The credential infrastructure layer.
Fork it, extend it, ship it.

interface AttesttoModule {
  manifest: ModuleManifest
  install: (ctx: ModuleContext) => Promise<void> | void
  uninstall?: () => void
  getInboxItems?: () => Promise<InboxItem[]>
  getHomeWidget?: () => Component | null
  getOnboarding?: () => OnboardingFlow | null
}

interface ModuleManifest {
  id: string                      // unique, e.g. "cr-driving"
  name: string                    // display name
  country: string                 // ISO 3166-1 alpha-2, or "universal"
  version: string                 // semver
  description: string             // short description
  icon: string                    // Material Icons name
  requiredCredentials: string[]   // VCs that must be in vault
  capabilities: string[]          // e.g. ['exam-practice', 'issue:MyVC']
  routes: ModuleRoute[]           // routes this module contributes
}

interface ModuleContext {
  getCredentials: (types: string[]) => Promise<VerifiableCredential[]>
  storeCredential: (vc: VerifiableCredential) => Promise<void>
  pushInboxItem: (item: InboxItem) => void
  requestBiometric: (reason: string) => Promise<boolean>
  navigate: (path: string) => void
  storage: ModuleStorage          // key-value, namespaced to module ID
  llm: LlmHandle                 // on-device Gemma 2B via WebGPU
}