@coordination-network/user-app-core 0.0.2 → 0.1.0

package/src/chain-state.ts

@@ -1,61 +1,57 @@
 import { ApprovedIssuerSet } from "@coordination-network/issuer-set"
 import { RevocationRegistry } from "@coordination-network/revocation-registry"
-import type { ChainStateLoader, WalletChainState } from "@coordination-network/wallet"
-import type { HttpClient } from "./types"
+import type { WalletChainState } from "@coordination-network/wallet"
+import type { ChainRoots, HttpClient } from "./types"
 
 interface IssuersResponseBody {
     leaves: string[]
-    root: string
 }
 
 interface RevocationSnapshotResponseBody {
-    root: string
     snapshot: string
 }
 
-/** The half of a chain state a member's approved-issuer set supplies. */
-export type IssuerSetState = Pick<WalletChainState, "approvedIssuers" | "approvedIssuerRoot">
+/** The trees a server's two lists rebuild, with no root attached. */
+export type ChainLists = Pick<WalletChainState, "approvedIssuers" | "revocations">
 
-/** The half its revocation snapshot supplies. */
-export type RevocationsState = Pick<WalletChainState, "revocations" | "revocationRoot">
-
-/**
- * `GET /v1/issuers` carries a `root` the server read from chain independently of the `leaves` it
- * also served, so `Wallet`'s comparison between the tree rebuilt from `leaves` and
- * `approvedIssuerRoot` catches a server that served a mismatched pair.
- */
-export async function readIssuerSet(http: HttpClient, issuersUrl: string): Promise<IssuerSetState> {
+async function readIssuerSet(http: HttpClient, issuersUrl: string): Promise<ApprovedIssuerSet> {
     const response = await http.getJson(issuersUrl)
     if (response.status !== 200) {
         throw new Error(`GET ${issuersUrl} returned ${response.status}`)
     }
-    const { leaves, root } = response.body as IssuersResponseBody
+    const { leaves } = response.body as IssuersResponseBody
 
-    return {
-        approvedIssuers: ApprovedIssuerSet.fromLeaves(leaves.map((leaf) => BigInt(leaf))),
-        approvedIssuerRoot: BigInt(root)
-    }
+    return ApprovedIssuerSet.fromLeaves(leaves.map((leaf) => BigInt(leaf)))
 }
 
-/** The snapshot's own `root` gives the revocation side the same cross-check. */
-export async function readRevocations(http: HttpClient, revocationsUrl: string): Promise<RevocationsState> {
+async function readRevocations(http: HttpClient, revocationsUrl: string): Promise<RevocationRegistry> {
     const response = await http.getJson(revocationsUrl)
     if (response.status !== 200) {
         throw new Error(`GET ${revocationsUrl} returned ${response.status}`)
     }
-    const { root, snapshot } = response.body as RevocationSnapshotResponseBody
+    const { snapshot } = response.body as RevocationSnapshotResponseBody
 
-    return { revocations: RevocationRegistry.import(snapshot), revocationRoot: BigInt(root) }
+    return RevocationRegistry.import(snapshot)
 }
 
 /**
- * Both lists are named per request by `issuersUrl`/`revocationsUrl`, so this is built fresh per
- * request and never held onto. A handler with several credentials to check reads the two halves
- * itself instead, so one read of each serves them all (see `presentation-create.ts`).
+ * Bulk data only: the `root` each endpoint also serves is not read, because the server choosing
+ * both halves of the comparison makes it pass whatever it serves. The caller pairs these trees
+ * with roots read from chain, and `listsMatchChain` rejects a pair that disagrees.
  */
-export function buildChainStateLoader(http: HttpClient, issuersUrl: string, revocationsUrl: string): ChainStateLoader {
-    return async () => ({
-        ...(await readIssuerSet(http, issuersUrl)),
-        ...(await readRevocations(http, revocationsUrl))
-    })
+export async function readLists(http: HttpClient, issuersUrl: string, revocationsUrl: string): Promise<ChainLists> {
+    const [approvedIssuers, revocations] = await Promise.all([
+        readIssuerSet(http, issuersUrl),
+        readRevocations(http, revocationsUrl)
+    ])
+    return { approvedIssuers, revocations }
+}
+
+/** Both roots, and the issuer set's leaf count, which with its root fixes every leaf. */
+export function listsMatchChain(lists: ChainLists, chain: ChainRoots): boolean {
+    return (
+        lists.approvedIssuers.root === chain.approvedIssuerRoot &&
+        lists.approvedIssuers.leafCount === chain.approvedIssuerLeafCount &&
+        lists.revocations.root === chain.revocationRoot
+    )
 }

package/src/errors.ts

@@ -1,6 +1,28 @@
 import { WalletError, type WalletErrorCode } from "@coordination-network/wallet"
 import { LinkError, type LinkErrorCode } from "@coordination-network/user-app-link"
 
+/**
+ * A key use the person or the platform ended: cancelled at the prompt, the key invalidated, or the
+ * authentication itself failed (lockout, no foreground activity, another prompt already showing).
+ */
+export class DeviceKeyError extends Error {
+    readonly code: "USER_CANCELED" | "KEY_INVALIDATED" | "AUTHENTICATION_FAILED"
+
+    constructor(code: DeviceKeyError["code"], message: string = code) {
+        super(message)
+        this.name = "DeviceKeyError"
+        this.code = code
+    }
+}
+
+/** A cancel is the person's refusal; anything else the key reports is this app's fault, not a request problem. */
+export function mapDeviceKeyError(error: unknown): LinkError {
+    if (error instanceof DeviceKeyError && error.code === "USER_CANCELED") {
+        return new LinkError("CONSENT_DENIED", "the person cancelled the device prompt")
+    }
+    return new LinkError("INTERNAL", error instanceof Error ? error.message : String(error))
+}
+
 /**
  * `WalletError` and `LinkError` speak different vocabularies for the same underlying failures.
  * Split along one line: a malformed or structurally-invalid credential is `INVALID_REQUEST`;
@@ -33,6 +55,8 @@ const WALLET_ERROR_TO_LINK_ERROR_CODE: Record<WalletErrorCode, LinkErrorCode> =
  * absent `code` would have produced a `LinkError` with no code at all.
  */
 export function mapWalletError(error: unknown, chainStateCode?: LinkErrorCode): LinkError {
+    // The wallet wraps whatever its signer or seed thunk threw; the key's own failures keep their meaning.
+    if (error instanceof WalletError && error.cause instanceof DeviceKeyError) return mapDeviceKeyError(error.cause)
     if (!(error instanceof WalletError)) {
         return new LinkError("INTERNAL", error instanceof Error ? error.message : String(error))
     }

package/src/handlers/credential-issue.ts

@@ -1,29 +1,29 @@
+import { buildDeviceBindingMessage, deriveKeys, signAccountBinding, type Hex } from "@coordination-network/identity"
+import { Identity } from "@semaphore-protocol/identity"
 import {
-    buildDeviceBindingMessage,
-    deriveEddsaKeypair,
-    deriveKeys,
-    eddsaPeerPointBytes,
-    signAccountBinding,
-    type Hex
-} from "@coordination-network/identity"
-import {
+    countryCode,
     deriveRevocationCommitment,
     generateRevocationSecret,
+    issuanceRequestCommitment,
     jwkToPublicKeyBytes,
     parseZkCredential,
-    signCommitmentOwnership
+    programmeHash,
+    signCommitmentOwnership,
+    signHolderKeyOwnership,
+    type ZkCredential
 } from "@coordination-network/credential"
+import { issuerKeyLeaf } from "@coordination-network/issuer-set"
 import type { ChainStateLoader, Wallet, WalletChainState } from "@coordination-network/wallet"
 import { LinkError, type CredentialIssueParams, type CredentialIssueResult } from "@coordination-network/user-app-link"
-import { buildChainStateLoader } from "../chain-state"
-import { mapWalletError } from "../errors"
+import { listsMatchChain, readLists } from "../chain-state"
+import { DeviceKeyError, mapDeviceKeyError, mapWalletError } from "../errors"
 import { bigintToBytes32, bytesToHex, hexToBytes } from "../hex"
 import { challengeResponseSchema, issueCredentialResponseSchema, postToMember, type MemberRefusal } from "../member-api"
 import { readIssuerEntry, writeIssuerEntry } from "../issuer-index"
 import { nowFn } from "../now"
 import { CREDENTIAL_ISSUE_STEPS } from "../steps"
-import { buildWallet } from "../wallet-factory"
-import type { UserAppPorts } from "../types"
+import { buildWallet, type IdentitySeedCache } from "../wallet-factory"
+import type { KeyPrompt, UserAppPorts } from "../types"
 
 type Refusal = Extract<CredentialIssueResult, { status: "refused" }>
 
@@ -40,6 +40,18 @@ const refused = ({ code, message }: MemberRefusal): Refusal => ({
     message
 })
 
+const isMemberKey = (memberKeyLeaves: ReadonlySet<bigint>, key: readonly [string, string]): boolean =>
+    memberKeyLeaves.has(issuerKeyLeaf([BigInt(key[0]), BigInt(key[1])]))
+
+/** A cancel or an invalidated key reaches the person as the link error that says so, not as an internal failure. */
+async function keyUse<T>(use: Promise<T>): Promise<T> {
+    try {
+        return await use
+    } catch (error) {
+        throw error instanceof DeviceKeyError ? mapDeviceKeyError(error) : error
+    }
+}
+
 /**
  * Whether an indexed credential still stops this member issuing another for the same programme.
  * Only one that is valid right now does: a revoked or expired credential, or an entry whose
@@ -61,6 +73,7 @@ async function isStillValid(wallet: Wallet, credentialId: string, load: ChainSta
  */
 export async function credentialIssueHandler(
     ports: UserAppPorts,
+    seeds: IdentitySeedCache,
     deviceSecret: Hex,
     params: CredentialIssueParams
 ): Promise<CredentialIssueResult> {
@@ -71,22 +84,56 @@ export async function credentialIssueHandler(
 
     // Read before the issuer signs: the revocation secret below never leaves this call, so a
     // failure after the 201 would orphan the credential at the issuer with nothing able to open it.
+    // So is the chain read, and an empty key list refuses before any challenge. Whether the signing
+    // key is among the keys can only be known after the signature; that mismatch is refused below.
     step(CREDENTIAL_ISSUE_STEPS.lists)
-    let chainState: WalletChainState
-    try {
-        chainState = await buildChainStateLoader(ports.http, params.issuersUrl, params.revocationsUrl)()
-    } catch (error) {
+    const [lists, leafRead, rootsRead] = await Promise.allSettled([
+        readLists(ports.http, params.issuersUrl, params.revocationsUrl),
+        ports.directory.issuerKeyLeavesOf(params.issuerNetworkId),
+        ports.roots.currentRoots()
+    ])
+    if (lists.status === "rejected") {
         throw new LinkError(
             "ISSUER_UNREACHABLE",
-            error instanceof Error
-                ? error.message
+            lists.reason instanceof Error
+                ? lists.reason.message
                 : "the issuer's approved-issuer set or revocation snapshot is unreadable"
         )
     }
+    if (leafRead.status === "rejected") {
+        // Fixed text: a viem message carries the RPC URL, which can hold a provider key.
+        throw new LinkError("CHAIN_UNREACHABLE", "the approved issuer keys could not be read from chain")
+    }
+    if (rootsRead.status === "rejected") {
+        throw new LinkError("CHAIN_UNREACHABLE", "the current roots could not be read from chain")
+    }
+    // The wallet's own check only runs once the issuer has signed, which would orphan the credential.
+    if (!listsMatchChain(lists.value, rootsRead.value)) {
+        throw new LinkError("ISSUER_UNREACHABLE", "the issuer's lists do not match the chain")
+    }
+    const chainState: WalletChainState = {
+        ...lists.value,
+        approvedIssuerRoot: rootsRead.value.approvedIssuerRoot,
+        revocationRoot: rootsRead.value.revocationRoot
+    }
+    const memberKeyLeaves = new Set(leafRead.value)
+    if (memberKeyLeaves.size === 0) {
+        throw new LinkError("ISSUER_NOT_APPROVED", `no approved issuer key is known for ${params.issuerNetworkId}`)
+    }
 
     const loadChainState: ChainStateLoader = async () => chainState
-    const wallet = await buildWallet(ports, loadChainState)
-    if (held !== null && (await isStillValid(wallet, held.credentialId, loadChainState))) {
+    // The hold check below reads and syncs only, so it asks nothing of the keys; the seed and the
+    // signature come after the challenge.
+    const prompt: KeyPrompt = {
+        title: "Bind a credential to this phone",
+        subtitle: `${params.approvalScope.programme} (${params.approvalScope.country})`
+    }
+    const wallet = buildWallet(ports, seeds, loadChainState, prompt)
+    if (
+        held !== null &&
+        isMemberKey(memberKeyLeaves, held.issuerPublicKey) &&
+        (await isStillValid(wallet, held.credentialId, loadChainState))
+    ) {
         return { status: "alreadyHeld", credentialId: held.credentialId }
     }
 
@@ -103,13 +150,20 @@ export async function credentialIssueHandler(
     const nonce = challenge.value.nonce
 
     step(CREDENTIAL_ISSUE_STEPS.binding)
+    const seed = await keyUse(seeds.resolve())
+    const identity = new Identity(seed)
     const confirmationKey = await ports.deviceKey.getPublicKeyJwk()
-    const eddsa = deriveEddsaKeypair(await ports.deviceKey.ecdh(eddsaPeerPointBytes()))
     const revocationSecret = generateRevocationSecret()
     const ownership = signCommitmentOwnership(revocationSecret, hexToBytes(nonce))
+    const holderOwnership = signHolderKeyOwnership(seed, hexToBytes(nonce))
 
-    const deviceBindingMessage = buildDeviceBindingMessage(nonce, keys.networkId, bigintToBytes32(eddsa.commitment))
-    const devicePopSignature = bytesToHex(await ports.deviceKey.sign(deviceBindingMessage))
+    const deviceBindingMessage = buildDeviceBindingMessage(
+        nonce,
+        keys.networkId,
+        bigintToBytes32(identity.commitment),
+        issuanceRequestCommitment(params.issuerNetworkId, params.approvalScope)
+    )
+    const devicePopSignature = bytesToHex(await keyUse(ports.deviceKey.signerFor(prompt).sign(deviceBindingMessage)))
     const { signature: accountPopSignature } = signAccountBinding(
         keys.account.privateKey,
         nonce,
@@ -117,6 +171,7 @@ export async function credentialIssueHandler(
     )
 
     step(CREDENTIAL_ISSUE_STEPS.signing)
+    const deviceAttestation = await ports.deviceKey.getAttestationChain()
     const issued = await postToMember(
         ports.http,
         params.credentialsUrl,
@@ -128,7 +183,11 @@ export async function credentialIssueHandler(
             accountPublicKey: keys.account.uncompressedPublicKey,
             devicePopSignature,
             accountPopSignature,
-            identityPublicKey: pointToStrings(eddsa.publicKey),
+            identityPublicKey: pointToStrings(identity.publicKey),
+            identityOwnershipSignature: {
+                R8: pointToStrings(holderOwnership.signature.R8),
+                S: String(holderOwnership.signature.S)
+            },
             revocation: {
                 commitment: deriveRevocationCommitment(revocationSecret).toString(),
                 publicKey: pointToStrings(ownership.publicKey),
@@ -136,19 +195,34 @@ export async function credentialIssueHandler(
                     R8: pointToStrings(ownership.signature.R8),
                     S: String(ownership.signature.S)
                 }
-            }
+            },
+            ...(deviceAttestation.length > 0 && { deviceAttestation })
         },
         { status: 201, schema: issueCredentialResponseSchema, unreachable: "ISSUER_UNREACHABLE" }
     )
     if (issued.refusal) return refused(issued.refusal)
 
-    let issuerPublicKey: [string, string]
+    let parsed: ZkCredential
     try {
-        const parsed = parseZkCredential(issued.value.credential)
-        issuerPublicKey = [parsed.issuerPublicKey[0].toString(), parsed.issuerPublicKey[1].toString()]
+        parsed = parseZkCredential(issued.value.credential)
     } catch (error) {
         throw new LinkError("ISSUER_UNREACHABLE", error instanceof Error ? error.message : "malformed credential")
     }
+    // The issuer's own binding check enforces this; a dishonest issuer is not trusted to.
+    if (
+        parsed.body.programmeHash !== programmeHash(params.approvalScope.programme) ||
+        parsed.body.countryCode !== countryCode(params.approvalScope.country)
+    ) {
+        throw new LinkError("ISSUER_UNREACHABLE", "credential is not for the programme and country consented to")
+    }
+    const issuerPublicKey: [string, string] = [
+        parsed.issuerPublicKey[0].toString(),
+        parsed.issuerPublicKey[1].toString()
+    ]
+
+    if (!isMemberKey(memberKeyLeaves, issuerPublicKey)) {
+        throw new LinkError("ISSUER_NOT_APPROVED", `the credential is not signed by a key of ${params.issuerNetworkId}`)
+    }
 
     // Built above for the hold check; the lists are read before the signature, so this is the
     // only step left that can fail.

package/src/handlers/presentation-create.ts

@@ -5,13 +5,13 @@ import {
     type PresentationCreateParams,
     type PresentationCreateResult
 } from "@coordination-network/user-app-link"
-import { readIssuerSet, readRevocations, type IssuerSetState, type RevocationsState } from "../chain-state"
+import { listsMatchChain, readLists } from "../chain-state"
 import { mapWalletError } from "../errors"
 import { bytesToHex, hexToBytes } from "../hex"
 import { listIssuerEntries, type IssuerIndexEntry } from "../issuer-index"
 import { postToMember, verifyResponseSchema } from "../member-api"
 import { latestExpiring, matchingCredentials } from "../selection"
-import { buildWallet, neverLoadChainState } from "../wallet-factory"
+import { buildWallet, neverLoadChainState, type IdentitySeedCache } from "../wallet-factory"
 import type { UserAppPorts } from "../types"
 
 /** A held credential together with the issuer entry naming its plaintext programme and issuer. */
@@ -27,39 +27,42 @@ interface SyncedCandidate extends Candidate {
 
 export async function presentationCreateHandler(
     ports: UserAppPorts,
+    seeds: IdentitySeedCache,
     params: PresentationCreateParams
 ): Promise<PresentationCreateResult> {
     const step = (name: string) => ports.progress("presentation.create", name)
 
     // The state is read below, once the request is known to have candidates, so the wallet is built
-    // without an authority and handed one per call.
-    const wallet = await buildWallet(ports, neverLoadChainState)
+    // without an authority and handed one per call. This one only lists and syncs: it holds no key.
+    const wallet = buildWallet(ports, seeds, neverLoadChainState, null)
 
     /**
      * The same for every candidate, so the request reads it once however many credentials it has
-     * to check — and a verifier that cannot serve it fails the whole request, since no candidate
-     * can be judged without it.
+     * to check — and a verifier that cannot serve the lists, or a chain that cannot be read, fails
+     * the whole request, since no candidate can be judged without them.
      */
-    async function verifierIssuerSet(): Promise<IssuerSetState> {
-        try {
-            return await readIssuerSet(ports.http, params.issuersUrl)
-        } catch (error) {
+    async function networkState(): Promise<WalletChainState> {
+        const [lists, roots] = await Promise.allSettled([
+            readLists(ports.http, params.issuersUrl, params.revocationsUrl),
+            ports.roots.currentRoots()
+        ])
+        if (lists.status === "rejected") {
             throw new LinkError(
                 "VERIFIER_UNREACHABLE",
-                error instanceof Error ? error.message : `GET ${params.issuersUrl} failed`
+                lists.reason instanceof Error ? lists.reason.message : "the verifier's lists are unreadable"
             )
         }
-    }
-
-    /** Same reasoning as the issuer set: the verifier is the party that must accept this root. */
-    async function verifierRevocations(): Promise<RevocationsState> {
-        try {
-            return await readRevocations(ports.http, params.revocationsUrl)
-        } catch (error) {
-            throw new LinkError(
-                "VERIFIER_UNREACHABLE",
-                error instanceof Error ? error.message : `GET ${params.revocationsUrl} failed`
-            )
+        if (roots.status === "rejected") {
+            // Fixed text: a viem message carries the RPC URL, which can hold a provider key.
+            throw new LinkError("CHAIN_UNREACHABLE", "the current roots could not be read from chain")
+        }
+        if (!listsMatchChain(lists.value, roots.value)) {
+            throw new LinkError("VERIFIER_UNREACHABLE", "the verifier's lists do not match the chain")
+        }
+        return {
+            ...lists.value,
+            approvedIssuerRoot: roots.value.approvedIssuerRoot,
+            revocationRoot: roots.value.revocationRoot
         }
     }
 
@@ -82,16 +85,10 @@ export async function presentationCreateHandler(
     // state is kept so the proof is built from the same read, not a second one that could disagree.
     let chainState: WalletChainState | undefined
     if (candidates.length > 0) {
-        const state = { ...(await verifierIssuerSet()), ...(await verifierRevocations()) }
+        const state = await networkState()
         chainState = state
         for (const candidate of candidates) {
-            try {
-                await wallet.syncCredential(candidate.id, async () => state)
-            } catch (error) {
-                // A served root that does not match the tree served beside it is the verifier's
-                // fault, not this wallet's; without mapping it the caller is told INTERNAL.
-                throw mapWalletError(error, "VERIFIER_UNREACHABLE")
-            }
+            await wallet.syncCredential(candidate.id, async () => state)
         }
     }
 
@@ -120,10 +117,23 @@ export async function presentationCreateHandler(
         )
     }
 
+    const approved = await ports.review({
+        kind: "proof",
+        verifier: params.audience,
+        programme: params.programme,
+        country: params.country,
+        issuerNetworkId: selected.issuerNetworkId
+    })
+    if (!approved) throw new LinkError("CONSENT_DENIED", "the proof was not shared")
+
     step("Proving")
+    const presenter = buildWallet(ports, seeds, neverLoadChainState, {
+        title: "Share a proof",
+        subtitle: `Proves your ${params.programme} credential (${params.country})`
+    })
     let proof
     try {
-        proof = await wallet.present(
+        proof = await presenter.present(
             selected.id,
             {
                 challenge: hexToBytes(params.challenge),
@@ -140,15 +150,6 @@ export async function presentationCreateHandler(
         throw new LinkError("PROOF_FAILED", error instanceof Error ? error.message : "proof generation failed")
     }
 
-    const approved = await ports.review({
-        kind: "proof",
-        verifier: params.audience,
-        programme: params.programme,
-        country: params.country,
-        issuerNetworkId: selected.issuerNetworkId
-    })
-    if (!approved) throw new LinkError("CONSENT_DENIED", "the proof was built but not shared")
-
     step("Sharing")
     // Only the id comes back: the verifier's own `ok` would be the verifier reporting on itself,
     // and its member app can read the recorded outcome from its own server under this id.

package/src/index.ts

@@ -4,25 +4,30 @@
  */
 
 export { createUserAppService } from "./service"
-export { mapWalletError } from "./errors"
+export { DeviceKeyError, mapWalletError } from "./errors"
 export { latestExpiring, matchingCredentials, type CredentialSelectionRequest } from "./selection"
 export { buildConsentSummary } from "./consent"
 export { DEVICE_SECRET_KEY } from "./device-secret"
 export { CREDENTIAL_ISSUE_STEPS } from "./steps"
 export { listIssuerEntries, readIssuerEntry, type IssuerIndexEntry } from "./issuer-index"
+export { DEVICE_ATTESTATION_CHALLENGE } from "@coordination-network/credential"
 export type {
     ConsentDetail,
     ConsentScope,
     ConsentSummary,
     DeviceKey,
+    ChainRoots,
     HeldCredential,
     HeldCredentialStatus,
     HttpClient,
     HttpJsonResponse,
+    KeyPrompt,
+    MemberDirectory,
     PresentationReview,
     PresentationReviewPrompt,
     PublicIdentity,
     RevocationAuthority,
+    RootAuthority,
     StealthScanKeys,
     UserAppPorts,
     UserAppService,

package/src/issuer-index.ts

@@ -3,9 +3,10 @@ import type { Store } from "@coordination-network/wallet"
 import type { ConsentScope } from "./types"
 
 /**
- * `issuerNetworkId` is asserted by the caller and cannot be verified here. An established mapping
- * still cannot be taken over while the credential under it is valid: `credential.issue` answers
- * `alreadyHeld` for such a key rather than issuing against it again.
+ * `issuerNetworkId` is asserted by the caller, so `credential.issue` checks it against the chain:
+ * an entry is written, or honoured as `alreadyHeld`, only for a key in the member's
+ * `issuerKeysOf` list. Listings and presentation read entries as written, including any from before
+ * this check.
  */
 const ISSUER_INDEX_PREFIX = "user-app-core:issuer-index:"
 
@@ -17,9 +18,8 @@ export interface IssuerIndexEntry {
     credentialId: string
     /** The Baby Jubjub key that signed the credential, as decimal field elements. */
     issuerPublicKey: [string, string]
-    /** Where the issuer published its own approved-issuer set at issuance. Nothing reads it yet:
-     *  a presentation reads the verifier's, which is why a hostile verifier can still probe for the
-     *  issuer by serving a subset. Recorded so that check can be anchored here instead. */
+    /** Where the issuer published its approved-issuer set at issuance. Nothing reads it back: a
+     *  presentation reads the verifier's lists. */
     issuersUrl: string
     programme: string
     country: string
@@ -62,3 +62,19 @@ export async function listIssuerEntries(store: Store): Promise<(IssuerIndexEntry
 export async function writeIssuerEntry(store: Store, issuerNetworkId: Hex32, entry: IssuerIndexEntry): Promise<void> {
     await store.set(keyFor(issuerNetworkId, entry), JSON.stringify(entry))
 }
+
+/** Removes the entries naming any of `credentialIds`; every other entry stays. */
+export async function deleteIssuerEntries(store: Store, credentialIds: ReadonlySet<string>): Promise<void> {
+    for (const key of await store.list()) {
+        if (!key.startsWith(ISSUER_INDEX_PREFIX)) continue
+        const raw = await store.get(key)
+        if (raw === null) continue
+        let credentialId: string
+        try {
+            credentialId = (JSON.parse(raw) as IssuerIndexEntry).credentialId
+        } catch {
+            continue
+        }
+        if (credentialIds.has(credentialId)) await store.delete(key)
+    }
+}

package/src/security-level.ts

@@ -0,0 +1,8 @@
+import type { SecurityLevel } from "@coordination-network/user-app-link"
+
+// UNKNOWN ranks with SOFTWARE: a keystore that cannot say is trusted no more than one that admits it.
+const RANK: Record<SecurityLevel, number> = { STRONGBOX: 2, TRUSTED_ENVIRONMENT: 1, SOFTWARE: 0, UNKNOWN: 0 }
+
+export function meetsSecurityLevel(level: SecurityLevel, minimum: SecurityLevel): boolean {
+    return RANK[level] >= RANK[minimum]
+}

package/src/selection.ts

@@ -9,8 +9,8 @@ export interface CredentialSelectionRequest {
 /**
  * `presentation.create` carries no credential id, so this narrows by what the credential body
  * says: the requested programme and country. Status is deliberately not a filter — each candidate
- * is then synced against its own issuer's snapshot, and a caller that finds none valid still
- * needs to know whether it held a revoked one.
+ * is then synced against the verifier's lists, checked against the chain's roots, and a caller
+ * that finds none valid still needs to know whether it held a revoked one.
  */
 export function matchingCredentials<T extends CredentialInfo>(
     credentials: T[],