@coordination-network/identity 0.0.1

package/src/stealthAddresses/getStealthPublicKey.ts

@@ -0,0 +1,21 @@
+import { secp256k1 } from "@noble/curves/secp256k1"
+import { bytesToNumberBE } from "@noble/curves/utils"
+import { Hex } from "../types"
+
+/**
+ * Generates stealth public key. ERC-5564 scheme 1: P_stealth = P_spend + (s_h mod n)·G,
+ * returned as a 65-byte uncompressed public key.
+ */
+export function getStealthPublicKey({
+    spendingPublicKey,
+    hashedSharedSecret
+}: {
+    spendingPublicKey: Hex
+    hashedSharedSecret: Uint8Array
+}): Uint8Array {
+    const sharedSecretScalar = bytesToNumberBE(hashedSharedSecret) % secp256k1.Point.CURVE().n
+
+    return secp256k1.Point.fromHex(spendingPublicKey.slice(2))
+        .add(secp256k1.Point.BASE.multiply(sharedSecretScalar))
+        .toBytes(false)
+}

package/src/stealthAddresses/getViewTag.ts

@@ -0,0 +1,7 @@
+/**
+ * First byte of the hashed shared secret, published in announcements so
+ * scanners can skip 255/256 non-matching shared secrets.
+ */
+export function getViewTag(hashedSharedSecret: Uint8Array): number {
+    return hashedSharedSecret[0]
+}

package/src/stealthAddresses/metaStealthAddressUri.ts

@@ -0,0 +1,7 @@
+import { Hex } from "../types"
+import { META_STEALTH_URI_PREFIX } from "../constants"
+
+/** Takes the encoded address, so it also formats one read back from a registry. */
+export function metaStealthAddressUri(metaStealthAddress: Hex): string {
+    return `${META_STEALTH_URI_PREFIX}${metaStealthAddress}`
+}

package/src/stealthAddresses/publicKeyToAddress.ts

@@ -0,0 +1,17 @@
+import { keccak_256 } from "@noble/hashes/sha3"
+import { Address } from "../types"
+import { bytesToHex } from "../bytes"
+import { InvalidPublicKeyLengthError } from "../errors"
+
+/**
+ * Derive Ethereum address from public key: keccak256 of the 64-byte X || Y
+ * coordinates (65 bytes without 0x04 prefix stripped), then last 20 bytes.
+ */
+export function publicKeyToAddress(publicKey: Uint8Array): Address {
+    if (publicKey.length !== 65) {
+        throw new InvalidPublicKeyLengthError()
+    }
+    const publicKeyHash = keccak_256(publicKey.slice(1))
+
+    return `0x${bytesToHex(publicKeyHash).slice(-40)}`
+}

package/src/stealthAddresses/validateMetaStealthAddress.ts

@@ -0,0 +1,19 @@
+import { assertCompressedPublicKey } from "./assertCompressedPublicKey"
+
+/** Validates 66-byte meta stealth address: shape and curve checks */
+export function validateMetaStealthAddress(metaStealthAddress: string): boolean {
+    if (!metaStealthAddress.startsWith("0x")) {
+        return false
+    }
+
+    const cleanedMetaStealthAddress = metaStealthAddress.slice(2)
+
+    try {
+        assertCompressedPublicKey(`0x${cleanedMetaStealthAddress.slice(0, 66)}`, "spending")
+        assertCompressedPublicKey(`0x${cleanedMetaStealthAddress.slice(66)}`, "viewing")
+    } catch {
+        return false
+    }
+
+    return true
+}

package/src/types.ts

@@ -0,0 +1,51 @@
+/** A `0x`-prefixed lowercase hexadecimal string. */
+export type Hex = `0x${string}`
+
+/** An Ethereum address. */
+export type Address = Hex
+
+/** A secp256k1 keypair, all fields normalized lowercase hex. */
+export interface Secp256k1Keypair {
+    /** 32-byte scalar, `0x` + 64 hex chars, lowercase. */
+    privateKey: Hex
+    /** 33-byte compressed SEC1 public key. */
+    publicKey: Hex
+    /** 65-byte SEC1 public key, `0x04`-prefixed (uncompressed form). */
+    uncompressedPublicKey: Hex
+}
+
+/** The full key set derived from one device secret, plus the device's `networkId`. */
+export interface DerivedKeys {
+    /** Derivation scheme version. See {@link KEY_DERIVATION_VERSION}. */
+    version: "v1"
+    /** bytes32 device identifier: `keccak256(uncompressed account pubkey, sans 04 prefix)`. */
+    networkId: Hex
+    /** Root secp256k1 keypair the other keys are derived from. */
+    account: Secp256k1Keypair
+    /** secp256k1 keypair used to authorize spending. */
+    spending: Secp256k1Keypair
+    /** secp256k1 keypair used to derive/scan stealth viewing tags. */
+    viewing: Secp256k1Keypair
+    /** secp256k1 keypair used to authenticate as the device. */
+    auth: Secp256k1Keypair
+}
+
+/**
+ * The Baby Jubjub EdDSA keypair and Semaphore-v4 identity commitment (the
+ * "fifth key") — a stable device-level ZK-identity key, rooted in a hardware
+ * ECDH shared secret rather than the device secret. See `DERIVATION.md` §12.
+ */
+export interface EddsaKeypair {
+    /**
+     * 32-byte keccak256 EdDSA seed as `0x` hex. Decode to raw bytes before
+     * re-feeding to zk-kit/Semaphore — the hex string derives a different key
+     * (`DERIVATION.md` §12.4).
+     */
+    seed: Hex
+    /** The Baby Jubjub EdDSA private scalar, pruned per `deriveSecretScalar`. */
+    secretScalar: bigint
+    /** The Baby Jubjub public key point, `[x, y]`. */
+    publicKey: [bigint, bigint]
+    /** The Semaphore v4 identity commitment: `poseidon2([x, y])`. */
+    commitment: bigint
+}

package/types/index.d.ts

@@ -0,0 +1,499 @@
+/** A `0x`-prefixed lowercase hexadecimal string. */
+type Hex = `0x${string}`;
+/** An Ethereum address. */
+type Address = Hex;
+/** A secp256k1 keypair, all fields normalized lowercase hex. */
+interface Secp256k1Keypair {
+    /** 32-byte scalar, `0x` + 64 hex chars, lowercase. */
+    privateKey: Hex;
+    /** 33-byte compressed SEC1 public key. */
+    publicKey: Hex;
+    /** 65-byte SEC1 public key, `0x04`-prefixed (uncompressed form). */
+    uncompressedPublicKey: Hex;
+}
+/** The full key set derived from one device secret, plus the device's `networkId`. */
+interface DerivedKeys {
+    /** Derivation scheme version. See {@link KEY_DERIVATION_VERSION}. */
+    version: "v1";
+    /** bytes32 device identifier: `keccak256(uncompressed account pubkey, sans 04 prefix)`. */
+    networkId: Hex;
+    /** Root secp256k1 keypair the other keys are derived from. */
+    account: Secp256k1Keypair;
+    /** secp256k1 keypair used to authorize spending. */
+    spending: Secp256k1Keypair;
+    /** secp256k1 keypair used to derive/scan stealth viewing tags. */
+    viewing: Secp256k1Keypair;
+    /** secp256k1 keypair used to authenticate as the device. */
+    auth: Secp256k1Keypair;
+}
+/**
+ * The Baby Jubjub EdDSA keypair and Semaphore-v4 identity commitment (the
+ * "fifth key") — a stable device-level ZK-identity key, rooted in a hardware
+ * ECDH shared secret rather than the device secret. See `DERIVATION.md` §12.
+ */
+interface EddsaKeypair {
+    /**
+     * 32-byte keccak256 EdDSA seed as `0x` hex. Decode to raw bytes before
+     * re-feeding to zk-kit/Semaphore — the hex string derives a different key
+     * (`DERIVATION.md` §12.4).
+     */
+    seed: Hex;
+    /** The Baby Jubjub EdDSA private scalar, pruned per `deriveSecretScalar`. */
+    secretScalar: bigint;
+    /** The Baby Jubjub public key point, `[x, y]`. */
+    publicKey: [bigint, bigint];
+    /** The Semaphore v4 identity commitment: `poseidon2([x, y])`. */
+    commitment: bigint;
+}
+
+/**
+ * Normative constants for the `v1` key derivation scheme. Changing any of
+ * these changes every derived key and `networkId`, so they MUST NOT change
+ * without a version bump (new `KEY_DERIVATION_VERSION` and domain strings).
+ */
+declare const KEY_DERIVATION_VERSION: "v1";
+/** Fixed domain-separation message signed by {@link signDerivationMessage}. */
+declare const FIXED_DOMAIN_MSG: "coordination-network/identity/v1";
+/** Domain-separation tag for deriving the account keypair from a device secret. */
+declare const DOMAIN_ACCOUNT: "coordination-network/identity/v1/account";
+/** Domain-separation tag for deriving the auth keypair. */
+declare const DOMAIN_AUTH: "coordination-network/identity/v1/auth";
+/** Domain-separation tag for deriving the Baby Jubjub EdDSA seed (the "fifth key") from the hardware ECDH shared secret. */
+declare const DOMAIN_EDDSA: "coordination-network/identity/v1/eddsa";
+/** Domain-separation message hashed to the fixed NUMS P-256 peer point `Q` for the fifth-key ECDH (`eddsa-peer.ts`). */
+declare const DOMAIN_EDDSA_PEER: "coordination-network/identity/v1/eddsa/peer";
+/**
+ * Byte length of `nonce` and `networkId` in the binding messages — fixed at
+ * 32 so the 64- vs 96-byte messages are injective.
+ */
+declare const BINDING_NONCE_LENGTH: 32;
+/** SEC1-compressed secp256k1 public key length. */
+declare const COMPRESSED_PUBLIC_KEY_LENGTH: 33;
+/** ERC-6538 scheme 1 meta-stealth address: compressed spending ‖ viewing public keys. */
+declare const META_STEALTH_ADDRESS_LENGTH: 66;
+/** ERC-5564 offchain display prefix — never stored onchain. */
+declare const META_STEALTH_URI_PREFIX: "st:eth:";
+/** ERC-5564 scheme id for secp256k1 with view tags. */
+declare const ERC_5564_SCHEME_ID: 1;
+
+type KeygenErrorCode = "INVALID_DEVICE_SECRET" | "DERIVATION_FAILURE" | "INVALID_BINDING_INPUT" | "INVALID_ECDH_SECRET" | "INVALID_META_STEALTH_ADDRESS" | "INVALID_PUBLIC_KEY_LENGTH";
+/**
+ * Base error class for all errors thrown by this package, discriminated by
+ * `code` so callers can branch without `instanceof` across bundle boundaries.
+ */
+declare class KeygenError extends Error {
+    readonly code: KeygenErrorCode;
+    constructor(code: KeygenErrorCode, message: string);
+}
+/** Thrown when a device secret does not satisfy the exactly-32-bytes contract. */
+declare class InvalidDeviceSecretError extends KeygenError {
+    constructor(message?: string);
+}
+/** Thrown when key derivation fails for a reason unrelated to input shape. */
+declare class DerivationFailureError extends KeygenError {
+    constructor(message?: string);
+}
+/**
+ * Thrown for malformed credential-binding inputs; a well-formed signature
+ * that merely fails to verify returns `false` instead.
+ */
+declare class InvalidBindingInputError extends KeygenError {
+    constructor(message?: string);
+}
+/** Thrown when a meta-stealth address fails to decode (bad prefix, length, hex, or curve point). */
+declare class InvalidMetaStealthAddressError extends KeygenError {
+    constructor(message?: string);
+}
+/** Thrown when a hardware ECDH shared secret does not satisfy the exactly-32-bytes contract. */
+declare class InvalidEcdhSecretError extends KeygenError {
+    constructor(message?: string);
+}
+/** Thrown when a public key is not the correct length */
+declare class InvalidPublicKeyLengthError extends KeygenError {
+    constructor(message?: string);
+}
+
+declare function hexToBytes(hex: string): Uint8Array;
+declare function bytesToHex(bytes: Uint8Array): Hex;
+/** Unpadded base64url (RFC 4648 §5) */
+declare function bytesToBase64url(bytes: Uint8Array): string;
+/** Decodes unpadded base64url (RFC 4648 §5). */
+declare function base64urlToBytes(encoded: string): Uint8Array;
+/**
+ * Normalizes a device secret to a defensive copy of exactly 32 bytes.
+ * Accepts a 32-byte `Uint8Array` or a `0x`-prefixed 64-hex-char string;
+ * anything else throws {@link InvalidDeviceSecretError}.
+ */
+declare function normalizeDeviceSecret(secret: Uint8Array | Hex | string): Uint8Array;
+/**
+ * Normalizes a hardware ECDH shared secret to a defensive copy of exactly 32
+ * bytes. Same exactly-32-bytes contract as {@link normalizeDeviceSecret};
+ * rethrown as {@link InvalidEcdhSecretError} so callers don't conflate the
+ * two secrets by error code.
+ */
+declare function normalizeEcdhSharedSecret(secret: Uint8Array | Hex | string): Uint8Array;
+
+/**
+ * Generates a fresh 32-byte device secret from the platform CSPRNG
+ * (`globalThis.crypto.getRandomValues`). Throws if no secure RNG is available
+ * (e.g. React Native without the `react-native-get-random-values` polyfill).
+ */
+declare function generateDeviceSecret(): Hex;
+
+/** A 32-byte-output hash function, e.g. `keccak_256`. */
+type HashFn = (input: Uint8Array) => Uint8Array;
+/** {@link hashToScalar} with an injectable hash, letting tests drive the reject/retry branch. */
+declare function hashToScalarWith(hashFn: HashFn, tag: string, input: Uint8Array): Uint8Array;
+/**
+ * Deterministically derives a secp256k1 private scalar from a domain tag and
+ * input bytes.
+ *
+ * NORMATIVE: for `counter = 0..255`, return the first
+ * `keccak256(utf8(tag) || input || [counter])` whose big-endian value lies in
+ * `[1, n)`. Out-of-range candidates have probability ~`2^-128`, so exhaustion
+ * is unreachable.
+ */
+declare function hashToScalar(tag: string, input: Uint8Array): Uint8Array;
+
+/**
+ * Tests whether `scalar` is a valid secp256k1 private key: exactly 32 bytes
+ * encoding an integer in `[1, n)`.
+ */
+declare function isValidScalar(scalar: Uint8Array): boolean;
+/**
+ * Expands a 32-byte private scalar into a full {@link Secp256k1Keypair}, with
+ * all fields as lowercase `0x` hex.
+ *
+ * @throws {DerivationFailureError} if `scalar` is not in `[1, n)`
+ */
+declare function scalarToKeypair(scalar: Uint8Array): Secp256k1Keypair;
+
+/**
+ * Derives the root secp256k1 account keypair from a 32-byte device secret.
+ *
+ * NORMATIVE: `accountPrivKey = hashToScalar(DOMAIN_ACCOUNT, deviceSecret)`.
+ */
+declare function deriveAccountKeypair(deviceSecret: Uint8Array | Hex): Secp256k1Keypair;
+/**
+ * Signs the fixed derivation message with the account private key.
+ *
+ * NORMATIVE: the EIP-191 digest of {@link FIXED_DOMAIN_MSG}, signed with
+ * RFC-6979 deterministic ECDSA (`lowS: true`, no `extraEntropy`), returned as
+ * the 64-byte compact `r || s` encoding.
+ */
+declare function signDerivationMessage(accountPrivateKey: Hex | Uint8Array): Hex;
+
+/**
+ * Derives the spending and viewing secp256k1 keypairs from the 64-byte
+ * compact derivation-message signature.
+ *
+ * NORMATIVE (FluidKey `generateKeysFromSignature` semantics): with
+ * `r = sig[0..32]` and `s = sig[32..64]`, `spendingPrivKey = keccak256(r)`
+ * and `viewingPrivKey = keccak256(s)`. No reject/retry — the hash output is
+ * used directly and validated to be in `[1, n)` by {@link scalarToKeypair}.
+ *
+ * `sig64` is unauthenticated — prefer {@link deriveKeys} (see `DERIVATION.md`).
+ */
+declare function deriveStealthKeys(sig64: Uint8Array | Hex): {
+    spending: Secp256k1Keypair;
+    viewing: Secp256k1Keypair;
+};
+
+/**
+ * The ERC-5564 hashed shared secret: keccak256 of the 33-byte compressed
+ * ECDH point.
+ *
+ * The sender can pass (ephemeralPrivateKey, viewingPublicKey).
+ * The recipient can pass (viewingPrivateKey, ephemeralPublicKey).
+ */
+declare function computeSharedSecret({ privateKey, publicKey }: {
+    privateKey: Hex;
+    publicKey: Hex;
+}): Uint8Array;
+
+/**
+ * First byte of the hashed shared secret, published in announcements so
+ * scanners can skip 255/256 non-matching shared secrets.
+ */
+declare function getViewTag(hashedSharedSecret: Uint8Array): number;
+
+/**
+ * Generates stealth public key. ERC-5564 scheme 1: P_stealth = P_spend + (s_h mod n)·G,
+ * returned as a 65-byte uncompressed public key.
+ */
+declare function getStealthPublicKey({ spendingPublicKey, hashedSharedSecret }: {
+    spendingPublicKey: Hex;
+    hashedSharedSecret: Uint8Array;
+}): Uint8Array;
+
+/**
+ * Derive Ethereum address from public key: keccak256 of the 64-byte X || Y
+ * coordinates (65 bytes without 0x04 prefix stripped), then last 20 bytes.
+ */
+declare function publicKeyToAddress(publicKey: Uint8Array): Address;
+
+/**
+ * A fresh CSPRNG keypair for one load. MUST be single-use — reusing an
+ * ephemeral key derives the same stealth address twice.
+ */
+declare function generateEphemeralKey(): Secp256k1Keypair;
+
+/**
+ * Derives a fresh stealth address from the
+ * recipient's spending and viewing public keys.
+ */
+declare function generateStealthAddress({ viewingPublicKey, spendingPublicKey, ephemeralPrivateKey }: {
+    viewingPublicKey: Hex;
+    spendingPublicKey: Hex;
+    ephemeralPrivateKey: Hex;
+}): Address;
+
+/**
+ * Recovers the private key controlling a stealth address,
+ * (p_spend + s_h) mod n.
+ */
+declare function generateStealthPrivateKey({ ephemeralPublicKey, viewingPrivateKey, spendingPrivateKey }: {
+    ephemeralPublicKey: Hex;
+    viewingPrivateKey: Hex;
+    spendingPrivateKey: Hex;
+}): Hex;
+
+/**
+ * Checks whether an announcement is addressed to a recipient: filters by
+ * view-tag first, then full address recompute.
+ */
+declare function checkStealthAddress({ stealthAddress, ephemeralPublicKey, spendingPublicKey, viewingPrivateKey, viewTag }: {
+    stealthAddress: Address;
+    ephemeralPublicKey: Hex;
+    spendingPublicKey: Hex;
+    viewingPrivateKey: Hex;
+    viewTag: number;
+}): boolean;
+
+/** Validates 66-byte meta stealth address: shape and curve checks */
+declare function validateMetaStealthAddress(metaStealthAddress: string): boolean;
+
+/**
+ * The 66-byte compressed spending || viewing concatenation the onchain registry stores. Throws
+ * InvalidMetaStealthAddressError, naming the offending key, so it can be used before registering.
+ */
+declare function encodeMetaStealthAddress({ spendingPublicKey, viewingPublicKey }: {
+    spendingPublicKey: Hex;
+    viewingPublicKey: Hex;
+}): Hex;
+
+/** The st:eth:0x… display form (ERC-5564 URI). Not stored onchain. */
+declare function encodeMetaStealthAddressUri(publicKeys: {
+    spendingPublicKey: Hex;
+    viewingPublicKey: Hex;
+}): string;
+
+/** Takes the encoded address, so it also formats one read back from a registry. */
+declare function metaStealthAddressUri(metaStealthAddress: Hex): string;
+
+/**
+ * Splits a 66-byte meta-stealth address (raw hex or `st:eth:` prefixed) into its
+ * spending and viewing public keys.
+ */
+declare function decodeMetaStealthAddress(metaStealthAddress: string): {
+    spendingPublicKey: Hex;
+    viewingPublicKey: Hex;
+};
+
+/**
+ * Builds an ERC-5564 announcement payload for a fresh stealth address,
+ * generates ephemeral key internally. The view tag is the
+ * first and only metadata byte.
+ */
+declare function buildAnnouncement({ metaStealthAddress }: {
+    metaStealthAddress: Hex;
+}): {
+    schemeId: typeof ERC_5564_SCHEME_ID;
+    stealthAddress: Address;
+    ephemeralPublicKey: Hex;
+    metadata: Hex;
+};
+
+/**
+ * Derives the secp256k1 auth keypair from the 64-byte compact
+ * derivation-message signature.
+ *
+ * NORMATIVE: `authPrivKey = hashToScalar(DOMAIN_AUTH, sig64)`.
+ *
+ * `sig64` is unauthenticated — prefer {@link deriveKeys} (see `DERIVATION.md`).
+ */
+declare function deriveAuthKeypair(sig64: Uint8Array | Hex): Secp256k1Keypair;
+
+/** Baby Jubjub EdDSA "fifth key" derivation — see `DERIVATION.md` §12. */
+
+/**
+ * Derives the Baby Jubjub EdDSA keypair and Semaphore-v4 identity commitment
+ * (the "fifth key"), rooted in a hardware ECDH shared secret.
+ *
+ * NORMATIVE (`DERIVATION.md` §12): `ecdhSharedSecret = X(hwPriv · Q)` for the
+ * fixed NUMS peer point `Q` (`eddsa-peer.ts`), computed natively by the
+ * caller — the library never talks to the Keystore, it only takes the raw
+ * 32-byte result. `seed = keccak256(utf8(DOMAIN_EDDSA) || ecdhSharedSecret)`,
+ * fed to `@zk-kit/eddsa-poseidon` as raw bytes (MUST NOT be the hex string,
+ * see §12.4); `commitment = poseidon2([x, y])`.
+ *
+ * @throws {InvalidEcdhSecretError} if `ecdhSharedSecret` is not exactly 32 bytes
+ */
+declare function deriveEddsaKeypair(ecdhSharedSecret: Uint8Array | Hex): EddsaKeypair;
+
+/** Fixed NUMS P-256 peer point `Q` for the fifth-key ECDH — see `DERIVATION.md` §12. */
+/**
+ * NORMATIVE: `Q = hashToCurve(utf8(DOMAIN_EDDSA_PEER))` (RFC 9380
+ * `P256_XMD:SHA-256_SSWU_RO_`, suite-default DST). Nobody knows `dlog(Q)`,
+ * so `hwPriv · Q` is computable only by the device that holds `hwPriv`.
+ * 65-byte SEC1 uncompressed encoding, `0x04`-prefixed.
+ */
+declare const EDDSA_PEER_POINT_HEX: "0x045db1cabf31539848bf802ad49a94ad8f8e3d52e75bb53aa4552d7cf836eba054213badca0cf4ba6daf8c146d3415d9ae1905440781dc5f08e6e946a471af99e9";
+/** Fresh copy of {@link EDDSA_PEER_POINT_HEX} as raw bytes. */
+declare function eddsaPeerPointBytes(): Uint8Array;
+/**
+ * Reproduces `Q` from its RFC 9380 provenance, independent of the pinned
+ * constant — the evidence that {@link EDDSA_PEER_POINT_HEX} is a NUMS point.
+ *
+ * `hashToCurve` returns an `H2CPoint`, which lacks `toRawBytes`; round-trip
+ * through `ProjectivePoint.fromAffine` to get the SEC1 encoding.
+ */
+declare function computeEddsaPeerPoint(): Uint8Array;
+
+/**
+ * Computes the bytes32 `networkId` from an uncompressed secp256k1 public key
+ * (65-byte SEC1 `0x04`-prefixed or 64-byte raw `X || Y`).
+ *
+ * NORMATIVE: `networkId = keccak256(X || Y)` — the SEC1 prefix is stripped.
+ * The last 20 bytes are the account's Ethereum address.
+ */
+declare function computeNetworkId(uncompressedPublicKey: Uint8Array | Hex): Hex;
+
+/**
+ * Derives the full `v1` device identity — `networkId` plus the four-key
+ * all-secp256k1 model — from a single device secret.
+ *
+ * Pipeline (NORMATIVE):
+ * 1. `account = deriveAccountKeypair(deviceSecret)`
+ * 2. `networkId = computeNetworkId(account.uncompressedPublicKey)`
+ * 3. `sig = signDerivationMessage(account.privateKey)` (EIP-191, deterministic)
+ * 4. `{ spending, viewing } = deriveStealthKeys(sig)` (FluidKey semantics)
+ * 5. `auth = deriveAuthKeypair(sig)`
+ */
+declare function deriveKeys(deviceSecret: Uint8Array | Hex): DerivedKeys;
+/** Derives only the `networkId` — equal to `deriveKeys(deviceSecret).networkId`, minus the signature work. */
+declare function deriveNetworkId(deviceSecret: Uint8Array | Hex): Hex;
+
+/**
+ * Normalizes a P-256 `confirmationKey` to its raw 64-byte `X || Y`
+ * coordinates, validating that the point is on the curve. Accepts a 65-byte
+ * SEC1 uncompressed, 33-byte compressed, or 64-byte raw `X || Y` encoding.
+ */
+declare function normalizeConfirmationKey(confirmationKey: Uint8Array | Hex): Uint8Array;
+/**
+ * Computes the `confirmationKeyHash` embedded in the account binding message.
+ *
+ * NORMATIVE: the RFC 7638 JWK thumbprint of the P-256 confirmation key, i.e.
+ * `sha256(utf8('{"crv":"P-256","kty":"EC","x":<base64url X>,"y":<base64url Y>}'))`
+ */
+declare function computeConfirmationKeyHash(confirmationKey: Uint8Array | Hex): Hex;
+
+/**
+ * Credential dual proof-of-possession binding — see `DERIVATION.md` §11.
+ *
+ * NORMATIVE layouts:
+ * ```
+ * deviceBindingMessage  = nonce(32) || networkId(32) || holderKeyCommitment(32) // credential issuance
+ * accountBindingMessage = nonce(32) || confirmationKeyHash(32) || networkId(32) // 96B, signed by A (secp256k1)
+ * ```
+ *
+ * NORMATIVE MUST: the device signs a locally-derived `networkId`, never one
+ * supplied by the issuance request. Every function here except the two
+ * low-level builders and {@link verifyDeviceBindingSignature} enforces this
+ * by deriving `networkId` internally rather than accepting it as a parameter.
+ */
+
+/**
+ * Builds `nonce(32) || networkId(32)`, optionally followed by a 32-byte holder commitment.
+ *
+ * Low-level, spec-literal builder — prefer {@link buildBindingMessages},
+ * which enforces the locally-derived-`networkId` MUST structurally.
+ */
+declare function buildDeviceBindingMessage(nonce: Uint8Array | Hex, networkId: Uint8Array | Hex, holderKeyCommitment?: Uint8Array | Hex): Uint8Array;
+/**
+ * Builds the 96-byte `accountBindingMessage`:
+ * `nonce(32) || confirmationKeyHash(32) || networkId(32)`.
+ *
+ * Low-level, spec-literal builder — see {@link buildBindingMessages} for the
+ * wallet-side entry point.
+ */
+declare function buildAccountBindingMessage(nonce: Uint8Array | Hex, confirmationKey: Uint8Array | Hex, networkId: Uint8Array | Hex): Uint8Array;
+/**
+ * Wallet-side entry point: builds both binding messages with `networkId`
+ * derived internally from the account's own public key, so a caller cannot
+ * supply a `networkId` from elsewhere even by mistake.
+ */
+declare function buildBindingMessages(nonce: Uint8Array | Hex, accountUncompressedPublicKey: Uint8Array | Hex, confirmationKey: Uint8Array | Hex, holderKeyCommitment?: Uint8Array | Hex): {
+    networkId: Hex;
+    deviceBindingMessage: Uint8Array;
+    accountBindingMessage: Uint8Array;
+};
+/**
+ * Produces `sig_A`: the EIP-191 signature over the `accountBindingMessage`,
+ * with `networkId` derived internally from the account private key. Same
+ * signing posture as {@link signDerivationMessage} (RFC-6979 deterministic,
+ * `lowS: true`, no `extraEntropy`, 64-byte compact `r || s`).
+ */
+declare function signAccountBinding(accountPrivateKey: Hex | Uint8Array, nonce: Uint8Array | Hex, confirmationKey: Uint8Array | Hex): {
+    signature: Hex;
+    networkId: Hex;
+};
+/**
+ * Issuer-side verification of `sig_A`, with `networkId` derived internally
+ * from `accountPublicKey` — never accepted as a parameter.
+ *
+ * Malformed inputs throw {@link InvalidBindingInputError}; a well-formed
+ * signature that fails to verify returns `false`.
+ */
+declare function verifyAccountBindingSignature({ nonce, confirmationKey, accountPublicKey, signature }: {
+    nonce: Uint8Array | Hex;
+    confirmationKey: Uint8Array | Hex;
+    accountPublicKey: Uint8Array | Hex;
+    signature: Uint8Array | Hex;
+}): boolean;
+/**
+ * Issuer-side verification of `sig_B` (hardware P-256) over the
+ * `deviceBindingMessage`. NORMATIVE MUST: `networkId` — not derivable here,
+ * since `sig_B` is independent of the account key — must be the device's
+ * locally-derived value; prefer {@link verifyCredentialBinding}.
+ *
+ * `prehash: true` (signers hash SHA-256 internally); `lowS: false` (hardware
+ * signatures aren't s-normalized — `DERIVATION.md` §11.4).
+ */
+declare function verifyDeviceBindingSignature({ nonce, networkId, confirmationKey, holderKeyCommitment, signature }: {
+    nonce: Uint8Array | Hex;
+    networkId: Uint8Array | Hex;
+    confirmationKey: Uint8Array | Hex;
+    holderKeyCommitment?: Uint8Array | Hex;
+    signature: Uint8Array | Hex;
+}): boolean;
+/**
+ * The full issuer gate: one `networkId` derived from `accountPublicKey` gates
+ * both `sig_A` and `sig_B`, so a device signature from one session can't pair
+ * with an unrelated account signature in either direction. `networkId` is
+ * returned even when `valid` is false, for issuer-side logging/rate-limiting.
+ */
+declare function verifyCredentialBinding({ nonce, accountPublicKey, confirmationKey, holderKeyCommitment, accountSignature, deviceSignature }: {
+    nonce: Uint8Array | Hex;
+    accountPublicKey: Uint8Array | Hex;
+    confirmationKey: Uint8Array | Hex;
+    holderKeyCommitment?: Uint8Array | Hex;
+    accountSignature: Uint8Array | Hex;
+    deviceSignature: Uint8Array | Hex;
+}): {
+    valid: boolean;
+    networkId: Hex;
+};
+
+export { BINDING_NONCE_LENGTH, COMPRESSED_PUBLIC_KEY_LENGTH, DOMAIN_ACCOUNT, DOMAIN_AUTH, DOMAIN_EDDSA, DOMAIN_EDDSA_PEER, DerivationFailureError, EDDSA_PEER_POINT_HEX, ERC_5564_SCHEME_ID, FIXED_DOMAIN_MSG, InvalidBindingInputError, InvalidDeviceSecretError, InvalidEcdhSecretError, InvalidMetaStealthAddressError, InvalidPublicKeyLengthError, KEY_DERIVATION_VERSION, KeygenError, META_STEALTH_ADDRESS_LENGTH, META_STEALTH_URI_PREFIX, base64urlToBytes, buildAccountBindingMessage, buildAnnouncement, buildBindingMessages, buildDeviceBindingMessage, bytesToBase64url, bytesToHex, checkStealthAddress, computeConfirmationKeyHash, computeEddsaPeerPoint, computeNetworkId, computeSharedSecret, decodeMetaStealthAddress, deriveAccountKeypair, deriveAuthKeypair, deriveEddsaKeypair, deriveKeys, deriveNetworkId, deriveStealthKeys, eddsaPeerPointBytes, encodeMetaStealthAddress, encodeMetaStealthAddressUri, generateDeviceSecret, generateEphemeralKey, generateStealthAddress, generateStealthPrivateKey, getStealthPublicKey, getViewTag, hashToScalar, hashToScalarWith, hexToBytes, isValidScalar, metaStealthAddressUri, normalizeConfirmationKey, normalizeDeviceSecret, normalizeEcdhSharedSecret, publicKeyToAddress, scalarToKeypair, signAccountBinding, signDerivationMessage, validateMetaStealthAddress, verifyAccountBindingSignature, verifyCredentialBinding, verifyDeviceBindingSignature };
+export type { Address, DerivedKeys, EddsaKeypair, HashFn, Hex, KeygenErrorCode, Secp256k1Keypair };