urn:cn:device-attestation:v1";
 export declare const DEVICE_KEY_DOMAIN = 320507632879070882430325612169297945123468706597652794395401074724051126576n;
 export declare function stringToField(value: string): bigint;
 export declare function programmeHash(programme: string): bigint;
 export declare function countryCode(country: string): number;
+/** What the device signature commits to besides the holder key: the issuer and the scope shown at consent. */
+export declare function issuanceRequestCommitment(issuerNetworkId: Hex32, approvalScope: ApprovalScope): Uint8Array;
 export declare function deriveDeviceKeyCommitment(publicKey: Jwk): bigint;
 export declare function zkCredentialCommitment(body: ZkCredentialBody): bigint;
 export declare function serializeZkCredential(credential: ZkCredential): SerializedZkCredential;

package/dist/credential-message.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEVICE_KEY_DOMAIN = exports.CREDENTIAL_DOMAIN = void 0;
+exports.DEVICE_KEY_DOMAIN = exports.DEVICE_ATTESTATION_CHALLENGE = exports.ISSUANCE_REQUEST_DOMAIN = exports.CREDENTIAL_DOMAIN = void 0;
 exports.stringToField = stringToField;
 exports.programmeHash = programmeHash;
 exports.countryCode = countryCode;
+exports.issuanceRequestCommitment = issuanceRequestCommitment;
 exports.deriveDeviceKeyCommitment = deriveDeviceKeyCommitment;
 exports.zkCredentialCommitment = zkCredentialCommitment;
 exports.serializeZkCredential = serializeZkCredential;
@@ -18,6 +19,10 @@ const utils_1 = require("@noble/hashes/utils");
 const crypto_1 = require("./crypto");
 // keccak256(utf8("urn:cn:credential:v1")) >> 8
 exports.CREDENTIAL_DOMAIN = 363566488821926773809509531830640889725124777157045803797738936823559174026n;
+exports.ISSUANCE_REQUEST_DOMAIN = "urn:cn:issuance-request:v1";
+// Android Key Attestation challenge for the device signing key, as UTF-8 bytes. Fixed because the key is
+// attested once, at generation; the device signature over the issuer nonce supplies freshness.
+exports.DEVICE_ATTESTATION_CHALLENGE = "urn:cn:device-attestation:v1";
 exports.DEVICE_KEY_DOMAIN = 320507632879070882430325612169297945123468706597652794395401074724051126576n;
 const FIELD_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
 function stringToField(value) {
@@ -33,6 +38,17 @@ function countryCode(country) {
         throw new Error("country must be an ISO 3166-1 alpha-3 code");
     return [...country].reduce((value, character) => (value << 8) | character.charCodeAt(0), 0);
 }
+/** What the device signature commits to besides the holder key: the issuer and the scope shown at consent. */
+function issuanceRequestCommitment(issuerNetworkId, approvalScope) {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(issuerNetworkId))
+        throw new Error("issuerNetworkId must be 32 bytes");
+    return (0, viem_1.hexToBytes)((0, viem_1.keccak256)((0, viem_1.concatHex)([
+        (0, viem_1.stringToHex)(exports.ISSUANCE_REQUEST_DOMAIN),
+        issuerNetworkId,
+        (0, viem_1.toHex)(programmeHash(approvalScope.programme), { size: 32 }),
+        (0, viem_1.toHex)(countryCode(approvalScope.country), { size: 32 })
+    ])));
+}
 const bytesToBigint = (value) => BigInt(`0x${(0, utils_1.bytesToHex)(value)}`);
 function deriveDeviceKeyCommitment(publicKey) {
     const encoded = (0, crypto_1.jwkToPublicKeyBytes)(publicKey);

package/dist/crypto.d.ts

@@ -1,6 +1,6 @@
 import { bytesToBase64url } from "@coordination-network/identity";
 import { Jwk } from "./types";
-import { DeviceSigner, Signer } from "./signer";
+import { DeviceSigner } from "./signer";
 export { bytesToBase64url };
 /**
  * Padding is optional under RFC 4648 §5 and some clients send it anyway (Python's
@@ -25,23 +25,15 @@ export declare function jwkThumbprint(jwk: Jwk): Uint8Array;
  * and JWS does not require it.
  */
 export declare function verifyP256(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): boolean;
-/** Bridges a Signer to the @sd-jwt signer callback (base64url over utf8 input). */
-export declare function createSdJwtSigner(signer: Signer): (data: string) => Promise<string>;
-/** Builds the @sd-jwt verifier callback from a resolved issuer JWK. */
-export declare function createSdJwtVerifier(jwk: Jwk): (data: string, signature: string) => boolean;
-/** The sha-256 hasher the @sd-jwt config takes. */
-export declare function sdJwtHasher(data: string | ArrayBuffer): Uint8Array;
-/** Hex salts for disclosure digests. */
-export declare function sdJwtSaltGenerator(length: number): string;
 /** RFC 4122 v4 UUID from CSPRNG bytes — node:crypto is unavailable under React Native. */
 export declare function randomUuid(): string;
 /**
  * Software P-256 signer. The issuer demo and every test use it; production
  * issuers replace it with a KMS-backed Signer, apps with a secure-element
  * DeviceSigner. Signs in message mode with low-s, raw 64-byte output —
- * exactly the Signer contract.
+ * exactly the DeviceSigner contract.
  */
-export declare class LocalP256Signer implements Signer, DeviceSigner {
+export declare class LocalP256Signer implements DeviceSigner {
     private readonly privateKey;
     constructor(privateKey: Uint8Array);
     static generate(): LocalP256Signer;

package/dist/crypto.js

@@ -7,18 +7,12 @@ exports.compressedPointToJwk = compressedPointToJwk;
 exports.jwkToCompressedPoint = jwkToCompressedPoint;
 exports.jwkThumbprint = jwkThumbprint;
 exports.verifyP256 = verifyP256;
-exports.createSdJwtSigner = createSdJwtSigner;
-exports.createSdJwtVerifier = createSdJwtVerifier;
-exports.sdJwtHasher = sdJwtHasher;
-exports.sdJwtSaltGenerator = sdJwtSaltGenerator;
 exports.randomUuid = randomUuid;
 const nist_js_1 = require("@noble/curves/nist.js");
 const sha2_1 = require("@noble/hashes/sha2");
 const utils_1 = require("@noble/hashes/utils");
 const identity_1 = require("@coordination-network/identity");
 Object.defineProperty(exports, "bytesToBase64url", { enumerable: true, get: function () { return identity_1.bytesToBase64url; } });
-/** Bridges the KMS-shaped Signer interface, the noble primitives, and the callback shapes @sd-jwt expects. */
-const utf8 = (data) => new TextEncoder().encode(data);
 /**
  * Padding is optional under RFC 4648 §5 and some clients send it anyway (Python's
  * urlsafe_b64encode, Java's URL encoder), so JWK coordinates are stripped before the strict decode
@@ -78,30 +72,6 @@ function verifyP256(message, signature, publicKey) {
         return false;
     }
 }
-/** Bridges a Signer to the @sd-jwt signer callback (base64url over utf8 input). */
-function createSdJwtSigner(signer) {
-    return async (data) => (0, identity_1.bytesToBase64url)(await signer.sign(utf8(data)));
-}
-/** Builds the @sd-jwt verifier callback from a resolved issuer JWK. */
-function createSdJwtVerifier(jwk) {
-    const publicKey = jwkToPublicKeyBytes(jwk);
-    return (data, signature) => {
-        try {
-            return verifyP256(utf8(data), base64urlToBytes(signature), publicKey);
-        }
-        catch {
-            return false;
-        }
-    };
-}
-/** The sha-256 hasher the @sd-jwt config takes. */
-function sdJwtHasher(data) {
-    return (0, sha2_1.sha256)(typeof data === "string" ? data : new Uint8Array(data));
-}
-/** Hex salts for disclosure digests. */
-function sdJwtSaltGenerator(length) {
-    return (0, utils_1.bytesToHex)((0, utils_1.randomBytes)(length));
-}
 /** RFC 4122 v4 UUID from CSPRNG bytes — node:crypto is unavailable under React Native. */
 function randomUuid() {
     const bytes = (0, utils_1.randomBytes)(16);
@@ -114,7 +84,7 @@ function randomUuid() {
  * Software P-256 signer. The issuer demo and every test use it; production
  * issuers replace it with a KMS-backed Signer, apps with a secure-element
  * DeviceSigner. Signs in message mode with low-s, raw 64-byte output —
- * exactly the Signer contract.
+ * exactly the DeviceSigner contract.
  */
 class LocalP256Signer {
     constructor(privateKey) {

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-export type IssuanceErrorCode = "INVALID_PARAMS" | "ISSUER_NOT_APPROVED" | "SUBJECT_MISMATCH" | "BINDING_INVALID" | "COMMITMENT_OWNERSHIP_INVALID";
+export type IssuanceErrorCode = "INVALID_PARAMS" | "ISSUER_NOT_APPROVED" | "SUBJECT_MISMATCH" | "BINDING_INVALID" | "HOLDER_KEY_OWNERSHIP_INVALID" | "COMMITMENT_OWNERSHIP_INVALID";
 export declare class IssuanceError extends Error {
     readonly code: IssuanceErrorCode;
     constructor(code: IssuanceErrorCode, message: string);

package/dist/holder-ownership.d.ts

@@ -0,0 +1,12 @@
+import type { EddsaPublicKey, EddsaSignature } from "./types";
+/** Proves possession of the holder identity key bound into a credential request. */
+export declare function signHolderKeyOwnership(identitySeed: Uint8Array, nonce: Uint8Array): {
+    publicKey: EddsaPublicKey;
+    signature: EddsaSignature;
+};
+/** Verifies that the requestor controls the supplied Baby Jubjub holder public key. */
+export declare function verifyHolderKeyOwnership(params: {
+    publicKey: EddsaPublicKey;
+    signature: EddsaSignature;
+    nonce: Uint8Array;
+}): boolean;

package/dist/holder-ownership.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signHolderKeyOwnership = signHolderKeyOwnership;
+exports.verifyHolderKeyOwnership = verifyHolderKeyOwnership;
+const identity_1 = require("@semaphore-protocol/identity");
+const revocation_1 = require("./revocation");
+/** Proves possession of the holder identity key bound into a credential request. */
+function signHolderKeyOwnership(identitySeed, nonce) {
+    if (identitySeed.length !== 32)
+        throw new Error("identity seed must be 32 bytes");
+    const identity = new identity_1.Identity(identitySeed);
+    const signature = identity.signMessage((0, revocation_1.nonceToBigint)(nonce));
+    return {
+        publicKey: [identity.publicKey[0], identity.publicKey[1]],
+        signature: { R8: [signature.R8[0], signature.R8[1]], S: signature.S }
+    };
+}
+/** Verifies that the requestor controls the supplied Baby Jubjub holder public key. */
+function verifyHolderKeyOwnership(params) {
+    try {
+        return identity_1.Identity.verifySignature((0, revocation_1.nonceToBigint)(params.nonce), params.signature, params.publicKey);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/index.d.ts

@@ -11,9 +11,5 @@ export * from "./zk-proof";
 export * from "./resolver";
 export * from "./registry-client";
 export * from "./crypto";
-export * from "./decode";
-export * from "./profile";
-export * from "./issue";
-export * from "./verify";
-export * from "./present";
 export * from "./revocation";
+export * from "./holder-ownership";

package/dist/index.js

@@ -27,9 +27,5 @@ __exportStar(require("./zk-proof"), exports);
 __exportStar(require("./resolver"), exports);
 __exportStar(require("./registry-client"), exports);
 __exportStar(require("./crypto"), exports);
-__exportStar(require("./decode"), exports);
-__exportStar(require("./profile"), exports);
-__exportStar(require("./issue"), exports);
-__exportStar(require("./verify"), exports);
-__exportStar(require("./present"), exports);
 __exportStar(require("./revocation"), exports);
+__exportStar(require("./holder-ownership"), exports);

package/dist/issue-credential.d.ts

@@ -1,4 +1,8 @@
 import { CredentialSigner } from "./credential-signer";
 import { ApprovalResolver } from "./resolver";
-import { ZkCredential, ZkCredentialIssueParams } from "./types";
+import { ZkCredential, ZkCredentialBody, ZkCredentialIssueParams } from "./types";
+/** Validates an issuance request without signing it. */
+export declare function validateZkCredentialIssue(params: ZkCredentialIssueParams, approval: ApprovalResolver): Promise<ZkCredentialBody>;
+/** Signs a request that has already passed {@link validateZkCredentialIssue}. */
+export declare function signValidatedZkCredential(body: ZkCredentialBody, signer: CredentialSigner): Promise<ZkCredential>;
 export declare function issueZkCredential(params: ZkCredentialIssueParams, signer: CredentialSigner, approval: ApprovalResolver): Promise<ZkCredential>;

package/dist/issue-credential.js

@@ -1,20 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateZkCredentialIssue = validateZkCredentialIssue;
+exports.signValidatedZkCredential = signValidatedZkCredential;
 exports.issueZkCredential = issueZkCredential;
 const identity_1 = require("@coordination-network/identity");
+const issuer_set_1 = require("@coordination-network/issuer-set");
 const utils_1 = require("@noble/hashes/utils");
 const identity_2 = require("@semaphore-protocol/identity");
 const credential_message_1 = require("./credential-message");
 const crypto_1 = require("./crypto");
 const errors_1 = require("./errors");
 const revocation_1 = require("./revocation");
-async function issueZkCredential(params, signer, approval) {
+const holder_ownership_1 = require("./holder-ownership");
+/** Validates an issuance request without signing it. */
+async function validateZkCredentialIssue(params, approval) {
     if (!(await approval.isApprovedNetworkMember(params.issuerNetworkId))) {
         throw new errors_1.IssuanceError("ISSUER_NOT_APPROVED", `issuer ${params.issuerNetworkId} is not an approved network member`);
     }
     if (!(params.validFrom < params.validUntil)) {
         throw new errors_1.IssuanceError("INVALID_PARAMS", "validFrom must be before validUntil");
     }
+    if (!(0, issuer_set_1.inPrimeOrderSubgroup)(params.identityPublicKey)) {
+        throw new errors_1.IssuanceError("INVALID_PARAMS", "identity public key is not in the prime-order subgroup");
+    }
     const holderKeyCommitment = identity_2.Identity.generateCommitment(params.identityPublicKey);
     const holderKeyCommitmentBytes = (0, utils_1.hexToBytes)(holderKeyCommitment.toString(16).padStart(64, "0"));
     let binding;
@@ -24,6 +32,7 @@ async function issueZkCredential(params, signer, approval) {
             accountPublicKey: params.accountPublicKey,
             confirmationKey: (0, crypto_1.jwkToPublicKeyBytes)(params.confirmationKey),
             holderKeyCommitment: holderKeyCommitmentBytes,
+            requestCommitment: (0, credential_message_1.issuanceRequestCommitment)(params.issuerNetworkId, params.approvalScope),
             accountSignature: params.accountPopSignature,
             deviceSignature: params.devicePopSignature
         });
@@ -40,6 +49,13 @@ async function issueZkCredential(params, signer, approval) {
     if (!binding.valid) {
         throw new errors_1.IssuanceError("BINDING_INVALID", "credential binding failed");
     }
+    if (!(0, holder_ownership_1.verifyHolderKeyOwnership)({
+        publicKey: params.identityPublicKey,
+        signature: params.identityOwnershipSignature,
+        nonce: params.nonce
+    })) {
+        throw new errors_1.IssuanceError("HOLDER_KEY_OWNERSHIP_INVALID", "holder key ownership proof failed");
+    }
     const ownershipOk = (0, revocation_1.verifyCommitmentOwnership)({
         commitment: params.revocation.commitment,
         publicKey: params.revocation.publicKey,
@@ -49,7 +65,7 @@ async function issueZkCredential(params, signer, approval) {
     if (!ownershipOk) {
         throw new errors_1.IssuanceError("COMMITMENT_OWNERSHIP_INVALID", "revocation commitment ownership proof failed");
     }
-    const body = {
+    return {
         programmeHash: (0, credential_message_1.programmeHash)(params.approvalScope.programme),
         countryCode: (0, credential_message_1.countryCode)(params.approvalScope.country),
         notBefore: params.validFrom,
@@ -58,9 +74,15 @@ async function issueZkCredential(params, signer, approval) {
         holderKeyCommitment,
         revocationCommitment: params.revocation.commitment
     };
+}
+/** Signs a request that has already passed {@link validateZkCredentialIssue}. */
+async function signValidatedZkCredential(body, signer) {
     return {
         body,
         issuerPublicKey: await signer.getPublicKey(),
         signature: await signer.sign((0, credential_message_1.zkCredentialCommitment)(body))
     };
 }
+async function issueZkCredential(params, signer, approval) {
+    return signValidatedZkCredential(await validateZkCredentialIssue(params, approval), signer);
+}

package/dist/revocation.d.ts

@@ -1,4 +1,5 @@
-import { EddsaPublicKey, EddsaSignature, StatusClaim } from "./types";
+import { EddsaPublicKey, EddsaSignature } from "./types";
+export declare function nonceToBigint(nonce: Uint8Array): bigint;
 /** Generates a fresh 32-byte revocation secret r. Device-side only. */
 export declare function generateRevocationSecret(): Uint8Array;
 /** commitment = new Identity(r).commitment (Semaphore V4). */
@@ -12,8 +13,10 @@ export declare function signCommitmentOwnership(r: Uint8Array, nonce: Uint8Array
     signature: EddsaSignature;
 };
 /**
- * Issuer-side check: verifies the EdDSA signature over the nonce, recomputes
- * the commitment from the public key, and compares it to the claimed one.
+ * Issuer-side check: requires a prime-order public key, verifies the EdDSA
+ * signature over the nonce, recomputes the commitment from the public key, and
+ * compares it to the claimed one. A low-order key is refused because its
+ * signatures need no secret.
  */
 export declare function verifyCommitmentOwnership(params: {
     commitment: bigint;
@@ -21,5 +24,3 @@ export declare function verifyCommitmentOwnership(params: {
     signature: EddsaSignature;
     nonce: Uint8Array;
 }): boolean;
-/** Builds the status.cn_zk_revocation claim for the signed body (spec 07). */
-export declare function buildStatusClaim(commitment: bigint, revocationRegistry: string): StatusClaim;

package/dist/revocation.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.nonceToBigint = nonceToBigint;
 exports.generateRevocationSecret = generateRevocationSecret;
 exports.deriveRevocationCommitment = deriveRevocationCommitment;
 exports.signCommitmentOwnership = signCommitmentOwnership;
 exports.verifyCommitmentOwnership = verifyCommitmentOwnership;
-exports.buildStatusClaim = buildStatusClaim;
+const issuer_set_1 = require("@coordination-network/issuer-set");
 const identity_1 = require("@semaphore-protocol/identity");
 const utils_1 = require("@noble/hashes/utils");
 /**
@@ -47,11 +48,16 @@ function signCommitmentOwnership(r, nonce) {
     };
 }
 /**
- * Issuer-side check: verifies the EdDSA signature over the nonce, recomputes
- * the commitment from the public key, and compares it to the claimed one.
+ * Issuer-side check: requires a prime-order public key, verifies the EdDSA
+ * signature over the nonce, recomputes the commitment from the public key, and
+ * compares it to the claimed one. A low-order key is refused because its
+ * signatures need no secret.
  */
 function verifyCommitmentOwnership(params) {
     try {
+        if (!(0, issuer_set_1.inPrimeOrderSubgroup)(params.publicKey)) {
+            return false;
+        }
         if (!identity_1.Identity.verifySignature(nonceToBigint(params.nonce), params.signature, params.publicKey)) {
             return false;
         }
@@ -61,12 +67,3 @@ function verifyCommitmentOwnership(params) {
         return false;
     }
 }
-/** Builds the status.cn_zk_revocation claim for the signed body (spec 07). */
-function buildStatusClaim(commitment, revocationRegistry) {
-    return {
-        cn_zk_revocation: {
-            revocationRegistry,
-            revocationCommitment: commitment.toString(10)
-        }
-    };
-}

package/dist/signer.d.ts

@@ -1,19 +1,8 @@
 import { Jwk } from "./types";
-/**
- * Issuer signing key, KMS-shaped. sign receives the JWS signing input in
- * message mode (the service applies SHA-256 itself, never a precomputed
- * digest) and returns the raw 64-byte r||s signature.
- */
-export interface Signer {
+/** Holder P-256 device key backed by a secure element in production. */
+export interface DeviceSigner {
     getPublicKeyJwk(): Promise<Jwk>;
     sign(message: Uint8Array): Promise<Uint8Array>;
-}
-/**
- * Holder P-256 device key: the secure element in the app, a software key in
- * tests. Same contract as Signer; a separate type because the two keys must
- * never be interchangeable in signatures.
- */
-export interface DeviceSigner extends Signer {
     /** Signs an already-computed 32-byte digest, without hashing it again. */
     signDigest(digest: Uint8Array): Promise<Uint8Array>;
 }

package/dist/types.d.ts

@@ -21,31 +21,6 @@ export interface EddsaSignature {
     R8: [bigint, bigint];
     S: bigint;
 }
-/**
- * The custom status member inside the signed body (spec 07). The commitment
- * is issuer-attested and visible to WS1 verifiers by design.
- */
-export interface StatusClaim {
-    cn_zk_revocation: {
-        /** urn:cn:contract: URN of the on-chain revocation registry. */
-        revocationRegistry: string;
-        revocationCommitment: string;
-    };
-}
-/** The reconstructed claim set of a verified credential. */
-export interface ApprovalCredentialClaims {
-    vct: string;
-    iss: string;
-    sub: string;
-    jti: string;
-    nbf: number;
-    exp: number;
-    cnf: {
-        jwk: Jwk;
-    };
-    status: StatusClaim;
-    approvalScope: ApprovalScope;
-}
 export interface IssuanceRequest {
     issuerNetworkId: Hex32;
     subjectNetworkId: Hex32;
@@ -63,11 +38,10 @@ export interface IssuanceRequest {
         ownershipSignature: EddsaSignature;
     };
 }
-export interface SdJwtIssueParams extends IssuanceRequest {
-    revocationRegistry: string;
-}
 export interface ZkCredentialIssueParams extends IssuanceRequest {
     identityPublicKey: EddsaPublicKey;
+    /** Signature over the issuer challenge proving control of `identityPublicKey`. */
+    identityOwnershipSignature: EddsaSignature;
 }
 export interface ZkCredentialBody {
     programmeHash: bigint;
@@ -99,13 +73,3 @@ export interface SerializedZkCredential {
         S: string;
     };
 }
-export type VerifyErrorCode = "MALFORMED" | "ISSUER_NOT_APPROVED" | "KEY_NOT_FOUND" | "PROOF_INVALID" | "EXPIRED" | "NOT_YET_VALID" | "REVOKED";
-/** Checks run in spec order (07, verification flow) and the first failure wins. */
-export type VerifyResult = {
-    ok: true;
-    claims: ApprovalCredentialClaims;
-} | {
-    ok: false;
-    code: VerifyErrorCode;
-    message: string;
-};

package/dist/zk-proof.d.ts

@@ -12,6 +12,12 @@ export interface ExpectedZkPresentation {
     programme: string;
     country: string;
 }
+/**
+ * `approvedIssuerRoot` and `revocationRoot` are the proof's public outputs and are
+ * not checked here. Check them against the registries before accepting the presentation:
+ * the issuer root against the approved-issuer set, the revocation root with the revocation
+ * registry's `isValidRoot`.
+ */
 export type ZkPresentationVerifyResult = {
     ok: true;
     approvedIssuerRoot: bigint;
@@ -41,5 +47,9 @@ export declare class ZkCredentialProofSystem {
     destroy(): Promise<void>;
 }
 export declare function generateZkPresentationProof(circuit: CompiledCircuit, inputs: ZkPresentationInputs, options?: ZkProofSystemOptions): Promise<ZkPresentationProof>;
+/**
+ * Verifies a presentation proof against the expected public inputs and returns the roots
+ * from the proof. Check those roots against the registries; see {@link ZkPresentationVerifyResult}.
+ */
 export declare function verifyZkPresentationProof(circuit: CompiledCircuit, proof: ZkPresentationProof, expected: ExpectedZkPresentation, options?: ZkProofSystemOptions): Promise<ZkPresentationVerifyResult>;
 export {};

package/dist/zk-proof.js

@@ -77,9 +77,16 @@ class ZkCredentialProofSystem {
         return new ZkCredentialProofSystem(new Noir(circuit), new UltraHonkBackend(circuit.bytecode, api), api, options.proof);
     }
     async generateProof(inputs) {
-        const { witness } = await this.noir.execute(inputs);
-        const proof = await this.backend.generateProof(witness, this.proofOptions);
-        return { proof: proof.proof, publicInputs: [...proof.publicInputs] };
+        try {
+            const { witness } = await this.noir.execute(inputs);
+            const proof = await this.backend.generateProof(witness, this.proofOptions);
+            return { proof: proof.proof, publicInputs: [...proof.publicInputs] };
+        }
+        catch {
+            // The circuit's assertion text distinguishes "not yet valid" from "expired".
+            // Both outcomes must be indistinguishable to the verifier that chose currentTime.
+            throw new Error("presentation proof failed");
+        }
     }
     async verifyProof(proof, expected) {
         const mismatch = publicInputMismatch(proof, expected);
@@ -119,6 +126,10 @@ async function generateZkPresentationProof(circuit, inputs, options = {}) {
         await proofSystem.destroy();
     }
 }
+/**
+ * Verifies a presentation proof against the expected public inputs and returns the roots
+ * from the proof. Check those roots against the registries; see {@link ZkPresentationVerifyResult}.
+ */
 async function verifyZkPresentationProof(circuit, proof, expected, options = {}) {
     const proofSystem = await ZkCredentialProofSystem.create(circuit, options);
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coordination-network/credential",
-  "version": "0.0.1",
+  "version": "0.1.0",
   "description": "Verifiable credential SDK for the coordination network: issuance, verification, holder binding and revocation helpers.",
   "license": "MIT",
   "repository": {
@@ -30,25 +30,22 @@
     "test": "jest"
   },
   "devDependencies": {
-    "@coordination-network/zk-artifacts": "^0.0.1",
-    "@sd-jwt/core": "^0.19.0",
-    "@sd-jwt/types": "^0.19.0",
+    "@coordination-network/zk-artifacts": "^0.1.0",
     "@types/jest": "^30.0.0",
     "@types/node": "^24.0.0",
+    "@zk-kit/baby-jubjub": "1.0.3",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11",
     "typescript": "^6.0.3"
   },
   "dependencies": {
     "@aztec/bb.js": "5.0.0",
-    "@coordination-network/identity": "^0.0.1",
-    "@coordination-network/issuer-set": "^0.0.1",
+    "@coordination-network/identity": "^0.1.0",
+    "@coordination-network/issuer-set": "^0.1.0",
     "@noble/curves": "^1.9.7",
     "@noble/hashes": "^1.8.0",
     "@noir-lang/noir_js": "1.0.0-beta.22",
-    "@sd-jwt/decode": "^0.19.0",
-    "@sd-jwt/sd-jwt-vc": "^0.19.0",
-    "@semaphore-protocol/identity": "^4.14.3",
+    "@semaphore-protocol/identity": "^4.14.4",
     "poseidon-lite": "0.3.0",
     "viem": "^2.55.11"
   }