@coordination-network/credential 0.0.1 → 0.1.0

package/src/credential-message.ts

@@ -2,13 +2,17 @@ import { Identity } from "@semaphore-protocol/identity"
 import { poseidon3 } from "poseidon-lite/poseidon3"
 import { poseidon4 } from "poseidon-lite/poseidon4"
 import { poseidon5 } from "poseidon-lite/poseidon5"
-import { keccak256, stringToHex } from "viem"
+import { concatHex, hexToBytes, keccak256, stringToHex, toHex } from "viem"
 import { bytesToHex } from "@noble/hashes/utils"
 import { jwkToPublicKeyBytes } from "./crypto"
-import { Jwk, SerializedZkCredential, ZkCredential, ZkCredentialBody } from "./types"
+import { ApprovalScope, Hex32, Jwk, SerializedZkCredential, ZkCredential, ZkCredentialBody } from "./types"
 
 // keccak256(utf8("urn:cn:credential:v1")) >> 8
 export const CREDENTIAL_DOMAIN = 363566488821926773809509531830640889725124777157045803797738936823559174026n
+export const ISSUANCE_REQUEST_DOMAIN = "urn:cn:issuance-request:v1"
+// Android Key Attestation challenge for the device signing key, as UTF-8 bytes. Fixed because the key is
+// attested once, at generation; the device signature over the issuer nonce supplies freshness.
+export const DEVICE_ATTESTATION_CHALLENGE = "urn:cn:device-attestation:v1"
 export const DEVICE_KEY_DOMAIN = 320507632879070882430325612169297945123468706597652794395401074724051126576n
 const FIELD_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n
 export function stringToField(value: string): bigint {
@@ -25,6 +29,22 @@ export function countryCode(country: string): number {
     return [...country].reduce((value, character) => (value << 8) | character.charCodeAt(0), 0)
 }
 
+/** What the device signature commits to besides the holder key: the issuer and the scope shown at consent. */
+export function issuanceRequestCommitment(issuerNetworkId: Hex32, approvalScope: ApprovalScope): Uint8Array {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(issuerNetworkId)) throw new Error("issuerNetworkId must be 32 bytes")
+
+    return hexToBytes(
+        keccak256(
+            concatHex([
+                stringToHex(ISSUANCE_REQUEST_DOMAIN),
+                issuerNetworkId,
+                toHex(programmeHash(approvalScope.programme), { size: 32 }),
+                toHex(countryCode(approvalScope.country), { size: 32 })
+            ])
+        )
+    )
+}
+
 const bytesToBigint = (value: Uint8Array): bigint => BigInt(`0x${bytesToHex(value)}`)
 
 export function deriveDeviceKeyCommitment(publicKey: Jwk): bigint {

package/src/crypto.ts

@@ -3,11 +3,7 @@ import { sha256 } from "@noble/hashes/sha2"
 import { bytesToHex, randomBytes } from "@noble/hashes/utils"
 import { base64urlToBytes as strictBase64urlToBytes, bytesToBase64url } from "@coordination-network/identity"
 import { Jwk } from "./types"
-import { DeviceSigner, Signer } from "./signer"
-
-/** Bridges the KMS-shaped Signer interface, the noble primitives, and the callback shapes @sd-jwt expects. */
-
-const utf8 = (data: string): Uint8Array => new TextEncoder().encode(data)
+import { DeviceSigner } from "./signer"
 
 export { bytesToBase64url }
 
@@ -74,33 +70,6 @@ export function verifyP256(message: Uint8Array, signature: Uint8Array, publicKey
     }
 }
 
-/** Bridges a Signer to the @sd-jwt signer callback (base64url over utf8 input). */
-export function createSdJwtSigner(signer: Signer): (data: string) => Promise<string> {
-    return async (data: string) => bytesToBase64url(await signer.sign(utf8(data)))
-}
-
-/** Builds the @sd-jwt verifier callback from a resolved issuer JWK. */
-export function createSdJwtVerifier(jwk: Jwk): (data: string, signature: string) => boolean {
-    const publicKey = jwkToPublicKeyBytes(jwk)
-    return (data: string, signature: string) => {
-        try {
-            return verifyP256(utf8(data), base64urlToBytes(signature), publicKey)
-        } catch {
-            return false
-        }
-    }
-}
-
-/** The sha-256 hasher the @sd-jwt config takes. */
-export function sdJwtHasher(data: string | ArrayBuffer): Uint8Array {
-    return sha256(typeof data === "string" ? data : new Uint8Array(data))
-}
-
-/** Hex salts for disclosure digests. */
-export function sdJwtSaltGenerator(length: number): string {
-    return bytesToHex(randomBytes(length))
-}
-
 /** RFC 4122 v4 UUID from CSPRNG bytes — node:crypto is unavailable under React Native. */
 export function randomUuid(): string {
     const bytes = randomBytes(16)
@@ -115,9 +84,9 @@ export function randomUuid(): string {
  * Software P-256 signer. The issuer demo and every test use it; production
  * issuers replace it with a KMS-backed Signer, apps with a secure-element
  * DeviceSigner. Signs in message mode with low-s, raw 64-byte output —
- * exactly the Signer contract.
+ * exactly the DeviceSigner contract.
  */
-export class LocalP256Signer implements Signer, DeviceSigner {
+export class LocalP256Signer implements DeviceSigner {
     private readonly privateKey: Uint8Array
 
     constructor(privateKey: Uint8Array) {

package/src/errors.ts

@@ -1,5 +1,10 @@
 export type IssuanceErrorCode =
-    "INVALID_PARAMS" | "ISSUER_NOT_APPROVED" | "SUBJECT_MISMATCH" | "BINDING_INVALID" | "COMMITMENT_OWNERSHIP_INVALID"
+    | "INVALID_PARAMS"
+    | "ISSUER_NOT_APPROVED"
+    | "SUBJECT_MISMATCH"
+    | "BINDING_INVALID"
+    | "HOLDER_KEY_OWNERSHIP_INVALID"
+    | "COMMITMENT_OWNERSHIP_INVALID"
 
 export class IssuanceError extends Error {
     readonly code: IssuanceErrorCode

package/src/holder-ownership.ts

@@ -0,0 +1,30 @@
+import { Identity } from "@semaphore-protocol/identity"
+import { nonceToBigint } from "./revocation"
+import type { EddsaPublicKey, EddsaSignature } from "./types"
+
+/** Proves possession of the holder identity key bound into a credential request. */
+export function signHolderKeyOwnership(
+    identitySeed: Uint8Array,
+    nonce: Uint8Array
+): { publicKey: EddsaPublicKey; signature: EddsaSignature } {
+    if (identitySeed.length !== 32) throw new Error("identity seed must be 32 bytes")
+    const identity = new Identity(identitySeed)
+    const signature = identity.signMessage(nonceToBigint(nonce))
+    return {
+        publicKey: [identity.publicKey[0], identity.publicKey[1]],
+        signature: { R8: [signature.R8[0], signature.R8[1]], S: signature.S }
+    }
+}
+
+/** Verifies that the requestor controls the supplied Baby Jubjub holder public key. */
+export function verifyHolderKeyOwnership(params: {
+    publicKey: EddsaPublicKey
+    signature: EddsaSignature
+    nonce: Uint8Array
+}): boolean {
+    try {
+        return Identity.verifySignature(nonceToBigint(params.nonce), params.signature, params.publicKey)
+    } catch {
+        return false
+    }
+}

package/src/index.ts

@@ -11,9 +11,5 @@ export * from "./zk-proof"
 export * from "./resolver"
 export * from "./registry-client"
 export * from "./crypto"
-export * from "./decode"
-export * from "./profile"
-export * from "./issue"
-export * from "./verify"
-export * from "./present"
 export * from "./revocation"
+export * from "./holder-ownership"

package/src/issue-credential.ts

@@ -1,19 +1,27 @@
 import { InvalidBindingInputError, verifyCredentialBinding } from "@coordination-network/identity"
+import { inPrimeOrderSubgroup } from "@coordination-network/issuer-set"
 import { hexToBytes } from "@noble/hashes/utils"
 import { Identity } from "@semaphore-protocol/identity"
 import { CredentialSigner } from "./credential-signer"
-import { countryCode, deriveDeviceKeyCommitment, programmeHash, zkCredentialCommitment } from "./credential-message"
+import {
+    countryCode,
+    deriveDeviceKeyCommitment,
+    issuanceRequestCommitment,
+    programmeHash,
+    zkCredentialCommitment
+} from "./credential-message"
 import { jwkToPublicKeyBytes } from "./crypto"
 import { IssuanceError } from "./errors"
 import { ApprovalResolver } from "./resolver"
 import { verifyCommitmentOwnership } from "./revocation"
-import { ZkCredential, ZkCredentialIssueParams } from "./types"
+import { verifyHolderKeyOwnership } from "./holder-ownership"
+import { ZkCredential, ZkCredentialBody, ZkCredentialIssueParams } from "./types"
 
-export async function issueZkCredential(
+/** Validates an issuance request without signing it. */
+export async function validateZkCredentialIssue(
     params: ZkCredentialIssueParams,
-    signer: CredentialSigner,
     approval: ApprovalResolver
-): Promise<ZkCredential> {
+): Promise<ZkCredentialBody> {
     if (!(await approval.isApprovedNetworkMember(params.issuerNetworkId))) {
         throw new IssuanceError(
             "ISSUER_NOT_APPROVED",
@@ -24,6 +32,10 @@ export async function issueZkCredential(
         throw new IssuanceError("INVALID_PARAMS", "validFrom must be before validUntil")
     }
 
+    if (!inPrimeOrderSubgroup(params.identityPublicKey)) {
+        throw new IssuanceError("INVALID_PARAMS", "identity public key is not in the prime-order subgroup")
+    }
+
     const holderKeyCommitment = Identity.generateCommitment(params.identityPublicKey)
     const holderKeyCommitmentBytes = hexToBytes(holderKeyCommitment.toString(16).padStart(64, "0"))
     let binding: ReturnType<typeof verifyCredentialBinding>
@@ -33,6 +45,7 @@ export async function issueZkCredential(
             accountPublicKey: params.accountPublicKey,
             confirmationKey: jwkToPublicKeyBytes(params.confirmationKey),
             holderKeyCommitment: holderKeyCommitmentBytes,
+            requestCommitment: issuanceRequestCommitment(params.issuerNetworkId, params.approvalScope),
             accountSignature: params.accountPopSignature,
             deviceSignature: params.devicePopSignature
         })
@@ -50,6 +63,16 @@ export async function issueZkCredential(
         throw new IssuanceError("BINDING_INVALID", "credential binding failed")
     }
 
+    if (
+        !verifyHolderKeyOwnership({
+            publicKey: params.identityPublicKey,
+            signature: params.identityOwnershipSignature,
+            nonce: params.nonce
+        })
+    ) {
+        throw new IssuanceError("HOLDER_KEY_OWNERSHIP_INVALID", "holder key ownership proof failed")
+    }
+
     const ownershipOk = verifyCommitmentOwnership({
         commitment: params.revocation.commitment,
         publicKey: params.revocation.publicKey,
@@ -60,7 +83,7 @@ export async function issueZkCredential(
         throw new IssuanceError("COMMITMENT_OWNERSHIP_INVALID", "revocation commitment ownership proof failed")
     }
 
-    const body = {
+    return {
         programmeHash: programmeHash(params.approvalScope.programme),
         countryCode: countryCode(params.approvalScope.country),
         notBefore: params.validFrom,
@@ -69,10 +92,24 @@ export async function issueZkCredential(
         holderKeyCommitment,
         revocationCommitment: params.revocation.commitment
     }
+}
 
+/** Signs a request that has already passed {@link validateZkCredentialIssue}. */
+export async function signValidatedZkCredential(
+    body: ZkCredentialBody,
+    signer: CredentialSigner
+): Promise<ZkCredential> {
     return {
         body,
         issuerPublicKey: await signer.getPublicKey(),
         signature: await signer.sign(zkCredentialCommitment(body))
     }
 }
+
+export async function issueZkCredential(
+    params: ZkCredentialIssueParams,
+    signer: CredentialSigner,
+    approval: ApprovalResolver
+): Promise<ZkCredential> {
+    return signValidatedZkCredential(await validateZkCredentialIssue(params, approval), signer)
+}

package/src/revocation.ts

@@ -1,6 +1,7 @@
+import { inPrimeOrderSubgroup } from "@coordination-network/issuer-set"
 import { Identity } from "@semaphore-protocol/identity"
 import { bytesToHex, randomBytes } from "@noble/hashes/utils"
-import { EddsaPublicKey, EddsaSignature, StatusClaim } from "./types"
+import { EddsaPublicKey, EddsaSignature } from "./types"
 
 /**
  * Device-side revocation material (spec 08). r is 32 random bytes, generated
@@ -15,7 +16,7 @@ function assertSecret(r: Uint8Array): void {
     }
 }
 
-function nonceToBigint(nonce: Uint8Array): bigint {
+export function nonceToBigint(nonce: Uint8Array): bigint {
     if (nonce.length === 0) {
         throw new Error("nonce must not be empty")
     }
@@ -51,8 +52,10 @@ export function signCommitmentOwnership(
 }
 
 /**
- * Issuer-side check: verifies the EdDSA signature over the nonce, recomputes
- * the commitment from the public key, and compares it to the claimed one.
+ * Issuer-side check: requires a prime-order public key, verifies the EdDSA
+ * signature over the nonce, recomputes the commitment from the public key, and
+ * compares it to the claimed one. A low-order key is refused because its
+ * signatures need no secret.
  */
 export function verifyCommitmentOwnership(params: {
     commitment: bigint
@@ -61,6 +64,9 @@ export function verifyCommitmentOwnership(params: {
     nonce: Uint8Array
 }): boolean {
     try {
+        if (!inPrimeOrderSubgroup(params.publicKey)) {
+            return false
+        }
         if (!Identity.verifySignature(nonceToBigint(params.nonce), params.signature, params.publicKey)) {
             return false
         }
@@ -69,13 +75,3 @@ export function verifyCommitmentOwnership(params: {
         return false
     }
 }
-
-/** Builds the status.cn_zk_revocation claim for the signed body (spec 07). */
-export function buildStatusClaim(commitment: bigint, revocationRegistry: string): StatusClaim {
-    return {
-        cn_zk_revocation: {
-            revocationRegistry,
-            revocationCommitment: commitment.toString(10)
-        }
-    }
-}

package/src/signer.ts

@@ -1,21 +1,9 @@
 import { Jwk } from "./types"
 
-/**
- * Issuer signing key, KMS-shaped. sign receives the JWS signing input in
- * message mode (the service applies SHA-256 itself, never a precomputed
- * digest) and returns the raw 64-byte r||s signature.
- */
-export interface Signer {
+/** Holder P-256 device key backed by a secure element in production. */
+export interface DeviceSigner {
     getPublicKeyJwk(): Promise<Jwk>
     sign(message: Uint8Array): Promise<Uint8Array>
-}
-
-/**
- * Holder P-256 device key: the secure element in the app, a software key in
- * tests. Same contract as Signer; a separate type because the two keys must
- * never be interchangeable in signatures.
- */
-export interface DeviceSigner extends Signer {
     /** Signs an already-computed 32-byte digest, without hashing it again. */
     signDigest(digest: Uint8Array): Promise<Uint8Array>
 }

package/src/types.ts

@@ -27,31 +27,6 @@ export interface EddsaSignature {
     S: bigint
 }
 
-/**
- * The custom status member inside the signed body (spec 07). The commitment
- * is issuer-attested and visible to WS1 verifiers by design.
- */
-export interface StatusClaim {
-    cn_zk_revocation: {
-        /** urn:cn:contract: URN of the on-chain revocation registry. */
-        revocationRegistry: string
-        revocationCommitment: string
-    }
-}
-
-/** The reconstructed claim set of a verified credential. */
-export interface ApprovalCredentialClaims {
-    vct: string
-    iss: string
-    sub: string
-    jti: string
-    nbf: number
-    exp: number
-    cnf: { jwk: Jwk }
-    status: StatusClaim
-    approvalScope: ApprovalScope
-}
-
 export interface IssuanceRequest {
     issuerNetworkId: Hex32
     subjectNetworkId: Hex32
@@ -70,12 +45,10 @@ export interface IssuanceRequest {
     }
 }
 
-export interface SdJwtIssueParams extends IssuanceRequest {
-    revocationRegistry: string
-}
-
 export interface ZkCredentialIssueParams extends IssuanceRequest {
     identityPublicKey: EddsaPublicKey
+    /** Signature over the issuer challenge proving control of `identityPublicKey`. */
+    identityOwnershipSignature: EddsaSignature
 }
 
 export interface ZkCredentialBody {
@@ -107,10 +80,3 @@ export interface SerializedZkCredential {
     issuerPublicKey: [string, string]
     signature: { R8: [string, string]; S: string }
 }
-
-export type VerifyErrorCode =
-    "MALFORMED" | "ISSUER_NOT_APPROVED" | "KEY_NOT_FOUND" | "PROOF_INVALID" | "EXPIRED" | "NOT_YET_VALID" | "REVOKED"
-
-/** Checks run in spec order (07, verification flow) and the first failure wins. */
-export type VerifyResult =
-    { ok: true; claims: ApprovalCredentialClaims } | { ok: false; code: VerifyErrorCode; message: string }

package/src/zk-proof.ts

@@ -25,6 +25,12 @@ export interface ExpectedZkPresentation {
     country: string
 }
 
+/**
+ * `approvedIssuerRoot` and `revocationRoot` are the proof's public outputs and are
+ * not checked here. Check them against the registries before accepting the presentation:
+ * the issuer root against the approved-issuer set, the revocation root with the revocation
+ * registry's `isValidRoot`.
+ */
 export type ZkPresentationVerifyResult =
     | { ok: true; approvedIssuerRoot: bigint; revocationRoot: bigint }
     | { ok: false; code: "PUBLIC_INPUT_MISMATCH"; publicInput?: PublicInputName }
@@ -134,9 +140,15 @@ export class ZkCredentialProofSystem {
     }
 
     async generateProof(inputs: ZkPresentationInputs): Promise<ZkPresentationProof> {
-        const { witness } = await this.noir.execute(inputs as unknown as InputMap)
-        const proof = await this.backend.generateProof(witness, this.proofOptions)
-        return { proof: proof.proof, publicInputs: [...proof.publicInputs] }
+        try {
+            const { witness } = await this.noir.execute(inputs as unknown as InputMap)
+            const proof = await this.backend.generateProof(witness, this.proofOptions)
+            return { proof: proof.proof, publicInputs: [...proof.publicInputs] }
+        } catch {
+            // The circuit's assertion text distinguishes "not yet valid" from "expired".
+            // Both outcomes must be indistinguishable to the verifier that chose currentTime.
+            throw new Error("presentation proof failed")
+        }
     }
 
     async verifyProof(
@@ -183,6 +195,10 @@ export async function generateZkPresentationProof(
     }
 }
 
+/**
+ * Verifies a presentation proof against the expected public inputs and returns the roots
+ * from the proof. Check those roots against the registries; see {@link ZkPresentationVerifyResult}.
+ */
 export async function verifyZkPresentationProof(
     circuit: CompiledCircuit,
     proof: ZkPresentationProof,

package/dist/decode.d.ts

@@ -1,8 +0,0 @@
-import { ApprovalCredentialClaims } from "./types";
-/**
- * Decodes a compact SD-JWT and reconstructs the full claim set from its
- * disclosures WITHOUT verifying the signature — for callers that already
- * trust the token, such as the issuer reading back a token it just signed.
- * Untrusted tokens go through verifyCredential/verifyPresentation instead.
- */
-export declare function decodeSdJwtCredentialClaims(token: string): ApprovalCredentialClaims;

package/dist/decode.js

@@ -1,27 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.decodeSdJwtCredentialClaims = decodeSdJwtCredentialClaims;
-const decode_1 = require("@sd-jwt/decode");
-const crypto_1 = require("./crypto");
-const profile_1 = require("./profile");
-/**
- * Decodes a compact SD-JWT and reconstructs the full claim set from its
- * disclosures WITHOUT verifying the signature — for callers that already
- * trust the token, such as the issuer reading back a token it just signed.
- * Untrusted tokens go through verifyCredential/verifyPresentation instead.
- */
-function decodeSdJwtCredentialClaims(token) {
-    let reconstructed;
-    try {
-        const decoded = (0, decode_1.decodeSdJwtSync)(token, crypto_1.sdJwtHasher);
-        reconstructed = (0, decode_1.getClaimsSync)(decoded.jwt.payload, decoded.disclosures, crypto_1.sdJwtHasher);
-    }
-    catch {
-        throw new Error("token is not a decodable SD-JWT");
-    }
-    const checked = (0, profile_1.validateClaims)(reconstructed);
-    if (!checked.ok) {
-        throw new Error(checked.message);
-    }
-    return checked.claims;
-}

package/dist/issue.d.ts

@@ -1,9 +0,0 @@
-import { ApprovalResolver } from "./resolver";
-import { Signer } from "./signer";
-import { SdJwtIssueParams } from "./types";
-/**
- * Issues the delegated user approval credential (spec 07, issuance flow).
- * Throws IssuanceError, without signing anything, if the issuer isn't
- * approved or any challenge signature fails.
- */
-export declare function issueSdJwtCredential(params: SdJwtIssueParams, signer: Signer, approval: ApprovalResolver): Promise<string>;

package/dist/issue.js

@@ -1,65 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.issueSdJwtCredential = issueSdJwtCredential;
-const sd_jwt_vc_1 = require("@sd-jwt/sd-jwt-vc");
-const identity_1 = require("@coordination-network/identity");
-const crypto_1 = require("./crypto");
-const errors_1 = require("./errors");
-const profile_1 = require("./profile");
-const revocation_1 = require("./revocation");
-/**
- * Issues the delegated user approval credential (spec 07, issuance flow).
- * Throws IssuanceError, without signing anything, if the issuer isn't
- * approved or any challenge signature fails.
- */
-async function issueSdJwtCredential(params, signer, approval) {
-    if (!(await approval.isApprovedNetworkMember(params.issuerNetworkId))) {
-        throw new errors_1.IssuanceError("ISSUER_NOT_APPROVED", `issuer ${params.issuerNetworkId} is not an approved network member`);
-    }
-    if (!(params.validFrom < params.validUntil)) {
-        throw new errors_1.IssuanceError("INVALID_PARAMS", "validFrom must be before validUntil");
-    }
-    let binding;
-    try {
-        binding = (0, identity_1.verifyCredentialBinding)({
-            nonce: params.nonce,
-            accountPublicKey: params.accountPublicKey,
-            confirmationKey: (0, crypto_1.jwkToPublicKeyBytes)(params.confirmationKey),
-            accountSignature: params.accountPopSignature,
-            deviceSignature: params.devicePopSignature
-        });
-    }
-    catch (error) {
-        if (error instanceof identity_1.InvalidBindingInputError) {
-            throw new errors_1.IssuanceError("INVALID_PARAMS", `malformed binding input: ${error.message}`);
-        }
-        throw error;
-    }
-    if (binding.networkId !== params.subjectNetworkId.toLowerCase()) {
-        throw new errors_1.IssuanceError("SUBJECT_MISMATCH", "subjectNetworkId does not match the account public key");
-    }
-    if (!binding.valid) {
-        throw new errors_1.IssuanceError("BINDING_INVALID", "credential binding failed");
-    }
-    const ownershipOk = (0, revocation_1.verifyCommitmentOwnership)({
-        commitment: params.revocation.commitment,
-        publicKey: params.revocation.publicKey,
-        signature: params.revocation.ownershipSignature,
-        nonce: params.nonce
-    });
-    if (!ownershipOk) {
-        throw new errors_1.IssuanceError("COMMITMENT_OWNERSHIP_INVALID", "revocation commitment ownership proof failed");
-    }
-    const payload = (0, profile_1.buildPayload)({ ...params, subjectNetworkId: binding.networkId }, `urn:uuid:${(0, crypto_1.randomUuid)()}`);
-    const sdjwt = new sd_jwt_vc_1.SDJwtVcInstance({
-        signer: (0, crypto_1.createSdJwtSigner)(signer),
-        signAlg: "ES256",
-        hasher: crypto_1.sdJwtHasher,
-        hashAlg: "sha-256",
-        saltGenerator: crypto_1.sdJwtSaltGenerator
-    });
-    // Cast: the library types `status` as its own status-list reference, but
-    // our custom cn_zk_revocation member is deliberate (spec 07) and the
-    // status-list fetcher only triggers on status.status_list.
-    return sdjwt.issue({ ...payload }, profile_1.DISCLOSURE_FRAME);
-}

package/dist/present.d.ts

@@ -1,32 +0,0 @@
-import { Resolver } from "./resolver";
-import { DeviceSigner } from "./signer";
-import { VerifyResult } from "./types";
-export interface PresentOptions {
-    /** Verifier URN, pinned as the KB-JWT audience. */
-    audience: string;
-    /** Verifier-issued nonce, echoed in the KB-JWT. */
-    nonce: string;
-    /** Which approvalScope members to disclose. Both when omitted. */
-    disclose?: ("programme" | "country")[];
-}
-export interface VerifyPresentationOptions {
-    /** The verifier's own URN; the KB-JWT audience must match it. */
-    audience: string;
-    /** The nonce this verifier handed out; must be fresh and match. */
-    nonce: string;
-    /** Verification time, unix seconds. Defaults to now. */
-    currentDate?: number;
-}
-/**
- * Builds a presentation from a stored credential: the JWS, the selected
- * disclosures, and a KB-JWT signed by the device key binding the verifier's
- * audience, the nonce and the sd_hash of the exact presented token (spec 07,
- * verification flow step 7).
- */
-export declare function presentSdJwtCredential(token: string, deviceSigner: DeviceSigner, options: PresentOptions): Promise<string>;
-/**
- * Verifies a presentation: the full verifyCredential pipeline, plus the
- * KB-JWT under the credential's cnf.jwk with nonce, sd_hash (both checked by
- * the library) and audience (checked here) pinned.
- */
-export declare function verifySdJwtPresentation(presentation: string, resolver: Resolver, options: VerifyPresentationOptions): Promise<VerifyResult>;

package/dist/present.js

@@ -1,73 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.presentSdJwtCredential = presentSdJwtCredential;
-exports.verifySdJwtPresentation = verifySdJwtPresentation;
-const sd_jwt_vc_1 = require("@sd-jwt/sd-jwt-vc");
-const crypto_1 = require("./crypto");
-const verify_1 = require("./verify");
-/**
- * Builds a presentation from a stored credential: the JWS, the selected
- * disclosures, and a KB-JWT signed by the device key binding the verifier's
- * audience, the nonce and the sd_hash of the exact presented token (spec 07,
- * verification flow step 7).
- */
-async function presentSdJwtCredential(token, deviceSigner, options) {
-    const disclose = options.disclose ?? ["programme", "country"];
-    const frame = { approvalScope: Object.fromEntries(disclose.map((member) => [member, true])) };
-    const sdjwt = new sd_jwt_vc_1.SDJwtVcInstance({
-        hasher: crypto_1.sdJwtHasher,
-        hashAlg: "sha-256",
-        saltGenerator: crypto_1.sdJwtSaltGenerator,
-        kbSigner: (0, crypto_1.createSdJwtSigner)(deviceSigner),
-        kbSignAlg: "ES256"
-    });
-    return sdjwt.present(token, frame, {
-        kb: {
-            payload: {
-                aud: options.audience,
-                nonce: options.nonce,
-                iat: Math.floor(Date.now() / 1000)
-            }
-        }
-    });
-}
-/**
- * Verifies a presentation: the full verifyCredential pipeline, plus the
- * KB-JWT under the credential's cnf.jwk with nonce, sd_hash (both checked by
- * the library) and audience (checked here) pinned.
- */
-async function verifySdJwtPresentation(presentation, resolver, options) {
-    const now = options.currentDate ?? Math.floor(Date.now() / 1000);
-    let audience;
-    const { result } = await (0, verify_1.runPipeline)(presentation, resolver, now, async (issuerJwk, clampedNow) => {
-        const sdjwt = new sd_jwt_vc_1.SDJwtVcInstance({
-            verifier: (0, crypto_1.createSdJwtVerifier)(issuerJwk),
-            hasher: crypto_1.sdJwtHasher,
-            hashAlg: "sha-256",
-            kbVerifier: (data, signature, payload) => {
-                const cnfJwk = payload.cnf?.jwk;
-                if (!cnfJwk)
-                    return false;
-                try {
-                    return (0, crypto_1.createSdJwtVerifier)(cnfJwk)(data, signature);
-                }
-                catch {
-                    return false;
-                }
-            }
-        });
-        const { payload, kb } = await sdjwt.verify(presentation, {
-            currentDate: clampedNow,
-            keyBindingNonce: options.nonce
-        });
-        audience = kb?.payload.aud;
-        return payload;
-    });
-    if (!result.ok) {
-        return result;
-    }
-    if (audience !== options.audience) {
-        return { ok: false, code: "PROOF_INVALID", message: "KB-JWT audience does not match this verifier" };
-    }
-    return result;
-}