@coordination-network/user-app-core 0.0.2 → 0.1.0

package/dist/index.cjs

@@ -2,10 +2,11 @@
 
 var identity = require('@coordination-network/identity');
 var credential = require('@coordination-network/credential');
+var wallet = require('@coordination-network/wallet');
 var userAppLink = require('@coordination-network/user-app-link');
+var identity$1 = require('@semaphore-protocol/identity');
 var issuerSet = require('@coordination-network/issuer-set');
 var revocationRegistry = require('@coordination-network/revocation-registry');
-var wallet = require('@coordination-network/wallet');
 var zod = require('zod');
 var userClient = require('@coordination-network/user-client');
 
@@ -85,43 +86,59 @@ async function writeDeviceSecret(store, secret) {
     await store.set(DEVICE_SECRET_KEY, secret);
 }
 
-/**
- * `GET /v1/issuers` carries a `root` the server read from chain independently of the `leaves` it
- * also served, so `Wallet`'s comparison between the tree rebuilt from `leaves` and
- * `approvedIssuerRoot` catches a server that served a mismatched pair.
- */
 async function readIssuerSet(http, issuersUrl) {
     const response = await http.getJson(issuersUrl);
     if (response.status !== 200) {
         throw new Error(`GET ${issuersUrl} returned ${response.status}`);
     }
-    const { leaves, root } = response.body;
-    return {
-        approvedIssuers: issuerSet.ApprovedIssuerSet.fromLeaves(leaves.map((leaf) => BigInt(leaf))),
-        approvedIssuerRoot: BigInt(root)
-    };
+    const { leaves } = response.body;
+    return issuerSet.ApprovedIssuerSet.fromLeaves(leaves.map((leaf) => BigInt(leaf)));
 }
-/** The snapshot's own `root` gives the revocation side the same cross-check. */
 async function readRevocations(http, revocationsUrl) {
     const response = await http.getJson(revocationsUrl);
     if (response.status !== 200) {
         throw new Error(`GET ${revocationsUrl} returned ${response.status}`);
     }
-    const { root, snapshot } = response.body;
-    return { revocations: revocationRegistry.RevocationRegistry.import(snapshot), revocationRoot: BigInt(root) };
+    const { snapshot } = response.body;
+    return revocationRegistry.RevocationRegistry.import(snapshot);
 }
 /**
- * Both lists are named per request by `issuersUrl`/`revocationsUrl`, so this is built fresh per
- * request and never held onto. A handler with several credentials to check reads the two halves
- * itself instead, so one read of each serves them all (see `presentation-create.ts`).
+ * Bulk data only: the `root` each endpoint also serves is not read, because the server choosing
+ * both halves of the comparison makes it pass whatever it serves. The caller pairs these trees
+ * with roots read from chain, and `listsMatchChain` rejects a pair that disagrees.
  */
-function buildChainStateLoader(http, issuersUrl, revocationsUrl) {
-    return async () => ({
-        ...(await readIssuerSet(http, issuersUrl)),
-        ...(await readRevocations(http, revocationsUrl))
-    });
+async function readLists(http, issuersUrl, revocationsUrl) {
+    const [approvedIssuers, revocations] = await Promise.all([
+        readIssuerSet(http, issuersUrl),
+        readRevocations(http, revocationsUrl)
+    ]);
+    return { approvedIssuers, revocations };
+}
+/** Both roots, and the issuer set's leaf count, which with its root fixes every leaf. */
+function listsMatchChain(lists, chain) {
+    return (lists.approvedIssuers.root === chain.approvedIssuerRoot &&
+        lists.approvedIssuers.leafCount === chain.approvedIssuerLeafCount &&
+        lists.revocations.root === chain.revocationRoot);
 }
 
+/**
+ * A key use the person or the platform ended: cancelled at the prompt, the key invalidated, or the
+ * authentication itself failed (lockout, no foreground activity, another prompt already showing).
+ */
+class DeviceKeyError extends Error {
+    constructor(code, message = code) {
+        super(message);
+        this.name = "DeviceKeyError";
+        this.code = code;
+    }
+}
+/** A cancel is the person's refusal; anything else the key reports is this app's fault, not a request problem. */
+function mapDeviceKeyError(error) {
+    if (error instanceof DeviceKeyError && error.code === "USER_CANCELED") {
+        return new userAppLink.LinkError("CONSENT_DENIED", "the person cancelled the device prompt");
+    }
+    return new userAppLink.LinkError("INTERNAL", error instanceof Error ? error.message : String(error));
+}
 /**
  * `WalletError` and `LinkError` speak different vocabularies for the same underlying failures.
  * Split along one line: a malformed or structurally-invalid credential is `INVALID_REQUEST`;
@@ -153,6 +170,9 @@ const WALLET_ERROR_TO_LINK_ERROR_CODE = {
  * absent `code` would have produced a `LinkError` with no code at all.
  */
 function mapWalletError(error, chainStateCode) {
+    // The wallet wraps whatever its signer or seed thunk threw; the key's own failures keep their meaning.
+    if (error instanceof wallet.WalletError && error.cause instanceof DeviceKeyError)
+        return mapDeviceKeyError(error.cause);
     if (!(error instanceof wallet.WalletError)) {
         return new userAppLink.LinkError("INTERNAL", error instanceof Error ? error.message : String(error));
     }
@@ -217,9 +237,10 @@ async function postToMember(http, url, body, expected) {
 }
 
 /**
- * `issuerNetworkId` is asserted by the caller and cannot be verified here. An established mapping
- * still cannot be taken over while the credential under it is valid: `credential.issue` answers
- * `alreadyHeld` for such a key rather than issuing against it again.
+ * `issuerNetworkId` is asserted by the caller, so `credential.issue` checks it against the chain:
+ * an entry is written, or honoured as `alreadyHeld`, only for a key in the member's
+ * `issuerKeysOf` list. Listings and presentation read entries as written, including any from before
+ * this check.
  */
 const ISSUER_INDEX_PREFIX = "user-app-core:issuer-index:";
 /**
@@ -252,6 +273,25 @@ async function listIssuerEntries(store) {
 async function writeIssuerEntry(store, issuerNetworkId, entry) {
     await store.set(keyFor(issuerNetworkId, entry), JSON.stringify(entry));
 }
+/** Removes the entries naming any of `credentialIds`; every other entry stays. */
+async function deleteIssuerEntries(store, credentialIds) {
+    for (const key of await store.list()) {
+        if (!key.startsWith(ISSUER_INDEX_PREFIX))
+            continue;
+        const raw = await store.get(key);
+        if (raw === null)
+            continue;
+        let credentialId;
+        try {
+            credentialId = JSON.parse(raw).credentialId;
+        }
+        catch {
+            continue;
+        }
+        if (credentialIds.has(credentialId))
+            await store.delete(key);
+    }
+}
 
 /** `ports.now` is optional (a test harness injects a deterministic clock); real ports omit it. */
 function nowFn(ports) {
@@ -272,6 +312,11 @@ const CREDENTIAL_ISSUE_STEPS = {
     storing: "Saving to your wallet"
 };
 
+/** Its own text, so the person never sees two identical dialogs back to back. */
+const ECDH_PROMPT = {
+    title: "Unlock your credentials",
+    subtitle: "Needed once each time the app starts"
+};
 /**
  * The Baby Jubjub identity seed, rooted in the hardware ECDH rather than the device secret.
  * `deriveEddsaKeypair` returns `seed` as a `0x`-prefixed hex string — handing that string to
@@ -279,9 +324,29 @@ const CREDENTIAL_ISSUE_STEPS = {
  * the 32 raw bytes decoded from it.
  */
 async function resolveIdentitySeed(deviceKey) {
-    const sharedSecret = await deviceKey.ecdh(identity.eddsaPeerPointBytes());
+    const sharedSecret = await deviceKey.ecdh(identity.eddsaPeerPointBytes(), ECDH_PROMPT);
     return identity.hexToBytes(identity.deriveEddsaKeypair(sharedSecret).seed);
 }
+function createIdentitySeedCache(deviceKey) {
+    let pending = null;
+    return {
+        resolve() {
+            if (pending === null) {
+                const attempt = resolveIdentitySeed(deviceKey);
+                pending = attempt;
+                // A cancelled prompt must not be cached: the next operation asks again.
+                attempt.catch(() => {
+                    if (pending === attempt)
+                        pending = null;
+                });
+            }
+            return pending;
+        },
+        clear() {
+            pending = null;
+        }
+    };
+}
 /**
  * `listCredentials` never syncs — there is no single authority to sync a mixed-issuer listing
  * against — so this sentinel documents that, and would surface loudly if a future bug called it.
@@ -289,16 +354,31 @@ async function resolveIdentitySeed(deviceKey) {
 const neverLoadChainState = async () => {
     throw new Error("chain state must not be requested outside a per-request authority");
 };
+/** A listing wallet's identity seed: like `neverLoadChainState`, loud if a future bug reaches for it. */
+const neverSeed = async () => {
+    throw new Error("a listing must not ask the device key for the identity seed");
+};
+const neverSign = async () => {
+    throw new Error("a listing must not ask the device key to sign");
+};
+/** A listing wallet's signer: it reads the public key, which raises no prompt, and never signs. */
+const listingSigner = (deviceKey) => ({
+    getPublicKeyJwk: () => deviceKey.getPublicKeyJwk(),
+    sign: neverSign,
+    signDigest: neverSign
+});
 /**
  * A fresh `Wallet` per request, scoped to one member's authority. The private `Wallet` gets a
  * constant-`true` consent prompt: the person has already been asked once, at the link boundary,
  * and prompting again here would show a second screen for one `presentation.create`.
+ *
+ * `prompt` is what a signature raises. `null` builds a wallet for listing and syncing, which must
+ * never touch a key: its seed and signer throw.
  */
-async function buildWallet(ports, loadChainState) {
-    const identitySeed = await resolveIdentitySeed(ports.deviceKey);
+function buildWallet(ports, seeds, loadChainState, prompt) {
     return new wallet.Wallet({
-        identitySeed,
-        deviceSigner: ports.deviceKey,
+        identitySeed: prompt === null ? neverSeed : () => seeds.resolve(),
+        deviceSigner: prompt === null ? listingSigner(ports.deviceKey) : ports.deviceKey.signerFor(prompt),
         consent: async () => true,
         proofGenerator: ports.proofGenerator,
         store: ports.store,
@@ -317,6 +397,16 @@ const refused = ({ code, message }) => ({
     code: code ?? UNNAMED_REFUSAL,
     message
 });
+const isMemberKey = (memberKeyLeaves, key) => memberKeyLeaves.has(issuerSet.issuerKeyLeaf([BigInt(key[0]), BigInt(key[1])]));
+/** A cancel or an invalidated key reaches the person as the link error that says so, not as an internal failure. */
+async function keyUse(use) {
+    try {
+        return await use;
+    }
+    catch (error) {
+        throw error instanceof DeviceKeyError ? mapDeviceKeyError(error) : error;
+    }
+}
 /**
  * Whether an indexed credential still stops this member issuing another for the same programme.
  * Only one that is valid right now does: a revoked or expired credential, or an entry whose
@@ -336,25 +426,56 @@ async function isStillValid(wallet, credentialId, load) {
  * The revocation secret is generated and opened inside this one call, so it never leaves the
  * function and nothing has to persist it between two deep links.
  */
-async function credentialIssueHandler(ports, deviceSecret, params) {
+async function credentialIssueHandler(ports, seeds, deviceSecret, params) {
     const step = (name) => ports.progress("credential.issue", name);
     step(CREDENTIAL_ISSUE_STEPS.held);
     const held = await readIssuerEntry(ports.store, params.issuerNetworkId, params.approvalScope);
     // Read before the issuer signs: the revocation secret below never leaves this call, so a
     // failure after the 201 would orphan the credential at the issuer with nothing able to open it.
+    // So is the chain read, and an empty key list refuses before any challenge. Whether the signing
+    // key is among the keys can only be known after the signature; that mismatch is refused below.
     step(CREDENTIAL_ISSUE_STEPS.lists);
-    let chainState;
-    try {
-        chainState = await buildChainStateLoader(ports.http, params.issuersUrl, params.revocationsUrl)();
-    }
-    catch (error) {
-        throw new userAppLink.LinkError("ISSUER_UNREACHABLE", error instanceof Error
-            ? error.message
+    const [lists, leafRead, rootsRead] = await Promise.allSettled([
+        readLists(ports.http, params.issuersUrl, params.revocationsUrl),
+        ports.directory.issuerKeyLeavesOf(params.issuerNetworkId),
+        ports.roots.currentRoots()
+    ]);
+    if (lists.status === "rejected") {
+        throw new userAppLink.LinkError("ISSUER_UNREACHABLE", lists.reason instanceof Error
+            ? lists.reason.message
             : "the issuer's approved-issuer set or revocation snapshot is unreadable");
     }
+    if (leafRead.status === "rejected") {
+        // Fixed text: a viem message carries the RPC URL, which can hold a provider key.
+        throw new userAppLink.LinkError("CHAIN_UNREACHABLE", "the approved issuer keys could not be read from chain");
+    }
+    if (rootsRead.status === "rejected") {
+        throw new userAppLink.LinkError("CHAIN_UNREACHABLE", "the current roots could not be read from chain");
+    }
+    // The wallet's own check only runs once the issuer has signed, which would orphan the credential.
+    if (!listsMatchChain(lists.value, rootsRead.value)) {
+        throw new userAppLink.LinkError("ISSUER_UNREACHABLE", "the issuer's lists do not match the chain");
+    }
+    const chainState = {
+        ...lists.value,
+        approvedIssuerRoot: rootsRead.value.approvedIssuerRoot,
+        revocationRoot: rootsRead.value.revocationRoot
+    };
+    const memberKeyLeaves = new Set(leafRead.value);
+    if (memberKeyLeaves.size === 0) {
+        throw new userAppLink.LinkError("ISSUER_NOT_APPROVED", `no approved issuer key is known for ${params.issuerNetworkId}`);
+    }
     const loadChainState = async () => chainState;
-    const wallet = await buildWallet(ports, loadChainState);
-    if (held !== null && (await isStillValid(wallet, held.credentialId, loadChainState))) {
+    // The hold check below reads and syncs only, so it asks nothing of the keys; the seed and the
+    // signature come after the challenge.
+    const prompt = {
+        title: "Bind a credential to this phone",
+        subtitle: `${params.approvalScope.programme} (${params.approvalScope.country})`
+    };
+    const wallet = buildWallet(ports, seeds, loadChainState, prompt);
+    if (held !== null &&
+        isMemberKey(memberKeyLeaves, held.issuerPublicKey) &&
+        (await isStillValid(wallet, held.credentialId, loadChainState))) {
         return { status: "alreadyHeld", credentialId: held.credentialId };
     }
     const keys = identity.deriveKeys(deviceSecret);
@@ -364,14 +485,17 @@ async function credentialIssueHandler(ports, deviceSecret, params) {
         return refused(challenge.refusal);
     const nonce = challenge.value.nonce;
     step(CREDENTIAL_ISSUE_STEPS.binding);
+    const seed = await keyUse(seeds.resolve());
+    const identity$2 = new identity$1.Identity(seed);
     const confirmationKey = await ports.deviceKey.getPublicKeyJwk();
-    const eddsa = identity.deriveEddsaKeypair(await ports.deviceKey.ecdh(identity.eddsaPeerPointBytes()));
     const revocationSecret = credential.generateRevocationSecret();
     const ownership = credential.signCommitmentOwnership(revocationSecret, identity.hexToBytes(nonce));
-    const deviceBindingMessage = identity.buildDeviceBindingMessage(nonce, keys.networkId, bigintToBytes32(eddsa.commitment));
-    const devicePopSignature = identity.bytesToHex(await ports.deviceKey.sign(deviceBindingMessage));
+    const holderOwnership = credential.signHolderKeyOwnership(seed, identity.hexToBytes(nonce));
+    const deviceBindingMessage = identity.buildDeviceBindingMessage(nonce, keys.networkId, bigintToBytes32(identity$2.commitment), credential.issuanceRequestCommitment(params.issuerNetworkId, params.approvalScope));
+    const devicePopSignature = identity.bytesToHex(await keyUse(ports.deviceKey.signerFor(prompt).sign(deviceBindingMessage)));
     const { signature: accountPopSignature } = identity.signAccountBinding(keys.account.privateKey, nonce, credential.jwkToPublicKeyBytes(confirmationKey));
     step(CREDENTIAL_ISSUE_STEPS.signing);
+    const deviceAttestation = await ports.deviceKey.getAttestationChain();
     const issued = await postToMember(ports.http, params.credentialsUrl, {
         challengeId: challenge.value.challengeId,
         subjectNetworkId: keys.networkId,
@@ -380,7 +504,11 @@ async function credentialIssueHandler(ports, deviceSecret, params) {
         accountPublicKey: keys.account.uncompressedPublicKey,
         devicePopSignature,
         accountPopSignature,
-        identityPublicKey: pointToStrings(eddsa.publicKey),
+        identityPublicKey: pointToStrings(identity$2.publicKey),
+        identityOwnershipSignature: {
+            R8: pointToStrings(holderOwnership.signature.R8),
+            S: String(holderOwnership.signature.S)
+        },
         revocation: {
             commitment: credential.deriveRevocationCommitment(revocationSecret).toString(),
             publicKey: pointToStrings(ownership.publicKey),
@@ -388,18 +516,30 @@ async function credentialIssueHandler(ports, deviceSecret, params) {
                 R8: pointToStrings(ownership.signature.R8),
                 S: String(ownership.signature.S)
             }
-        }
+        },
+        ...(deviceAttestation.length > 0 && { deviceAttestation })
     }, { status: 201, schema: issueCredentialResponseSchema, unreachable: "ISSUER_UNREACHABLE" });
     if (issued.refusal)
         return refused(issued.refusal);
-    let issuerPublicKey;
+    let parsed;
     try {
-        const parsed = credential.parseZkCredential(issued.value.credential);
-        issuerPublicKey = [parsed.issuerPublicKey[0].toString(), parsed.issuerPublicKey[1].toString()];
+        parsed = credential.parseZkCredential(issued.value.credential);
     }
     catch (error) {
         throw new userAppLink.LinkError("ISSUER_UNREACHABLE", error instanceof Error ? error.message : "malformed credential");
     }
+    // The issuer's own binding check enforces this; a dishonest issuer is not trusted to.
+    if (parsed.body.programmeHash !== credential.programmeHash(params.approvalScope.programme) ||
+        parsed.body.countryCode !== credential.countryCode(params.approvalScope.country)) {
+        throw new userAppLink.LinkError("ISSUER_UNREACHABLE", "credential is not for the programme and country consented to");
+    }
+    const issuerPublicKey = [
+        parsed.issuerPublicKey[0].toString(),
+        parsed.issuerPublicKey[1].toString()
+    ];
+    if (!isMemberKey(memberKeyLeaves, issuerPublicKey)) {
+        throw new userAppLink.LinkError("ISSUER_NOT_APPROVED", `the credential is not signed by a key of ${params.issuerNetworkId}`);
+    }
     // Built above for the hold check; the lists are read before the signature, so this is the
     // only step left that can fail.
     step(CREDENTIAL_ISSUE_STEPS.storing);
@@ -428,8 +568,8 @@ async function credentialIssueHandler(ports, deviceSecret, params) {
 /**
  * `presentation.create` carries no credential id, so this narrows by what the credential body
  * says: the requested programme and country. Status is deliberately not a filter — each candidate
- * is then synced against its own issuer's snapshot, and a caller that finds none valid still
- * needs to know whether it held a revoked one.
+ * is then synced against the verifier's lists, checked against the chain's roots, and a caller
+ * that finds none valid still needs to know whether it held a revoked one.
  */
 function matchingCredentials(credentials, request) {
     const wantedProgramme = credential.programmeHash(request.programme);
@@ -452,32 +592,36 @@ function latestExpiring(credentials) {
     });
 }
 
-async function presentationCreateHandler(ports, params) {
+async function presentationCreateHandler(ports, seeds, params) {
     const step = (name) => ports.progress("presentation.create", name);
     // The state is read below, once the request is known to have candidates, so the wallet is built
-    // without an authority and handed one per call.
-    const wallet$1 = await buildWallet(ports, neverLoadChainState);
+    // without an authority and handed one per call. This one only lists and syncs: it holds no key.
+    const wallet$1 = buildWallet(ports, seeds, neverLoadChainState, null);
     /**
      * The same for every candidate, so the request reads it once however many credentials it has
-     * to check — and a verifier that cannot serve it fails the whole request, since no candidate
-     * can be judged without it.
+     * to check — and a verifier that cannot serve the lists, or a chain that cannot be read, fails
+     * the whole request, since no candidate can be judged without them.
      */
-    async function verifierIssuerSet() {
-        try {
-            return await readIssuerSet(ports.http, params.issuersUrl);
+    async function networkState() {
+        const [lists, roots] = await Promise.allSettled([
+            readLists(ports.http, params.issuersUrl, params.revocationsUrl),
+            ports.roots.currentRoots()
+        ]);
+        if (lists.status === "rejected") {
+            throw new userAppLink.LinkError("VERIFIER_UNREACHABLE", lists.reason instanceof Error ? lists.reason.message : "the verifier's lists are unreadable");
         }
-        catch (error) {
-            throw new userAppLink.LinkError("VERIFIER_UNREACHABLE", error instanceof Error ? error.message : `GET ${params.issuersUrl} failed`);
-        }
-    }
-    /** Same reasoning as the issuer set: the verifier is the party that must accept this root. */
-    async function verifierRevocations() {
-        try {
-            return await readRevocations(ports.http, params.revocationsUrl);
+        if (roots.status === "rejected") {
+            // Fixed text: a viem message carries the RPC URL, which can hold a provider key.
+            throw new userAppLink.LinkError("CHAIN_UNREACHABLE", "the current roots could not be read from chain");
         }
-        catch (error) {
-            throw new userAppLink.LinkError("VERIFIER_UNREACHABLE", error instanceof Error ? error.message : `GET ${params.revocationsUrl} failed`);
+        if (!listsMatchChain(lists.value, roots.value)) {
+            throw new userAppLink.LinkError("VERIFIER_UNREACHABLE", "the verifier's lists do not match the chain");
         }
+        return {
+            ...lists.value,
+            approvedIssuerRoot: roots.value.approvedIssuerRoot,
+            revocationRoot: roots.value.revocationRoot
+        };
     }
     async function readCandidates() {
         const infoById = new Map((await wallet$1.listCredentials()).map((info) => [info.id, info]));
@@ -496,17 +640,10 @@ async function presentationCreateHandler(ports, params) {
     // state is kept so the proof is built from the same read, not a second one that could disagree.
     let chainState;
     if (candidates.length > 0) {
-        const state = { ...(await verifierIssuerSet()), ...(await verifierRevocations()) };
+        const state = await networkState();
         chainState = state;
         for (const candidate of candidates) {
-            try {
-                await wallet$1.syncCredential(candidate.id, async () => state);
-            }
-            catch (error) {
-                // A served root that does not match the tree served beside it is the verifier's
-                // fault, not this wallet's; without mapping it the caller is told INTERNAL.
-                throw mapWalletError(error, "VERIFIER_UNREACHABLE");
-            }
+            await wallet$1.syncCredential(candidate.id, async () => state);
         }
     }
     const synced = (await readCandidates()).flatMap((candidate) => chainState === undefined ? [] : [{ ...candidate, chainState }]);
@@ -529,10 +666,23 @@ async function presentationCreateHandler(ports, params) {
         }
         throw new userAppLink.LinkError("NO_CREDENTIAL", `no held credential matches programme "${params.programme}"/"${params.country}"`);
     }
+    const approved = await ports.review({
+        kind: "proof",
+        verifier: params.audience,
+        programme: params.programme,
+        country: params.country,
+        issuerNetworkId: selected.issuerNetworkId
+    });
+    if (!approved)
+        throw new userAppLink.LinkError("CONSENT_DENIED", "the proof was not shared");
     step("Proving");
+    const presenter = buildWallet(ports, seeds, neverLoadChainState, {
+        title: "Share a proof",
+        subtitle: `Proves your ${params.programme} credential (${params.country})`
+    });
     let proof;
     try {
-        proof = await wallet$1.present(selected.id, {
+        proof = await presenter.present(selected.id, {
             challenge: identity.hexToBytes(params.challenge),
             audience: params.audience,
             currentTime: params.currentTime,
@@ -546,15 +696,6 @@ async function presentationCreateHandler(ports, params) {
         // A raw prover failure, not a WalletError - keep it distinguishable from NO_CREDENTIAL above.
         throw new userAppLink.LinkError("PROOF_FAILED", error instanceof Error ? error.message : "proof generation failed");
     }
-    const approved = await ports.review({
-        kind: "proof",
-        verifier: params.audience,
-        programme: params.programme,
-        country: params.country,
-        issuerNetworkId: selected.issuerNetworkId
-    });
-    if (!approved)
-        throw new userAppLink.LinkError("CONSENT_DENIED", "the proof was built but not shared");
     step("Sharing");
     // Only the id comes back: the verifier's own `ok` would be the verifier reporting on itself,
     // and its member app can read the recorded outcome from its own server under this id.
@@ -590,6 +731,12 @@ async function assembleIdentity(deviceSecret, deviceKey) {
     };
 }
 
+// UNKNOWN ranks with SOFTWARE: a keystore that cannot say is trusted no more than one that admits it.
+const RANK = { STRONGBOX: 2, TRUSTED_ENVIRONMENT: 1, SOFTWARE: 0, UNKNOWN: 0 };
+function meetsSecurityLevel(level, minimum) {
+    return RANK[level] >= RANK[minimum];
+}
+
 /**
  * Still not `Wallet`'s own status: that also carries `issuer-not-approved`, which `syncRevocations`
  * stamps against whichever single member last asked for a presentation, and reporting one member's
@@ -651,6 +798,7 @@ function createUserAppService(ports) {
             throw new userAppLink.LinkError("NOT_ONBOARDED", "no identity has been created yet");
         return secret;
     }
+    const seeds = createIdentitySeedCache(ports.deviceKey);
     // One slot deep: a handler body reads and writes the same store a concurrent one might be
     // mid-sync against, so two deep links run their handler bodies one at a time, never interleaved.
     let queue = Promise.resolve();
@@ -661,10 +809,10 @@ function createUserAppService(ports) {
     }
     const handlers = {
         "registration.sign": (params) => serialize(async () => registrationSignHandler(ports, await requireOnboarded(), params)),
-        "credential.issue": (params) => serialize(async () => credentialIssueHandler(ports, await requireOnboarded(), params)),
+        "credential.issue": (params) => serialize(async () => credentialIssueHandler(ports, seeds, await requireOnboarded(), params)),
         "presentation.create": (params) => serialize(async () => {
             await requireOnboarded();
-            return presentationCreateHandler(ports, params);
+            return presentationCreateHandler(ports, seeds, params);
         })
     };
     return {
@@ -680,6 +828,13 @@ function createUserAppService(ports) {
                 if ((await resolveDeviceSecret()) !== null) {
                     throw new Error("createIdentity: an identity already exists — erase() before creating another");
                 }
+                const minimum = ports.minimumDeviceSecurityLevel;
+                if (minimum !== undefined) {
+                    const level = await ports.deviceKey.getSecurityLevel();
+                    if (!meetsSecurityLevel(level, minimum)) {
+                        throw new Error(`This phone's key protection is ${level}; creating an identity needs a hardware-backed key (${minimum} or better).`);
+                    }
+                }
                 const secret = identity.generateDeviceSecret();
                 const identity$1 = await assembleIdentity(secret, ports.deviceKey);
                 await writeDeviceSecret(ports.store, secret);
@@ -705,7 +860,7 @@ function createUserAppService(ports) {
          * name and the plaintext programme survive — the credential body carries a hash.
          */
         async listCredentials() {
-            const wallet = await buildWallet(ports, neverLoadChainState);
+            const wallet = buildWallet(ports, seeds, neverLoadChainState, null);
             const held = await wallet.listCredentials();
             const entryByCredentialId = new Map((await listIssuerEntries(ports.store)).map((entry) => [entry.credentialId, entry]));
             const nowSeconds = Math.floor(nowFn(ports) / 1000);
@@ -731,6 +886,37 @@ function createUserAppService(ports) {
                 expiresAt: body.expiresAt
             })));
         },
+        removeUnboundCredentials() {
+            return serialize(async () => {
+                const commitment = credential.deriveDeviceKeyCommitment(await ports.deviceKey.getPublicKeyJwk());
+                const wallet$1 = buildWallet(ports, seeds, neverLoadChainState, null);
+                const unbound = [];
+                for (const key of await ports.store.list()) {
+                    if (!key.startsWith(wallet.CREDENTIAL_PREFIX))
+                        continue;
+                    const id = key.slice(wallet.CREDENTIAL_PREFIX.length);
+                    try {
+                        const info = await wallet$1.getCredential(id);
+                        if (info !== null &&
+                            credential.parseZkCredential(info.credential).body.deviceKeyCommitment !== commitment) {
+                            unbound.push(id);
+                        }
+                    }
+                    catch {
+                        // Unreadable, so not proven unbound: left in place.
+                    }
+                }
+                if (unbound.length === 0)
+                    return 0;
+                // Index entries first: a run killed before the credentials go leaves them still
+                // unbound, so the next run removes them.
+                await deleteIssuerEntries(ports.store, new Set(unbound));
+                for (const id of unbound)
+                    await wallet$1.deleteCredential(id);
+                seeds.clear();
+                return unbound.length;
+            });
+        },
         /**
          * Clears the entire store, not only this package's own keys — a host app shares it, and an
          * "erase everything" that left its configuration behind would be a half-erase. A caller
@@ -741,13 +927,19 @@ function createUserAppService(ports) {
                 for (const key of await ports.store.list())
                     await ports.store.delete(key);
                 deviceSecretCache = null;
+                seeds.clear();
             });
         }
     };
 }
 
+Object.defineProperty(exports, "DEVICE_ATTESTATION_CHALLENGE", {
+    enumerable: true,
+    get: function () { return credential.DEVICE_ATTESTATION_CHALLENGE; }
+});
 exports.CREDENTIAL_ISSUE_STEPS = CREDENTIAL_ISSUE_STEPS;
 exports.DEVICE_SECRET_KEY = DEVICE_SECRET_KEY;
+exports.DeviceKeyError = DeviceKeyError;
 exports.buildConsentSummary = buildConsentSummary;
 exports.createUserAppService = createUserAppService;
 exports.latestExpiring = latestExpiring;