@coordination-network/identity 0.0.2 → 0.1.1

package/dist/index.cjs

@@ -10,11 +10,11 @@ var p256 = require('@noble/curves/p256');
 var sha2 = require('@noble/hashes/sha2');
 
 /**
- * Normative constants for the `v1` key derivation scheme. Changing any of
+ * Normative constants for the `v2` key derivation scheme. Changing any of
  * these changes every derived key and `networkId`, so they MUST NOT change
  * without a version bump (new `KEY_DERIVATION_VERSION` and domain strings).
  */
-const KEY_DERIVATION_VERSION = "v1";
+const KEY_DERIVATION_VERSION = "v2";
 /** Fixed domain-separation message signed by {@link signDerivationMessage}. */
 const FIXED_DOMAIN_MSG = "coordination-network/identity/v1";
 /** Domain-separation tag for deriving the account keypair from a device secret. */
@@ -23,11 +23,15 @@ const DOMAIN_ACCOUNT = "coordination-network/identity/v1/account";
 const DOMAIN_AUTH = "coordination-network/identity/v1/auth";
 /** Domain-separation tag for deriving the Baby Jubjub EdDSA seed (the "fifth key") from the hardware ECDH shared secret. */
 const DOMAIN_EDDSA = "coordination-network/identity/v1/eddsa";
+/** Distinct Baby Jubjub seed for public paymaster membership; never use the credential holder key as a group leaf. */
+const DOMAIN_PAYMASTER = "coordination-network/identity/v1/paymaster";
 /** Domain-separation message hashed to the fixed NUMS P-256 peer point `Q` for the fifth-key ECDH (`eddsa-peer.ts`). */
 const DOMAIN_EDDSA_PEER = "coordination-network/identity/v1/eddsa/peer";
+/** Domain-separation tag prefixed to `X || Y` when hashing a user `networkId`. */
+const DOMAIN_NETWORK_ID = "coordination-network/identity/v2/network-id";
 /**
  * Byte length of `nonce` and `networkId` in the binding messages — fixed at
- * 32 so the 64- vs 96-byte messages are injective.
+ * 32 so the 128-byte device and 96-byte account messages are injective.
  */
 const BINDING_NONCE_LENGTH = 32;
 /** SEC1-compressed secp256k1 public key length. */
@@ -548,6 +552,19 @@ function deriveAuthKeypair(sig64) {
 }
 
 /** Baby Jubjub EdDSA "fifth key" derivation — see `DERIVATION.md` §12. */
+function deriveKeypair(ecdhSharedSecret, domain) {
+    const secret = normalizeEcdhSharedSecret(ecdhSharedSecret);
+    const seed = sha3.keccak_256(utils.concatBytes(utils.utf8ToBytes(domain), secret));
+    const secretScalar = eddsaPoseidon.deriveSecretScalar(seed);
+    const publicKey = eddsaPoseidon.derivePublicKey(seed);
+    const commitment = poseidon2.poseidon2(publicKey);
+    return {
+        seed: bytesToHex(seed),
+        secretScalar,
+        publicKey,
+        commitment
+    };
+}
 /**
  * Derives the Baby Jubjub EdDSA keypair and Semaphore-v4 identity commitment
  * (the "fifth key"), rooted in a hardware ECDH shared secret.
@@ -562,17 +579,11 @@ function deriveAuthKeypair(sig64) {
  * @throws {InvalidEcdhSecretError} if `ecdhSharedSecret` is not exactly 32 bytes
  */
 function deriveEddsaKeypair(ecdhSharedSecret) {
-    const secret = normalizeEcdhSharedSecret(ecdhSharedSecret);
-    const seed = sha3.keccak_256(utils.concatBytes(utils.utf8ToBytes(DOMAIN_EDDSA), secret));
-    const secretScalar = eddsaPoseidon.deriveSecretScalar(seed);
-    const publicKey = eddsaPoseidon.derivePublicKey(seed);
-    const commitment = poseidon2.poseidon2(publicKey);
-    return {
-        seed: bytesToHex(seed),
-        secretScalar,
-        publicKey,
-        commitment
-    };
+    return deriveKeypair(ecdhSharedSecret, DOMAIN_EDDSA);
+}
+/** Derives a separate Semaphore identity whose public commitment may join the paymaster group. */
+function derivePaymasterKeypair(ecdhSharedSecret) {
+    return deriveKeypair(ecdhSharedSecret, DOMAIN_PAYMASTER);
 }
 
 /** Fixed NUMS P-256 peer point `Q` for the fifth-key ECDH — see `DERIVATION.md` §12. */
@@ -599,35 +610,46 @@ function computeEddsaPeerPoint() {
     return p256.p256.ProjectivePoint.fromAffine(point.toAffine()).toRawBytes(false);
 }
 
-/**
- * Computes the bytes32 `networkId` from an uncompressed secp256k1 public key
- * (65-byte SEC1 `0x04`-prefixed or 64-byte raw `X || Y`).
- *
- * NORMATIVE: `networkId = keccak256(X || Y)` — the SEC1 prefix is stripped.
- * The last 20 bytes are the account's Ethereum address.
- */
-function computeNetworkId(uncompressedPublicKey) {
+function publicKeyCoordinates(uncompressedPublicKey, caller) {
     const bytes = toBytes(uncompressedPublicKey);
-    let coordinates;
     if (bytes.length === 65 && bytes[0] === 0x04) {
-        coordinates = bytes.slice(1);
+        return bytes.slice(1);
     }
-    else if (bytes.length === 64) {
-        coordinates = bytes;
-    }
-    else {
-        throw new TypeError("computeNetworkId: expected a 65-byte 0x04-prefixed or 64-byte raw uncompressed public key");
+    if (bytes.length === 64) {
+        return bytes;
     }
+    throw new TypeError(`${caller}: expected a 65-byte 0x04-prefixed or 64-byte raw uncompressed public key`);
+}
+/**
+ * Computes a user's bytes32 `networkId` from an uncompressed secp256k1 public
+ * key (65-byte SEC1 `0x04`-prefixed or 64-byte raw `X || Y`).
+ *
+ * NORMATIVE: `networkId = keccak256(utf8(DOMAIN_NETWORK_ID) || X || Y)` — the
+ * SEC1 prefix is stripped.
+ */
+function computeNetworkId(uncompressedPublicKey) {
+    const coordinates = publicKeyCoordinates(uncompressedPublicKey, "computeNetworkId");
+    return bytesToHex(sha3.keccak_256(utils.concatBytes(utils.utf8ToBytes(DOMAIN_NETWORK_ID), coordinates)));
+}
+/**
+ * Computes a member's bytes32 id from the same public key forms.
+ *
+ * NORMATIVE: `memberNetworkId = keccak256(X || Y)`. The last 20 bytes are the
+ * member's auth address, which `NetworkMemberRegistry` reads.
+ */
+function computeMemberNetworkId(uncompressedPublicKey) {
+    const coordinates = publicKeyCoordinates(uncompressedPublicKey, "computeMemberNetworkId");
     return bytesToHex(sha3.keccak_256(coordinates));
 }
 
 /**
- * Derives the full `v1` device identity — `networkId` plus the four-key
- * all-secp256k1 model — from a single device secret.
+ * Derives the full `v2` device identity — `networkId`, `memberNetworkId` and the account,
+ * spending, viewing and auth secp256k1 keypairs — from a single device secret.
  *
  * Pipeline (NORMATIVE):
  * 1. `account = deriveAccountKeypair(deviceSecret)`
- * 2. `networkId = computeNetworkId(account.uncompressedPublicKey)`
+ * 2. `networkId = computeNetworkId(account.uncompressedPublicKey)` and
+ *    `memberNetworkId = computeMemberNetworkId(account.uncompressedPublicKey)`
  * 3. `sig = signDerivationMessage(account.privateKey)` (EIP-191, deterministic)
  * 4. `{ spending, viewing } = deriveStealthKeys(sig)` (FluidKey semantics)
  * 5. `auth = deriveAuthKeypair(sig)`
@@ -635,12 +657,14 @@ function computeNetworkId(uncompressedPublicKey) {
 function deriveKeys(deviceSecret) {
     const account = deriveAccountKeypair(deviceSecret);
     const networkId = computeNetworkId(account.uncompressedPublicKey);
+    const memberNetworkId = computeMemberNetworkId(account.uncompressedPublicKey);
     const signature = signDerivationMessage(account.privateKey);
     const { spending, viewing } = deriveStealthKeys(signature);
     const auth = deriveAuthKeypair(signature);
     return {
         version: KEY_DERIVATION_VERSION,
         networkId,
+        memberNetworkId,
         account,
         spending,
         viewing,
@@ -695,10 +719,15 @@ function computeConfirmationKeyHash(confirmationKey) {
  *
  * NORMATIVE layouts:
  * ```
- * deviceBindingMessage  = nonce(32) || networkId(32) || holderKeyCommitment(32) // credential issuance
- * accountBindingMessage = nonce(32) || confirmationKeyHash(32) || networkId(32) // 96B, signed by A (secp256k1)
+ * deviceBindingMessage  = nonce(32) || networkId(32) || holderKeyCommitment(32) || requestCommitment(32)
+ * accountBindingMessage = nonce(32) || confirmationKeyHash(32) || networkId(32)
  * ```
  *
+ * B (P-256) signs the 128-byte device message; A (secp256k1) signs the 96-byte account message.
+ *
+ * `requestCommitment` is opaque here: the credential layer defines it and
+ * binds the issuer and scope shown at consent into it.
+ *
  * NORMATIVE MUST: the device signs a locally-derived `networkId`, never one
  * supplied by the issuance request. Every function here except the two
  * low-level builders and {@link verifyDeviceBindingSignature} enforces this
@@ -712,6 +741,12 @@ function toBindingBytes(value, label) {
         throw new InvalidBindingInputError(`${label}: expected raw bytes or a well-formed 0x-prefixed hex string`);
     }
 }
+function toBindingHash32(value, label) {
+    const bytes = toBindingBytes(value, label);
+    if (bytes.length !== 32)
+        throw new InvalidBindingInputError(`${label}: expected exactly 32 bytes`);
+    return bytes;
+}
 function decodeAndValidateNonceAndNetworkId(nonce, networkId) {
     const nonceBytes = toBindingBytes(nonce, "nonce");
     const networkIdBytes = toBindingBytes(networkId, "networkId");
@@ -776,19 +811,17 @@ function parseDeviceSignature(signature) {
     throw new InvalidBindingInputError("deviceSignature: expected a 64-byte compact (r || s) or DER-encoded P-256 signature");
 }
 /**
- * Builds `nonce(32) || networkId(32)`, optionally followed by a 32-byte holder commitment.
+ * Builds the 128-byte `deviceBindingMessage`:
+ * `nonce(32) || networkId(32) || holderKeyCommitment(32) || requestCommitment(32)`.
  *
  * Low-level, spec-literal builder — prefer {@link buildBindingMessages},
  * which enforces the locally-derived-`networkId` MUST structurally.
  */
-function buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment) {
+function buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment, requestCommitment) {
     const { nonceBytes, networkIdBytes } = decodeAndValidateNonceAndNetworkId(nonce, networkId);
-    if (holderKeyCommitment === undefined)
-        return utils.concatBytes(nonceBytes, networkIdBytes);
-    const holderBytes = toBindingBytes(holderKeyCommitment, "holderKeyCommitment");
-    if (holderBytes.length !== 32)
-        throw new InvalidBindingInputError("holderKeyCommitment: expected exactly 32 bytes");
-    return utils.concatBytes(nonceBytes, networkIdBytes, holderBytes);
+    const holderBytes = toBindingHash32(holderKeyCommitment, "holderKeyCommitment");
+    const requestBytes = toBindingHash32(requestCommitment, "requestCommitment");
+    return utils.concatBytes(nonceBytes, networkIdBytes, holderBytes, requestBytes);
 }
 /**
  * Builds the 96-byte `accountBindingMessage`:
@@ -807,7 +840,7 @@ function buildAccountBindingMessage(nonce, confirmationKey, networkId) {
  * derived internally from the account's own public key, so a caller cannot
  * supply a `networkId` from elsewhere even by mistake.
  */
-function buildBindingMessages(nonce, accountUncompressedPublicKey, confirmationKey, holderKeyCommitment) {
+function buildBindingMessages(nonce, accountUncompressedPublicKey, confirmationKey, holderKeyCommitment, requestCommitment) {
     let networkId;
     try {
         networkId = computeNetworkId(accountUncompressedPublicKey);
@@ -815,7 +848,7 @@ function buildBindingMessages(nonce, accountUncompressedPublicKey, confirmationK
     catch {
         throw new InvalidBindingInputError("accountUncompressedPublicKey: expected a 65-byte 0x04-prefixed or 64-byte raw uncompressed secp256k1 public key");
     }
-    const deviceBindingMessage = buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment);
+    const deviceBindingMessage = buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment, requestCommitment);
     const accountBindingMessage = buildAccountBindingMessage(nonce, confirmationKey, networkId);
     return { networkId, deviceBindingMessage, accountBindingMessage };
 }
@@ -858,8 +891,8 @@ function verifyAccountBindingSignature({ nonce, confirmationKey, accountPublicKe
  * `prehash: true` (signers hash SHA-256 internally); `lowS: false` (hardware
  * signatures aren't s-normalized — `DERIVATION.md` §11.4).
  */
-function verifyDeviceBindingSignature({ nonce, networkId, confirmationKey, holderKeyCommitment, signature }) {
-    const message = buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment);
+function verifyDeviceBindingSignature({ nonce, networkId, confirmationKey, holderKeyCommitment, requestCommitment, signature }) {
+    const message = buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment, requestCommitment);
     const publicKeyBytes = prependUncompressedPrefix(normalizeConfirmationKey(confirmationKey));
     const parsedSignature = parseDeviceSignature(signature);
     return p256.p256.verify(parsedSignature.toCompactRawBytes(), message, publicKeyBytes, {
@@ -873,7 +906,7 @@ function verifyDeviceBindingSignature({ nonce, networkId, confirmationKey, holde
  * with an unrelated account signature in either direction. `networkId` is
  * returned even when `valid` is false, for issuer-side logging/rate-limiting.
  */
-function verifyCredentialBinding({ nonce, accountPublicKey, confirmationKey, holderKeyCommitment, accountSignature, deviceSignature }) {
+function verifyCredentialBinding({ nonce, accountPublicKey, confirmationKey, holderKeyCommitment, requestCommitment, accountSignature, deviceSignature }) {
     const publicKeyBytes = normalizeAccountPublicKey(accountPublicKey);
     const networkId = computeNetworkId(publicKeyBytes);
     const accountValid = verifyAccountBindingSignature({
@@ -887,6 +920,7 @@ function verifyCredentialBinding({ nonce, accountPublicKey, confirmationKey, hol
         networkId,
         confirmationKey,
         holderKeyCommitment,
+        requestCommitment,
         signature: deviceSignature
     });
     return { valid: accountValid && deviceValid, networkId };
@@ -898,6 +932,8 @@ exports.DOMAIN_ACCOUNT = DOMAIN_ACCOUNT;
 exports.DOMAIN_AUTH = DOMAIN_AUTH;
 exports.DOMAIN_EDDSA = DOMAIN_EDDSA;
 exports.DOMAIN_EDDSA_PEER = DOMAIN_EDDSA_PEER;
+exports.DOMAIN_NETWORK_ID = DOMAIN_NETWORK_ID;
+exports.DOMAIN_PAYMASTER = DOMAIN_PAYMASTER;
 exports.DerivationFailureError = DerivationFailureError;
 exports.EDDSA_PEER_POINT_HEX = EDDSA_PEER_POINT_HEX;
 exports.ERC_5564_SCHEME_ID = ERC_5564_SCHEME_ID;
@@ -921,6 +957,7 @@ exports.bytesToHex = bytesToHex;
 exports.checkStealthAddress = checkStealthAddress;
 exports.computeConfirmationKeyHash = computeConfirmationKeyHash;
 exports.computeEddsaPeerPoint = computeEddsaPeerPoint;
+exports.computeMemberNetworkId = computeMemberNetworkId;
 exports.computeNetworkId = computeNetworkId;
 exports.computeSharedSecret = computeSharedSecret;
 exports.decodeMetaStealthAddress = decodeMetaStealthAddress;
@@ -929,6 +966,7 @@ exports.deriveAuthKeypair = deriveAuthKeypair;
 exports.deriveEddsaKeypair = deriveEddsaKeypair;
 exports.deriveKeys = deriveKeys;
 exports.deriveNetworkId = deriveNetworkId;
+exports.derivePaymasterKeypair = derivePaymasterKeypair;
 exports.deriveStealthKeys = deriveStealthKeys;
 exports.eddsaPeerPointBytes = eddsaPeerPointBytes;
 exports.encodeMetaStealthAddress = encodeMetaStealthAddress;

package/dist/index.js

@@ -8,11 +8,11 @@ import { hashToCurve, p256 } from '@noble/curves/p256';
 import { sha256 } from '@noble/hashes/sha2';
 
 /**
- * Normative constants for the `v1` key derivation scheme. Changing any of
+ * Normative constants for the `v2` key derivation scheme. Changing any of
  * these changes every derived key and `networkId`, so they MUST NOT change
  * without a version bump (new `KEY_DERIVATION_VERSION` and domain strings).
  */
-const KEY_DERIVATION_VERSION = "v1";
+const KEY_DERIVATION_VERSION = "v2";
 /** Fixed domain-separation message signed by {@link signDerivationMessage}. */
 const FIXED_DOMAIN_MSG = "coordination-network/identity/v1";
 /** Domain-separation tag for deriving the account keypair from a device secret. */
@@ -21,11 +21,15 @@ const DOMAIN_ACCOUNT = "coordination-network/identity/v1/account";
 const DOMAIN_AUTH = "coordination-network/identity/v1/auth";
 /** Domain-separation tag for deriving the Baby Jubjub EdDSA seed (the "fifth key") from the hardware ECDH shared secret. */
 const DOMAIN_EDDSA = "coordination-network/identity/v1/eddsa";
+/** Distinct Baby Jubjub seed for public paymaster membership; never use the credential holder key as a group leaf. */
+const DOMAIN_PAYMASTER = "coordination-network/identity/v1/paymaster";
 /** Domain-separation message hashed to the fixed NUMS P-256 peer point `Q` for the fifth-key ECDH (`eddsa-peer.ts`). */
 const DOMAIN_EDDSA_PEER = "coordination-network/identity/v1/eddsa/peer";
+/** Domain-separation tag prefixed to `X || Y` when hashing a user `networkId`. */
+const DOMAIN_NETWORK_ID = "coordination-network/identity/v2/network-id";
 /**
  * Byte length of `nonce` and `networkId` in the binding messages — fixed at
- * 32 so the 64- vs 96-byte messages are injective.
+ * 32 so the 128-byte device and 96-byte account messages are injective.
  */
 const BINDING_NONCE_LENGTH = 32;
 /** SEC1-compressed secp256k1 public key length. */
@@ -546,6 +550,19 @@ function deriveAuthKeypair(sig64) {
 }
 
 /** Baby Jubjub EdDSA "fifth key" derivation — see `DERIVATION.md` §12. */
+function deriveKeypair(ecdhSharedSecret, domain) {
+    const secret = normalizeEcdhSharedSecret(ecdhSharedSecret);
+    const seed = keccak_256(concatBytes(utf8ToBytes(domain), secret));
+    const secretScalar = deriveSecretScalar(seed);
+    const publicKey = derivePublicKey(seed);
+    const commitment = poseidon2(publicKey);
+    return {
+        seed: bytesToHex(seed),
+        secretScalar,
+        publicKey,
+        commitment
+    };
+}
 /**
  * Derives the Baby Jubjub EdDSA keypair and Semaphore-v4 identity commitment
  * (the "fifth key"), rooted in a hardware ECDH shared secret.
@@ -560,17 +577,11 @@ function deriveAuthKeypair(sig64) {
  * @throws {InvalidEcdhSecretError} if `ecdhSharedSecret` is not exactly 32 bytes
  */
 function deriveEddsaKeypair(ecdhSharedSecret) {
-    const secret = normalizeEcdhSharedSecret(ecdhSharedSecret);
-    const seed = keccak_256(concatBytes(utf8ToBytes(DOMAIN_EDDSA), secret));
-    const secretScalar = deriveSecretScalar(seed);
-    const publicKey = derivePublicKey(seed);
-    const commitment = poseidon2(publicKey);
-    return {
-        seed: bytesToHex(seed),
-        secretScalar,
-        publicKey,
-        commitment
-    };
+    return deriveKeypair(ecdhSharedSecret, DOMAIN_EDDSA);
+}
+/** Derives a separate Semaphore identity whose public commitment may join the paymaster group. */
+function derivePaymasterKeypair(ecdhSharedSecret) {
+    return deriveKeypair(ecdhSharedSecret, DOMAIN_PAYMASTER);
 }
 
 /** Fixed NUMS P-256 peer point `Q` for the fifth-key ECDH — see `DERIVATION.md` §12. */
@@ -597,35 +608,46 @@ function computeEddsaPeerPoint() {
     return p256.ProjectivePoint.fromAffine(point.toAffine()).toRawBytes(false);
 }
 
-/**
- * Computes the bytes32 `networkId` from an uncompressed secp256k1 public key
- * (65-byte SEC1 `0x04`-prefixed or 64-byte raw `X || Y`).
- *
- * NORMATIVE: `networkId = keccak256(X || Y)` — the SEC1 prefix is stripped.
- * The last 20 bytes are the account's Ethereum address.
- */
-function computeNetworkId(uncompressedPublicKey) {
+function publicKeyCoordinates(uncompressedPublicKey, caller) {
     const bytes = toBytes(uncompressedPublicKey);
-    let coordinates;
     if (bytes.length === 65 && bytes[0] === 0x04) {
-        coordinates = bytes.slice(1);
+        return bytes.slice(1);
     }
-    else if (bytes.length === 64) {
-        coordinates = bytes;
-    }
-    else {
-        throw new TypeError("computeNetworkId: expected a 65-byte 0x04-prefixed or 64-byte raw uncompressed public key");
+    if (bytes.length === 64) {
+        return bytes;
     }
+    throw new TypeError(`${caller}: expected a 65-byte 0x04-prefixed or 64-byte raw uncompressed public key`);
+}
+/**
+ * Computes a user's bytes32 `networkId` from an uncompressed secp256k1 public
+ * key (65-byte SEC1 `0x04`-prefixed or 64-byte raw `X || Y`).
+ *
+ * NORMATIVE: `networkId = keccak256(utf8(DOMAIN_NETWORK_ID) || X || Y)` — the
+ * SEC1 prefix is stripped.
+ */
+function computeNetworkId(uncompressedPublicKey) {
+    const coordinates = publicKeyCoordinates(uncompressedPublicKey, "computeNetworkId");
+    return bytesToHex(keccak_256(concatBytes(utf8ToBytes(DOMAIN_NETWORK_ID), coordinates)));
+}
+/**
+ * Computes a member's bytes32 id from the same public key forms.
+ *
+ * NORMATIVE: `memberNetworkId = keccak256(X || Y)`. The last 20 bytes are the
+ * member's auth address, which `NetworkMemberRegistry` reads.
+ */
+function computeMemberNetworkId(uncompressedPublicKey) {
+    const coordinates = publicKeyCoordinates(uncompressedPublicKey, "computeMemberNetworkId");
     return bytesToHex(keccak_256(coordinates));
 }
 
 /**
- * Derives the full `v1` device identity — `networkId` plus the four-key
- * all-secp256k1 model — from a single device secret.
+ * Derives the full `v2` device identity — `networkId`, `memberNetworkId` and the account,
+ * spending, viewing and auth secp256k1 keypairs — from a single device secret.
  *
  * Pipeline (NORMATIVE):
  * 1. `account = deriveAccountKeypair(deviceSecret)`
- * 2. `networkId = computeNetworkId(account.uncompressedPublicKey)`
+ * 2. `networkId = computeNetworkId(account.uncompressedPublicKey)` and
+ *    `memberNetworkId = computeMemberNetworkId(account.uncompressedPublicKey)`
  * 3. `sig = signDerivationMessage(account.privateKey)` (EIP-191, deterministic)
  * 4. `{ spending, viewing } = deriveStealthKeys(sig)` (FluidKey semantics)
  * 5. `auth = deriveAuthKeypair(sig)`
@@ -633,12 +655,14 @@ function computeNetworkId(uncompressedPublicKey) {
 function deriveKeys(deviceSecret) {
     const account = deriveAccountKeypair(deviceSecret);
     const networkId = computeNetworkId(account.uncompressedPublicKey);
+    const memberNetworkId = computeMemberNetworkId(account.uncompressedPublicKey);
     const signature = signDerivationMessage(account.privateKey);
     const { spending, viewing } = deriveStealthKeys(signature);
     const auth = deriveAuthKeypair(signature);
     return {
         version: KEY_DERIVATION_VERSION,
         networkId,
+        memberNetworkId,
         account,
         spending,
         viewing,
@@ -693,10 +717,15 @@ function computeConfirmationKeyHash(confirmationKey) {
  *
  * NORMATIVE layouts:
  * ```
- * deviceBindingMessage  = nonce(32) || networkId(32) || holderKeyCommitment(32) // credential issuance
- * accountBindingMessage = nonce(32) || confirmationKeyHash(32) || networkId(32) // 96B, signed by A (secp256k1)
+ * deviceBindingMessage  = nonce(32) || networkId(32) || holderKeyCommitment(32) || requestCommitment(32)
+ * accountBindingMessage = nonce(32) || confirmationKeyHash(32) || networkId(32)
  * ```
  *
+ * B (P-256) signs the 128-byte device message; A (secp256k1) signs the 96-byte account message.
+ *
+ * `requestCommitment` is opaque here: the credential layer defines it and
+ * binds the issuer and scope shown at consent into it.
+ *
  * NORMATIVE MUST: the device signs a locally-derived `networkId`, never one
  * supplied by the issuance request. Every function here except the two
  * low-level builders and {@link verifyDeviceBindingSignature} enforces this
@@ -710,6 +739,12 @@ function toBindingBytes(value, label) {
         throw new InvalidBindingInputError(`${label}: expected raw bytes or a well-formed 0x-prefixed hex string`);
     }
 }
+function toBindingHash32(value, label) {
+    const bytes = toBindingBytes(value, label);
+    if (bytes.length !== 32)
+        throw new InvalidBindingInputError(`${label}: expected exactly 32 bytes`);
+    return bytes;
+}
 function decodeAndValidateNonceAndNetworkId(nonce, networkId) {
     const nonceBytes = toBindingBytes(nonce, "nonce");
     const networkIdBytes = toBindingBytes(networkId, "networkId");
@@ -774,19 +809,17 @@ function parseDeviceSignature(signature) {
     throw new InvalidBindingInputError("deviceSignature: expected a 64-byte compact (r || s) or DER-encoded P-256 signature");
 }
 /**
- * Builds `nonce(32) || networkId(32)`, optionally followed by a 32-byte holder commitment.
+ * Builds the 128-byte `deviceBindingMessage`:
+ * `nonce(32) || networkId(32) || holderKeyCommitment(32) || requestCommitment(32)`.
  *
  * Low-level, spec-literal builder — prefer {@link buildBindingMessages},
  * which enforces the locally-derived-`networkId` MUST structurally.
  */
-function buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment) {
+function buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment, requestCommitment) {
     const { nonceBytes, networkIdBytes } = decodeAndValidateNonceAndNetworkId(nonce, networkId);
-    if (holderKeyCommitment === undefined)
-        return concatBytes(nonceBytes, networkIdBytes);
-    const holderBytes = toBindingBytes(holderKeyCommitment, "holderKeyCommitment");
-    if (holderBytes.length !== 32)
-        throw new InvalidBindingInputError("holderKeyCommitment: expected exactly 32 bytes");
-    return concatBytes(nonceBytes, networkIdBytes, holderBytes);
+    const holderBytes = toBindingHash32(holderKeyCommitment, "holderKeyCommitment");
+    const requestBytes = toBindingHash32(requestCommitment, "requestCommitment");
+    return concatBytes(nonceBytes, networkIdBytes, holderBytes, requestBytes);
 }
 /**
  * Builds the 96-byte `accountBindingMessage`:
@@ -805,7 +838,7 @@ function buildAccountBindingMessage(nonce, confirmationKey, networkId) {
  * derived internally from the account's own public key, so a caller cannot
  * supply a `networkId` from elsewhere even by mistake.
  */
-function buildBindingMessages(nonce, accountUncompressedPublicKey, confirmationKey, holderKeyCommitment) {
+function buildBindingMessages(nonce, accountUncompressedPublicKey, confirmationKey, holderKeyCommitment, requestCommitment) {
     let networkId;
     try {
         networkId = computeNetworkId(accountUncompressedPublicKey);
@@ -813,7 +846,7 @@ function buildBindingMessages(nonce, accountUncompressedPublicKey, confirmationK
     catch {
         throw new InvalidBindingInputError("accountUncompressedPublicKey: expected a 65-byte 0x04-prefixed or 64-byte raw uncompressed secp256k1 public key");
     }
-    const deviceBindingMessage = buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment);
+    const deviceBindingMessage = buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment, requestCommitment);
     const accountBindingMessage = buildAccountBindingMessage(nonce, confirmationKey, networkId);
     return { networkId, deviceBindingMessage, accountBindingMessage };
 }
@@ -856,8 +889,8 @@ function verifyAccountBindingSignature({ nonce, confirmationKey, accountPublicKe
  * `prehash: true` (signers hash SHA-256 internally); `lowS: false` (hardware
  * signatures aren't s-normalized — `DERIVATION.md` §11.4).
  */
-function verifyDeviceBindingSignature({ nonce, networkId, confirmationKey, holderKeyCommitment, signature }) {
-    const message = buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment);
+function verifyDeviceBindingSignature({ nonce, networkId, confirmationKey, holderKeyCommitment, requestCommitment, signature }) {
+    const message = buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment, requestCommitment);
     const publicKeyBytes = prependUncompressedPrefix(normalizeConfirmationKey(confirmationKey));
     const parsedSignature = parseDeviceSignature(signature);
     return p256.verify(parsedSignature.toCompactRawBytes(), message, publicKeyBytes, {
@@ -871,7 +904,7 @@ function verifyDeviceBindingSignature({ nonce, networkId, confirmationKey, holde
  * with an unrelated account signature in either direction. `networkId` is
  * returned even when `valid` is false, for issuer-side logging/rate-limiting.
  */
-function verifyCredentialBinding({ nonce, accountPublicKey, confirmationKey, holderKeyCommitment, accountSignature, deviceSignature }) {
+function verifyCredentialBinding({ nonce, accountPublicKey, confirmationKey, holderKeyCommitment, requestCommitment, accountSignature, deviceSignature }) {
     const publicKeyBytes = normalizeAccountPublicKey(accountPublicKey);
     const networkId = computeNetworkId(publicKeyBytes);
     const accountValid = verifyAccountBindingSignature({
@@ -885,9 +918,10 @@ function verifyCredentialBinding({ nonce, accountPublicKey, confirmationKey, hol
         networkId,
         confirmationKey,
         holderKeyCommitment,
+        requestCommitment,
         signature: deviceSignature
     });
     return { valid: accountValid && deviceValid, networkId };
 }
 
-export { BINDING_NONCE_LENGTH, COMPRESSED_PUBLIC_KEY_LENGTH, DOMAIN_ACCOUNT, DOMAIN_AUTH, DOMAIN_EDDSA, DOMAIN_EDDSA_PEER, DerivationFailureError, EDDSA_PEER_POINT_HEX, ERC_5564_SCHEME_ID, FIXED_DOMAIN_MSG, InvalidBindingInputError, InvalidDeviceSecretError, InvalidEcdhSecretError, InvalidMetaStealthAddressError, InvalidPublicKeyLengthError, KEY_DERIVATION_VERSION, KeygenError, META_STEALTH_ADDRESS_LENGTH, META_STEALTH_URI_PREFIX, base64urlToBytes, buildAccountBindingMessage, buildAnnouncement, buildBindingMessages, buildDeviceBindingMessage, bytesToBase64url, bytesToHex, checkStealthAddress, computeConfirmationKeyHash, computeEddsaPeerPoint, computeNetworkId, computeSharedSecret, decodeMetaStealthAddress, deriveAccountKeypair, deriveAuthKeypair, deriveEddsaKeypair, deriveKeys, deriveNetworkId, deriveStealthKeys, eddsaPeerPointBytes, encodeMetaStealthAddress, encodeMetaStealthAddressUri, generateDeviceSecret, generateEphemeralKey, generateStealthAddress, generateStealthPrivateKey, getStealthPublicKey, getViewTag, hashToScalar, hashToScalarWith, hexToBytes, isValidScalar, metaStealthAddressUri, normalizeConfirmationKey, normalizeDeviceSecret, normalizeEcdhSharedSecret, publicKeyToAddress, scalarToKeypair, signAccountBinding, signDerivationMessage, validateMetaStealthAddress, verifyAccountBindingSignature, verifyCredentialBinding, verifyDeviceBindingSignature };
+export { BINDING_NONCE_LENGTH, COMPRESSED_PUBLIC_KEY_LENGTH, DOMAIN_ACCOUNT, DOMAIN_AUTH, DOMAIN_EDDSA, DOMAIN_EDDSA_PEER, DOMAIN_NETWORK_ID, DOMAIN_PAYMASTER, DerivationFailureError, EDDSA_PEER_POINT_HEX, ERC_5564_SCHEME_ID, FIXED_DOMAIN_MSG, InvalidBindingInputError, InvalidDeviceSecretError, InvalidEcdhSecretError, InvalidMetaStealthAddressError, InvalidPublicKeyLengthError, KEY_DERIVATION_VERSION, KeygenError, META_STEALTH_ADDRESS_LENGTH, META_STEALTH_URI_PREFIX, base64urlToBytes, buildAccountBindingMessage, buildAnnouncement, buildBindingMessages, buildDeviceBindingMessage, bytesToBase64url, bytesToHex, checkStealthAddress, computeConfirmationKeyHash, computeEddsaPeerPoint, computeMemberNetworkId, computeNetworkId, computeSharedSecret, decodeMetaStealthAddress, deriveAccountKeypair, deriveAuthKeypair, deriveEddsaKeypair, deriveKeys, deriveNetworkId, derivePaymasterKeypair, deriveStealthKeys, eddsaPeerPointBytes, encodeMetaStealthAddress, encodeMetaStealthAddressUri, generateDeviceSecret, generateEphemeralKey, generateStealthAddress, generateStealthPrivateKey, getStealthPublicKey, getViewTag, hashToScalar, hashToScalarWith, hexToBytes, isValidScalar, metaStealthAddressUri, normalizeConfirmationKey, normalizeDeviceSecret, normalizeEcdhSharedSecret, publicKeyToAddress, scalarToKeypair, signAccountBinding, signDerivationMessage, validateMetaStealthAddress, verifyAccountBindingSignature, verifyCredentialBinding, verifyDeviceBindingSignature };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coordination-network/identity",
-  "version": "0.0.2",
+  "version": "0.1.1",
   "description": "Deterministic device key derivation for the coordination network: networkId and the four-key secp256k1 model (account, spending, viewing, auth) from one device secret, plus a hardware-rooted Baby Jubjub EdDSA/Semaphore-commitment fifth key.",
   "license": "MIT",
   "repository": {
@@ -46,7 +46,7 @@
     "@fluidkey/stealth-account-kit": "1.1.1",
     "@rollup/plugin-typescript": "^12.3.0",
     "@scopelift/stealth-address-sdk": "^1.0.0-beta.5",
-    "@semaphore-protocol/identity": "4.14.3",
+    "@semaphore-protocol/identity": "4.14.5",
     "rimraf": "^6.1.3",
     "rollup": "^4.62.2",
     "rollup-plugin-cleanup": "^3.2.1",