@tinycloud/node-sdk 3.8.1-beta.2 → 3.9.0-beta.4

package/dist/share-receive.cjs

@@ -24,14 +24,57 @@ __export(share_receive_exports, {
   requestAgentShareEmailProof: () => requestAgentShareEmailProof
 });
 module.exports = __toCommonJS(share_receive_exports);
-var import_sdk_core5 = require("@tinycloud/sdk-core");
+var import_sdk_core7 = require("@tinycloud/sdk-core");
 var import_share_sdk2 = require("@tinycloud/share-sdk");
 
 // src/credentials/email-proof.ts
-var import_sdk_core3 = require("@tinycloud/sdk-core");
+var import_sdk_core5 = require("@tinycloud/sdk-core");
+var import_held_credentials = require("@tinycloud/sdk-core/held-credentials");
 
 // src/credentials/interpreter.ts
+var import_sdk_core3 = require("@tinycloud/sdk-core");
+
+// src/credentials/held-binding.ts
+var import_sdk_core2 = require("@tinycloud/sdk-core");
+
+// src/credentials/pins.ts
 var import_sdk_core = require("@tinycloud/sdk-core");
+var EMAIL_PROOF_PINS = Object.freeze({
+  witnessOrigin: "https://witness.credentials.org",
+  issuerDid: "did:web:issuer.credentials.org",
+  issuerKid: "did:web:issuer.credentials.org#controller",
+  issuerX: "eEJI4xEobto4HtQ7Pg9R1vBOwcpfGRTlXDG5QfqLnGQ",
+  descriptorDigest: "1tg-qphmKBVtNwzVg9xyz-xxqt_xtMXAsQyXw46m8S0"
+});
+var HELD_ACCOUNT_BINDING_PINS = Object.freeze({
+  type: import_sdk_core.ACCOUNT_HOLDER_BINDING_DOMAIN,
+  protocol: "tinycloud.credentials/acquisition/v1",
+  profile: "tinycloud.email-held/v1",
+  profileVersion: 1,
+  descriptorDigest: "dc3_DuvzipXwYkTfjKqTaK1c3VS0YSPnaBsYSQriC0w",
+  issuer: EMAIL_PROOF_PINS.issuerDid,
+  issuerKid: EMAIL_PROOF_PINS.issuerKid,
+  audience: "tinycloud://credentials",
+  openerOrigin: "https://localhost",
+  completionOrigin: "https://localhost",
+  completionContext: "sdk-acquisition",
+  credentialLifetimeSeconds: 31536e3
+});
+
+// src/credentials/held-binding.ts
+var REQUEST_TTL_MS = 6e5;
+var substituted = () => new import_sdk_core2.CredentialError("REQUEST_SUBSTITUTED", "Holder binding was substituted");
+async function assertHeldBinding(binding, expected) {
+  const { descriptor } = expected;
+  if (descriptor.holderBinding.alg !== "EIP191" || binding.type !== descriptor.holderBinding.domain || binding.requestId !== expected.requestId || binding.descriptorDigest !== expected.descriptorDigest || binding.requirementDigest !== expected.requirementDigest || binding.holderDid !== expected.holderDid || binding.issuer !== descriptor.issuer.did || binding.issuerKid !== descriptor.issuer.kid || binding.profile !== descriptor.profile || binding.openerOrigin !== expected.openerOrigin || binding.completionOrigin !== expected.openerOrigin || binding.audience !== HELD_ACCOUNT_BINDING_PINS.audience || binding.completionContext !== HELD_ACCOUNT_BINDING_PINS.completionContext || // The static fields, against the one frozen object the request body and the account signer also use (A2.4).
+  binding.type !== HELD_ACCOUNT_BINDING_PINS.type || binding.protocol !== HELD_ACCOUNT_BINDING_PINS.protocol || binding.profile !== HELD_ACCOUNT_BINDING_PINS.profile || binding.profileVersion !== HELD_ACCOUNT_BINDING_PINS.profileVersion || binding.descriptorDigest !== HELD_ACCOUNT_BINDING_PINS.descriptorDigest || binding.issuer !== HELD_ACCOUNT_BINDING_PINS.issuer || binding.issuerKid !== HELD_ACCOUNT_BINDING_PINS.issuerKid || binding.openerOrigin !== HELD_ACCOUNT_BINDING_PINS.openerOrigin || binding.completionOrigin !== HELD_ACCOUNT_BINDING_PINS.completionOrigin || binding.credentialLifetimeSeconds !== HELD_ACCOUNT_BINDING_PINS.credentialLifetimeSeconds) throw substituted();
+  if (expected.challengeNonce === void 0 || binding.challengeNonce !== expected.challengeNonce) throw substituted();
+  if (binding.normalizedClaimsDigest !== await (0, import_sdk_core2.canonicalDigest)(expected.requirement.claims)) throw substituted();
+  const expires = Date.parse(binding.expiresAt);
+  if (expected.serverExpiresAt === void 0 || expires !== Date.parse(expected.serverExpiresAt) || Date.parse(binding.issuedAt) !== expires - REQUEST_TTL_MS) throw substituted();
+}
+
+// src/credentials/interpreter.ts
 var delay = (ms, signal) => new Promise((resolve, reject) => {
   const timer = setTimeout(resolve, ms);
   signal?.addEventListener("abort", () => {
@@ -40,18 +83,36 @@ var delay = (ms, signal) => new Promise((resolve, reject) => {
   }, { once: true });
 });
 async function interpretCredentialFlow(input) {
+  const held = input.descriptor.subjectRelationship === "account_is_subject";
+  if (held && input.allowAccountSubject !== true) throw new import_sdk_core3.CredentialError("UNSUPPORTED_PROFILE", "The held credential profile requires an explicit opt-in");
   const steps = new Map(input.descriptor.steps.map((step) => [step.type, step]));
   const completed = /* @__PURE__ */ new Set();
   let lastTransition = "";
+  const checkBinding = async (value) => {
+    const binding = (0, import_sdk_core3.validateCredentialHolderBinding)(value);
+    if (binding.requestId !== input.requestId || binding.descriptorDigest !== input.descriptorDigest || binding.requirementDigest !== input.requirementDigest || binding.holderDid !== input.holderDid || binding.issuer !== input.descriptor.issuer.did || binding.issuerKid !== input.descriptor.issuer.kid || binding.profile !== input.descriptor.profile || binding.openerOrigin !== input.openerOrigin || binding.completionOrigin !== input.openerOrigin || binding.audience !== "tinycloud://credentials") throw new import_sdk_core3.CredentialError("REQUEST_SUBSTITUTED", "Holder binding was substituted");
+    const alg = input.descriptor.holderBinding.alg;
+    if (binding.type !== input.descriptor.holderBinding.domain || alg === "EIP191" && !input.transport.challengeNonce) throw new import_sdk_core3.CredentialError("REQUEST_SUBSTITUTED", "Holder binding was substituted");
+    if (alg === "EIP191") await assertHeldBinding(binding, { descriptor: input.descriptor, requirement: input.requirement, requestId: input.requestId, descriptorDigest: input.descriptorDigest, requirementDigest: input.requirementDigest, holderDid: input.holderDid, openerOrigin: input.openerOrigin, challengeNonce: input.transport.challengeNonce(input.requestId), serverExpiresAt: input.expiresAt });
+    return binding;
+  };
+  const ensureHeldBinding = async () => {
+    if (!held || input.transport.signedBinding?.(input.requestId) !== void 0) return;
+    await checkBinding(await input.transport.holderBinding(input.requestId, input.verifier, input.signal));
+  };
   for (; ; ) {
     input.signal?.throwIfAborted();
     const state = await input.transport.state(input.requestId, input.verifier, input.signal);
-    if (state.requestId !== input.requestId) throw new import_sdk_core.CredentialError("REQUEST_SUBSTITUTED", "Credential request identity changed");
-    if (state.state === "expired") throw new import_sdk_core.CredentialError("REQUEST_EXPIRED", "Credential request expired", { state: state.state, correlationId: state.correlationId });
-    if (state.state === "canceled") throw new import_sdk_core.CredentialError("CANCELED", "Credential request was canceled", { state: state.state, correlationId: state.correlationId });
-    if (state.state === "issuer_unready") throw new import_sdk_core.CredentialError("ISSUER_UNREADY", "Credential issuer is not ready", { retryAfterMs: state.retryAfterMs, state: state.state, correlationId: state.correlationId });
-    if (state.state === "complete") return;
+    if (state.requestId !== input.requestId) throw new import_sdk_core3.CredentialError("REQUEST_SUBSTITUTED", "Credential request identity changed");
+    if (state.state === "expired") throw new import_sdk_core3.CredentialError("REQUEST_EXPIRED", "Credential request expired", { state: state.state, correlationId: state.correlationId });
+    if (state.state === "canceled") throw new import_sdk_core3.CredentialError("CANCELED", "Credential request was canceled", { state: state.state, correlationId: state.correlationId });
+    if (state.state === "issuer_unready") throw new import_sdk_core3.CredentialError("ISSUER_UNREADY", "Credential issuer is not ready", { retryAfterMs: state.retryAfterMs, state: state.state, correlationId: state.correlationId });
+    if (state.state === "complete") {
+      await ensureHeldBinding();
+      return;
+    }
     if (state.state === "ready_to_issue" || state.state === "issued") {
+      await ensureHeldBinding();
       if (state.state === "ready_to_issue" && !completed.has("issue")) {
         await input.transport.issue(input.requestId, input.verifier, input.signal);
         completed.add("issue");
@@ -64,7 +125,7 @@ async function interpretCredentialFlow(input) {
       continue;
     }
     const declared = steps.get(next.type);
-    if (next.id !== next.type || !declared || declared.type !== next.type || declared.version !== next.version) throw new import_sdk_core.CredentialError("REQUEST_SUBSTITUTED", "Server selected an undeclared credential step");
+    if (next.id !== next.type || !declared || declared.type !== next.type || declared.version !== next.version) throw new import_sdk_core3.CredentialError("REQUEST_SUBSTITUTED", "Server selected an undeclared credential step");
     if (completed.has(next.id) || state.transitionId === lastTransition) {
       await (input.onWait?.() ?? delay(state.retryAfterMs ?? 50, input.signal));
       continue;
@@ -72,21 +133,22 @@ async function interpretCredentialFlow(input) {
     lastTransition = state.transitionId;
     if (next.type === "holder_signature") {
       input.onProgress?.({ state: "signing", stepId: next.id, correlationId: state.correlationId });
-      const binding = (0, import_sdk_core.validateCredentialHolderBinding)(await input.transport.holderBinding(input.requestId, input.verifier, input.signal));
-      if (binding.requestId !== input.requestId || binding.descriptorDigest !== input.descriptorDigest || binding.requirementDigest !== input.requirementDigest || binding.holderDid !== input.holderDid || binding.issuer !== input.descriptor.issuer.did || binding.issuerKid !== input.descriptor.issuer.kid || binding.profile !== input.descriptor.profile || binding.openerOrigin !== input.openerOrigin || binding.completionOrigin !== input.openerOrigin || binding.audience !== "tinycloud://credentials") throw new import_sdk_core.CredentialError("REQUEST_SUBSTITUTED", "Holder binding was substituted");
-      const bytes = (0, import_sdk_core.holderBindingSigningBytes)(binding);
+      const binding = await checkBinding(await input.transport.holderBinding(input.requestId, input.verifier, input.signal));
+      const alg = input.descriptor.holderBinding.alg;
+      if (alg === "EIP191" !== (input.signing.holderKey?.alg === "EIP191")) throw new import_sdk_core3.CredentialError("REQUEST_SUBSTITUTED", "Holder binding was substituted");
+      const bytes = (0, import_sdk_core3.holderBindingSigningBytes)(binding);
       let signature = await input.signing.autoSign?.(binding, bytes, input.signal);
       if (signature === void 0) {
-        if (!input.signing.requestApproval) throw new import_sdk_core.CredentialError("SIGNATURE_REJECTED", "OpenKey approval is required");
+        if (!input.signing.requestApproval) throw new import_sdk_core3.CredentialError("SIGNATURE_REJECTED", "OpenKey approval is required");
         try {
           signature = await input.signing.requestApproval(binding, bytes, input.signal);
         } catch (cause) {
-          if (cause instanceof import_sdk_core.CredentialError) throw cause;
-          throw new import_sdk_core.CredentialError("SIGNATURE_REJECTED", "OpenKey approval was rejected", { cause });
+          if (cause instanceof import_sdk_core3.CredentialError) throw cause;
+          throw new import_sdk_core3.CredentialError("SIGNATURE_REJECTED", "OpenKey approval was rejected", { cause });
         }
       }
-      if (!(signature instanceof Uint8Array) || signature.length === 0) throw new import_sdk_core.CredentialError("SIGNATURE_REJECTED", "OpenKey signature is invalid");
-      await input.transport.submitHolderSignature(input.requestId, input.verifier, (0, import_sdk_core.encodeBase64Url)(signature), input.signal, input.signing.holderKey);
+      if (!(signature instanceof Uint8Array) || signature.length === 0) throw new import_sdk_core3.CredentialError("SIGNATURE_REJECTED", "OpenKey signature is invalid");
+      await input.transport.submitHolderSignature(input.requestId, input.verifier, alg === "EIP191" ? `0x${Array.from(signature, (byte) => byte.toString(16).padStart(2, "0")).join("")}` : (0, import_sdk_core3.encodeBase64Url)(signature), input.signal, input.signing.holderKey);
     } else {
       input.onProgress?.({ state: next.type === "collect_input" ? "collecting" : "proving", stepId: next.id, correlationId: state.correlationId });
       const handler = input.handlers?.[next.type];
@@ -120,9 +182,9 @@ async function interpretCredentialFlow(input) {
             await input.transport.submitStep(input.requestId, input.verifier, next.id, proof, input.signal);
             break;
           } catch (cause) {
-            if (!(cause instanceof import_sdk_core.CredentialError) || cause.code !== "PROOF_REJECTED") throw cause;
+            if (!(cause instanceof import_sdk_core3.CredentialError) || cause.code !== "PROOF_REJECTED") throw cause;
             const attemptsRemaining = input.descriptor.lifecycle.maxProofAttempts - attempt;
-            if (next.type !== "mailbox_otp" || attemptsRemaining <= 0) throw new import_sdk_core.CredentialError("VERIFICATION_FAILED", "The proof was not accepted", { state: attemptsRemaining <= 0 ? "proof_attempts_exhausted" : "proof_rejected", cause });
+            if (next.type !== "mailbox_otp" || attemptsRemaining <= 0) throw new import_sdk_core3.CredentialError("VERIFICATION_FAILED", "The proof was not accepted", { state: attemptsRemaining <= 0 ? "proof_attempts_exhausted" : "proof_rejected", cause });
             feedback = { kind: "rejected", attemptsRemaining };
           }
         }
@@ -133,27 +195,27 @@ async function interpretCredentialFlow(input) {
 }
 
 // src/credentials/transport.ts
-var import_sdk_core2 = require("@tinycloud/sdk-core");
+var import_sdk_core4 = require("@tinycloud/sdk-core");
 function object(value, label) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new import_sdk_core2.CredentialError("VERIFICATION_FAILED", `${label} is invalid`);
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new import_sdk_core4.CredentialError("VERIFICATION_FAILED", `${label} is invalid`);
   return value;
 }
 function opaque(value, label) {
-  if (typeof value !== "string" || !/^[A-Za-z0-9_-]{16,128}$/.test(value)) throw new import_sdk_core2.CredentialError("REQUEST_SUBSTITUTED", `${label} is invalid`);
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]{16,128}$/.test(value)) throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", `${label} is invalid`);
   return value;
 }
 function timestamp(value, label) {
-  if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) throw new import_sdk_core2.CredentialError("VERIFICATION_FAILED", `${label} is invalid`);
+  if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) throw new import_sdk_core4.CredentialError("VERIFICATION_FAILED", `${label} is invalid`);
   return new Date(value).toISOString();
 }
 function jwtPayload(credential) {
   const part = credential.split("~", 1)[0]?.split(".")[1];
-  if (!part) throw new import_sdk_core2.CredentialError("VERIFICATION_FAILED", "Issued SD-JWT is invalid");
+  if (!part) throw new import_sdk_core4.CredentialError("VERIFICATION_FAILED", "Issued SD-JWT is invalid");
   try {
-    return object(JSON.parse(new TextDecoder().decode((0, import_sdk_core2.decodeBase64Url)(part))), "SD-JWT payload");
+    return object(JSON.parse(new TextDecoder().decode((0, import_sdk_core4.decodeBase64Url)(part))), "SD-JWT payload");
   } catch (cause) {
-    if (cause instanceof import_sdk_core2.CredentialError) throw cause;
-    throw new import_sdk_core2.CredentialError("VERIFICATION_FAILED", "Issued SD-JWT is invalid", { cause });
+    if (cause instanceof import_sdk_core4.CredentialError) throw cause;
+    throw new import_sdk_core4.CredentialError("VERIFICATION_FAILED", "Issued SD-JWT is invalid", { cause });
   }
 }
 var SERVER_CODES = /* @__PURE__ */ new Set(["REQUEST_EXPIRED", "ISSUER_UNREADY", "UNSUPPORTED_PROFILE", "UNSUPPORTED_VERSION", "SIGNATURE_REJECTED"]);
@@ -162,12 +224,13 @@ function serverError(value, response, honorServerRecoverable) {
   const body = value;
   const keys = Object.keys(body).sort();
   if (keys.join(",") !== "code,correlationId,recoverable,state,type" || body.type !== "tinycloud.credentials/error/v1" || typeof body.code !== "string" || typeof body.recoverable !== "boolean" || typeof body.state !== "string" || typeof body.correlationId !== "string") return void 0;
-  if (body.code === "PROOF_REJECTED") return body.recoverable ? new import_sdk_core2.CredentialError("PROOF_REJECTED", "The proof was not accepted", { state: body.state, correlationId: body.correlationId }) : new import_sdk_core2.CredentialError("VERIFICATION_FAILED", "The proof attempt limit was reached", { state: "proof_attempts_exhausted", correlationId: body.correlationId });
-  if (body.code === "RATE_LIMITED") return new import_sdk_core2.CredentialError("ISSUER_UNREADY", "Too many verification codes were requested", { state: "rate_limited", correlationId: body.correlationId, retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0, recoverable: honorServerRecoverable ? body.recoverable : void 0 });
-  if (body.code === "CHALLENGE_EXPIRED") return new import_sdk_core2.CredentialError("REQUEST_EXPIRED", "The credential challenge expired", { state: body.state, correlationId: body.correlationId, recoverable: honorServerRecoverable ? body.recoverable : void 0 });
+  if (body.code === "PROOF_REJECTED") return body.recoverable ? new import_sdk_core4.CredentialError("PROOF_REJECTED", "The proof was not accepted", { state: body.state, correlationId: body.correlationId }) : new import_sdk_core4.CredentialError("VERIFICATION_FAILED", "The proof attempt limit was reached", { state: "proof_attempts_exhausted", correlationId: body.correlationId });
+  if (body.code === "RATE_LIMITED") return new import_sdk_core4.CredentialError("ISSUER_UNREADY", "Too many verification codes were requested", { state: "rate_limited", correlationId: body.correlationId, retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0, recoverable: honorServerRecoverable ? body.recoverable : void 0 });
+  if (body.code === "CHALLENGE_EXPIRED") return new import_sdk_core4.CredentialError("REQUEST_EXPIRED", "The credential challenge expired", { state: body.state, correlationId: body.correlationId, recoverable: honorServerRecoverable ? body.recoverable : void 0 });
+  if (body.code === "DESCRIPTOR_MISMATCH") body.code = "UNSUPPORTED_PROFILE";
   if (!SERVER_CODES.has(body.code)) return void 0;
   const code = body.code;
-  return new import_sdk_core2.CredentialError(code, `OpenCredentials rejected the request: ${code}`, {
+  return new import_sdk_core4.CredentialError(code, `OpenCredentials rejected the request: ${code}`, {
     state: body.state,
     correlationId: body.correlationId,
     retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0,
@@ -175,15 +238,20 @@ function serverError(value, response, honorServerRecoverable) {
   });
 }
 var OpenCredentialsHttpTransport = class {
+  /**
+   * `allowAccountSubject` is passed only by the email-proof functions, after the per-call held opt-in was accepted. Without it an account-bound
+   * (held) descriptor is refused here, before any request (TC-2254 A2.5).
+   */
   constructor(descriptor, fetchFn = globalThis.fetch.bind(globalThis), options = {}) {
     this.descriptor = descriptor;
     this.fetchFn = fetchFn;
     this.options = options;
     this.nonces = /* @__PURE__ */ new Map();
     this.bindings = /* @__PURE__ */ new Map();
+    if (descriptor.subjectRelationship === "account_is_subject" && options.allowAccountSubject !== true) throw new import_sdk_core4.CredentialError("UNSUPPORTED_PROFILE", "The held credential profile requires an explicit opt-in");
   }
   url(endpoint, id) {
-    return new URL((0, import_sdk_core2.credentialEndpointPath)(endpoint, id), this.descriptor.issuer.origin).href;
+    return new URL((0, import_sdk_core4.credentialEndpointPath)(endpoint, id), this.descriptor.issuer.origin).href;
   }
   async request(endpoint, input) {
     let response;
@@ -191,8 +259,8 @@ var OpenCredentialsHttpTransport = class {
       const init = { method: input.method ?? "GET", credentials: "omit", cache: "no-store", redirect: "error", referrerPolicy: "no-referrer", signal: input.signal, headers: { accept: "application/json", ...input.body === void 0 ? {} : { "content-type": "application/json" }, ...input.verifier === void 0 ? {} : { authorization: `Bearer ${input.verifier}` } }, ...input.body === void 0 ? {} : { body: JSON.stringify(input.body) } };
       response = await this.fetchFn(this.url(endpoint, input.id), init);
     } catch (cause) {
-      if (cause instanceof DOMException && cause.name === "AbortError") throw new import_sdk_core2.CredentialError("CANCELED", "Credential acquisition was canceled", { cause });
-      throw new import_sdk_core2.CredentialError("OFFLINE", "OpenCredentials is unavailable", { cause });
+      if (cause instanceof DOMException && cause.name === "AbortError") throw new import_sdk_core4.CredentialError("CANCELED", "Credential acquisition was canceled", { cause });
+      throw new import_sdk_core4.CredentialError("OFFLINE", "OpenCredentials is unavailable", { cause });
     }
     if (!response.ok) {
       let parsed;
@@ -203,95 +271,112 @@ var OpenCredentialsHttpTransport = class {
       }
       const typed = serverError(parsed, response, this.options.honorServerRecoverable === true);
       if (typed) throw typed;
-      if (response.status === 410) throw new import_sdk_core2.CredentialError("REQUEST_EXPIRED", "Credential request expired");
-      if (response.status === 409) throw new import_sdk_core2.CredentialError("REQUEST_SUBSTITUTED", "Credential request was replayed or substituted");
-      if (response.status === 503) throw new import_sdk_core2.CredentialError("ISSUER_UNREADY", "Credential issuer is not ready", { retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0 });
-      throw new import_sdk_core2.CredentialError("VERIFICATION_FAILED", "OpenCredentials rejected the request");
+      if (response.status === 410) throw new import_sdk_core4.CredentialError("REQUEST_EXPIRED", "Credential request expired");
+      if (response.status === 409) throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", "Credential request was replayed or substituted");
+      if (response.status === 503) throw new import_sdk_core4.CredentialError("ISSUER_UNREADY", "Credential issuer is not ready", { retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0 });
+      throw new import_sdk_core4.CredentialError("VERIFICATION_FAILED", "OpenCredentials rejected the request");
     }
     if (response.status === 204) return void 0;
     try {
       return await response.json();
     } catch (cause) {
-      throw new import_sdk_core2.CredentialError("VERIFICATION_FAILED", "OpenCredentials response is invalid", { cause });
+      throw new import_sdk_core4.CredentialError("VERIFICATION_FAILED", "OpenCredentials response is invalid", { cause });
     }
   }
   async create(input) {
-    const body = object(await this.request("request", { method: "POST", body: { protocol: input.descriptor.protocol, profile: input.descriptor.profile, profileVersion: input.descriptor.profileVersion, descriptorDigest: input.descriptorDigest, requirementDigest: input.requirementDigest, holderDid: input.holderDid, inputs: input.inputs ?? input.requirement.claims, audience: "tinycloud://credentials", openerOrigin: input.openerOrigin, completionOrigin: input.openerOrigin, completionContext: "sdk-acquisition", completionVerifierChallenge: input.completionVerifierChallenge }, signal: input.signal }), "create response");
-    if (body.type !== "tinycloud.credentials/acquisition-request/v1" || body.protocol !== input.descriptor.protocol || body.next !== "challenge" || body.endpoint !== "challenge") throw new import_sdk_core2.CredentialError("VERIFICATION_FAILED", "create response is invalid");
+    const body = object(await this.request("request", { method: "POST", body: { protocol: input.descriptor.protocol, profile: input.descriptor.profile, profileVersion: input.descriptor.profileVersion, descriptorDigest: input.descriptorDigest, requirementDigest: input.requirementDigest, holderDid: input.holderDid, inputs: input.inputs ?? input.requirement.claims, audience: HELD_ACCOUNT_BINDING_PINS.audience, openerOrigin: input.openerOrigin, completionOrigin: input.openerOrigin, completionContext: HELD_ACCOUNT_BINDING_PINS.completionContext, completionVerifierChallenge: input.completionVerifierChallenge }, signal: input.signal }), "create response");
+    if (body.type !== "tinycloud.credentials/acquisition-request/v1" || body.protocol !== input.descriptor.protocol || body.next !== "challenge" || body.endpoint !== "challenge") throw new import_sdk_core4.CredentialError("VERIFICATION_FAILED", "create response is invalid");
     const requestId = opaque(body.requestId, "requestId");
     return { requestId, locator: requestId, expiresAt: timestamp(body.expiresAt, "expiresAt"), correlationId: requestId };
   }
+  /** The nonce stored from R3 or R2 for this request. Held acquisition compares the signed binding with it. */
+  challengeNonce(id) {
+    return this.nonces.get(id);
+  }
+  /** The binding fetched and validated for this request, as the account signed it. */
+  signedBinding(id) {
+    return this.bindings.get(id);
+  }
   proofStep() {
     return this.descriptor.steps.some((step) => step.type === "mailbox_otp") ? "mailbox_otp" : "collect_input";
   }
   async state(id, verifier, signal) {
     const raw = object(await this.request("state", { id, verifier, signal }), "state response");
-    if (raw.type !== "tinycloud.credentials/acquisition-state/v1" || raw.requestId !== id || raw.profile !== this.descriptor.profile || raw.profileVersion !== 1) throw new import_sdk_core2.CredentialError("REQUEST_SUBSTITUTED", "Credential state response is substituted");
+    if (raw.type !== "tinycloud.credentials/acquisition-state/v1" || raw.requestId !== id || raw.profile !== this.descriptor.profile || raw.profileVersion !== 1) throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", "Credential state response is substituted");
     const base = { type: "OpenCredentialsAcquisitionState", version: 1, requestId: id, transitionId: `${String(raw.state)}:${String(raw.resultPreviouslyRead ?? false)}`, correlationId: id };
     if (raw.state === "challenge_required") {
       const type = this.proofStep();
       return { ...base, state: "pending", nextStep: { id: type, type, version: 1, constraints: { challengeRequired: true } } };
     }
+    if (this.descriptor.subjectRelationship === "account_is_subject" && (raw.state === "proof_required" || raw.state === "holder_binding_required" || raw.state === "holder_signature_required" || raw.state === "ready_to_issue" || raw.state === "issued")) {
+      const nonce = raw.challengeNonce;
+      const prior = this.nonces.get(id);
+      if (typeof nonce !== "string" || nonce === "" || prior !== void 0 && prior !== nonce) throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", "Credential challenge nonce is missing or changed");
+      this.nonces.set(id, opaque(nonce, "challengeNonce"));
+    }
     if (raw.state === "proof_required") {
       const type = this.proofStep();
-      this.nonces.set(id, opaque(raw.challengeNonce, "challengeNonce"));
+      if (this.descriptor.subjectRelationship !== "account_is_subject") this.nonces.set(id, opaque(raw.challengeNonce, "challengeNonce"));
       return { ...base, state: "pending", nextStep: { id: type, type, version: 1, constraints: {} } };
     }
     if (raw.state === "holder_binding_required" || raw.state === "holder_signature_required") return { ...base, state: "pending", nextStep: { id: "holder_signature", type: "holder_signature", version: 1, constraints: {} } };
     if (raw.state === "ready_to_issue") return { ...base, state: "ready_to_issue" };
     if (raw.state === "issued") return { ...base, state: "complete" };
-    throw new import_sdk_core2.CredentialError("REQUEST_SUBSTITUTED", "Credential state is unsupported");
+    throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", "Credential state is unsupported");
   }
   async beginStep(id, verifier, stepId, signal) {
     const step = this.proofStep();
-    if (stepId !== step) throw new import_sdk_core2.CredentialError("REQUEST_SUBSTITUTED", "Credential challenge step is substituted");
+    if (stepId !== step) throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", "Credential challenge step is substituted");
     const challenge = object(await this.request("challenge", { id, verifier, method: "POST", body: { step, stepVersion: 1 }, signal }), "challenge response");
-    if (challenge.type !== "tinycloud.credentials/challenge/v1" || challenge.step !== step || challenge.stepVersion !== 1) throw new import_sdk_core2.CredentialError("REQUEST_SUBSTITUTED", "Credential challenge is substituted");
+    if (challenge.type !== "tinycloud.credentials/challenge/v1" || challenge.step !== step || challenge.stepVersion !== 1) throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", "Credential challenge is substituted");
     this.nonces.set(id, opaque(challenge.challengeNonce, "challengeNonce"));
   }
   async submitStep(id, verifier, stepId, proof, signal) {
     const step = this.proofStep();
-    if (stepId !== step) throw new import_sdk_core2.CredentialError("REQUEST_SUBSTITUTED", "Credential proof step is substituted");
+    if (stepId !== step) throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", "Credential proof step is substituted");
     const nonce = this.nonces.get(id);
-    if (!nonce) throw new import_sdk_core2.CredentialError("REQUEST_SUBSTITUTED", "Credential challenge is missing");
+    if (!nonce) throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", "Credential challenge is missing");
     await this.request("proof", { id, verifier, method: "POST", body: { step, stepVersion: 1, challengeNonce: nonce, proof }, signal });
   }
   async holderBinding(id, verifier, signal) {
     const raw = object(await this.request("holder_binding", { id, verifier, signal }), "holder binding response");
-    if (raw.type !== "tinycloud.credentials/holder-binding-request/v1" || raw.signingDomain !== "tinycloud.credentials/holder-binding/v1" || raw.alg !== "EdDSA" || typeof raw.canonical !== "string") throw new import_sdk_core2.CredentialError("REQUEST_SUBSTITUTED", "Holder binding response is invalid");
-    const binding = (0, import_sdk_core2.validateCredentialHolderBinding)(raw.binding);
-    if ((0, import_sdk_core2.encodeBase64Url)((0, import_sdk_core2.holderBindingCanonicalBytes)(binding)) !== raw.canonical) throw new import_sdk_core2.CredentialError("REQUEST_SUBSTITUTED", "Holder binding canonical bytes were substituted");
+    if (raw.type !== "tinycloud.credentials/holder-binding-request/v1" || raw.signingDomain !== this.descriptor.holderBinding.domain || raw.alg !== this.descriptor.holderBinding.alg || typeof raw.canonical !== "string") throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", "Holder binding response is invalid");
+    const binding = (0, import_sdk_core4.validateCredentialHolderBinding)(raw.binding);
+    if (binding.type !== raw.signingDomain) throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", "Holder binding type does not match its signing domain");
+    if ((0, import_sdk_core4.encodeBase64Url)((0, import_sdk_core4.holderBindingCanonicalBytes)(binding)) !== raw.canonical) throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", "Holder binding canonical bytes were substituted");
     this.bindings.set(id, binding);
     return binding;
   }
   async submitHolderSignature(id, verifier, signature, signal, key) {
     const binding = this.bindings.get(id);
-    if (!binding) throw new import_sdk_core2.CredentialError("REQUEST_SUBSTITUTED", "Holder binding was not retrieved");
+    if (!binding) throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", "Holder binding was not retrieved");
+    if (this.descriptor.holderBinding.alg === "EIP191" && !key) throw new import_sdk_core4.CredentialError("REQUEST_SUBSTITUTED", "An account holder must name its key and algorithm");
+    const alg = key?.alg ?? "EdDSA";
     const kid = key?.kid ?? `${binding.holderDid}#${binding.holderDid.replace("did:key:", "")}`;
-    await this.request("holder_signature", { id, verifier, method: "POST", body: { alg: key?.alg ?? "EdDSA", kid, signature }, signal });
+    await this.request("holder_signature", { id, verifier, method: "POST", body: { alg, kid, signature }, signal });
   }
   async issue(id, verifier, signal) {
     await this.request("issue", { id, verifier, method: "POST", signal });
   }
   async result(id, verifier, signal) {
     const raw = object(await this.request("result", { id, verifier, signal }), "result response");
-    if (raw.type !== "tinycloud.credentials/result/v1" || raw.protocol !== this.descriptor.protocol || raw.profile !== this.descriptor.profile || raw.profileVersion !== 1 || raw.format !== "vc+sd-jwt" || raw.descriptorDigest !== await (0, import_sdk_core2.canonicalDigest)(this.descriptor) || raw.issuer !== this.descriptor.issuer.did || raw.issuerKid !== this.descriptor.issuer.kid || typeof raw.credential !== "string" || await (0, import_sdk_core2.sha256Base64Url)(raw.credential) !== raw.credentialDigest) throw new import_sdk_core2.CredentialError("VERIFICATION_FAILED", "Issued result metadata is invalid");
+    if (raw.type !== "tinycloud.credentials/result/v1" || raw.protocol !== this.descriptor.protocol || raw.profile !== this.descriptor.profile || raw.profileVersion !== 1 || raw.format !== "vc+sd-jwt" || raw.descriptorDigest !== await (0, import_sdk_core4.canonicalDigest)(this.descriptor) || raw.issuer !== this.descriptor.issuer.did || raw.issuerKid !== this.descriptor.issuer.kid || typeof raw.credential !== "string" || await (0, import_sdk_core4.sha256Base64Url)(raw.credential) !== raw.credentialDigest) throw new import_sdk_core4.CredentialError("VERIFICATION_FAILED", "Issued result metadata is invalid");
     const holder = object(raw.holderBinding, "result holder binding");
-    if (raw.subject !== holder.did || holder.signingDomain !== "tinycloud.credentials/holder-binding/v1") throw new import_sdk_core2.CredentialError("HOLDER_MISMATCH", "Issued holder binding is invalid");
+    if (raw.subject !== holder.did || holder.signingDomain !== this.descriptor.holderBinding.domain) throw new import_sdk_core4.CredentialError("HOLDER_MISMATCH", "Issued holder binding is invalid");
     const claimsRaw = object(raw.claims, "result claims");
     const claims = {};
     for (const [name, value] of Object.entries(claimsRaw)) {
-      if (typeof value !== "string") throw new import_sdk_core2.CredentialError("VERIFICATION_FAILED", "Issued claims are invalid");
+      if (typeof value !== "string") throw new import_sdk_core4.CredentialError("VERIFICATION_FAILED", "Issued claims are invalid");
       claims[name] = value;
     }
     const validity = object(raw.validity, "result validity");
     const payload = jwtPayload(raw.credential);
-    if (typeof payload.jti !== "string") throw new import_sdk_core2.CredentialError("VERIFICATION_FAILED", "Credential id is invalid");
+    if (typeof payload.jti !== "string") throw new import_sdk_core4.CredentialError("VERIFICATION_FAILED", "Credential id is invalid");
     const issuedAt = timestamp(validity.issuedAt, "issuedAt");
     const expiresAt = timestamp(validity.expiresAt, "expiresAt");
     const status = object(raw.status, "result status");
-    if (status.type !== "none" || status.freshnessSeconds !== this.descriptor.status.freshnessSeconds) throw new import_sdk_core2.CredentialError("VERIFICATION_FAILED", "Credential status is invalid");
-    return { type: "OpenCredentialsIssuedCredential", version: 1, protocol: this.descriptor.protocol, profile: { id: this.descriptor.profile, version: 1 }, credentialType: { id: this.descriptor.format.vct, version: 1 }, schema: this.descriptor.format.vct, format: "vc+sd-jwt", issuerDid: raw.issuer, issuerKid: raw.issuerKid, subjectDid: raw.subject, holderDid: raw.subject, claims, claimsDigest: await (0, import_sdk_core2.canonicalDigest)(claims), descriptorDigest: raw.descriptorDigest, credentialId: payload.jti, issuedAt, notBefore: issuedAt, expiresAt, status: { method: "none", freshnessSeconds: status.freshnessSeconds }, credential: raw.credential };
+    if (status.type !== "none" || status.freshnessSeconds !== this.descriptor.status.freshnessSeconds) throw new import_sdk_core4.CredentialError("VERIFICATION_FAILED", "Credential status is invalid");
+    return { type: "OpenCredentialsIssuedCredential", version: 1, protocol: this.descriptor.protocol, profile: { id: this.descriptor.profile, version: 1 }, credentialType: { id: this.descriptor.format.vct, version: 1 }, schema: this.descriptor.format.vct, format: "vc+sd-jwt", issuerDid: raw.issuer, issuerKid: raw.issuerKid, subjectDid: raw.subject, holderDid: raw.subject, claims, claimsDigest: await (0, import_sdk_core4.canonicalDigest)(claims), descriptorDigest: raw.descriptorDigest, credentialId: payload.jti, issuedAt, notBefore: issuedAt, expiresAt, status: { method: "none", freshnessSeconds: status.freshnessSeconds }, credential: raw.credential };
   }
   async issuerMetadata(signal) {
     return await this.request("issuer_metadata", { signal });
@@ -302,13 +387,6 @@ var OpenCredentialsHttpTransport = class {
 };
 
 // src/credentials/email-proof.ts
-var EMAIL_PROOF_PINS = Object.freeze({
-  witnessOrigin: "https://witness.credentials.org",
-  issuerDid: "did:web:issuer.credentials.org",
-  issuerKid: "did:web:issuer.credentials.org#controller",
-  issuerX: "eEJI4xEobto4HtQ7Pg9R1vBOwcpfGRTlXDG5QfqLnGQ",
-  descriptorDigest: "1tg-qphmKBVtNwzVg9xyz-xxqt_xtMXAsQyXw46m8S0"
-});
 var EMAIL_PROOF_CREDENTIAL_TYPE = { id: "opencredentials.email/v1", version: 1 };
 var EMAIL_PROOF_PENDING_MAX_MS = 15 * 6e4;
 var DISCOVERY_URL = `${EMAIL_PROOF_PINS.witnessOrigin}/.well-known/opencredentials`;
@@ -323,9 +401,17 @@ var EMAIL_PROOF_ISSUER_KEYS = [
 ];
 var DEFAULT_EMAIL_PROOF_PROFILE = "tinycloud.email-proof/v1";
 var PROFILE_PINS = {
-  "tinycloud.email-proof/v1": { descriptorDigest: EMAIL_PROOF_PINS.descriptorDigest, requiredStep: "mailbox_otp", enabled: true }
+  "tinycloud.email-proof/v1": { descriptorDigest: EMAIL_PROOF_PINS.descriptorDigest, requiredStep: "mailbox_otp", enabled: true },
+  // Held profile: disabled by default. A call enables it only with the per-call opt-in `allowHeldProfile: true` (see `profilePin`).
+  // Without it, requests refuse with PROFILE_UNAVAILABLE before any network call.
+  "tinycloud.email-held/v1": { descriptorDigest: HELD_ACCOUNT_BINDING_PINS.descriptorDigest, requiredStep: "mailbox_otp", enabled: false }
 };
-var OPENER_ORIGIN = "https://localhost";
+var OPENER_ORIGIN = HELD_ACCOUNT_BINDING_PINS.openerOrigin;
+var HELD_PROFILE = "tinycloud.email-held/v1";
+var HELD_KID_FRAGMENT = "blockchainAccountId";
+var HELD_MAX_AGE_SECONDS = 31536e3;
+var HELD_REQUEST_TTL_MS = 6e5;
+var CLOCK_SKEW_BOUND_MS = 3e5;
 var STEP_TIMEOUT_MS = 6e4;
 var HOLDER_DID_PREFIX = "did:key:";
 var HOLDER_DID_PATTERN = /^did:key:z6Mk[^#]+$/;
@@ -345,6 +431,7 @@ var RECOVERABILITY = {
   CREDENTIAL_INVALID: false,
   SESSION_EXPIRED: false,
   SESSION_INVALID: false,
+  CLIENT_CLOCK_SKEW: false,
   CANCELED: false,
   FAILED: false
 };
@@ -361,6 +448,7 @@ var MESSAGES = {
   CREDENTIAL_INVALID: "Issued credential failed verification.",
   SESSION_EXPIRED: "Email verification request expired. Request a new code.",
   SESSION_INVALID: "Email verification request is no longer valid. Request a new code.",
+  CLIENT_CLOCK_SKEW: "Your device clock is more than 5 minutes behind. Correct it and try again.",
   CANCELED: "Email verification was canceled.",
   FAILED: "Email verification failed."
 };
@@ -392,7 +480,8 @@ function restoreEmailProofPending(fields) {
     requirementDigest: fields.requirementDigest,
     openerOrigin: fields.openerOrigin,
     createdAt: fields.createdAt,
-    expiresAt: fields.expiresAt
+    expiresAt: fields.expiresAt,
+    ...fields.serverExpiresAt === void 0 ? {} : { serverExpiresAt: fields.serverExpiresAt }
   };
   const pending = { ...shown };
   hide(pending, "verifier", fields.verifier);
@@ -406,6 +495,9 @@ function hide(target, key, value) {
 function pendingDeadlineMs(pending) {
   return Math.min(Date.parse(pending.expiresAt), Date.parse(pending.createdAt) + EMAIL_PROOF_PENDING_MAX_MS);
 }
+function isTicketEmailProofResult(result) {
+  return result.envelope.profile.id !== HELD_PROFILE;
+}
 var CodeRequested = class extends Error {
 };
 var pauseForCode = async () => {
@@ -413,17 +505,19 @@ var pauseForCode = async () => {
 };
 async function requestEmailProofCode(input) {
   const profile = input.profile ?? DEFAULT_EMAIL_PROOF_PROFILE;
-  profilePin(profile, "request");
-  const address = normalizeAddress(input.address);
-  assertHolder(input.holder, "request");
+  profilePin(profile, "request", input.allowHeldProfile);
+  const held = profile === HELD_PROFILE;
+  if (held) assertHolder(input.holder, "request", profile);
+  const address = normalizeAddress(input.address, profile);
+  if (!held) assertHolder(input.holder, "request", profile);
   const now = input.now ?? (() => /* @__PURE__ */ new Date());
   const signal = input.signal ?? AbortSignal.timeout(STEP_TIMEOUT_MS);
   const requirement = emailRequirement(address, profile);
-  const requirementDigest = await (0, import_sdk_core3.credentialRequirementDigest)(requirement);
-  const descriptor = await witnessDescriptor(profile, requirement, { fetch: input.fetch, signal }, "request");
-  const descriptorDigest = await (0, import_sdk_core3.canonicalDigest)(descriptor);
+  const requirementDigest = await (0, import_sdk_core5.credentialRequirementDigest)(requirement);
+  const descriptor = await witnessDescriptor(profile, requirement, { fetch: input.fetch, signal }, "request", input.allowHeldProfile);
+  const descriptorDigest = await (0, import_sdk_core5.canonicalDigest)(descriptor);
   const verifier = randomVerifier();
-  const transport = new OpenCredentialsHttpTransport(descriptor, input.fetch, { honorServerRecoverable: true });
+  const transport = new OpenCredentialsHttpTransport(descriptor, input.fetch, { honorServerRecoverable: true, ...held ? { allowAccountSubject: true } : {} });
   const createdAtMs = now().getTime();
   let created;
   try {
@@ -434,7 +528,7 @@ async function requestEmailProofCode(input) {
       requirementDigest,
       holderDid: input.holder.did,
       openerOrigin: OPENER_ORIGIN,
-      completionVerifierChallenge: await (0, import_sdk_core3.sha256Base64Url)(verifier),
+      completionVerifierChallenge: await (0, import_sdk_core5.sha256Base64Url)(verifier),
       signal
     });
   } catch (error) {
@@ -442,6 +536,8 @@ async function requestEmailProofCode(input) {
   }
   const serverExpiry = Date.parse(created.expiresAt);
   if (!Number.isFinite(serverExpiry)) throw new EmailProofError("request", "FAILED");
+  const serverNowMs = serverExpiry - HELD_REQUEST_TTL_MS;
+  if (held && serverNowMs - now().getTime() > CLOCK_SKEW_BOUND_MS) throw new EmailProofError("request", "CLIENT_CLOCK_SKEW");
   const pending = restoreEmailProofPending({
     type: "TinyCloudEmailProofPending",
     version: 1,
@@ -454,11 +550,14 @@ async function requestEmailProofCode(input) {
     requirementDigest,
     openerOrigin: OPENER_ORIGIN,
     createdAt: new Date(createdAtMs).toISOString(),
-    expiresAt: new Date(Math.min(serverExpiry, createdAtMs + EMAIL_PROOF_PENDING_MAX_MS)).toISOString()
+    // Held: the deadline is measured on the client clock (a fast client must not lose window), the witness enforces its own 600 s.
+    expiresAt: new Date(held ? createdAtMs + Math.min(serverExpiry - serverNowMs, EMAIL_PROOF_PENDING_MAX_MS) : Math.min(serverExpiry, createdAtMs + EMAIL_PROOF_PENDING_MAX_MS)).toISOString(),
+    ...held ? { serverExpiresAt: created.expiresAt } : {}
   });
   try {
     await interpretCredentialFlow({
       descriptor,
+      ...held ? { allowAccountSubject: true } : {},
       requirement,
       requestId: created.requestId,
       verifier,
@@ -466,8 +565,9 @@ async function requestEmailProofCode(input) {
       descriptorDigest,
       requirementDigest,
       openerOrigin: OPENER_ORIGIN,
+      ...held ? { expiresAt: created.expiresAt } : {},
       transport,
-      signing: holderSigning(input.holder),
+      signing: holderSigning(input.holder, held),
       handlers: { mailbox_otp: pauseForCode },
       signal
     });
@@ -484,22 +584,26 @@ async function completeWithIssuerKeys(input, issuerKeys) {
   const { pending } = input;
   const now = input.now ?? (() => /* @__PURE__ */ new Date());
   if (!isPending(pending)) throw new EmailProofError("session", "SESSION_INVALID");
+  profilePin(pending.profile, "session", input.allowHeldProfile);
+  const held = pending.profile === HELD_PROFILE;
+  if (held && !Number.isFinite(Date.parse(pending.serverExpiresAt ?? ""))) throw new EmailProofError("session", "SESSION_INVALID");
   if (pendingDeadlineMs(pending) <= now().getTime()) throw new EmailProofError("session", "SESSION_EXPIRED");
   if (!/^\d{8}$/.test(input.code)) throw new EmailProofError("code", "CODE_INVALID");
-  assertHolder(input.holder, "code");
+  assertHolder(input.holder, "code", pending.profile);
   if (input.holder.did !== pending.holderDid) throw new EmailProofError("session", "SESSION_INVALID");
   const signal = input.signal ?? AbortSignal.timeout(STEP_TIMEOUT_MS);
   const requirement = emailRequirement(pending.address, pending.profile);
-  if (await (0, import_sdk_core3.credentialRequirementDigest)(requirement) !== pending.requirementDigest) throw new EmailProofError("session", "SESSION_INVALID");
-  const descriptor = await witnessDescriptor(pending.profile, requirement, { fetch: input.fetch, signal }, "session");
-  const descriptorDigest = await (0, import_sdk_core3.canonicalDigest)(descriptor);
+  if (await (0, import_sdk_core5.credentialRequirementDigest)(requirement) !== pending.requirementDigest) throw new EmailProofError("session", "SESSION_INVALID");
+  const descriptor = await witnessDescriptor(pending.profile, requirement, { fetch: input.fetch, signal }, "session", input.allowHeldProfile);
+  const descriptorDigest = await (0, import_sdk_core5.canonicalDigest)(descriptor);
   if (descriptorDigest !== pending.descriptorDigest) throw new EmailProofError("session", "SESSION_INVALID");
-  const transport = new OpenCredentialsHttpTransport(descriptor, input.fetch, { honorServerRecoverable: true });
+  const transport = new OpenCredentialsHttpTransport(descriptor, input.fetch, { honorServerRecoverable: true, ...held ? { allowAccountSubject: true } : {} });
   try {
     const state = await transport.state(pending.requestId, pending.verifier, signal);
     if (state.nextStep?.constraints.challengeRequired === true) throw new EmailProofError("session", "SESSION_INVALID");
     await interpretCredentialFlow({
       descriptor,
+      ...held ? { allowAccountSubject: true } : {},
       requirement,
       requestId: pending.requestId,
       verifier: pending.verifier,
@@ -507,8 +611,9 @@ async function completeWithIssuerKeys(input, issuerKeys) {
       descriptorDigest,
       requirementDigest: pending.requirementDigest,
       openerOrigin: pending.openerOrigin,
+      ...held ? { expiresAt: pending.serverExpiresAt } : {},
       transport,
-      signing: holderSigning(input.holder),
+      signing: holderSigning(input.holder, held),
       handlers: { mailbox_otp: async () => ({ otp: input.code }) },
       signal
     });
@@ -517,7 +622,11 @@ async function completeWithIssuerKeys(input, issuerKeys) {
   }
   try {
     const envelope = await transport.result(pending.requestId, pending.verifier, signal);
-    const verified = await (0, import_sdk_core3.verifyIssuedCredential)({
+    if (held) {
+      const verified2 = await verifyHeldResult({ envelope, pending, descriptor, descriptorDigest, transport, issuerKeys, now });
+      return { envelope, verified: verified2, credentialId: verified2.credentialId, issuedAt: verified2.issuedAt.toISOString(), expiresAt: verified2.expiresAt.toISOString(), descriptor };
+    }
+    const verified = await (0, import_sdk_core5.verifyIssuedCredential)({
       envelope,
       descriptor,
       descriptorDigest,
@@ -533,27 +642,49 @@ async function completeWithIssuerKeys(input, issuerKeys) {
     throw mapError(error, "credential", signal);
   }
 }
-function normalizeAddress(address) {
+function normalizeAddress(address, profile) {
+  if (profile === HELD_PROFILE) return normalizeHeldAddress(address);
   const value = address.trim();
   if (value.length > 254 || !EMAIL_PATTERN.test(value)) throw new EmailProofError("request", "ADDRESS_INVALID");
   return value;
 }
+var HELD_LOCAL_ATOM = /^[a-z0-9!#$%&'*+\-/=?^_`{|}~]+(\.[a-z0-9!#$%&'*+\-/=?^_`{|}~]+)*$/;
+var HELD_DOMAIN_LABEL = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+function normalizeHeldAddress(address) {
+  const invalid = () => new EmailProofError("request", "ADDRESS_INVALID");
+  const trimmed = address.trim();
+  if (/[^\x00-\x7f]/.test(trimmed)) throw invalid();
+  const value = trimmed.toLowerCase();
+  const parts = value.split("@");
+  if (value.length < 3 || value.length > 254 || parts.length !== 2 || /[^\x21-\x7e]/.test(value)) throw invalid();
+  const [local, domain] = parts;
+  if (local.length > 64 || !HELD_LOCAL_ATOM.test(local) || local.startsWith("+")) throw invalid();
+  if (domain.length > 253 || !domain.includes(".") || !domain.split(".").every((label) => label.length <= 63 && HELD_DOMAIN_LABEL.test(label))) throw invalid();
+  return value;
+}
 function holderKid(did) {
   return `${did}#${did.slice(HOLDER_DID_PREFIX.length)}`;
 }
-function assertHolder(holder, step) {
+function assertHeldHolder(holder, step) {
+  const parsed = (0, import_held_credentials.parsePkhDid)(holder.did);
+  const canonical = parsed !== null && parsed.chainId === "1" ? `did:pkh:eip155:1:${(0, import_held_credentials.toChecksumAddress)(parsed.address)}` : void 0;
+  if (canonical === void 0 || holder.did !== canonical || holder.alg !== "EIP191" || holder.kid !== `${canonical}#${HELD_KID_FRAGMENT}`) throw new EmailProofError(step, "HOLDER_INVALID");
+}
+function assertHolder(holder, step, profile) {
+  if (profile === HELD_PROFILE) return assertHeldHolder(holder, step);
   if (!HOLDER_DID_PATTERN.test(holder.did) || holder.alg !== "EdDSA" || holder.kid !== holderKid(holder.did)) throw new EmailProofError(step, "HOLDER_INVALID");
 }
-function profilePin(profile, step) {
+function profilePin(profile, step, allowHeld) {
   const entry = Object.prototype.hasOwnProperty.call(PROFILE_PINS, profile) ? PROFILE_PINS[profile] : void 0;
-  if (!entry || !entry.enabled) throw new EmailProofError(step, "PROFILE_UNAVAILABLE");
+  if (!entry || !entry.enabled && !(allowHeld === true && profile === HELD_PROFILE)) throw new EmailProofError(step, "PROFILE_UNAVAILABLE");
   return entry;
 }
 function emailRequirement(address, profile) {
-  return (0, import_sdk_core3.createEmailCredentialRequirement)({ email: address, profile: { id: profile, version: 1 }, credentialType: EMAIL_PROOF_CREDENTIAL_TYPE });
+  if (profile === HELD_PROFILE) return (0, import_sdk_core5.validateCredentialRequirement)({ type: "TinyCloudCredentialRequirement", version: 1, profile: { id: profile, version: 1 }, credentialType: EMAIL_PROOF_CREDENTIAL_TYPE, claims: { email: address }, maxAgeSeconds: HELD_MAX_AGE_SECONDS });
+  return (0, import_sdk_core5.createEmailCredentialRequirement)({ email: address, profile: { id: profile, version: 1 }, credentialType: EMAIL_PROOF_CREDENTIAL_TYPE });
 }
-async function witnessDescriptor(profile, requirement, options, step) {
-  const pin = profilePin(profile, step);
+async function witnessDescriptor(profile, requirement, options, step, allowHeld) {
+  const pin = profilePin(profile, step, allowHeld);
   let descriptor;
   try {
     descriptor = await discoverCatalogDescriptor(requirement, DISCOVERY_URL, { fetch: options.fetch, signal: options.signal });
@@ -563,7 +694,7 @@ async function witnessDescriptor(profile, requirement, options, step) {
   if (descriptor.issuer.origin !== EMAIL_PROOF_PINS.witnessOrigin || descriptor.issuer.did !== EMAIL_PROOF_PINS.issuerDid || !descriptor.steps.some((candidate) => candidate.type === pin.requiredStep)) {
     throw new EmailProofError(step, "PROFILE_UNAVAILABLE");
   }
-  if (await (0, import_sdk_core3.canonicalDigest)(descriptor) !== pin.descriptorDigest) throw new EmailProofError(step, "PROFILE_UNAVAILABLE");
+  if (await (0, import_sdk_core5.canonicalDigest)(descriptor) !== pin.descriptorDigest) throw new EmailProofError(step, "PROFILE_UNAVAILABLE");
   return descriptor;
 }
 async function discoverCatalogDescriptor(requirement, discoveryUrl, options = {}) {
@@ -571,30 +702,30 @@ async function discoverCatalogDescriptor(requirement, discoveryUrl, options = {}
   try {
     url = new URL(discoveryUrl);
   } catch {
-    throw new import_sdk_core3.CredentialError("UNSUPPORTED_PROFILE", "Discovery URL is invalid");
+    throw new import_sdk_core5.CredentialError("UNSUPPORTED_PROFILE", "Discovery URL is invalid");
   }
-  if (url.protocol !== "https:" || !["/.well-known/opencredentials", "/v1/credential-types"].includes(url.pathname) || url.search || url.hash) throw new import_sdk_core3.CredentialError("UNSUPPORTED_PROFILE", "Discovery URL is not an allowed catalog endpoint");
+  if (url.protocol !== "https:" || !["/.well-known/opencredentials", "/v1/credential-types"].includes(url.pathname) || url.search || url.hash) throw new import_sdk_core5.CredentialError("UNSUPPORTED_PROFILE", "Discovery URL is not an allowed catalog endpoint");
   const init = { credentials: "omit", cache: "no-store", redirect: "error", referrerPolicy: "no-referrer", signal: options.signal };
   let response;
   try {
     response = await (options.fetch ?? globalThis.fetch.bind(globalThis))(url, init);
   } catch (cause) {
-    throw new import_sdk_core3.CredentialError("OFFLINE", "Credential discovery is unavailable", { cause });
+    throw new import_sdk_core5.CredentialError("OFFLINE", "Credential discovery is unavailable", { cause });
   }
-  if (!response.ok) throw new import_sdk_core3.CredentialError(response.status === 503 ? "ISSUER_UNREADY" : "OFFLINE", "Credential discovery is unavailable");
+  if (!response.ok) throw new import_sdk_core5.CredentialError(response.status === 503 ? "ISSUER_UNREADY" : "OFFLINE", "Credential discovery is unavailable");
   const catalog = await response.json();
-  if (catalog.type !== "tinycloud.credentials/catalog/v1" || catalog.protocol !== "tinycloud.credentials/acquisition/v1" || catalog.catalogVersion !== 1 || !Array.isArray(catalog.profiles)) throw new import_sdk_core3.CredentialError("DESCRIPTOR_INVALID", "Credential catalog is invalid");
+  if (catalog.type !== "tinycloud.credentials/catalog/v1" || catalog.protocol !== "tinycloud.credentials/acquisition/v1" || catalog.catalogVersion !== 1 || !Array.isArray(catalog.profiles)) throw new import_sdk_core5.CredentialError("DESCRIPTOR_INVALID", "Credential catalog is invalid");
   for (const entryValue of catalog.profiles) {
     if (typeof entryValue !== "object" || entryValue === null || Array.isArray(entryValue)) continue;
     const entry = entryValue;
     if (entry.supported !== true || entry.enabled !== true || entry.readiness !== "ready" && entry.readiness !== "degraded") continue;
     try {
-      const candidate = (0, import_sdk_core3.validateCredentialFlowDescriptor)(entry.descriptor);
-      if ((0, import_sdk_core3.descriptorSatisfiesRequirement)(candidate, requirement) && entry.descriptorDigest === await (0, import_sdk_core3.canonicalDigest)(candidate)) return candidate;
+      const candidate = (0, import_sdk_core5.validateCredentialFlowDescriptor)(entry.descriptor);
+      if ((0, import_sdk_core5.descriptorSatisfiesRequirement)(candidate, requirement) && entry.descriptorDigest === await (0, import_sdk_core5.canonicalDigest)(candidate)) return candidate;
     } catch {
     }
   }
-  throw new import_sdk_core3.CredentialError("UNSUPPORTED_PROFILE", "No available credential profile satisfies the requirement");
+  throw new import_sdk_core5.CredentialError("UNSUPPORTED_PROFILE", "No available credential profile satisfies the requirement");
 }
 function discoveryFailure(error, signal, step) {
   if (signal.aborted && signal.reason?.name !== "TimeoutError") return new EmailProofError(step, "CANCELED");
@@ -603,11 +734,55 @@ function discoveryFailure(error, signal, step) {
 function pinnedIssuerMetadata(keys) {
   return { type: "OpenCredentialsIssuerMetadata", version: 1, origin: EMAIL_PROOF_PINS.witnessOrigin, issuerDid: EMAIL_PROOF_PINS.issuerDid, keys, cache: { maxAgeSeconds: 3600, etag: "pinned" } };
 }
-function holderSigning(holder) {
-  return { autoSign: async (_binding, bytes) => holder.sign(bytes), holderKey: { alg: "EdDSA", kid: holder.kid } };
+async function verifyHeldResult(input) {
+  const { envelope, pending, descriptor } = input;
+  const refuse = (message) => new import_sdk_core5.CredentialError("VERIFICATION_FAILED", message);
+  const iatMs = Date.parse(envelope.issuedAt);
+  const clientMs = input.now().getTime();
+  if (!Number.isFinite(iatMs) || iatMs - clientMs > CLOCK_SKEW_BOUND_MS) throw refuse("client clock is more than 5 minutes behind the issuer");
+  const key = input.issuerKeys.find((candidate) => candidate.kid === EMAIL_PROOF_PINS.issuerKid);
+  if (!key) throw refuse("no pinned issuer key");
+  const issuerSet = (0, import_held_credentials.parseIssuerSet)(
+    { format: "tinycloud.credentials-issuers/v1", version: 1, issuers: [{ issuerDid: EMAIL_PROOF_PINS.issuerDid, kid: EMAIL_PROOF_PINS.issuerKid, alg: "EdDSA", publicKey: key.jwk.x, vcts: [EMAIL_PROOF_CREDENTIAL_TYPE.id], profiles: [HELD_PROFILE], notBefore: "2020-01-01T00:00:00Z", retiredAt: null, notAfter: null }] },
+    { didMethods: { issuer: ["web"] } }
+  );
+  const verified = (0, import_held_credentials.verifyHeldEmailCredential)(envelope.credential, {
+    now: new Date(Math.max(clientMs, iatMs)),
+    owner: pending.holderDid,
+    didMethods: { issuer: ["web"] },
+    acceptedIssuers: [{ issuerDid: EMAIL_PROOF_PINS.issuerDid, kid: EMAIL_PROOF_PINS.issuerKid }],
+    issuerSet
+  });
+  const signed = input.transport.signedBinding(pending.requestId);
+  const claims = Object.keys(envelope.claims).sort().join();
+  const toSecond = (ms) => Math.floor(ms / 1e3);
+  if (
+    // (i) the holder, as the one EIP-55 string
+    envelope.subjectDid !== pending.holderDid || envelope.holderDid !== pending.holderDid || // (ii) exactly {email, emailDomain}, equal to the credential's, and the requested mailbox
+    claims !== "email,emailDomain" || envelope.claims.email !== verified.claims.email || envelope.claims.emailDomain !== verified.claims.emailDomain || envelope.claims.email !== pending.address || // (iii) validity to the second
+    toSecond(Date.parse(envelope.issuedAt)) !== toSecond(verified.issuedAt.getTime()) || toSecond(Date.parse(envelope.expiresAt)) !== toSecond(verified.expiresAt.getTime()) || // (v) the pins
+    envelope.descriptorDigest !== input.descriptorDigest || envelope.profile.id !== HELD_PROFILE || envelope.profile.version !== 1 || envelope.issuerDid !== EMAIL_PROOF_PINS.issuerDid || envelope.issuerKid !== EMAIL_PROOF_PINS.issuerKid || envelope.format !== "vc+sd-jwt" || envelope.status.method !== "none" || envelope.status.freshnessSeconds !== descriptor.status.freshnessSeconds
+  ) throw refuse("issued credential does not match the request");
+  if (signed?.type !== descriptor.holderBinding.domain || !("credentialLifetimeSeconds" in signed)) throw refuse("signed binding is missing");
+  if (verified.credentialId !== signed.jti || (verified.expiresAt.getTime() - verified.issuedAt.getTime()) / 1e3 !== signed.credentialLifetimeSeconds) throw refuse("credential does not match the binding the account signed");
+  return verified;
+}
+function holderSigning(holder, held) {
+  return {
+    autoSign: async (_binding, bytes) => {
+      try {
+        return await holder.sign(bytes);
+      } catch (error) {
+        const aborted = error instanceof DOMException && (error.name === "TimeoutError" || error.name === "AbortError");
+        if (!held || error instanceof EmailProofError || aborted) throw error;
+        throw new EmailProofError("credential", "SIGNATURE_REJECTED");
+      }
+    },
+    holderKey: { alg: holder.alg, kid: holder.kid }
+  };
 }
 function randomVerifier() {
-  return (0, import_sdk_core3.encodeBase64Url)(crypto.getRandomValues(new Uint8Array(32)));
+  return (0, import_sdk_core5.encodeBase64Url)(crypto.getRandomValues(new Uint8Array(32)));
 }
 function isPending(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -617,7 +792,7 @@ function isPending(value) {
 function mapError(value, step, signal) {
   if (value instanceof EmailProofError) return value;
   if (value instanceof DOMException && value.name === "TimeoutError") return new EmailProofError(step, "NETWORK");
-  const error = (0, import_sdk_core3.credentialError)(value);
+  const error = (0, import_sdk_core5.credentialError)(value);
   const details = error.details;
   switch (error.code) {
     case "ISSUER_UNREADY":
@@ -626,6 +801,7 @@ function mapError(value, step, signal) {
       if (signal?.aborted && signal.reason?.name !== "TimeoutError") return new EmailProofError(step, "CANCELED");
       return new EmailProofError(step, "NETWORK");
     case "UNSUPPORTED_PROFILE":
+    case "UNSUPPORTED_VERSION":
     case "DESCRIPTOR_INVALID":
       return new EmailProofError(step, "PROFILE_UNAVAILABLE");
     case "PROOF_REJECTED":
@@ -651,18 +827,19 @@ function mapError(value, step, signal) {
 }
 
 // src/share-receive-access.ts
-var import_sdk_core4 = require("@tinycloud/sdk-core");
+var import_sdk_core6 = require("@tinycloud/sdk-core");
 var import_share_sdk = require("@tinycloud/share-sdk");
 async function openVerifiedAgentShare(pending, result, requirement, options) {
   const { envelope } = pending;
-  if (!(0, import_sdk_core4.credentialMatchesRequirement)(requirement, result.verified, options.holder.did, new Date(options.now?.() ?? Date.now()))) {
+  if (!isTicketEmailProofResult(result)) throw new import_share_sdk.ShareReceiveError("authorization-denied", "email credential does not match this share");
+  if (!(0, import_sdk_core6.credentialMatchesRequirement)(requirement, result.verified, options.holder.did, new Date(options.now?.() ?? Date.now()))) {
     throw new import_share_sdk.ShareReceiveError("authorization-denied", "email credential does not match this share");
   }
   if (envelope.target.nodeAudience !== envelope.attestedEnforcerBinding.nodeAudience) {
     throw new import_share_sdk.ShareReceiveError("envelope-invalid", "share Node binding is invalid");
   }
   try {
-    await (0, import_sdk_core4.verifyOwnerNodeBinding)({
+    await (0, import_sdk_core6.verifyOwnerNodeBinding)({
       registryUrl: options.registryOrigin,
       ownerDid: envelope.policy.ownerDid,
       nodeOrigin: envelope.target.origin,
@@ -675,7 +852,7 @@ async function openVerifiedAgentShare(pending, result, requirement, options) {
   }
   let admitted;
   try {
-    admitted = await (0, import_sdk_core4.admitPolicyCredentialV4)({
+    admitted = await (0, import_sdk_core6.admitPolicyCredentialV4)({
       policy: envelope.policy,
       policyCid: envelope.policyCid,
       policyRootCid: envelope.policyRoot.cid,
@@ -729,7 +906,7 @@ function requirementFor(envelope) {
     throw new import_share_sdk2.ShareReceiveError("unsupported-target", "this receive path accepts exact-email shares only");
   }
   const policy = envelope.policy;
-  return (0, import_sdk_core5.createEmailCredentialRequirement)({
+  return (0, import_sdk_core7.createEmailCredentialRequirement)({
     email: envelope.recipientMatcher.value,
     profile: policy.credentialRequirement.profile,
     credentialType: policy.credentialRequirement.credentialType
@@ -748,7 +925,7 @@ async function requestAgentShareEmailProof(link, options) {
   })).metadata;
   if (envelope === void 0) throw new import_share_sdk2.ShareReceiveError("envelope-invalid", "share envelope is invalid");
   const requirement = requirementFor(envelope);
-  if (await (0, import_sdk_core5.credentialRequirementDigest)(requirement) !== envelope.policy.credentialRequirement.requirementDigest) {
+  if (await (0, import_sdk_core7.credentialRequirementDigest)(requirement) !== envelope.policy.credentialRequirement.requirementDigest) {
     throw new import_share_sdk2.ShareReceiveError("envelope-invalid", "share credential requirement is invalid");
   }
   const proof = await requestEmailProofCode({ address: requirement.claims.email, holder: options.holder, fetch: options.fetch, signal: options.signal });
@@ -758,7 +935,7 @@ async function completeAgentShareReceive(pending, code, options) {
   const { envelope } = pending;
   active(envelope, options.now?.() ?? Date.now());
   const requirement = requirementFor(envelope);
-  if (await (0, import_sdk_core5.credentialRequirementDigest)(requirement) !== envelope.policy.credentialRequirement.requirementDigest) {
+  if (await (0, import_sdk_core7.credentialRequirementDigest)(requirement) !== envelope.policy.credentialRequirement.requirementDigest) {
     throw new import_share_sdk2.ShareReceiveError("envelope-invalid", "share credential requirement is invalid");
   }
   if (pending.proof.address !== requirement.claims.email || pending.proof.holderDid !== options.holder.did) {