@coordination-network/credential 0.0.1

package/dist/zk-proof.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ZkCredentialProofSystem = exports.assertZkCredentialCircuitAbi = void 0;
+exports.generateZkPresentationProof = generateZkPresentationProof;
+exports.verifyZkPresentationProof = verifyZkPresentationProof;
+const credential_message_1 = require("./credential-message");
+const presentation_inputs_1 = require("./presentation-inputs");
+const PUBLIC_INPUT_NAMES = [
+    "current_time",
+    "challenge",
+    "audience",
+    "required_programme_hash",
+    "required_country_code"
+];
+const publicParameterNames = (circuit) => circuit.abi.parameters.filter((parameter) => parameter.visibility === "public").map((parameter) => parameter.name);
+const assertZkCredentialCircuitAbi = (circuit) => {
+    const actual = publicParameterNames(circuit);
+    if (actual.length !== PUBLIC_INPUT_NAMES.length ||
+        actual.some((name, index) => name !== PUBLIC_INPUT_NAMES[index])) {
+        throw new Error(`unexpected credential circuit public inputs: ${actual.join(", ")}`);
+    }
+    const returnType = circuit.abi.return_type;
+    if (returnType === null ||
+        returnType.visibility !== "public" ||
+        returnType.abi_type.kind !== "tuple" ||
+        returnType.abi_type.fields.length !== 2 ||
+        returnType.abi_type.fields.some((field) => field.kind !== "field")) {
+        throw new Error("credential circuit must return the proven issuer and revocation roots as public Fields");
+    }
+};
+exports.assertZkCredentialCircuitAbi = assertZkCredentialCircuitAbi;
+const expectedPublicInputs = (expected) => {
+    if (!Number.isSafeInteger(expected.currentTime) || expected.currentTime < 0) {
+        throw new Error("currentTime must be a non-negative safe integer");
+    }
+    return [
+        BigInt(expected.currentTime),
+        (0, presentation_inputs_1.challengeToField)(expected.challenge),
+        (0, credential_message_1.stringToField)(expected.audience),
+        (0, credential_message_1.programmeHash)(expected.programme),
+        BigInt((0, credential_message_1.countryCode)(expected.country))
+    ];
+};
+const proofPublicValues = (proof) => {
+    if (proof.publicInputs.length !== PUBLIC_INPUT_NAMES.length + 2)
+        return null;
+    try {
+        return proof.publicInputs.map(BigInt);
+    }
+    catch {
+        return null;
+    }
+};
+const publicInputMismatch = (proof, expected) => {
+    const values = proofPublicValues(proof);
+    if (values === null)
+        return null;
+    const actual = values.slice(0, PUBLIC_INPUT_NAMES.length);
+    const wanted = expectedPublicInputs(expected);
+    const mismatch = actual.findIndex((value, index) => value !== wanted[index]);
+    return mismatch < 0 ? undefined : PUBLIC_INPUT_NAMES[mismatch];
+};
+class ZkCredentialProofSystem {
+    constructor(noir, backend, api, proofOptions) {
+        this.noir = noir;
+        this.backend = backend;
+        this.api = api;
+        this.proofOptions = proofOptions;
+    }
+    static async create(circuit, options = {}) {
+        (0, exports.assertZkCredentialCircuitAbi)(circuit);
+        const [{ Noir }, { Barretenberg, UltraHonkBackend }] = await Promise.all([
+            import("@noir-lang/noir_js"),
+            import("@aztec/bb.js")
+        ]);
+        const api = await Barretenberg.new(options.backend);
+        return new ZkCredentialProofSystem(new Noir(circuit), new UltraHonkBackend(circuit.bytecode, api), api, options.proof);
+    }
+    async generateProof(inputs) {
+        const { witness } = await this.noir.execute(inputs);
+        const proof = await this.backend.generateProof(witness, this.proofOptions);
+        return { proof: proof.proof, publicInputs: [...proof.publicInputs] };
+    }
+    async verifyProof(proof, expected) {
+        const mismatch = publicInputMismatch(proof, expected);
+        if (mismatch === null)
+            return { ok: false, code: "PUBLIC_INPUT_MISMATCH" };
+        if (mismatch !== undefined)
+            return { ok: false, code: "PUBLIC_INPUT_MISMATCH", publicInput: mismatch };
+        if (!(proof.proof instanceof Uint8Array) || proof.proof.length === 0 || proof.proof.length % 32 !== 0) {
+            return { ok: false, code: "PROOF_INVALID" };
+        }
+        try {
+            if (!(await this.backend.verifyProof(proof, this.proofOptions))) {
+                return { ok: false, code: "PROOF_INVALID" };
+            }
+            const publicValues = proofPublicValues(proof);
+            return {
+                ok: true,
+                approvedIssuerRoot: publicValues[PUBLIC_INPUT_NAMES.length],
+                revocationRoot: publicValues[PUBLIC_INPUT_NAMES.length + 1]
+            };
+        }
+        catch {
+            return { ok: false, code: "PROOF_INVALID" };
+        }
+    }
+    async destroy() {
+        await this.api.destroy();
+    }
+}
+exports.ZkCredentialProofSystem = ZkCredentialProofSystem;
+async function generateZkPresentationProof(circuit, inputs, options = {}) {
+    const proofSystem = await ZkCredentialProofSystem.create(circuit, options);
+    try {
+        return await proofSystem.generateProof(inputs);
+    }
+    finally {
+        await proofSystem.destroy();
+    }
+}
+async function verifyZkPresentationProof(circuit, proof, expected, options = {}) {
+    const proofSystem = await ZkCredentialProofSystem.create(circuit, options);
+    try {
+        return await proofSystem.verifyProof(proof, expected);
+    }
+    finally {
+        await proofSystem.destroy();
+    }
+}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@coordination-network/credential",
+  "version": "0.0.1",
+  "description": "Verifiable credential SDK for the coordination network: issuance, verification, holder binding and revocation helpers.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zk-kit/coordination-network.git",
+    "directory": "packages/credential"
+  },
+  "homepage": "https://github.com/zk-kit/coordination-network/tree/main/packages/credential",
+  "bugs": "https://github.com/zk-kit/coordination-network/issues",
+  "sideEffects": false,
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist/",
+    "src/",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "installConfig": {
+    "hoistingLimits": "workspaces"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "jest"
+  },
+  "devDependencies": {
+    "@coordination-network/zk-artifacts": "^0.0.1",
+    "@sd-jwt/core": "^0.19.0",
+    "@sd-jwt/types": "^0.19.0",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^24.0.0",
+    "jest": "^30.4.2",
+    "ts-jest": "^29.4.11",
+    "typescript": "^6.0.3"
+  },
+  "dependencies": {
+    "@aztec/bb.js": "5.0.0",
+    "@coordination-network/identity": "^0.0.1",
+    "@coordination-network/issuer-set": "^0.0.1",
+    "@noble/curves": "^1.9.7",
+    "@noble/hashes": "^1.8.0",
+    "@noir-lang/noir_js": "1.0.0-beta.22",
+    "@sd-jwt/decode": "^0.19.0",
+    "@sd-jwt/sd-jwt-vc": "^0.19.0",
+    "@semaphore-protocol/identity": "^4.14.3",
+    "poseidon-lite": "0.3.0",
+    "viem": "^2.55.11"
+  }
+}

package/src/credential-message.ts

@@ -0,0 +1,173 @@
+import { Identity } from "@semaphore-protocol/identity"
+import { poseidon3 } from "poseidon-lite/poseidon3"
+import { poseidon4 } from "poseidon-lite/poseidon4"
+import { poseidon5 } from "poseidon-lite/poseidon5"
+import { keccak256, stringToHex } from "viem"
+import { bytesToHex } from "@noble/hashes/utils"
+import { jwkToPublicKeyBytes } from "./crypto"
+import { Jwk, SerializedZkCredential, ZkCredential, ZkCredentialBody } from "./types"
+
+// keccak256(utf8("urn:cn:credential:v1")) >> 8
+export const CREDENTIAL_DOMAIN = 363566488821926773809509531830640889725124777157045803797738936823559174026n
+export const DEVICE_KEY_DOMAIN = 320507632879070882430325612169297945123468706597652794395401074724051126576n
+const FIELD_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n
+export function stringToField(value: string): bigint {
+    return BigInt(keccak256(stringToHex(value))) >> 8n
+}
+
+export function programmeHash(programme: string): bigint {
+    if (programme.length === 0) throw new Error("programme must not be empty")
+    return stringToField(programme)
+}
+
+export function countryCode(country: string): number {
+    if (!/^[A-Z]{3}$/.test(country)) throw new Error("country must be an ISO 3166-1 alpha-3 code")
+    return [...country].reduce((value, character) => (value << 8) | character.charCodeAt(0), 0)
+}
+
+const bytesToBigint = (value: Uint8Array): bigint => BigInt(`0x${bytesToHex(value)}`)
+
+export function deriveDeviceKeyCommitment(publicKey: Jwk): bigint {
+    const encoded = jwkToPublicKeyBytes(publicKey)
+    const x = encoded.slice(1, 33)
+    const y = encoded.slice(33, 65)
+
+    return poseidon5([
+        DEVICE_KEY_DOMAIN,
+        bytesToBigint(x.slice(0, 16)),
+        bytesToBigint(x.slice(16, 32)),
+        bytesToBigint(y.slice(0, 16)),
+        bytesToBigint(y.slice(16, 32))
+    ])
+}
+
+export function zkCredentialCommitment(body: ZkCredentialBody): bigint {
+    const policy = poseidon4([
+        body.programmeHash,
+        BigInt(body.countryCode),
+        BigInt(body.notBefore),
+        BigInt(body.expiresAt)
+    ])
+    const keys = poseidon3([body.deviceKeyCommitment, body.holderKeyCommitment, body.revocationCommitment])
+
+    return poseidon3([CREDENTIAL_DOMAIN, policy, keys])
+}
+
+const decimal = (value: unknown, name: string): bigint => {
+    if (typeof value !== "string" || !/^(0|[1-9][0-9]*)$/.test(value)) throw new Error(`${name} must be decimal`)
+    const parsed = BigInt(value)
+    if (parsed >= FIELD_MODULUS) throw new Error(`${name} must fit the BN254 field`)
+    return parsed
+}
+
+const timestamp = (value: unknown, name: string): number => {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+        throw new Error(`${name} must be a non-negative integer`)
+    }
+    return value
+}
+
+const encodedCountryCode = (value: unknown): number => {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > 0xffffff) {
+        throw new Error("credential.body.countryCode must be a three-byte integer")
+    }
+    return value
+}
+
+const record = (value: unknown, name: string): Record<string, unknown> => {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error(`${name} must be an object`)
+    }
+    return value as Record<string, unknown>
+}
+
+const exactKeys = (value: Record<string, unknown>, keys: string[], name: string): void => {
+    const actual = Object.keys(value).sort()
+    const expected = [...keys].sort()
+    if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
+        throw new Error(`${name} has unexpected fields`)
+    }
+}
+
+export function serializeZkCredential(credential: ZkCredential): SerializedZkCredential {
+    return {
+        body: {
+            programmeHash: credential.body.programmeHash.toString(),
+            countryCode: credential.body.countryCode,
+            notBefore: credential.body.notBefore,
+            expiresAt: credential.body.expiresAt,
+            deviceKeyCommitment: credential.body.deviceKeyCommitment.toString(),
+            holderKeyCommitment: credential.body.holderKeyCommitment.toString(),
+            revocationCommitment: credential.body.revocationCommitment.toString()
+        },
+        issuerPublicKey: credential.issuerPublicKey.map(String) as [string, string],
+        signature: {
+            R8: credential.signature.R8.map(String) as [string, string],
+            S: credential.signature.S.toString()
+        }
+    }
+}
+
+export function parseZkCredential(value: unknown): ZkCredential {
+    const credential = record(value, "credential")
+    exactKeys(credential, ["body", "issuerPublicKey", "signature"], "credential")
+    const body = record(credential.body, "credential.body")
+    exactKeys(
+        body,
+        [
+            "programmeHash",
+            "countryCode",
+            "notBefore",
+            "expiresAt",
+            "deviceKeyCommitment",
+            "holderKeyCommitment",
+            "revocationCommitment"
+        ],
+        "credential.body"
+    )
+    if (!Array.isArray(credential.issuerPublicKey) || credential.issuerPublicKey.length !== 2) {
+        throw new Error("credential.issuerPublicKey must contain two values")
+    }
+    const signature = record(credential.signature, "credential.signature")
+    exactKeys(signature, ["R8", "S"], "credential.signature")
+    if (!Array.isArray(signature.R8) || signature.R8.length !== 2) {
+        throw new Error("credential.signature.R8 must contain two values")
+    }
+
+    const parsed: ZkCredential = {
+        body: {
+            programmeHash: decimal(body.programmeHash, "credential.body.programmeHash"),
+            countryCode: encodedCountryCode(body.countryCode),
+            notBefore: timestamp(body.notBefore, "credential.body.notBefore"),
+            expiresAt: timestamp(body.expiresAt, "credential.body.expiresAt"),
+            deviceKeyCommitment: decimal(body.deviceKeyCommitment, "credential.body.deviceKeyCommitment"),
+            holderKeyCommitment: decimal(body.holderKeyCommitment, "credential.body.holderKeyCommitment"),
+            revocationCommitment: decimal(body.revocationCommitment, "credential.body.revocationCommitment")
+        },
+        issuerPublicKey: [
+            decimal(credential.issuerPublicKey[0], "credential.issuerPublicKey[0]"),
+            decimal(credential.issuerPublicKey[1], "credential.issuerPublicKey[1]")
+        ],
+        signature: {
+            R8: [
+                decimal(signature.R8[0], "credential.signature.R8[0]"),
+                decimal(signature.R8[1], "credential.signature.R8[1]")
+            ],
+            S: decimal(signature.S, "credential.signature.S")
+        }
+    }
+    if (parsed.body.notBefore >= parsed.body.expiresAt) throw new Error("credential validity window is invalid")
+    return parsed
+}
+
+export function verifyZkCredential(credential: ZkCredential): boolean {
+    try {
+        return Identity.verifySignature(
+            zkCredentialCommitment(credential.body),
+            credential.signature,
+            credential.issuerPublicKey
+        )
+    } catch {
+        return false
+    }
+}

package/src/credential-signer.ts

@@ -0,0 +1,24 @@
+import { Identity } from "@semaphore-protocol/identity"
+import { EddsaPublicKey, EddsaSignature } from "./types"
+
+export interface CredentialSigner {
+    getPublicKey(): Promise<EddsaPublicKey>
+    sign(message: bigint): Promise<EddsaSignature>
+}
+
+export class LocalCredentialSigner implements CredentialSigner {
+    private readonly identity: Identity
+
+    constructor(secret: string | Uint8Array) {
+        this.identity = new Identity(secret)
+    }
+
+    async getPublicKey(): Promise<EddsaPublicKey> {
+        return [this.identity.publicKey[0], this.identity.publicKey[1]]
+    }
+
+    async sign(message: bigint): Promise<EddsaSignature> {
+        const signature = this.identity.signMessage(message)
+        return { R8: [signature.R8[0], signature.R8[1]], S: signature.S }
+    }
+}

package/src/crypto.ts

@@ -0,0 +1,146 @@
+import { p256 } from "@noble/curves/nist.js"
+import { sha256 } from "@noble/hashes/sha2"
+import { bytesToHex, randomBytes } from "@noble/hashes/utils"
+import { base64urlToBytes as strictBase64urlToBytes, bytesToBase64url } from "@coordination-network/identity"
+import { Jwk } from "./types"
+import { DeviceSigner, Signer } from "./signer"
+
+/** Bridges the KMS-shaped Signer interface, the noble primitives, and the callback shapes @sd-jwt expects. */
+
+const utf8 = (data: string): Uint8Array => new TextEncoder().encode(data)
+
+export { bytesToBase64url }
+
+/**
+ * Padding is optional under RFC 4648 §5 and some clients send it anyway (Python's
+ * urlsafe_b64encode, Java's URL encoder), so JWK coordinates are stripped before the strict decode
+ * rather than rejected.
+ */
+export function base64urlToBytes(encoded: string): Uint8Array {
+    const unpadded = encoded.replace(/=+$/, "")
+    const invalid = unpadded.match(/[^A-Za-z0-9_-]/)
+    if (invalid) throw new Error(`invalid base64url character: ${invalid[0]}`)
+    return strictBase64urlToBytes(unpadded)
+}
+
+/** Uncompressed SEC1 point (65 bytes, 0x04 || x || y) from a P-256 JWK. */
+export function jwkToPublicKeyBytes(jwk: Jwk): Uint8Array {
+    const x = base64urlToBytes(jwk.x)
+    const y = base64urlToBytes(jwk.y)
+    if (jwk.kty !== "EC" || jwk.crv !== "P-256" || x.length !== 32 || y.length !== 32) {
+        throw new Error("expected a P-256 EC JWK with 32-byte coordinates")
+    }
+    const point = new Uint8Array(65)
+    point[0] = 0x04
+    point.set(x, 1)
+    point.set(y, 33)
+    return point
+}
+
+/**
+ * Registry keys are stored as the compressed SEC1 point (33 bytes, spec 07).
+ * Both converters go through the curve, so an off-curve point throws instead
+ * of round-tripping garbage.
+ */
+export function compressedPointToJwk(point: Uint8Array): Jwk {
+    const raw = p256.ProjectivePoint.fromHex(point).toRawBytes(false)
+    return {
+        kty: "EC",
+        crv: "P-256",
+        x: bytesToBase64url(raw.slice(1, 33)),
+        y: bytesToBase64url(raw.slice(33, 65))
+    }
+}
+
+export function jwkToCompressedPoint(jwk: Jwk): Uint8Array {
+    return p256.ProjectivePoint.fromHex(jwkToPublicKeyBytes(jwk)).toRawBytes(true)
+}
+
+/** RFC 7638 JWK thumbprint: SHA-256 over the ordered required members. */
+export function jwkThumbprint(jwk: Jwk): Uint8Array {
+    return sha256(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }))
+}
+
+/**
+ * ECDSA P-256 verification in message mode. lowS is not enforced on verify:
+ * we produce low-s signatures ourselves, but external signers (KMS) may not,
+ * and JWS does not require it.
+ */
+export function verifyP256(message: Uint8Array, signature: Uint8Array, publicKey: Uint8Array): boolean {
+    try {
+        return p256.verify(signature, sha256(message), publicKey, { lowS: false })
+    } catch {
+        return false
+    }
+}
+
+/** Bridges a Signer to the @sd-jwt signer callback (base64url over utf8 input). */
+export function createSdJwtSigner(signer: Signer): (data: string) => Promise<string> {
+    return async (data: string) => bytesToBase64url(await signer.sign(utf8(data)))
+}
+
+/** Builds the @sd-jwt verifier callback from a resolved issuer JWK. */
+export function createSdJwtVerifier(jwk: Jwk): (data: string, signature: string) => boolean {
+    const publicKey = jwkToPublicKeyBytes(jwk)
+    return (data: string, signature: string) => {
+        try {
+            return verifyP256(utf8(data), base64urlToBytes(signature), publicKey)
+        } catch {
+            return false
+        }
+    }
+}
+
+/** The sha-256 hasher the @sd-jwt config takes. */
+export function sdJwtHasher(data: string | ArrayBuffer): Uint8Array {
+    return sha256(typeof data === "string" ? data : new Uint8Array(data))
+}
+
+/** Hex salts for disclosure digests. */
+export function sdJwtSaltGenerator(length: number): string {
+    return bytesToHex(randomBytes(length))
+}
+
+/** RFC 4122 v4 UUID from CSPRNG bytes — node:crypto is unavailable under React Native. */
+export function randomUuid(): string {
+    const bytes = randomBytes(16)
+    bytes[6] = (bytes[6] & 0x0f) | 0x40
+    bytes[8] = (bytes[8] & 0x3f) | 0x80
+    const hex = bytesToHex(bytes)
+
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`
+}
+
+/**
+ * Software P-256 signer. The issuer demo and every test use it; production
+ * issuers replace it with a KMS-backed Signer, apps with a secure-element
+ * DeviceSigner. Signs in message mode with low-s, raw 64-byte output —
+ * exactly the Signer contract.
+ */
+export class LocalP256Signer implements Signer, DeviceSigner {
+    private readonly privateKey: Uint8Array
+
+    constructor(privateKey: Uint8Array) {
+        if (privateKey.length !== 32) {
+            throw new Error("P-256 private key must be 32 bytes")
+        }
+        this.privateKey = privateKey
+    }
+
+    static generate(): LocalP256Signer {
+        return new LocalP256Signer(p256.utils.randomSecretKey())
+    }
+
+    async getPublicKeyJwk(): Promise<Jwk> {
+        return compressedPointToJwk(p256.getPublicKey(this.privateKey, true))
+    }
+
+    async sign(message: Uint8Array): Promise<Uint8Array> {
+        return p256.sign(sha256(message), this.privateKey, { lowS: true }).toCompactRawBytes()
+    }
+
+    async signDigest(digest: Uint8Array): Promise<Uint8Array> {
+        if (digest.length !== 32) throw new Error("P-256 digest must be 32 bytes")
+        return p256.sign(digest, this.privateKey, { lowS: true }).toCompactRawBytes()
+    }
+}

package/src/decode.ts

@@ -0,0 +1,25 @@
+import { decodeSdJwtSync, getClaimsSync } from "@sd-jwt/decode"
+import { sdJwtHasher } from "./crypto"
+import { validateClaims } from "./profile"
+import { ApprovalCredentialClaims } from "./types"
+
+/**
+ * Decodes a compact SD-JWT and reconstructs the full claim set from its
+ * disclosures WITHOUT verifying the signature — for callers that already
+ * trust the token, such as the issuer reading back a token it just signed.
+ * Untrusted tokens go through verifyCredential/verifyPresentation instead.
+ */
+export function decodeSdJwtCredentialClaims(token: string): ApprovalCredentialClaims {
+    let reconstructed: unknown
+    try {
+        const decoded = decodeSdJwtSync(token, sdJwtHasher)
+        reconstructed = getClaimsSync(decoded.jwt.payload, decoded.disclosures, sdJwtHasher)
+    } catch {
+        throw new Error("token is not a decodable SD-JWT")
+    }
+    const checked = validateClaims(reconstructed)
+    if (!checked.ok) {
+        throw new Error(checked.message)
+    }
+    return checked.claims
+}

package/src/errors.ts

@@ -0,0 +1,12 @@
+export type IssuanceErrorCode =
+    "INVALID_PARAMS" | "ISSUER_NOT_APPROVED" | "SUBJECT_MISMATCH" | "BINDING_INVALID" | "COMMITMENT_OWNERSHIP_INVALID"
+
+export class IssuanceError extends Error {
+    readonly code: IssuanceErrorCode
+
+    constructor(code: IssuanceErrorCode, message: string) {
+        super(message)
+        this.name = "IssuanceError"
+        this.code = code
+    }
+}

package/src/index.ts

@@ -0,0 +1,19 @@
+export * from "./errors"
+export * from "./types"
+export * from "./signer"
+export * from "./credential-message"
+export * from "./credential-signer"
+export * from "./issue-credential"
+export * from "./issuer-set"
+export * from "./presentation-inputs"
+export * from "./witness"
+export * from "./zk-proof"
+export * from "./resolver"
+export * from "./registry-client"
+export * from "./crypto"
+export * from "./decode"
+export * from "./profile"
+export * from "./issue"
+export * from "./verify"
+export * from "./present"
+export * from "./revocation"

package/src/issue-credential.ts

@@ -0,0 +1,78 @@
+import { InvalidBindingInputError, verifyCredentialBinding } from "@coordination-network/identity"
+import { hexToBytes } from "@noble/hashes/utils"
+import { Identity } from "@semaphore-protocol/identity"
+import { CredentialSigner } from "./credential-signer"
+import { countryCode, deriveDeviceKeyCommitment, programmeHash, zkCredentialCommitment } from "./credential-message"
+import { jwkToPublicKeyBytes } from "./crypto"
+import { IssuanceError } from "./errors"
+import { ApprovalResolver } from "./resolver"
+import { verifyCommitmentOwnership } from "./revocation"
+import { ZkCredential, ZkCredentialIssueParams } from "./types"
+
+export async function issueZkCredential(
+    params: ZkCredentialIssueParams,
+    signer: CredentialSigner,
+    approval: ApprovalResolver
+): Promise<ZkCredential> {
+    if (!(await approval.isApprovedNetworkMember(params.issuerNetworkId))) {
+        throw new IssuanceError(
+            "ISSUER_NOT_APPROVED",
+            `issuer ${params.issuerNetworkId} is not an approved network member`
+        )
+    }
+    if (!(params.validFrom < params.validUntil)) {
+        throw new IssuanceError("INVALID_PARAMS", "validFrom must be before validUntil")
+    }
+
+    const holderKeyCommitment = Identity.generateCommitment(params.identityPublicKey)
+    const holderKeyCommitmentBytes = hexToBytes(holderKeyCommitment.toString(16).padStart(64, "0"))
+    let binding: ReturnType<typeof verifyCredentialBinding>
+    try {
+        binding = verifyCredentialBinding({
+            nonce: params.nonce,
+            accountPublicKey: params.accountPublicKey,
+            confirmationKey: jwkToPublicKeyBytes(params.confirmationKey),
+            holderKeyCommitment: holderKeyCommitmentBytes,
+            accountSignature: params.accountPopSignature,
+            deviceSignature: params.devicePopSignature
+        })
+    } catch (error) {
+        if (error instanceof InvalidBindingInputError) {
+            throw new IssuanceError("INVALID_PARAMS", `malformed binding input: ${error.message}`)
+        }
+        throw error
+    }
+
+    if (binding.networkId !== params.subjectNetworkId.toLowerCase()) {
+        throw new IssuanceError("SUBJECT_MISMATCH", "subjectNetworkId does not match the account public key")
+    }
+    if (!binding.valid) {
+        throw new IssuanceError("BINDING_INVALID", "credential binding failed")
+    }
+
+    const ownershipOk = verifyCommitmentOwnership({
+        commitment: params.revocation.commitment,
+        publicKey: params.revocation.publicKey,
+        signature: params.revocation.ownershipSignature,
+        nonce: params.nonce
+    })
+    if (!ownershipOk) {
+        throw new IssuanceError("COMMITMENT_OWNERSHIP_INVALID", "revocation commitment ownership proof failed")
+    }
+
+    const body = {
+        programmeHash: programmeHash(params.approvalScope.programme),
+        countryCode: countryCode(params.approvalScope.country),
+        notBefore: params.validFrom,
+        expiresAt: params.validUntil,
+        deviceKeyCommitment: deriveDeviceKeyCommitment(params.confirmationKey),
+        holderKeyCommitment,
+        revocationCommitment: params.revocation.commitment
+    }
+
+    return {
+        body,
+        issuerPublicKey: await signer.getPublicKey(),
+        signature: await signer.sign(zkCredentialCommitment(body))
+    }
+}