@coordination-network/user-app-core 0.0.1

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@coordination-network/user-app-core",
+  "version": "0.0.1",
+  "description": "The three user-app-link operations a user app serves, over injected device, storage and proving ports.",
+  "license": "MIT",
+  "repository": "https://github.com/zk-kit/coordination-network",
+  "homepage": "https://github.com/zk-kit/coordination-network/tree/main/packages/user-app-core",
+  "bugs": "https://github.com/zk-kit/coordination-network/issues",
+  "sideEffects": false,
+  "type": "module",
+  "main": "dist/index.cjs",
+  "module": "dist/index.js",
+  "types": "types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./types/index.d.ts",
+      "require": "./dist/index.cjs",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist/",
+    "types/",
+    "src/",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "rimraf dist types && rollup -c rollup.config.mjs"
+  },
+  "dependencies": {
+    "@coordination-network/credential": "^0.0.1",
+    "@coordination-network/identity": "^0.0.1",
+    "@coordination-network/issuer-set": "^0.0.1",
+    "@coordination-network/revocation-registry": "^0.0.1",
+    "@coordination-network/user-app-link": "^0.0.1",
+    "@coordination-network/user-client": "^0.0.1",
+    "@coordination-network/wallet": "^0.0.1",
+    "@semaphore-protocol/identity": "4.14.3",
+    "zod": "^4.3.11"
+  },
+  "devDependencies": {
+    "@noble/curves": "^1.9.7",
+    "@rollup/plugin-typescript": "^12.3.0",
+    "rimraf": "^6.1.3",
+    "rollup": "^4.62.2",
+    "rollup-plugin-cleanup": "^3.2.1",
+    "rollup-plugin-dts": "^6.4.1",
+    "tslib": "^2.8.0",
+    "typescript": "^6.0.3"
+  }
+}

package/src/chain-state.ts

@@ -0,0 +1,61 @@
+import { ApprovedIssuerSet } from "@coordination-network/issuer-set"
+import { RevocationRegistry } from "@coordination-network/revocation-registry"
+import type { ChainStateLoader, WalletChainState } from "@coordination-network/wallet"
+import type { HttpClient } from "./types"
+
+interface IssuersResponseBody {
+    leaves: string[]
+    root: string
+}
+
+interface RevocationSnapshotResponseBody {
+    root: string
+    snapshot: string
+}
+
+/** The half of a chain state a member's approved-issuer set supplies. */
+export type IssuerSetState = Pick<WalletChainState, "approvedIssuers" | "approvedIssuerRoot">
+
+/** The half its revocation snapshot supplies. */
+export type RevocationsState = Pick<WalletChainState, "revocations" | "revocationRoot">
+
+/**
+ * `GET /v1/issuers` carries a `root` the server read from chain independently of the `leaves` it
+ * also served, so `Wallet`'s comparison between the tree rebuilt from `leaves` and
+ * `approvedIssuerRoot` catches a server that served a mismatched pair.
+ */
+export async function readIssuerSet(http: HttpClient, issuersUrl: string): Promise<IssuerSetState> {
+    const response = await http.getJson(issuersUrl)
+    if (response.status !== 200) {
+        throw new Error(`GET ${issuersUrl} returned ${response.status}`)
+    }
+    const { leaves, root } = response.body as IssuersResponseBody
+
+    return {
+        approvedIssuers: ApprovedIssuerSet.fromLeaves(leaves.map((leaf) => BigInt(leaf))),
+        approvedIssuerRoot: BigInt(root)
+    }
+}
+
+/** The snapshot's own `root` gives the revocation side the same cross-check. */
+export async function readRevocations(http: HttpClient, revocationsUrl: string): Promise<RevocationsState> {
+    const response = await http.getJson(revocationsUrl)
+    if (response.status !== 200) {
+        throw new Error(`GET ${revocationsUrl} returned ${response.status}`)
+    }
+    const { root, snapshot } = response.body as RevocationSnapshotResponseBody
+
+    return { revocations: RevocationRegistry.import(snapshot), revocationRoot: BigInt(root) }
+}
+
+/**
+ * Both lists are named per request by `issuersUrl`/`revocationsUrl`, so this is built fresh per
+ * request and never held onto. A handler with several credentials to check reads the two halves
+ * itself instead, so one read of each serves them all (see `presentation-create.ts`).
+ */
+export function buildChainStateLoader(http: HttpClient, issuersUrl: string, revocationsUrl: string): ChainStateLoader {
+    return async () => ({
+        ...(await readIssuerSet(http, issuersUrl)),
+        ...(await readRevocations(http, revocationsUrl))
+    })
+}

package/src/consent.ts

@@ -0,0 +1,69 @@
+import type { DecodedLinkRequest, LinkOp, Params } from "@coordination-network/user-app-link"
+import type { ConsentSummary } from "./types"
+
+/**
+ * `createRequestHandler` calls this after confirming `request.op` is a known op and validating
+ * `params` against its schema, so the casts below are re-attaching types the caller already
+ * proved, not asserting past them — an exhaustive switch covers every case with no defensive
+ * default branch needed. Every value here ends up behind the sheet's "Technical details" toggle;
+ * the sentence above it is the app's, not this package's.
+ */
+export function buildConsentSummary(request: DecodedLinkRequest): ConsentSummary {
+    const caller = request.caller
+    // The callback is the only signal against a spoofed caller, so it is never shortened.
+    const callback = { label: "Callback", value: request.callback, truncate: false }
+
+    switch (request.op as LinkOp) {
+        case "registration.sign": {
+            const p = request.params as Params<"registration.sign">
+            return {
+                op: "registration.sign",
+                caller,
+                details: [
+                    callback,
+                    // The signature is bound to this contract, so it names what approving commits to.
+                    { label: "Registry contract", value: p.verifyingContract },
+                    { label: "Chain ID", value: String(p.chainId) }
+                ]
+            }
+        }
+
+        case "credential.issue": {
+            const p = request.params as Params<"credential.issue">
+            return {
+                op: "credential.issue",
+                caller,
+                scope: { programme: p.approvalScope.programme, country: p.approvalScope.country },
+                details: [
+                    { label: "Issuer", value: p.issuerNetworkId },
+                    // This app posts the binding signatures there itself, so this row is the one
+                    // that says where they go. The caller picks the URL, and the schema holds all
+                    // four issuance URLs to that one origin, so this row speaks for the rest.
+                    { label: "Issuer server", value: p.credentialsUrl },
+                    { label: "Programme", value: p.approvalScope.programme },
+                    { label: "Country", value: p.approvalScope.country },
+                    callback
+                ]
+            }
+        }
+
+        case "presentation.create": {
+            const p = request.params as Params<"presentation.create">
+            return {
+                op: "presentation.create",
+                caller,
+                scope: { programme: p.programme, country: p.country },
+                details: [
+                    { label: "Verifier", value: p.audience },
+                    // The proof is posted by this app, not handed back to the caller, so this row
+                    // is the one that says where it actually goes. Unlike the callback, this URL
+                    // is not scheme-restricted, and a caller picks it.
+                    { label: "Proof is sent to", value: p.responseUrl },
+                    callback,
+                    { label: "Programme", value: p.programme },
+                    { label: "Country", value: p.country }
+                ]
+            }
+        }
+    }
+}

package/src/device-secret.ts

@@ -0,0 +1,16 @@
+import type { Hex } from "@coordination-network/identity"
+import type { Store } from "@coordination-network/wallet"
+
+/**
+ * This package holds exactly one identity, so unlike `Wallet`'s `key:`-prefixed store (built for
+ * several imported keys) the device secret lives under one fixed key.
+ */
+export const DEVICE_SECRET_KEY = "user-app-core:device-secret"
+
+export async function readDeviceSecret(store: Store): Promise<Hex | null> {
+    return (await store.get(DEVICE_SECRET_KEY)) as Hex | null
+}
+
+export async function writeDeviceSecret(store: Store, secret: Hex): Promise<void> {
+    await store.set(DEVICE_SECRET_KEY, secret)
+}

package/src/errors.ts

@@ -0,0 +1,42 @@
+import { WalletError, type WalletErrorCode } from "@coordination-network/wallet"
+import { LinkError, type LinkErrorCode } from "@coordination-network/user-app-link"
+
+/**
+ * `WalletError` and `LinkError` speak different vocabularies for the same underlying failures.
+ * Split along one line: a malformed or structurally-invalid credential is `INVALID_REQUEST`;
+ * a well-formed credential that is simply not usable right now (not yet valid, expired, its
+ * issuer retired) is `NO_CREDENTIAL`, while a revoked one says so outright. A chain-state failure
+ * means whichever server published those lists is unreachable or inconsistent, not a fault in
+ * this app, hence an unreachable code rather than `INTERNAL`.
+ */
+const WALLET_ERROR_TO_LINK_ERROR_CODE: Record<WalletErrorCode, LinkErrorCode> = {
+    NOT_FOUND: "NO_CREDENTIAL",
+    ALREADY_STORED: "INVALID_REQUEST",
+    CREDENTIAL_INVALID: "INVALID_REQUEST",
+    CONSENT_DENIED: "CONSENT_DENIED",
+    REVOKED: "CREDENTIAL_REVOKED",
+    CHAIN_STATE_UNAVAILABLE: "VERIFIER_UNREACHABLE",
+    CHAIN_STATE_INVALID: "VERIFIER_UNREACHABLE",
+    NOT_YET_VALID: "NO_CREDENTIAL",
+    EXPIRED: "NO_CREDENTIAL",
+    ISSUER_NOT_APPROVED: "NO_CREDENTIAL",
+    PRESENTATION_FAILED: "PROOF_FAILED"
+}
+
+/**
+ * Preserves the original message on the thrown `LinkError`. `chainStateCode` names the side whose
+ * lists were being read: during issuance that is the issuer, not a verifier.
+ *
+ * Takes `unknown` rather than `WalletError` because the wallet's sync methods are not total over
+ * `WalletError`: they parse each stored credential and write each record back, so a corrupt record
+ * or a failing device store throws something else entirely. Indexing the table with that error's
+ * absent `code` would have produced a `LinkError` with no code at all.
+ */
+export function mapWalletError(error: unknown, chainStateCode?: LinkErrorCode): LinkError {
+    if (!(error instanceof WalletError)) {
+        return new LinkError("INTERNAL", error instanceof Error ? error.message : String(error))
+    }
+    const isChainState = error.code === "CHAIN_STATE_UNAVAILABLE" || error.code === "CHAIN_STATE_INVALID"
+    const code = isChainState && chainStateCode ? chainStateCode : WALLET_ERROR_TO_LINK_ERROR_CODE[error.code]
+    return new LinkError(code, error.message)
+}

package/src/handlers/credential-issue.ts

@@ -0,0 +1,176 @@
+import {
+    buildDeviceBindingMessage,
+    deriveEddsaKeypair,
+    deriveKeys,
+    eddsaPeerPointBytes,
+    signAccountBinding,
+    type Hex
+} from "@coordination-network/identity"
+import {
+    deriveRevocationCommitment,
+    generateRevocationSecret,
+    jwkToPublicKeyBytes,
+    parseZkCredential,
+    signCommitmentOwnership
+} from "@coordination-network/credential"
+import type { ChainStateLoader, Wallet, WalletChainState } from "@coordination-network/wallet"
+import { LinkError, type CredentialIssueParams, type CredentialIssueResult } from "@coordination-network/user-app-link"
+import { buildChainStateLoader } from "../chain-state"
+import { mapWalletError } from "../errors"
+import { bigintToBytes32, bytesToHex, hexToBytes } from "../hex"
+import { challengeResponseSchema, issueCredentialResponseSchema, postToMember, type MemberRefusal } from "../member-api"
+import { readIssuerEntry, writeIssuerEntry } from "../issuer-index"
+import { nowFn } from "../now"
+import { CREDENTIAL_ISSUE_STEPS } from "../steps"
+import { buildWallet } from "../wallet-factory"
+import type { UserAppPorts } from "../types"
+
+type Refusal = Extract<CredentialIssueResult, { status: "refused" }>
+
+/** The issuer answered, but named no reason of its own. */
+const UNNAMED_REFUSAL = "ISSUANCE_REFUSED"
+
+/** A Baby Jubjub point as the decimal-string pair the wire protocol carries. */
+const pointToStrings = (point: readonly [bigint, bigint]): [string, string] => [String(point[0]), String(point[1])]
+
+/** Relayed in the issuer's own words, under a stand-in code when it named none of its own. */
+const refused = ({ code, message }: MemberRefusal): Refusal => ({
+    status: "refused",
+    code: code ?? UNNAMED_REFUSAL,
+    message
+})
+
+/**
+ * Whether an indexed credential still stops this member issuing another for the same programme.
+ * Only one that is valid right now does: a revoked or expired credential, or an entry whose
+ * credential is gone, would otherwise leave the person with no way back but erasing everything.
+ */
+async function isStillValid(wallet: Wallet, credentialId: string, load: ChainStateLoader): Promise<boolean> {
+    if ((await wallet.getCredential(credentialId)) === null) return false
+    await wallet.syncCredential(credentialId, load)
+    return (await wallet.getCredential(credentialId))?.status === "valid"
+}
+
+/**
+ * The whole issuance, behind the one consent the link boundary already took: hold check, nonce,
+ * binding, the issuer's signature, the two authority checks, storage. Assembly over existing
+ * functions, no new cryptography.
+ *
+ * The revocation secret is generated and opened inside this one call, so it never leaves the
+ * function and nothing has to persist it between two deep links.
+ */
+export async function credentialIssueHandler(
+    ports: UserAppPorts,
+    deviceSecret: Hex,
+    params: CredentialIssueParams
+): Promise<CredentialIssueResult> {
+    const step = (name: string) => ports.progress("credential.issue", name)
+
+    step(CREDENTIAL_ISSUE_STEPS.held)
+    const held = await readIssuerEntry(ports.store, params.issuerNetworkId, params.approvalScope)
+
+    // Read before the issuer signs: the revocation secret below never leaves this call, so a
+    // failure after the 201 would orphan the credential at the issuer with nothing able to open it.
+    step(CREDENTIAL_ISSUE_STEPS.lists)
+    let chainState: WalletChainState
+    try {
+        chainState = await buildChainStateLoader(ports.http, params.issuersUrl, params.revocationsUrl)()
+    } catch (error) {
+        throw new LinkError(
+            "ISSUER_UNREACHABLE",
+            error instanceof Error
+                ? error.message
+                : "the issuer's approved-issuer set or revocation snapshot is unreadable"
+        )
+    }
+
+    const loadChainState: ChainStateLoader = async () => chainState
+    const wallet = await buildWallet(ports, loadChainState)
+    if (held !== null && (await isStillValid(wallet, held.credentialId, loadChainState))) {
+        return { status: "alreadyHeld", credentialId: held.credentialId }
+    }
+
+    const keys = deriveKeys(deviceSecret)
+
+    step(CREDENTIAL_ISSUE_STEPS.challenge)
+    const challenge = await postToMember(
+        ports.http,
+        params.challengeUrl,
+        { subjectNetworkId: keys.networkId },
+        { status: 200, schema: challengeResponseSchema, unreachable: "ISSUER_UNREACHABLE" }
+    )
+    if (challenge.refusal) return refused(challenge.refusal)
+    const nonce = challenge.value.nonce
+
+    step(CREDENTIAL_ISSUE_STEPS.binding)
+    const confirmationKey = await ports.deviceKey.getPublicKeyJwk()
+    const eddsa = deriveEddsaKeypair(await ports.deviceKey.ecdh(eddsaPeerPointBytes()))
+    const revocationSecret = generateRevocationSecret()
+    const ownership = signCommitmentOwnership(revocationSecret, hexToBytes(nonce))
+
+    const deviceBindingMessage = buildDeviceBindingMessage(nonce, keys.networkId, bigintToBytes32(eddsa.commitment))
+    const devicePopSignature = bytesToHex(await ports.deviceKey.sign(deviceBindingMessage))
+    const { signature: accountPopSignature } = signAccountBinding(
+        keys.account.privateKey,
+        nonce,
+        jwkToPublicKeyBytes(confirmationKey)
+    )
+
+    step(CREDENTIAL_ISSUE_STEPS.signing)
+    const issued = await postToMember(
+        ports.http,
+        params.credentialsUrl,
+        {
+            subjectNetworkId: keys.networkId,
+            approvalScope: params.approvalScope,
+            confirmationKey,
+            accountPublicKey: keys.account.uncompressedPublicKey,
+            devicePopSignature,
+            accountPopSignature,
+            identityPublicKey: pointToStrings(eddsa.publicKey),
+            revocation: {
+                commitment: deriveRevocationCommitment(revocationSecret).toString(),
+                publicKey: pointToStrings(ownership.publicKey),
+                ownershipSignature: {
+                    R8: pointToStrings(ownership.signature.R8),
+                    S: String(ownership.signature.S)
+                }
+            }
+        },
+        { status: 201, schema: issueCredentialResponseSchema, unreachable: "ISSUER_UNREACHABLE" }
+    )
+    if (issued.refusal) return refused(issued.refusal)
+
+    let issuerPublicKey: [string, string]
+    try {
+        const parsed = parseZkCredential(issued.value.credential)
+        issuerPublicKey = [parsed.issuerPublicKey[0].toString(), parsed.issuerPublicKey[1].toString()]
+    } catch (error) {
+        throw new LinkError("ISSUER_UNREACHABLE", error instanceof Error ? error.message : "malformed credential")
+    }
+
+    // Built above for the hold check; the lists are read before the signature, so this is the
+    // only step left that can fail.
+    step(CREDENTIAL_ISSUE_STEPS.storing)
+    let credentialId: string
+    try {
+        credentialId = await wallet.addCredential({
+            id: issued.value.id,
+            credential: issued.value.credential,
+            revocationSecret
+        })
+    } catch (error) {
+        throw mapWalletError(error, "ISSUER_UNREACHABLE")
+    }
+
+    await writeIssuerEntry(ports.store, params.issuerNetworkId, {
+        credentialId,
+        issuerPublicKey,
+        issuersUrl: params.issuersUrl,
+        programme: params.approvalScope.programme,
+        country: params.approvalScope.country,
+        issuedAt: Math.floor(nowFn(ports) / 1000)
+    })
+
+    return { status: "stored", credentialId }
+}

package/src/handlers/presentation-create.ts

@@ -0,0 +1,168 @@
+import { WalletError, type CredentialInfo, type WalletChainState } from "@coordination-network/wallet"
+import {
+    LinkError,
+    type Hex32,
+    type PresentationCreateParams,
+    type PresentationCreateResult
+} from "@coordination-network/user-app-link"
+import { readIssuerSet, readRevocations, type IssuerSetState, type RevocationsState } from "../chain-state"
+import { mapWalletError } from "../errors"
+import { bytesToHex, hexToBytes } from "../hex"
+import { listIssuerEntries, type IssuerIndexEntry } from "../issuer-index"
+import { postToMember, verifyResponseSchema } from "../member-api"
+import { latestExpiring, matchingCredentials } from "../selection"
+import { buildWallet, neverLoadChainState } from "../wallet-factory"
+import type { UserAppPorts } from "../types"
+
+/** A held credential together with the issuer entry naming its plaintext programme and issuer. */
+interface Candidate extends CredentialInfo {
+    issuerNetworkId: Hex32
+    entry: IssuerIndexEntry
+}
+
+/** A candidate checked against the network state, carrying the state that check read. */
+interface SyncedCandidate extends Candidate {
+    chainState: WalletChainState
+}
+
+export async function presentationCreateHandler(
+    ports: UserAppPorts,
+    params: PresentationCreateParams
+): Promise<PresentationCreateResult> {
+    const step = (name: string) => ports.progress("presentation.create", name)
+
+    // The state is read below, once the request is known to have candidates, so the wallet is built
+    // without an authority and handed one per call.
+    const wallet = await buildWallet(ports, neverLoadChainState)
+
+    /**
+     * The same for every candidate, so the request reads it once however many credentials it has
+     * to check — and a verifier that cannot serve it fails the whole request, since no candidate
+     * can be judged without it.
+     */
+    async function verifierIssuerSet(): Promise<IssuerSetState> {
+        try {
+            return await readIssuerSet(ports.http, params.issuersUrl)
+        } catch (error) {
+            throw new LinkError(
+                "VERIFIER_UNREACHABLE",
+                error instanceof Error ? error.message : `GET ${params.issuersUrl} failed`
+            )
+        }
+    }
+
+    /** Same reasoning as the issuer set: the verifier is the party that must accept this root. */
+    async function verifierRevocations(): Promise<RevocationsState> {
+        try {
+            return await readRevocations(ports.http, params.revocationsUrl)
+        } catch (error) {
+            throw new LinkError(
+                "VERIFIER_UNREACHABLE",
+                error instanceof Error ? error.message : `GET ${params.revocationsUrl} failed`
+            )
+        }
+    }
+
+    async function readCandidates(): Promise<Candidate[]> {
+        const infoById = new Map((await wallet.listCredentials()).map((info) => [info.id, info]))
+        const held = (await listIssuerEntries(ports.store)).flatMap(({ issuerNetworkId, ...entry }) => {
+            const info = infoById.get(entry.credentialId)
+            // An entry whose credential is gone names a snapshot for nothing; a credential with
+            // no entry has no snapshot to be checked against. Neither can be proved.
+            return info === undefined ? [] : [{ ...info, issuerNetworkId, entry }]
+        })
+        return matchingCredentials(held, params)
+    }
+
+    step("Checking your credential")
+    const candidates = await readCandidates()
+
+    // One read for the whole request: every member serves the same network tree, and reading it
+    // per issuer was itself what told whoever served it which issuer a credential came from. The
+    // state is kept so the proof is built from the same read, not a second one that could disagree.
+    let chainState: WalletChainState | undefined
+    if (candidates.length > 0) {
+        const state = { ...(await verifierIssuerSet()), ...(await verifierRevocations()) }
+        chainState = state
+        for (const candidate of candidates) {
+            try {
+                await wallet.syncCredential(candidate.id, async () => state)
+            } catch (error) {
+                // A served root that does not match the tree served beside it is the verifier's
+                // fault, not this wallet's; without mapping it the caller is told INTERNAL.
+                throw mapWalletError(error, "VERIFIER_UNREACHABLE")
+            }
+        }
+    }
+
+    const synced = (await readCandidates()).flatMap<SyncedCandidate>((candidate) =>
+        chainState === undefined ? [] : [{ ...candidate, chainState }]
+    )
+    const selected = latestExpiring(synced.filter((candidate) => candidate.status === "valid"))
+    if (selected === null) {
+        const revoked = latestExpiring(synced.filter((candidate) => candidate.status === "revoked"))
+        if (revoked !== null) {
+            // The refusal itself says the person holds a revoked credential, which a proof never
+            // would, so it goes through the same gate the proof does.
+            const told = await ports.review({
+                kind: "revoked",
+                verifier: params.audience,
+                programme: params.programme,
+                country: params.country,
+                issuerNetworkId: revoked.issuerNetworkId
+            })
+            if (!told) throw new LinkError("CONSENT_DENIED", "the refusal was not shared")
+            throw new LinkError("CREDENTIAL_REVOKED", `the ${params.programme} credential you hold has been revoked`)
+        }
+        throw new LinkError(
+            "NO_CREDENTIAL",
+            `no held credential matches programme "${params.programme}"/"${params.country}"`
+        )
+    }
+
+    step("Proving")
+    let proof
+    try {
+        proof = await wallet.present(
+            selected.id,
+            {
+                challenge: hexToBytes(params.challenge),
+                audience: params.audience,
+                currentTime: params.currentTime,
+                programme: params.programme,
+                country: params.country
+            },
+            async () => selected.chainState
+        )
+    } catch (error) {
+        if (error instanceof WalletError) throw mapWalletError(error)
+        // A raw prover failure, not a WalletError - keep it distinguishable from NO_CREDENTIAL above.
+        throw new LinkError("PROOF_FAILED", error instanceof Error ? error.message : "proof generation failed")
+    }
+
+    const approved = await ports.review({
+        kind: "proof",
+        verifier: params.audience,
+        programme: params.programme,
+        country: params.country,
+        issuerNetworkId: selected.issuerNetworkId
+    })
+    if (!approved) throw new LinkError("CONSENT_DENIED", "the proof was built but not shared")
+
+    step("Sharing")
+    // Only the id comes back: the verifier's own `ok` would be the verifier reporting on itself,
+    // and its member app can read the recorded outcome from its own server under this id.
+    const posted = await postToMember(
+        ports.http,
+        params.responseUrl,
+        { requestId: params.requestId, proof: bytesToHex(proof.proof), publicInputs: proof.publicInputs },
+        { status: 200, schema: verifyResponseSchema, unreachable: "VERIFIER_UNREACHABLE" }
+    )
+    // An issuer's error body is the issuer refusing this person, and the wallet relays it. A
+    // verifier has nothing to refuse — it is answering a request the wallet made — so an error
+    // body from it is just an answer the wallet cannot use.
+    if (posted.refusal) {
+        throw new LinkError("VERIFIER_UNREACHABLE", `${params.responseUrl} returned an unusable response`)
+    }
+    return { verificationId: posted.value.verificationId }
+}

package/src/handlers/registration-sign.ts

@@ -0,0 +1,19 @@
+import { deriveKeys, type Hex } from "@coordination-network/identity"
+import type { RegistrationSignParams, RegistrationSignResult } from "@coordination-network/user-app-link"
+import { buildRegistrationRequest } from "@coordination-network/user-client"
+import type { UserAppPorts } from "../types"
+
+export async function registrationSignHandler(
+    ports: UserAppPorts,
+    deviceSecret: Hex,
+    params: RegistrationSignParams
+): Promise<RegistrationSignResult> {
+    const keys = deriveKeys(deviceSecret)
+    return {
+        request: buildRegistrationRequest(keys, {
+            chainId: params.chainId,
+            verifyingContract: params.verifyingContract
+        }),
+        securityLevel: await ports.deviceKey.getSecurityLevel()
+    }
+}

package/src/hex.ts

@@ -0,0 +1,8 @@
+import { bytesToHex, hexToBytes } from "@coordination-network/identity"
+
+export { bytesToHex, hexToBytes }
+
+/** Encodes a field element as the 32-byte big-endian value the binding and commitment builders expect. */
+export function bigintToBytes32(value: bigint): Uint8Array {
+    return hexToBytes(`0x${value.toString(16).padStart(64, "0")}`)
+}

package/src/identity.ts

@@ -0,0 +1,15 @@
+import { deriveKeys, type Hex } from "@coordination-network/identity"
+import { metaStealthAddressFromKeys } from "@coordination-network/user-client"
+import type { DeviceKey, PublicIdentity } from "./types"
+
+/** Assembles the four values the Identity screen shows — `Wallet` exposes none of them directly. */
+export async function assembleIdentity(deviceSecret: Hex, deviceKey: DeviceKey): Promise<PublicIdentity> {
+    const keys = deriveKeys(deviceSecret)
+
+    return {
+        networkId: keys.networkId,
+        metaStealthAddress: metaStealthAddressFromKeys(keys),
+        accountPublicKey: keys.account.uncompressedPublicKey,
+        securityLevel: await deviceKey.getSecurityLevel()
+    }
+}

package/src/index.ts

@@ -0,0 +1,30 @@
+/**
+ * `@coordination-network/user-app-core` — the three `user-app-link` operations a user app serves,
+ * over injected device, storage and proving ports. See `README.md`.
+ */
+
+export { createUserAppService } from "./service"
+export { mapWalletError } from "./errors"
+export { latestExpiring, matchingCredentials, type CredentialSelectionRequest } from "./selection"
+export { buildConsentSummary } from "./consent"
+export { DEVICE_SECRET_KEY } from "./device-secret"
+export { CREDENTIAL_ISSUE_STEPS } from "./steps"
+export { listIssuerEntries, readIssuerEntry, type IssuerIndexEntry } from "./issuer-index"
+export type {
+    ConsentDetail,
+    ConsentScope,
+    ConsentSummary,
+    DeviceKey,
+    HeldCredential,
+    HeldCredentialStatus,
+    HttpClient,
+    HttpJsonResponse,
+    PresentationReview,
+    PresentationReviewPrompt,
+    PublicIdentity,
+    RevocationAuthority,
+    StealthScanKeys,
+    UserAppPorts,
+    UserAppService,
+    UserConsentPrompt
+} from "./types"