@coordination-network/identity 0.0.2 → 0.1.1

package/src/binding.ts

@@ -3,10 +3,15 @@
  *
  * NORMATIVE layouts:
  * ```
- * deviceBindingMessage  = nonce(32) || networkId(32) || holderKeyCommitment(32) // credential issuance
- * accountBindingMessage = nonce(32) || confirmationKeyHash(32) || networkId(32) // 96B, signed by A (secp256k1)
+ * deviceBindingMessage  = nonce(32) || networkId(32) || holderKeyCommitment(32) || requestCommitment(32)
+ * accountBindingMessage = nonce(32) || confirmationKeyHash(32) || networkId(32)
  * ```
  *
+ * B (P-256) signs the 128-byte device message; A (secp256k1) signs the 96-byte account message.
+ *
+ * `requestCommitment` is opaque here: the credential layer defines it and
+ * binds the issuer and scope shown at consent into it.
+ *
  * NORMATIVE MUST: the device signs a locally-derived `networkId`, never one
  * supplied by the issuance request. Every function here except the two
  * low-level builders and {@link verifyDeviceBindingSignature} enforces this
@@ -31,6 +36,12 @@ function toBindingBytes(value: Uint8Array | Hex, label: string): Uint8Array {
     }
 }
 
+function toBindingHash32(value: Uint8Array | Hex, label: string): Uint8Array {
+    const bytes = toBindingBytes(value, label)
+    if (bytes.length !== 32) throw new InvalidBindingInputError(`${label}: expected exactly 32 bytes`)
+    return bytes
+}
+
 function decodeAndValidateNonceAndNetworkId(
     nonce: Uint8Array | Hex,
     networkId: Uint8Array | Hex
@@ -111,7 +122,8 @@ function parseDeviceSignature(signature: Uint8Array | Hex): ReturnType<typeof p2
 }
 
 /**
- * Builds `nonce(32) || networkId(32)`, optionally followed by a 32-byte holder commitment.
+ * Builds the 128-byte `deviceBindingMessage`:
+ * `nonce(32) || networkId(32) || holderKeyCommitment(32) || requestCommitment(32)`.
  *
  * Low-level, spec-literal builder — prefer {@link buildBindingMessages},
  * which enforces the locally-derived-`networkId` MUST structurally.
@@ -119,13 +131,13 @@ function parseDeviceSignature(signature: Uint8Array | Hex): ReturnType<typeof p2
 export function buildDeviceBindingMessage(
     nonce: Uint8Array | Hex,
     networkId: Uint8Array | Hex,
-    holderKeyCommitment?: Uint8Array | Hex
+    holderKeyCommitment: Uint8Array | Hex,
+    requestCommitment: Uint8Array | Hex
 ): Uint8Array {
     const { nonceBytes, networkIdBytes } = decodeAndValidateNonceAndNetworkId(nonce, networkId)
-    if (holderKeyCommitment === undefined) return concatBytes(nonceBytes, networkIdBytes)
-    const holderBytes = toBindingBytes(holderKeyCommitment, "holderKeyCommitment")
-    if (holderBytes.length !== 32) throw new InvalidBindingInputError("holderKeyCommitment: expected exactly 32 bytes")
-    return concatBytes(nonceBytes, networkIdBytes, holderBytes)
+    const holderBytes = toBindingHash32(holderKeyCommitment, "holderKeyCommitment")
+    const requestBytes = toBindingHash32(requestCommitment, "requestCommitment")
+    return concatBytes(nonceBytes, networkIdBytes, holderBytes, requestBytes)
 }
 
 /**
@@ -155,7 +167,8 @@ export function buildBindingMessages(
     nonce: Uint8Array | Hex,
     accountUncompressedPublicKey: Uint8Array | Hex,
     confirmationKey: Uint8Array | Hex,
-    holderKeyCommitment?: Uint8Array | Hex
+    holderKeyCommitment: Uint8Array | Hex,
+    requestCommitment: Uint8Array | Hex
 ): { networkId: Hex; deviceBindingMessage: Uint8Array; accountBindingMessage: Uint8Array } {
     let networkId: Hex
 
@@ -167,7 +180,7 @@ export function buildBindingMessages(
         )
     }
 
-    const deviceBindingMessage = buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment)
+    const deviceBindingMessage = buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment, requestCommitment)
     const accountBindingMessage = buildAccountBindingMessage(nonce, confirmationKey, networkId)
 
     return { networkId, deviceBindingMessage, accountBindingMessage }
@@ -237,15 +250,17 @@ export function verifyDeviceBindingSignature({
     networkId,
     confirmationKey,
     holderKeyCommitment,
+    requestCommitment,
     signature
 }: {
     nonce: Uint8Array | Hex
     networkId: Uint8Array | Hex
     confirmationKey: Uint8Array | Hex
-    holderKeyCommitment?: Uint8Array | Hex
+    holderKeyCommitment: Uint8Array | Hex
+    requestCommitment: Uint8Array | Hex
     signature: Uint8Array | Hex
 }): boolean {
-    const message = buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment)
+    const message = buildDeviceBindingMessage(nonce, networkId, holderKeyCommitment, requestCommitment)
     const publicKeyBytes = prependUncompressedPrefix(normalizeConfirmationKey(confirmationKey))
     const parsedSignature = parseDeviceSignature(signature)
 
@@ -266,13 +281,15 @@ export function verifyCredentialBinding({
     accountPublicKey,
     confirmationKey,
     holderKeyCommitment,
+    requestCommitment,
     accountSignature,
     deviceSignature
 }: {
     nonce: Uint8Array | Hex
     accountPublicKey: Uint8Array | Hex
     confirmationKey: Uint8Array | Hex
-    holderKeyCommitment?: Uint8Array | Hex
+    holderKeyCommitment: Uint8Array | Hex
+    requestCommitment: Uint8Array | Hex
     accountSignature: Uint8Array | Hex
     deviceSignature: Uint8Array | Hex
 }): { valid: boolean; networkId: Hex } {
@@ -291,6 +308,7 @@ export function verifyCredentialBinding({
         networkId,
         confirmationKey,
         holderKeyCommitment,
+        requestCommitment,
         signature: deviceSignature
     })
 

package/src/constants.ts

@@ -1,10 +1,10 @@
 /**
- * Normative constants for the `v1` key derivation scheme. Changing any of
+ * Normative constants for the `v2` key derivation scheme. Changing any of
  * these changes every derived key and `networkId`, so they MUST NOT change
  * without a version bump (new `KEY_DERIVATION_VERSION` and domain strings).
  */
 
-export const KEY_DERIVATION_VERSION = "v1" as const
+export const KEY_DERIVATION_VERSION = "v2" as const
 
 /** Fixed domain-separation message signed by {@link signDerivationMessage}. */
 export const FIXED_DOMAIN_MSG = "coordination-network/identity/v1" as const
@@ -18,12 +18,18 @@ export const DOMAIN_AUTH = "coordination-network/identity/v1/auth" as const
 /** Domain-separation tag for deriving the Baby Jubjub EdDSA seed (the "fifth key") from the hardware ECDH shared secret. */
 export const DOMAIN_EDDSA = "coordination-network/identity/v1/eddsa" as const
 
+/** Distinct Baby Jubjub seed for public paymaster membership; never use the credential holder key as a group leaf. */
+export const DOMAIN_PAYMASTER = "coordination-network/identity/v1/paymaster" as const
+
 /** Domain-separation message hashed to the fixed NUMS P-256 peer point `Q` for the fifth-key ECDH (`eddsa-peer.ts`). */
 export const DOMAIN_EDDSA_PEER = "coordination-network/identity/v1/eddsa/peer" as const
 
+/** Domain-separation tag prefixed to `X || Y` when hashing a user `networkId`. */
+export const DOMAIN_NETWORK_ID = "coordination-network/identity/v2/network-id" as const
+
 /**
  * Byte length of `nonce` and `networkId` in the binding messages — fixed at
- * 32 so the 64- vs 96-byte messages are injective.
+ * 32 so the 128-byte device and 96-byte account messages are injective.
  */
 export const BINDING_NONCE_LENGTH = 32 as const
 

package/src/derive.ts

@@ -3,15 +3,16 @@ import { KEY_DERIVATION_VERSION } from "./constants"
 import { deriveAccountKeypair, signDerivationMessage } from "./account"
 import { deriveStealthKeys } from "./stealthAddresses/deriveStealthKeys"
 import { deriveAuthKeypair } from "./auth"
-import { computeNetworkId } from "./network-id"
+import { computeMemberNetworkId, computeNetworkId } from "./network-id"
 
 /**
- * Derives the full `v1` device identity — `networkId` plus the four-key
- * all-secp256k1 model — from a single device secret.
+ * Derives the full `v2` device identity — `networkId`, `memberNetworkId` and the account,
+ * spending, viewing and auth secp256k1 keypairs — from a single device secret.
  *
  * Pipeline (NORMATIVE):
  * 1. `account = deriveAccountKeypair(deviceSecret)`
- * 2. `networkId = computeNetworkId(account.uncompressedPublicKey)`
+ * 2. `networkId = computeNetworkId(account.uncompressedPublicKey)` and
+ *    `memberNetworkId = computeMemberNetworkId(account.uncompressedPublicKey)`
  * 3. `sig = signDerivationMessage(account.privateKey)` (EIP-191, deterministic)
  * 4. `{ spending, viewing } = deriveStealthKeys(sig)` (FluidKey semantics)
  * 5. `auth = deriveAuthKeypair(sig)`
@@ -19,6 +20,7 @@ import { computeNetworkId } from "./network-id"
 export function deriveKeys(deviceSecret: Uint8Array | Hex): DerivedKeys {
     const account = deriveAccountKeypair(deviceSecret)
     const networkId = computeNetworkId(account.uncompressedPublicKey)
+    const memberNetworkId = computeMemberNetworkId(account.uncompressedPublicKey)
     const signature = signDerivationMessage(account.privateKey)
     const { spending, viewing } = deriveStealthKeys(signature)
     const auth = deriveAuthKeypair(signature)
@@ -26,6 +28,7 @@ export function deriveKeys(deviceSecret: Uint8Array | Hex): DerivedKeys {
     return {
         version: KEY_DERIVATION_VERSION,
         networkId,
+        memberNetworkId,
         account,
         spending,
         viewing,

package/src/eddsa.ts

@@ -4,9 +4,25 @@ import { keccak_256 } from "@noble/hashes/sha3"
 import { deriveSecretScalar, derivePublicKey } from "@zk-kit/eddsa-poseidon"
 import { poseidon2 } from "poseidon-lite/poseidon2"
 import type { EddsaKeypair, Hex } from "./types"
-import { DOMAIN_EDDSA } from "./constants"
+import { DOMAIN_EDDSA, DOMAIN_PAYMASTER } from "./constants"
 import { bytesToHex, concatBytes, normalizeEcdhSharedSecret, utf8ToBytes } from "./bytes"
 
+function deriveKeypair(ecdhSharedSecret: Uint8Array | Hex, domain: string): EddsaKeypair {
+    const secret = normalizeEcdhSharedSecret(ecdhSharedSecret)
+    const seed = keccak_256(concatBytes(utf8ToBytes(domain), secret))
+
+    const secretScalar = deriveSecretScalar(seed)
+    const publicKey = derivePublicKey(seed)
+    const commitment = poseidon2(publicKey)
+
+    return {
+        seed: bytesToHex(seed),
+        secretScalar,
+        publicKey,
+        commitment
+    }
+}
+
 /**
  * Derives the Baby Jubjub EdDSA keypair and Semaphore-v4 identity commitment
  * (the "fifth key"), rooted in a hardware ECDH shared secret.
@@ -21,17 +37,10 @@ import { bytesToHex, concatBytes, normalizeEcdhSharedSecret, utf8ToBytes } from
  * @throws {InvalidEcdhSecretError} if `ecdhSharedSecret` is not exactly 32 bytes
  */
 export function deriveEddsaKeypair(ecdhSharedSecret: Uint8Array | Hex): EddsaKeypair {
-    const secret = normalizeEcdhSharedSecret(ecdhSharedSecret)
-    const seed = keccak_256(concatBytes(utf8ToBytes(DOMAIN_EDDSA), secret))
-
-    const secretScalar = deriveSecretScalar(seed)
-    const publicKey = derivePublicKey(seed)
-    const commitment = poseidon2(publicKey)
+    return deriveKeypair(ecdhSharedSecret, DOMAIN_EDDSA)
+}
 
-    return {
-        seed: bytesToHex(seed),
-        secretScalar,
-        publicKey,
-        commitment
-    }
+/** Derives a separate Semaphore identity whose public commitment may join the paymaster group. */
+export function derivePaymasterKeypair(ecdhSharedSecret: Uint8Array | Hex): EddsaKeypair {
+    return deriveKeypair(ecdhSharedSecret, DOMAIN_PAYMASTER)
 }

package/src/index.ts

@@ -37,9 +37,9 @@ export { metaStealthAddressUri } from "./stealthAddresses/metaStealthAddressUri"
 export { decodeMetaStealthAddress } from "./stealthAddresses/decodeMetaStealthAddress"
 export { buildAnnouncement } from "./stealthAddresses/buildAnnouncement"
 export { deriveAuthKeypair } from "./auth"
-export { deriveEddsaKeypair } from "./eddsa"
+export { deriveEddsaKeypair, derivePaymasterKeypair } from "./eddsa"
 export { EDDSA_PEER_POINT_HEX, eddsaPeerPointBytes, computeEddsaPeerPoint } from "./eddsa-peer"
-export { computeNetworkId } from "./network-id"
+export { computeNetworkId, computeMemberNetworkId } from "./network-id"
 export { deriveKeys, deriveNetworkId } from "./derive"
 export { normalizeConfirmationKey, computeConfirmationKeyHash } from "./confirmation-key"
 export {

package/src/network-id.ts

@@ -1,26 +1,43 @@
 import { keccak_256 } from "@noble/hashes/sha3"
 import type { Hex } from "./types"
-import { bytesToHex, toBytes } from "./bytes"
+import { bytesToHex, concatBytes, toBytes, utf8ToBytes } from "./bytes"
+import { DOMAIN_NETWORK_ID } from "./constants"
+
+function publicKeyCoordinates(uncompressedPublicKey: Uint8Array | Hex, caller: string): Uint8Array {
+    const bytes = toBytes(uncompressedPublicKey)
+
+    if (bytes.length === 65 && bytes[0] === 0x04) {
+        return bytes.slice(1)
+    }
+
+    if (bytes.length === 64) {
+        return bytes
+    }
+
+    throw new TypeError(`${caller}: expected a 65-byte 0x04-prefixed or 64-byte raw uncompressed public key`)
+}
 
 /**
- * Computes the bytes32 `networkId` from an uncompressed secp256k1 public key
- * (65-byte SEC1 `0x04`-prefixed or 64-byte raw `X || Y`).
+ * Computes a user's bytes32 `networkId` from an uncompressed secp256k1 public
+ * key (65-byte SEC1 `0x04`-prefixed or 64-byte raw `X || Y`).
  *
- * NORMATIVE: `networkId = keccak256(X || Y)` — the SEC1 prefix is stripped.
- * The last 20 bytes are the account's Ethereum address.
+ * NORMATIVE: `networkId = keccak256(utf8(DOMAIN_NETWORK_ID) || X || Y)` — the
+ * SEC1 prefix is stripped.
  */
 export function computeNetworkId(uncompressedPublicKey: Uint8Array | Hex): Hex {
-    const bytes = toBytes(uncompressedPublicKey)
+    const coordinates = publicKeyCoordinates(uncompressedPublicKey, "computeNetworkId")
 
-    let coordinates: Uint8Array
+    return bytesToHex(keccak_256(concatBytes(utf8ToBytes(DOMAIN_NETWORK_ID), coordinates)))
+}
 
-    if (bytes.length === 65 && bytes[0] === 0x04) {
-        coordinates = bytes.slice(1)
-    } else if (bytes.length === 64) {
-        coordinates = bytes
-    } else {
-        throw new TypeError("computeNetworkId: expected a 65-byte 0x04-prefixed or 64-byte raw uncompressed public key")
-    }
+/**
+ * Computes a member's bytes32 id from the same public key forms.
+ *
+ * NORMATIVE: `memberNetworkId = keccak256(X || Y)`. The last 20 bytes are the
+ * member's auth address, which `NetworkMemberRegistry` reads.
+ */
+export function computeMemberNetworkId(uncompressedPublicKey: Uint8Array | Hex): Hex {
+    const coordinates = publicKeyCoordinates(uncompressedPublicKey, "computeMemberNetworkId")
 
     return bytesToHex(keccak_256(coordinates))
 }

package/src/types.ts

@@ -14,12 +14,14 @@ export interface Secp256k1Keypair {
     uncompressedPublicKey: Hex
 }
 
-/** The full key set derived from one device secret, plus the device's `networkId`. */
+/** The full key set derived from one device secret, plus the device's `networkId` and `memberNetworkId`. */
 export interface DerivedKeys {
     /** Derivation scheme version. See {@link KEY_DERIVATION_VERSION}. */
-    version: "v1"
-    /** bytes32 device identifier: `keccak256(uncompressed account pubkey, sans 04 prefix)`. */
+    version: "v2"
+    /** bytes32 user identifier: `keccak256(utf8(DOMAIN_NETWORK_ID) || X || Y)` of the account pubkey. */
     networkId: Hex
+    /** bytes32 member identifier: `keccak256(X || Y)`; its low 20 bytes are the member's auth address. */
+    memberNetworkId: Hex
     /** Root secp256k1 keypair the other keys are derived from. */
     account: Secp256k1Keypair
     /** secp256k1 keypair used to authorize spending. */

package/types/index.d.ts

@@ -11,12 +11,14 @@ interface Secp256k1Keypair {
     /** 65-byte SEC1 public key, `0x04`-prefixed (uncompressed form). */
     uncompressedPublicKey: Hex;
 }
-/** The full key set derived from one device secret, plus the device's `networkId`. */
+/** The full key set derived from one device secret, plus the device's `networkId` and `memberNetworkId`. */
 interface DerivedKeys {
     /** Derivation scheme version. See {@link KEY_DERIVATION_VERSION}. */
-    version: "v1";
-    /** bytes32 device identifier: `keccak256(uncompressed account pubkey, sans 04 prefix)`. */
+    version: "v2";
+    /** bytes32 user identifier: `keccak256(utf8(DOMAIN_NETWORK_ID) || X || Y)` of the account pubkey. */
     networkId: Hex;
+    /** bytes32 member identifier: `keccak256(X || Y)`; its low 20 bytes are the member's auth address. */
+    memberNetworkId: Hex;
     /** Root secp256k1 keypair the other keys are derived from. */
     account: Secp256k1Keypair;
     /** secp256k1 keypair used to authorize spending. */
@@ -47,11 +49,11 @@ interface EddsaKeypair {
 }
 
 /**
- * Normative constants for the `v1` key derivation scheme. Changing any of
+ * Normative constants for the `v2` key derivation scheme. Changing any of
  * these changes every derived key and `networkId`, so they MUST NOT change
  * without a version bump (new `KEY_DERIVATION_VERSION` and domain strings).
  */
-declare const KEY_DERIVATION_VERSION: "v1";
+declare const KEY_DERIVATION_VERSION: "v2";
 /** Fixed domain-separation message signed by {@link signDerivationMessage}. */
 declare const FIXED_DOMAIN_MSG: "coordination-network/identity/v1";
 /** Domain-separation tag for deriving the account keypair from a device secret. */
@@ -60,11 +62,15 @@ declare const DOMAIN_ACCOUNT: "coordination-network/identity/v1/account";
 declare const DOMAIN_AUTH: "coordination-network/identity/v1/auth";
 /** Domain-separation tag for deriving the Baby Jubjub EdDSA seed (the "fifth key") from the hardware ECDH shared secret. */
 declare const DOMAIN_EDDSA: "coordination-network/identity/v1/eddsa";
+/** Distinct Baby Jubjub seed for public paymaster membership; never use the credential holder key as a group leaf. */
+declare const DOMAIN_PAYMASTER: "coordination-network/identity/v1/paymaster";
 /** Domain-separation message hashed to the fixed NUMS P-256 peer point `Q` for the fifth-key ECDH (`eddsa-peer.ts`). */
 declare const DOMAIN_EDDSA_PEER: "coordination-network/identity/v1/eddsa/peer";
+/** Domain-separation tag prefixed to `X || Y` when hashing a user `networkId`. */
+declare const DOMAIN_NETWORK_ID: "coordination-network/identity/v2/network-id";
 /**
  * Byte length of `nonce` and `networkId` in the binding messages — fixed at
- * 32 so the 64- vs 96-byte messages are injective.
+ * 32 so the 128-byte device and 96-byte account messages are injective.
  */
 declare const BINDING_NONCE_LENGTH: 32;
 /** SEC1-compressed secp256k1 public key length. */
@@ -340,6 +346,8 @@ declare function deriveAuthKeypair(sig64: Uint8Array | Hex): Secp256k1Keypair;
  * @throws {InvalidEcdhSecretError} if `ecdhSharedSecret` is not exactly 32 bytes
  */
 declare function deriveEddsaKeypair(ecdhSharedSecret: Uint8Array | Hex): EddsaKeypair;
+/** Derives a separate Semaphore identity whose public commitment may join the paymaster group. */
+declare function derivePaymasterKeypair(ecdhSharedSecret: Uint8Array | Hex): EddsaKeypair;
 
 /** Fixed NUMS P-256 peer point `Q` for the fifth-key ECDH — see `DERIVATION.md` §12. */
 /**
@@ -361,21 +369,29 @@ declare function eddsaPeerPointBytes(): Uint8Array;
 declare function computeEddsaPeerPoint(): Uint8Array;
 
 /**
- * Computes the bytes32 `networkId` from an uncompressed secp256k1 public key
- * (65-byte SEC1 `0x04`-prefixed or 64-byte raw `X || Y`).
+ * Computes a user's bytes32 `networkId` from an uncompressed secp256k1 public
+ * key (65-byte SEC1 `0x04`-prefixed or 64-byte raw `X || Y`).
  *
- * NORMATIVE: `networkId = keccak256(X || Y)` — the SEC1 prefix is stripped.
- * The last 20 bytes are the account's Ethereum address.
+ * NORMATIVE: `networkId = keccak256(utf8(DOMAIN_NETWORK_ID) || X || Y)` — the
+ * SEC1 prefix is stripped.
  */
 declare function computeNetworkId(uncompressedPublicKey: Uint8Array | Hex): Hex;
+/**
+ * Computes a member's bytes32 id from the same public key forms.
+ *
+ * NORMATIVE: `memberNetworkId = keccak256(X || Y)`. The last 20 bytes are the
+ * member's auth address, which `NetworkMemberRegistry` reads.
+ */
+declare function computeMemberNetworkId(uncompressedPublicKey: Uint8Array | Hex): Hex;
 
 /**
- * Derives the full `v1` device identity — `networkId` plus the four-key
- * all-secp256k1 model — from a single device secret.
+ * Derives the full `v2` device identity — `networkId`, `memberNetworkId` and the account,
+ * spending, viewing and auth secp256k1 keypairs — from a single device secret.
  *
  * Pipeline (NORMATIVE):
  * 1. `account = deriveAccountKeypair(deviceSecret)`
- * 2. `networkId = computeNetworkId(account.uncompressedPublicKey)`
+ * 2. `networkId = computeNetworkId(account.uncompressedPublicKey)` and
+ *    `memberNetworkId = computeMemberNetworkId(account.uncompressedPublicKey)`
  * 3. `sig = signDerivationMessage(account.privateKey)` (EIP-191, deterministic)
  * 4. `{ spending, viewing } = deriveStealthKeys(sig)` (FluidKey semantics)
  * 5. `auth = deriveAuthKeypair(sig)`
@@ -403,10 +419,15 @@ declare function computeConfirmationKeyHash(confirmationKey: Uint8Array | Hex):
  *
  * NORMATIVE layouts:
  * ```
- * deviceBindingMessage  = nonce(32) || networkId(32) || holderKeyCommitment(32) // credential issuance
- * accountBindingMessage = nonce(32) || confirmationKeyHash(32) || networkId(32) // 96B, signed by A (secp256k1)
+ * deviceBindingMessage  = nonce(32) || networkId(32) || holderKeyCommitment(32) || requestCommitment(32)
+ * accountBindingMessage = nonce(32) || confirmationKeyHash(32) || networkId(32)
  * ```
  *
+ * B (P-256) signs the 128-byte device message; A (secp256k1) signs the 96-byte account message.
+ *
+ * `requestCommitment` is opaque here: the credential layer defines it and
+ * binds the issuer and scope shown at consent into it.
+ *
  * NORMATIVE MUST: the device signs a locally-derived `networkId`, never one
  * supplied by the issuance request. Every function here except the two
  * low-level builders and {@link verifyDeviceBindingSignature} enforces this
@@ -414,12 +435,13 @@ declare function computeConfirmationKeyHash(confirmationKey: Uint8Array | Hex):
  */
 
 /**
- * Builds `nonce(32) || networkId(32)`, optionally followed by a 32-byte holder commitment.
+ * Builds the 128-byte `deviceBindingMessage`:
+ * `nonce(32) || networkId(32) || holderKeyCommitment(32) || requestCommitment(32)`.
  *
  * Low-level, spec-literal builder — prefer {@link buildBindingMessages},
  * which enforces the locally-derived-`networkId` MUST structurally.
  */
-declare function buildDeviceBindingMessage(nonce: Uint8Array | Hex, networkId: Uint8Array | Hex, holderKeyCommitment?: Uint8Array | Hex): Uint8Array;
+declare function buildDeviceBindingMessage(nonce: Uint8Array | Hex, networkId: Uint8Array | Hex, holderKeyCommitment: Uint8Array | Hex, requestCommitment: Uint8Array | Hex): Uint8Array;
 /**
  * Builds the 96-byte `accountBindingMessage`:
  * `nonce(32) || confirmationKeyHash(32) || networkId(32)`.
@@ -433,7 +455,7 @@ declare function buildAccountBindingMessage(nonce: Uint8Array | Hex, confirmatio
  * derived internally from the account's own public key, so a caller cannot
  * supply a `networkId` from elsewhere even by mistake.
  */
-declare function buildBindingMessages(nonce: Uint8Array | Hex, accountUncompressedPublicKey: Uint8Array | Hex, confirmationKey: Uint8Array | Hex, holderKeyCommitment?: Uint8Array | Hex): {
+declare function buildBindingMessages(nonce: Uint8Array | Hex, accountUncompressedPublicKey: Uint8Array | Hex, confirmationKey: Uint8Array | Hex, holderKeyCommitment: Uint8Array | Hex, requestCommitment: Uint8Array | Hex): {
     networkId: Hex;
     deviceBindingMessage: Uint8Array;
     accountBindingMessage: Uint8Array;
@@ -470,11 +492,12 @@ declare function verifyAccountBindingSignature({ nonce, confirmationKey, account
  * `prehash: true` (signers hash SHA-256 internally); `lowS: false` (hardware
  * signatures aren't s-normalized — `DERIVATION.md` §11.4).
  */
-declare function verifyDeviceBindingSignature({ nonce, networkId, confirmationKey, holderKeyCommitment, signature }: {
+declare function verifyDeviceBindingSignature({ nonce, networkId, confirmationKey, holderKeyCommitment, requestCommitment, signature }: {
     nonce: Uint8Array | Hex;
     networkId: Uint8Array | Hex;
     confirmationKey: Uint8Array | Hex;
-    holderKeyCommitment?: Uint8Array | Hex;
+    holderKeyCommitment: Uint8Array | Hex;
+    requestCommitment: Uint8Array | Hex;
     signature: Uint8Array | Hex;
 }): boolean;
 /**
@@ -483,11 +506,12 @@ declare function verifyDeviceBindingSignature({ nonce, networkId, confirmationKe
  * with an unrelated account signature in either direction. `networkId` is
  * returned even when `valid` is false, for issuer-side logging/rate-limiting.
  */
-declare function verifyCredentialBinding({ nonce, accountPublicKey, confirmationKey, holderKeyCommitment, accountSignature, deviceSignature }: {
+declare function verifyCredentialBinding({ nonce, accountPublicKey, confirmationKey, holderKeyCommitment, requestCommitment, accountSignature, deviceSignature }: {
     nonce: Uint8Array | Hex;
     accountPublicKey: Uint8Array | Hex;
     confirmationKey: Uint8Array | Hex;
-    holderKeyCommitment?: Uint8Array | Hex;
+    holderKeyCommitment: Uint8Array | Hex;
+    requestCommitment: Uint8Array | Hex;
     accountSignature: Uint8Array | Hex;
     deviceSignature: Uint8Array | Hex;
 }): {
@@ -495,5 +519,5 @@ declare function verifyCredentialBinding({ nonce, accountPublicKey, confirmation
     networkId: Hex;
 };
 
-export { BINDING_NONCE_LENGTH, COMPRESSED_PUBLIC_KEY_LENGTH, DOMAIN_ACCOUNT, DOMAIN_AUTH, DOMAIN_EDDSA, DOMAIN_EDDSA_PEER, DerivationFailureError, EDDSA_PEER_POINT_HEX, ERC_5564_SCHEME_ID, FIXED_DOMAIN_MSG, InvalidBindingInputError, InvalidDeviceSecretError, InvalidEcdhSecretError, InvalidMetaStealthAddressError, InvalidPublicKeyLengthError, KEY_DERIVATION_VERSION, KeygenError, META_STEALTH_ADDRESS_LENGTH, META_STEALTH_URI_PREFIX, base64urlToBytes, buildAccountBindingMessage, buildAnnouncement, buildBindingMessages, buildDeviceBindingMessage, bytesToBase64url, bytesToHex, checkStealthAddress, computeConfirmationKeyHash, computeEddsaPeerPoint, computeNetworkId, computeSharedSecret, decodeMetaStealthAddress, deriveAccountKeypair, deriveAuthKeypair, deriveEddsaKeypair, deriveKeys, deriveNetworkId, deriveStealthKeys, eddsaPeerPointBytes, encodeMetaStealthAddress, encodeMetaStealthAddressUri, generateDeviceSecret, generateEphemeralKey, generateStealthAddress, generateStealthPrivateKey, getStealthPublicKey, getViewTag, hashToScalar, hashToScalarWith, hexToBytes, isValidScalar, metaStealthAddressUri, normalizeConfirmationKey, normalizeDeviceSecret, normalizeEcdhSharedSecret, publicKeyToAddress, scalarToKeypair, signAccountBinding, signDerivationMessage, validateMetaStealthAddress, verifyAccountBindingSignature, verifyCredentialBinding, verifyDeviceBindingSignature };
+export { BINDING_NONCE_LENGTH, COMPRESSED_PUBLIC_KEY_LENGTH, DOMAIN_ACCOUNT, DOMAIN_AUTH, DOMAIN_EDDSA, DOMAIN_EDDSA_PEER, DOMAIN_NETWORK_ID, DOMAIN_PAYMASTER, DerivationFailureError, EDDSA_PEER_POINT_HEX, ERC_5564_SCHEME_ID, FIXED_DOMAIN_MSG, InvalidBindingInputError, InvalidDeviceSecretError, InvalidEcdhSecretError, InvalidMetaStealthAddressError, InvalidPublicKeyLengthError, KEY_DERIVATION_VERSION, KeygenError, META_STEALTH_ADDRESS_LENGTH, META_STEALTH_URI_PREFIX, base64urlToBytes, buildAccountBindingMessage, buildAnnouncement, buildBindingMessages, buildDeviceBindingMessage, bytesToBase64url, bytesToHex, checkStealthAddress, computeConfirmationKeyHash, computeEddsaPeerPoint, computeMemberNetworkId, computeNetworkId, computeSharedSecret, decodeMetaStealthAddress, deriveAccountKeypair, deriveAuthKeypair, deriveEddsaKeypair, deriveKeys, deriveNetworkId, derivePaymasterKeypair, deriveStealthKeys, eddsaPeerPointBytes, encodeMetaStealthAddress, encodeMetaStealthAddressUri, generateDeviceSecret, generateEphemeralKey, generateStealthAddress, generateStealthPrivateKey, getStealthPublicKey, getViewTag, hashToScalar, hashToScalarWith, hexToBytes, isValidScalar, metaStealthAddressUri, normalizeConfirmationKey, normalizeDeviceSecret, normalizeEcdhSharedSecret, publicKeyToAddress, scalarToKeypair, signAccountBinding, signDerivationMessage, validateMetaStealthAddress, verifyAccountBindingSignature, verifyCredentialBinding, verifyDeviceBindingSignature };
 export type { Address, DerivedKeys, EddsaKeypair, HashFn, Hex, KeygenErrorCode, Secp256k1Keypair };