Wallet unit architecture

Key storage

Device binding uses cnf.jwk inside the SD-JWT payload (credential.ts). Secure enclave / StrongBox integration is platform-specific and not universally implemented in the open PoC—treat as integration homework for production wallets.

OpenAC Studio

A separate Next.js app for scenario-driven exploration of collusion, issuance, and revocation assumptions — wallet-unit-poc/openac-studio.