@midnight-ntwrk/credential-compact 0.1.0-rc2

package/src/credentials/proofs.compact

@@ -0,0 +1,122 @@
+// Context-tagged proof primitives.
+// This file owns signature verification plus the shared proof payload/challenge
+// derivation rules for generic issuance and presentation flows.
+export pure circuit verifySignature(
+  pk: JubjubPoint,
+  signature: Signature,
+  challenge: Field
+): Boolean {
+  const leftSide: JubjubPoint = ecMulGenerator(signature.s);
+  const cPk: JubjubPoint = ecMul(pk, challenge);
+  const rightSide: JubjubPoint = ecAdd(signature.r, cPk);
+  const xMatches: Boolean = jubjubPointX(leftSide) == jubjubPointX(rightSide);
+  const yMatches: Boolean = jubjubPointY(leftSide) == jubjubPointY(rightSide);
+  assert(xMatches && yMatches, "Signature verification failed");
+  return xMatches && yMatches;
+}
+
+// NOTE: The proof object does not carry a purpose field. Instead, the verifier
+// chooses the context-specific challenge derivation helper, which gives us
+// explicit domain separation without asking callers to populate a mutable enum.
+// =====================
+// Context tags
+// =====================
+export pure circuit issuanceContextTag(): Bytes<32> {
+  return pad(32, "midnight:vc:issuance");
+}
+
+export pure circuit presentationContextTag(): Bytes<32> {
+  return pad(32, "midnight:vc:presentation");
+}
+
+// =====================
+// Internal payload and challenge derivation
+// =====================
+pure circuit proofPayloadRootForContext(
+  bodyRoot: Bytes<32>,
+  contextTag: Bytes<32>,
+  proof: Proof
+): Bytes<32> {
+  return persistentHash<Vector<5, Bytes<32>>>([
+    bodyRoot,
+    contextTag,
+    persistentHash<VerificationMethodRef>(proof.signerVerificationMethodRef),
+    upgradeFromTransient(transientHash<Uint<64>>(proof.createdAt)),
+    proof.challengeHash
+  ]);
+}
+
+pure circuit proofChallengeForContext(
+  bodyRoot: Bytes<32>,
+  contextTag: Bytes<32>,
+  proof: Proof
+): Field {
+  return degradeToTransient(persistentHash<Vector<3, Bytes<32>>>([
+    proofPayloadRootForContext(bodyRoot, contextTag, proof),
+    upgradeFromTransient(transientHash<JubjubPoint>(proof.publicKey)),
+    upgradeFromTransient(transientHash<JubjubPoint>(proof.signature.r))
+  ]));
+}
+
+pure circuit assertValidProofForContext(
+  bodyRoot: Bytes<32>,
+  contextTag: Bytes<32>,
+  proof: Proof
+): [] {
+  assert(
+    verifySignature(
+      proof.publicKey,
+      proof.signature,
+      proofChallengeForContext(bodyRoot, contextTag, proof)
+    ),
+    "Proof verification failed"
+  );
+}
+
+export pure circuit issuanceProofPayloadRoot(
+  bodyRoot: Bytes<32>,
+  proof: Proof
+): Bytes<32> {
+  return proofPayloadRootForContext(bodyRoot, issuanceContextTag(), proof);
+}
+
+export pure circuit presentationProofPayloadRoot(
+  bodyRoot: Bytes<32>,
+  proof: Proof
+): Bytes<32> {
+  return proofPayloadRootForContext(bodyRoot, presentationContextTag(), proof);
+}
+
+export pure circuit issuanceProofChallenge(
+  bodyRoot: Bytes<32>,
+  proof: Proof
+): Field {
+  return proofChallengeForContext(bodyRoot, issuanceContextTag(), proof);
+}
+
+export pure circuit presentationProofChallenge(
+  bodyRoot: Bytes<32>,
+  proof: Proof
+): Field {
+  return proofChallengeForContext(bodyRoot, presentationContextTag(), proof);
+}
+
+// =====================
+// Public context-specific proof entrypoints
+// =====================
+// NOTE: The proof container is generic, but the verification context is
+// explicit. Callers choose the context helper rather than mutating the proof
+// payload itself.
+export pure circuit assertValidIssuanceContextProof(
+  bodyRoot: Bytes<32>,
+  proof: Proof
+): [] {
+  assertValidProofForContext(bodyRoot, issuanceContextTag(), proof);
+}
+
+export pure circuit assertValidPresentationContextProof(
+  bodyRoot: Bytes<32>,
+  proof: Proof
+): [] {
+  assertValidProofForContext(bodyRoot, presentationContextTag(), proof);
+}

package/src/credentials/protocol-support.compact

@@ -0,0 +1,7 @@
+// Shared protocol surface for credential families that model issuance and
+// presentation exchanges over the generic protocol modules.
+
+include "./types";
+include "./protocols";
+include "./issue";
+include "./present";

package/src/credentials/protocols.compact

@@ -0,0 +1,125 @@
+// Shared protocol-envelope primitives.
+// These helpers are intentionally generic over issuance and presentation
+// choreography and remain reusable across family- and transport-specific flows.
+export enum HolderBindingProfile {
+  explicitDid,
+  secretHolder,
+  blindedSecretHolder
+}
+
+// Compatibility protocol hint. Authoritative family capabilities belong on the
+// schema descriptor; protocol messages may carry this shape only as a transport
+// hint while older adapters migrate.
+export struct CredentialProtocolFeatures {
+  supportsSelectiveDisclosure: Boolean,
+  supportsPredicateProofs: Boolean,
+  supportsVerifierScopedPseudonym: Boolean,
+  supportsSameHolderProof: Boolean,
+}
+
+export pure circuit protocolFeaturesAsSchemaCapabilities(
+  features: CredentialProtocolFeatures
+): SchemaCapabilities {
+  return SchemaCapabilities {
+    supportsSelectiveDisclosure: features.supportsSelectiveDisclosure,
+    supportsPredicateProofs: features.supportsPredicateProofs,
+    supportsVerifierScopedPseudonym: features.supportsVerifierScopedPseudonym,
+    supportsSameHolderProof: features.supportsSameHolderProof,
+  };
+}
+
+export pure circuit assertProtocolFeaturesMatchSchemaCapabilities(
+  features: CredentialProtocolFeatures,
+  capabilities: SchemaCapabilities
+): [] {
+  assertMatchingSchemaCapabilities(
+    protocolFeaturesAsSchemaCapabilities(features),
+    capabilities
+  );
+}
+
+export struct ProtocolMessageEnvelope {
+  version: Uint<16>,
+  messageId: Bytes<32>,
+  threadId: Bytes<32>,
+  initialMessage: Boolean,
+  respondsToMessageId: Bytes<32>,
+  createdAt: Uint<64>,
+  hasExpiresAt: Boolean,
+  expiresAt: Uint<64>,
+}
+
+export pure circuit noProtocolResponseReference(): Bytes<32> {
+  return pad(32, "midnight:vc:protocol:none");
+}
+
+export pure circuit assertValidVerificationMethodRef(
+  verificationMethodRef: VerificationMethodRef
+): [] {
+  assert(
+    verificationMethodRef.methodId != pad(32, ""),
+    "Verification method reference must be set"
+  );
+}
+
+export pure circuit assertMatchingSchemaRefs(
+  expected: SchemaRef,
+  actual: SchemaRef
+): [] {
+  assertValidSchemaRef(expected);
+  assertValidSchemaRef(actual);
+  assert(
+    expected.packageId == actual.packageId
+      && expected.schemaId == actual.schemaId
+      && expected.majorVersion == actual.majorVersion
+      && expected.minorVersion == actual.minorVersion,
+    "Schema reference mismatch"
+  );
+}
+
+export pure circuit assertValidProtocolMessageEnvelope(
+  envelope: ProtocolMessageEnvelope
+): [] {
+  const noResponse = noProtocolResponseReference();
+  assert(envelope.version == 1, "Protocol message version mismatch");
+  assert(envelope.messageId != noResponse, "Protocol message id must be set");
+  assert(envelope.threadId != noResponse, "Protocol thread id must be set");
+  if (envelope.initialMessage) {
+    assert(
+      envelope.respondsToMessageId == noResponse,
+      "Initial protocol message must not reference a previous message"
+    );
+  } else {
+    assert(
+      envelope.respondsToMessageId != noResponse,
+      "Protocol response message must reference a previous message"
+    );
+  }
+  if (envelope.hasExpiresAt) {
+    assert(
+      envelope.expiresAt >= envelope.createdAt,
+      "Protocol message expiration must not precede creation"
+    );
+  }
+}
+
+export pure circuit assertProtocolResponseEnvelope(
+  requestEnvelope: ProtocolMessageEnvelope,
+  responseEnvelope: ProtocolMessageEnvelope
+): [] {
+  assertValidProtocolMessageEnvelope(requestEnvelope);
+  assertValidProtocolMessageEnvelope(responseEnvelope);
+  assert(!responseEnvelope.initialMessage, "Protocol response must not be initial");
+  assert(
+    responseEnvelope.threadId == requestEnvelope.threadId,
+    "Protocol response thread id does not match the request thread id"
+  );
+  assert(
+    responseEnvelope.respondsToMessageId == requestEnvelope.messageId,
+    "Protocol response does not reference the request message id"
+  );
+  assert(
+    responseEnvelope.createdAt >= requestEnvelope.createdAt,
+    "Protocol response creation time must not precede the request"
+  );
+}

package/src/credentials/relations.compact

@@ -0,0 +1,36 @@
+// Generic VC↔VP linkage helpers.
+// This module intentionally validates only shared envelope relations; family
+// semantics and holder-binding witness checks stay in higher layers.
+module CredentialPresentationRelations<
+  TPublicClaims,
+  TClaimCommitments,
+  TDisclosures,
+  THolderBinding,
+  TStatusBinding
+> {
+  // The generic parameters are intentionally threaded through the imported
+  // `VC<>` and `VP<>` instantiations so the relation helper stays family-typed
+  // even though the linkage checks only read shared envelope fields.
+  import VC<TPublicClaims, TClaimCommitments, THolderBinding, TStatusBinding> prefix VC_;
+  import VP<TDisclosures, THolderBinding> prefix VP_;
+
+  export pure circuit assertMatchingCredentialPresentation(
+    credential: VC_Credential,
+    presentation: VP_Presentation
+  ): [] {
+    // Holder-binding equality is intentionally left to the family layer because
+    // different holder-binding profiles require different witness semantics.
+    assert(
+      presentation.credentialClaimRoot == credential.claimRoot,
+      "Presentation must reference the credential claim root"
+    );
+    assert(
+      presentation.issuerVerificationMethodRef.didContractAddress == credential.issuerVerificationMethodRef.didContractAddress,
+      "Presentation issuer contract does not match credential issuer"
+    );
+    assert(
+      presentation.issuerVerificationMethodRef.methodId == credential.issuerVerificationMethodRef.methodId,
+      "Presentation issuer method reference does not match credential issuer"
+    );
+  }
+}

package/src/credentials/status-bindings.compact

@@ -0,0 +1,60 @@
+// VC-side status-binding primitives.
+// Owns only the credential-embedded binding layer; proof protocols and live
+// registry evaluation stay in the status-registry package.
+export struct StatusRegistryRef {
+  registryId: Bytes<32>,
+  authorityVerificationMethodRef: VerificationMethodRef,
+}
+
+export struct NoStatusBinding {}
+
+export enum StatusType {
+  revocationRegistry
+}
+
+export struct RegistryBoundStatusBinding {
+  statusType: StatusType,
+  registryRef: StatusRegistryRef,
+  statusHandleCommitment: Bytes<32>,
+}
+
+// NOTE: `StatusType` is explicit even though the current repo only supports the
+// revocation-registry binding mode. Keeping it in the binding preserves an
+// extension seam without overloading registry ids or handle commitment shapes.
+export pure circuit assertValidStatusRegistryRef(
+  registryRef: StatusRegistryRef
+): [] {
+  assert(
+    registryRef.registryId != pad(32, ""),
+    "Status registry id must be set"
+  );
+  assertValidVerificationMethodRef(registryRef.authorityVerificationMethodRef);
+}
+
+export pure circuit assertValidNoStatusBinding(
+  binding: NoStatusBinding
+): [] {
+  // NOTE: NoStatusBinding is intentionally empty; this validator stays as a
+  // symmetry point with the real binding variants.
+}
+
+export pure circuit assertValidRegistryBoundStatusBinding(
+  binding: RegistryBoundStatusBinding
+): [] {
+  assert(
+    binding.statusType == StatusType.revocationRegistry,
+    "Registry-bound status type must be revocationRegistry"
+  );
+  assertValidStatusRegistryRef(binding.registryRef);
+  assert(
+    binding.statusHandleCommitment != pad(32, ""),
+    "Status handle commitment must be set"
+  );
+}
+
+export pure circuit registryBoundStatusBindingRoot(
+  binding: RegistryBoundStatusBinding
+): Bytes<32> {
+  assertValidRegistryBoundStatusBinding(binding);
+  return persistentHash<RegistryBoundStatusBinding>(binding);
+}

package/src/credentials/types.compact

@@ -0,0 +1,141 @@
+export struct SchemaRef {
+  packageId: Bytes<32>,
+  schemaId: Bytes<32>,
+  majorVersion: Uint<16>,
+  minorVersion: Uint<16>,
+}
+
+export struct SchemaCapabilities {
+  supportsSelectiveDisclosure: Boolean,
+  supportsPredicateProofs: Boolean,
+  supportsVerifierScopedPseudonym: Boolean,
+  supportsSameHolderProof: Boolean,
+}
+
+export struct SchemaFamilyResolutionHint {
+  hasResolverHint: Boolean,
+  resolverHint: Bytes<32>,
+}
+
+export struct SchemaDescriptor {
+  schema: SchemaRef,
+  capabilities: SchemaCapabilities,
+  familyResolutionHint: SchemaFamilyResolutionHint,
+}
+
+export pure circuit noSchemaFamilyResolverHint(): Bytes<32> {
+  return pad(32, "midnight:vc:schema:no-hint");
+}
+
+export pure circuit assertValidSchemaRef(schema: SchemaRef): [] {
+  assert(schema.packageId != pad(32, ""), "Schema package id must be set");
+  assert(schema.schemaId != pad(32, ""), "Schema id must be set");
+  assert(schema.majorVersion > 0, "Schema major version must be positive");
+}
+
+export pure circuit assertValidSchemaCapabilities(
+  capabilities: SchemaCapabilities
+): [] {
+  // Boolean-only capabilities have no invalid values today. Keep this helper so
+  // future non-boolean capability fields get one validation entry point.
+}
+
+export pure circuit assertValidSchemaFamilyResolutionHint(
+  hint: SchemaFamilyResolutionHint
+): [] {
+  const noHint = noSchemaFamilyResolverHint();
+  if (hint.hasResolverHint) {
+    assert(hint.resolverHint != noHint, "Schema resolver hint must be set");
+    assert(
+      hint.resolverHint != pad(32, ""),
+      "Schema resolver hint must not be empty"
+    );
+  } else {
+    assert(
+      hint.resolverHint == noHint,
+      "Absent schema resolver hint must use the no-hint sentinel"
+    );
+  }
+}
+
+export pure circuit assertValidSchemaDescriptor(
+  descriptor: SchemaDescriptor
+): [] {
+  assertValidSchemaRef(descriptor.schema);
+  assertValidSchemaCapabilities(descriptor.capabilities);
+  assertValidSchemaFamilyResolutionHint(descriptor.familyResolutionHint);
+}
+
+export pure circuit assertMatchingSchemaCapabilities(
+  expected: SchemaCapabilities,
+  actual: SchemaCapabilities
+): [] {
+  assert(
+    expected.supportsSelectiveDisclosure == actual.supportsSelectiveDisclosure
+      && expected.supportsPredicateProofs == actual.supportsPredicateProofs
+      && expected.supportsVerifierScopedPseudonym == actual.supportsVerifierScopedPseudonym
+      && expected.supportsSameHolderProof == actual.supportsSameHolderProof,
+    "Schema capabilities mismatch"
+  );
+}
+
+export struct VerificationMethodRef {
+  didContractAddress: ContractAddress,
+  methodId: Bytes<32>,
+}
+
+export struct NoPublicClaims {
+}
+
+export struct NoClaimCommitments {
+}
+
+export struct Signature {
+  r: JubjubPoint,
+  s: Field,
+}
+
+export struct ExplicitHolderBinding {
+  holderVerificationMethodRef: VerificationMethodRef,
+}
+
+export struct JubjubHolderBinding {
+  // Legacy compatibility/minimal holder binding.
+  // This binds the VC/VP to a specific Jubjub public key, but it is not the
+  // recommended public profile for new DID-shaped flows.
+  // Proof-of-possession still depends on validating the presentation Proof
+  // alongside this binding.
+  holderPublicKey: JubjubPoint,
+}
+
+export struct OffchainMidnightHolderBinding {
+  // Preferred lightweight DID-shaped binding for offchain/prototype flows.
+  // This adds DID-shaped metadata for prototype offchain Midnight DID flows.
+  // It does not by itself prove that holderPublicKey is the key published in
+  // the offchain DID state; callers still need the surrounding DID semantics.
+  holderDidStateHash: Bytes<32>,
+  holderMethodId: Bytes<32>,
+  holderPublicKey: JubjubPoint,
+}
+
+export struct SecretHolderBinding {
+  holderSecretCommitment: Bytes<32>,
+  requestChallengeResponse: Bytes<32>,
+}
+
+export struct BlindedSecretHolderBinding {
+  blindedHolderSecretCommitment: Bytes<32>,
+  issuerNonce: Bytes<32>,
+  requestChallengeResponse: Bytes<32>,
+}
+
+// Proof is kept separate from the VC/VP body on purpose.
+// The body is the semantic payload; the proof is the cryptographic artifact
+// over that payload plus interaction context.
+export struct Proof {
+  signerVerificationMethodRef: VerificationMethodRef,
+  createdAt: Uint<64>,
+  challengeHash: Bytes<32>,
+  publicKey: JubjubPoint,
+  signature: Signature,
+}

package/src/credentials/vc-support.compact

@@ -0,0 +1,8 @@
+// Shared VC surface for credential families that need envelope types,
+// proof helpers, and proof-bound validation rules.
+
+include "./types";
+include "./proofs";
+include "./vc";
+include "./vp";
+include "./relations";

package/src/credentials/vc.compact

@@ -0,0 +1,59 @@
+// Thin VC envelope surface.
+// Owns credential-local structure, body-root derivation, and issuer-proof
+// verification. Family-specific claim validation stays outside this module.
+module VC<TPublicClaims, TClaimCommitments, THolderBinding, TStatusBinding> {
+  export struct Credential {
+    version: Uint<16>,
+    schema: SchemaRef,
+    issuerVerificationMethodRef: VerificationMethodRef,
+    holderBinding: THolderBinding,
+    statusBinding: TStatusBinding,
+    issuedAt: Uint<64>,
+    hasExpiration: Boolean,
+    expiresAt: Uint<64>,
+    // Direct values intentionally carried in the signed credential body.
+    claims: TPublicClaims,
+    // Commitment digests for private and predicate-only claim values.
+    claimCommitments: TClaimCommitments,
+    claimRoot: Bytes<32>,
+  }
+
+  export pure circuit credentialBodyRoot(credential: Credential): Bytes<32> {
+    return persistentHash<Credential>(credential);
+  }
+
+  export pure circuit assertValidCredentialEnvelope(
+    credential: Credential,
+    expectedClaimRoot: Bytes<32>
+  ): [] {
+    assert(credential.version == 1, "Credential version mismatch");
+    assert(credential.claimRoot == expectedClaimRoot, "Credential claim root mismatch");
+    if (credential.hasExpiration) {
+      assert(credential.expiresAt >= credential.issuedAt, "Expiration must not precede issuance");
+    }
+  }
+
+  export pure circuit assertValidCredentialProof(
+    credential: Credential,
+    proof: Proof
+  ): [] {
+    const bodyRoot: Bytes<32> = credentialBodyRoot(credential);
+    assertValidCredentialProofForBodyRoot(credential, proof, bodyRoot);
+  }
+
+  export pure circuit assertValidCredentialProofForBodyRoot(
+    credential: Credential,
+    proof: Proof,
+    bodyRoot: Bytes<32>
+  ): [] {
+    assert(
+      credential.issuerVerificationMethodRef.didContractAddress == proof.signerVerificationMethodRef.didContractAddress,
+      "Issuer proof contract address does not match issuer verification method"
+    );
+    assert(
+      credential.issuerVerificationMethodRef.methodId == proof.signerVerificationMethodRef.methodId,
+      "Issuer proof method reference does not match issuer verification method"
+    );
+    assertValidIssuanceContextProof(bodyRoot, proof);
+  }
+}

package/src/credentials/vp.compact

@@ -0,0 +1,25 @@
+// Thin VP envelope surface.
+// Owns presentation-local structure and body-root derivation. VC↔VP linkage
+// and holder-binding equality stay outside this module.
+module VP<TDisclosures, THolderBinding> {
+  export struct Presentation {
+    version: Uint<16>,
+    schema: SchemaRef,
+    credentialClaimRoot: Bytes<32>,
+    issuerVerificationMethodRef: VerificationMethodRef,
+    holderBinding: THolderBinding,
+    disclosed: TDisclosures,
+  }
+
+  export pure circuit presentationBodyRoot(presentation: Presentation): Bytes<32> {
+    return persistentHash<Presentation>(presentation);
+  }
+
+  export pure circuit assertValidPresentationEnvelope(
+    presentation: Presentation
+  ): [] {
+    // VC/VP linkage now lives in `relations.compact`; the thin VP surface only
+    // owns presentation-local envelope invariants.
+    assert(presentation.version == 1, "Presentation version mismatch");
+  }
+}

package/src/credentials.compact

@@ -0,0 +1,20 @@
+// This file is part of midnightntwrk/midnight-did.
+// Copyright (C) 2026 Midnight Foundation
+// SPDX-License-Identifier: Apache-2.0
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+pragma language_version >= 0.20;
+
+import CompactStandardLibrary;
+
+include "./credentials/composable";