@tinycloud/node-sdk 3.9.0-beta.3 → 3.9.0-beta.4

package/dist/credentials.js

@@ -1,10 +1,52 @@
 // src/credentials/interpreter.ts
 import {
-  CredentialError,
+  CredentialError as CredentialError2,
   encodeBase64Url,
   holderBindingSigningBytes,
   validateCredentialHolderBinding
 } from "@tinycloud/sdk-core";
+
+// src/credentials/held-binding.ts
+import { canonicalDigest, CredentialError } from "@tinycloud/sdk-core";
+
+// src/credentials/pins.ts
+import { ACCOUNT_HOLDER_BINDING_DOMAIN } from "@tinycloud/sdk-core";
+var EMAIL_PROOF_PINS = Object.freeze({
+  witnessOrigin: "https://witness.credentials.org",
+  issuerDid: "did:web:issuer.credentials.org",
+  issuerKid: "did:web:issuer.credentials.org#controller",
+  issuerX: "eEJI4xEobto4HtQ7Pg9R1vBOwcpfGRTlXDG5QfqLnGQ",
+  descriptorDigest: "1tg-qphmKBVtNwzVg9xyz-xxqt_xtMXAsQyXw46m8S0"
+});
+var HELD_ACCOUNT_BINDING_PINS = Object.freeze({
+  type: ACCOUNT_HOLDER_BINDING_DOMAIN,
+  protocol: "tinycloud.credentials/acquisition/v1",
+  profile: "tinycloud.email-held/v1",
+  profileVersion: 1,
+  descriptorDigest: "dc3_DuvzipXwYkTfjKqTaK1c3VS0YSPnaBsYSQriC0w",
+  issuer: EMAIL_PROOF_PINS.issuerDid,
+  issuerKid: EMAIL_PROOF_PINS.issuerKid,
+  audience: "tinycloud://credentials",
+  openerOrigin: "https://localhost",
+  completionOrigin: "https://localhost",
+  completionContext: "sdk-acquisition",
+  credentialLifetimeSeconds: 31536e3
+});
+
+// src/credentials/held-binding.ts
+var REQUEST_TTL_MS = 6e5;
+var substituted = () => new CredentialError("REQUEST_SUBSTITUTED", "Holder binding was substituted");
+async function assertHeldBinding(binding, expected) {
+  const { descriptor } = expected;
+  if (descriptor.holderBinding.alg !== "EIP191" || binding.type !== descriptor.holderBinding.domain || binding.requestId !== expected.requestId || binding.descriptorDigest !== expected.descriptorDigest || binding.requirementDigest !== expected.requirementDigest || binding.holderDid !== expected.holderDid || binding.issuer !== descriptor.issuer.did || binding.issuerKid !== descriptor.issuer.kid || binding.profile !== descriptor.profile || binding.openerOrigin !== expected.openerOrigin || binding.completionOrigin !== expected.openerOrigin || binding.audience !== HELD_ACCOUNT_BINDING_PINS.audience || binding.completionContext !== HELD_ACCOUNT_BINDING_PINS.completionContext || // The static fields, against the one frozen object the request body and the account signer also use (A2.4).
+  binding.type !== HELD_ACCOUNT_BINDING_PINS.type || binding.protocol !== HELD_ACCOUNT_BINDING_PINS.protocol || binding.profile !== HELD_ACCOUNT_BINDING_PINS.profile || binding.profileVersion !== HELD_ACCOUNT_BINDING_PINS.profileVersion || binding.descriptorDigest !== HELD_ACCOUNT_BINDING_PINS.descriptorDigest || binding.issuer !== HELD_ACCOUNT_BINDING_PINS.issuer || binding.issuerKid !== HELD_ACCOUNT_BINDING_PINS.issuerKid || binding.openerOrigin !== HELD_ACCOUNT_BINDING_PINS.openerOrigin || binding.completionOrigin !== HELD_ACCOUNT_BINDING_PINS.completionOrigin || binding.credentialLifetimeSeconds !== HELD_ACCOUNT_BINDING_PINS.credentialLifetimeSeconds) throw substituted();
+  if (expected.challengeNonce === void 0 || binding.challengeNonce !== expected.challengeNonce) throw substituted();
+  if (binding.normalizedClaimsDigest !== await canonicalDigest(expected.requirement.claims)) throw substituted();
+  const expires = Date.parse(binding.expiresAt);
+  if (expected.serverExpiresAt === void 0 || expires !== Date.parse(expected.serverExpiresAt) || Date.parse(binding.issuedAt) !== expires - REQUEST_TTL_MS) throw substituted();
+}
+
+// src/credentials/interpreter.ts
 var delay = (ms, signal) => new Promise((resolve, reject) => {
   const timer = setTimeout(resolve, ms);
   signal?.addEventListener("abort", () => {
@@ -17,18 +59,36 @@ function mailboxSubject(requirement) {
   return typeof email === "string" && email.length > 0 ? Object.freeze({ kind: "email", value: email }) : void 0;
 }
 async function interpretCredentialFlow(input) {
+  const held = input.descriptor.subjectRelationship === "account_is_subject";
+  if (held && input.allowAccountSubject !== true) throw new CredentialError2("UNSUPPORTED_PROFILE", "The held credential profile requires an explicit opt-in");
   const steps = new Map(input.descriptor.steps.map((step) => [step.type, step]));
   const completed = /* @__PURE__ */ new Set();
   let lastTransition = "";
+  const checkBinding = async (value) => {
+    const binding = validateCredentialHolderBinding(value);
+    if (binding.requestId !== input.requestId || binding.descriptorDigest !== input.descriptorDigest || binding.requirementDigest !== input.requirementDigest || binding.holderDid !== input.holderDid || binding.issuer !== input.descriptor.issuer.did || binding.issuerKid !== input.descriptor.issuer.kid || binding.profile !== input.descriptor.profile || binding.openerOrigin !== input.openerOrigin || binding.completionOrigin !== input.openerOrigin || binding.audience !== "tinycloud://credentials") throw new CredentialError2("REQUEST_SUBSTITUTED", "Holder binding was substituted");
+    const alg = input.descriptor.holderBinding.alg;
+    if (binding.type !== input.descriptor.holderBinding.domain || alg === "EIP191" && !input.transport.challengeNonce) throw new CredentialError2("REQUEST_SUBSTITUTED", "Holder binding was substituted");
+    if (alg === "EIP191") await assertHeldBinding(binding, { descriptor: input.descriptor, requirement: input.requirement, requestId: input.requestId, descriptorDigest: input.descriptorDigest, requirementDigest: input.requirementDigest, holderDid: input.holderDid, openerOrigin: input.openerOrigin, challengeNonce: input.transport.challengeNonce(input.requestId), serverExpiresAt: input.expiresAt });
+    return binding;
+  };
+  const ensureHeldBinding = async () => {
+    if (!held || input.transport.signedBinding?.(input.requestId) !== void 0) return;
+    await checkBinding(await input.transport.holderBinding(input.requestId, input.verifier, input.signal));
+  };
   for (; ; ) {
     input.signal?.throwIfAborted();
     const state = await input.transport.state(input.requestId, input.verifier, input.signal);
-    if (state.requestId !== input.requestId) throw new CredentialError("REQUEST_SUBSTITUTED", "Credential request identity changed");
-    if (state.state === "expired") throw new CredentialError("REQUEST_EXPIRED", "Credential request expired", { state: state.state, correlationId: state.correlationId });
-    if (state.state === "canceled") throw new CredentialError("CANCELED", "Credential request was canceled", { state: state.state, correlationId: state.correlationId });
-    if (state.state === "issuer_unready") throw new CredentialError("ISSUER_UNREADY", "Credential issuer is not ready", { retryAfterMs: state.retryAfterMs, state: state.state, correlationId: state.correlationId });
-    if (state.state === "complete") return;
+    if (state.requestId !== input.requestId) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential request identity changed");
+    if (state.state === "expired") throw new CredentialError2("REQUEST_EXPIRED", "Credential request expired", { state: state.state, correlationId: state.correlationId });
+    if (state.state === "canceled") throw new CredentialError2("CANCELED", "Credential request was canceled", { state: state.state, correlationId: state.correlationId });
+    if (state.state === "issuer_unready") throw new CredentialError2("ISSUER_UNREADY", "Credential issuer is not ready", { retryAfterMs: state.retryAfterMs, state: state.state, correlationId: state.correlationId });
+    if (state.state === "complete") {
+      await ensureHeldBinding();
+      return;
+    }
     if (state.state === "ready_to_issue" || state.state === "issued") {
+      await ensureHeldBinding();
       if (state.state === "ready_to_issue" && !completed.has("issue")) {
         await input.transport.issue(input.requestId, input.verifier, input.signal);
         completed.add("issue");
@@ -41,7 +101,7 @@ async function interpretCredentialFlow(input) {
       continue;
     }
     const declared = steps.get(next.type);
-    if (next.id !== next.type || !declared || declared.type !== next.type || declared.version !== next.version) throw new CredentialError("REQUEST_SUBSTITUTED", "Server selected an undeclared credential step");
+    if (next.id !== next.type || !declared || declared.type !== next.type || declared.version !== next.version) throw new CredentialError2("REQUEST_SUBSTITUTED", "Server selected an undeclared credential step");
     if (completed.has(next.id) || state.transitionId === lastTransition) {
       await (input.onWait?.() ?? delay(state.retryAfterMs ?? 50, input.signal));
       continue;
@@ -49,21 +109,22 @@ async function interpretCredentialFlow(input) {
     lastTransition = state.transitionId;
     if (next.type === "holder_signature") {
       input.onProgress?.({ state: "signing", stepId: next.id, correlationId: state.correlationId });
-      const binding = validateCredentialHolderBinding(await input.transport.holderBinding(input.requestId, input.verifier, input.signal));
-      if (binding.requestId !== input.requestId || binding.descriptorDigest !== input.descriptorDigest || binding.requirementDigest !== input.requirementDigest || binding.holderDid !== input.holderDid || binding.issuer !== input.descriptor.issuer.did || binding.issuerKid !== input.descriptor.issuer.kid || binding.profile !== input.descriptor.profile || binding.openerOrigin !== input.openerOrigin || binding.completionOrigin !== input.openerOrigin || binding.audience !== "tinycloud://credentials") throw new CredentialError("REQUEST_SUBSTITUTED", "Holder binding was substituted");
+      const binding = await checkBinding(await input.transport.holderBinding(input.requestId, input.verifier, input.signal));
+      const alg = input.descriptor.holderBinding.alg;
+      if (alg === "EIP191" !== (input.signing.holderKey?.alg === "EIP191")) throw new CredentialError2("REQUEST_SUBSTITUTED", "Holder binding was substituted");
       const bytes = holderBindingSigningBytes(binding);
       let signature = await input.signing.autoSign?.(binding, bytes, input.signal);
       if (signature === void 0) {
-        if (!input.signing.requestApproval) throw new CredentialError("SIGNATURE_REJECTED", "OpenKey approval is required");
+        if (!input.signing.requestApproval) throw new CredentialError2("SIGNATURE_REJECTED", "OpenKey approval is required");
         try {
           signature = await input.signing.requestApproval(binding, bytes, input.signal);
         } catch (cause) {
-          if (cause instanceof CredentialError) throw cause;
-          throw new CredentialError("SIGNATURE_REJECTED", "OpenKey approval was rejected", { cause });
+          if (cause instanceof CredentialError2) throw cause;
+          throw new CredentialError2("SIGNATURE_REJECTED", "OpenKey approval was rejected", { cause });
         }
       }
-      if (!(signature instanceof Uint8Array) || signature.length === 0) throw new CredentialError("SIGNATURE_REJECTED", "OpenKey signature is invalid");
-      await input.transport.submitHolderSignature(input.requestId, input.verifier, encodeBase64Url(signature), input.signal, input.signing.holderKey);
+      if (!(signature instanceof Uint8Array) || signature.length === 0) throw new CredentialError2("SIGNATURE_REJECTED", "OpenKey signature is invalid");
+      await input.transport.submitHolderSignature(input.requestId, input.verifier, alg === "EIP191" ? `0x${Array.from(signature, (byte) => byte.toString(16).padStart(2, "0")).join("")}` : encodeBase64Url(signature), input.signal, input.signing.holderKey);
     } else {
       input.onProgress?.({ state: next.type === "collect_input" ? "collecting" : "proving", stepId: next.id, correlationId: state.correlationId });
       const handler = input.handlers?.[next.type];
@@ -97,9 +158,9 @@ async function interpretCredentialFlow(input) {
             await input.transport.submitStep(input.requestId, input.verifier, next.id, proof, input.signal);
             break;
           } catch (cause) {
-            if (!(cause instanceof CredentialError) || cause.code !== "PROOF_REJECTED") throw cause;
+            if (!(cause instanceof CredentialError2) || cause.code !== "PROOF_REJECTED") throw cause;
             const attemptsRemaining = input.descriptor.lifecycle.maxProofAttempts - attempt;
-            if (next.type !== "mailbox_otp" || attemptsRemaining <= 0) throw new CredentialError("VERIFICATION_FAILED", "The proof was not accepted", { state: attemptsRemaining <= 0 ? "proof_attempts_exhausted" : "proof_rejected", cause });
+            if (next.type !== "mailbox_otp" || attemptsRemaining <= 0) throw new CredentialError2("VERIFICATION_FAILED", "The proof was not accepted", { state: attemptsRemaining <= 0 ? "proof_attempts_exhausted" : "proof_rejected", cause });
             feedback = { kind: "rejected", attemptsRemaining };
           }
         }
@@ -111,8 +172,8 @@ async function interpretCredentialFlow(input) {
 
 // src/credentials/transport.ts
 import {
-  CredentialError as CredentialError2,
-  canonicalDigest,
+  CredentialError as CredentialError3,
+  canonicalDigest as canonicalDigest2,
   credentialEndpointPath,
   decodeBase64Url,
   encodeBase64Url as encodeBase64Url2,
@@ -121,25 +182,25 @@ import {
   validateCredentialHolderBinding as validateCredentialHolderBinding2
 } from "@tinycloud/sdk-core";
 function object(value, label) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CredentialError2("VERIFICATION_FAILED", `${label} is invalid`);
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CredentialError3("VERIFICATION_FAILED", `${label} is invalid`);
   return value;
 }
 function opaque(value, label) {
-  if (typeof value !== "string" || !/^[A-Za-z0-9_-]{16,128}$/.test(value)) throw new CredentialError2("REQUEST_SUBSTITUTED", `${label} is invalid`);
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]{16,128}$/.test(value)) throw new CredentialError3("REQUEST_SUBSTITUTED", `${label} is invalid`);
   return value;
 }
 function timestamp(value, label) {
-  if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) throw new CredentialError2("VERIFICATION_FAILED", `${label} is invalid`);
+  if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) throw new CredentialError3("VERIFICATION_FAILED", `${label} is invalid`);
   return new Date(value).toISOString();
 }
 function jwtPayload(credential) {
   const part = credential.split("~", 1)[0]?.split(".")[1];
-  if (!part) throw new CredentialError2("VERIFICATION_FAILED", "Issued SD-JWT is invalid");
+  if (!part) throw new CredentialError3("VERIFICATION_FAILED", "Issued SD-JWT is invalid");
   try {
     return object(JSON.parse(new TextDecoder().decode(decodeBase64Url(part))), "SD-JWT payload");
   } catch (cause) {
-    if (cause instanceof CredentialError2) throw cause;
-    throw new CredentialError2("VERIFICATION_FAILED", "Issued SD-JWT is invalid", { cause });
+    if (cause instanceof CredentialError3) throw cause;
+    throw new CredentialError3("VERIFICATION_FAILED", "Issued SD-JWT is invalid", { cause });
   }
 }
 var SERVER_CODES = /* @__PURE__ */ new Set(["REQUEST_EXPIRED", "ISSUER_UNREADY", "UNSUPPORTED_PROFILE", "UNSUPPORTED_VERSION", "SIGNATURE_REJECTED"]);
@@ -148,12 +209,13 @@ function serverError(value, response, honorServerRecoverable) {
   const body = value;
   const keys = Object.keys(body).sort();
   if (keys.join(",") !== "code,correlationId,recoverable,state,type" || body.type !== "tinycloud.credentials/error/v1" || typeof body.code !== "string" || typeof body.recoverable !== "boolean" || typeof body.state !== "string" || typeof body.correlationId !== "string") return void 0;
-  if (body.code === "PROOF_REJECTED") return body.recoverable ? new CredentialError2("PROOF_REJECTED", "The proof was not accepted", { state: body.state, correlationId: body.correlationId }) : new CredentialError2("VERIFICATION_FAILED", "The proof attempt limit was reached", { state: "proof_attempts_exhausted", correlationId: body.correlationId });
-  if (body.code === "RATE_LIMITED") return new CredentialError2("ISSUER_UNREADY", "Too many verification codes were requested", { state: "rate_limited", correlationId: body.correlationId, retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0, recoverable: honorServerRecoverable ? body.recoverable : void 0 });
-  if (body.code === "CHALLENGE_EXPIRED") return new CredentialError2("REQUEST_EXPIRED", "The credential challenge expired", { state: body.state, correlationId: body.correlationId, recoverable: honorServerRecoverable ? body.recoverable : void 0 });
+  if (body.code === "PROOF_REJECTED") return body.recoverable ? new CredentialError3("PROOF_REJECTED", "The proof was not accepted", { state: body.state, correlationId: body.correlationId }) : new CredentialError3("VERIFICATION_FAILED", "The proof attempt limit was reached", { state: "proof_attempts_exhausted", correlationId: body.correlationId });
+  if (body.code === "RATE_LIMITED") return new CredentialError3("ISSUER_UNREADY", "Too many verification codes were requested", { state: "rate_limited", correlationId: body.correlationId, retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0, recoverable: honorServerRecoverable ? body.recoverable : void 0 });
+  if (body.code === "CHALLENGE_EXPIRED") return new CredentialError3("REQUEST_EXPIRED", "The credential challenge expired", { state: body.state, correlationId: body.correlationId, recoverable: honorServerRecoverable ? body.recoverable : void 0 });
+  if (body.code === "DESCRIPTOR_MISMATCH") body.code = "UNSUPPORTED_PROFILE";
   if (!SERVER_CODES.has(body.code)) return void 0;
   const code = body.code;
-  return new CredentialError2(code, `OpenCredentials rejected the request: ${code}`, {
+  return new CredentialError3(code, `OpenCredentials rejected the request: ${code}`, {
     state: body.state,
     correlationId: body.correlationId,
     retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0,
@@ -161,12 +223,17 @@ function serverError(value, response, honorServerRecoverable) {
   });
 }
 var OpenCredentialsHttpTransport = class {
+  /**
+   * `allowAccountSubject` is passed only by the email-proof functions, after the per-call held opt-in was accepted. Without it an account-bound
+   * (held) descriptor is refused here, before any request (TC-2254 A2.5).
+   */
   constructor(descriptor, fetchFn = globalThis.fetch.bind(globalThis), options = {}) {
     this.descriptor = descriptor;
     this.fetchFn = fetchFn;
     this.options = options;
     this.nonces = /* @__PURE__ */ new Map();
     this.bindings = /* @__PURE__ */ new Map();
+    if (descriptor.subjectRelationship === "account_is_subject" && options.allowAccountSubject !== true) throw new CredentialError3("UNSUPPORTED_PROFILE", "The held credential profile requires an explicit opt-in");
   }
   url(endpoint, id) {
     return new URL(credentialEndpointPath(endpoint, id), this.descriptor.issuer.origin).href;
@@ -177,8 +244,8 @@ var OpenCredentialsHttpTransport = class {
       const init = { method: input.method ?? "GET", credentials: "omit", cache: "no-store", redirect: "error", referrerPolicy: "no-referrer", signal: input.signal, headers: { accept: "application/json", ...input.body === void 0 ? {} : { "content-type": "application/json" }, ...input.verifier === void 0 ? {} : { authorization: `Bearer ${input.verifier}` } }, ...input.body === void 0 ? {} : { body: JSON.stringify(input.body) } };
       response = await this.fetchFn(this.url(endpoint, input.id), init);
     } catch (cause) {
-      if (cause instanceof DOMException && cause.name === "AbortError") throw new CredentialError2("CANCELED", "Credential acquisition was canceled", { cause });
-      throw new CredentialError2("OFFLINE", "OpenCredentials is unavailable", { cause });
+      if (cause instanceof DOMException && cause.name === "AbortError") throw new CredentialError3("CANCELED", "Credential acquisition was canceled", { cause });
+      throw new CredentialError3("OFFLINE", "OpenCredentials is unavailable", { cause });
     }
     if (!response.ok) {
       let parsed;
@@ -189,95 +256,112 @@ var OpenCredentialsHttpTransport = class {
       }
       const typed = serverError(parsed, response, this.options.honorServerRecoverable === true);
       if (typed) throw typed;
-      if (response.status === 410) throw new CredentialError2("REQUEST_EXPIRED", "Credential request expired");
-      if (response.status === 409) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential request was replayed or substituted");
-      if (response.status === 503) throw new CredentialError2("ISSUER_UNREADY", "Credential issuer is not ready", { retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0 });
-      throw new CredentialError2("VERIFICATION_FAILED", "OpenCredentials rejected the request");
+      if (response.status === 410) throw new CredentialError3("REQUEST_EXPIRED", "Credential request expired");
+      if (response.status === 409) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential request was replayed or substituted");
+      if (response.status === 503) throw new CredentialError3("ISSUER_UNREADY", "Credential issuer is not ready", { retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0 });
+      throw new CredentialError3("VERIFICATION_FAILED", "OpenCredentials rejected the request");
     }
     if (response.status === 204) return void 0;
     try {
       return await response.json();
     } catch (cause) {
-      throw new CredentialError2("VERIFICATION_FAILED", "OpenCredentials response is invalid", { cause });
+      throw new CredentialError3("VERIFICATION_FAILED", "OpenCredentials response is invalid", { cause });
     }
   }
   async create(input) {
-    const body = object(await this.request("request", { method: "POST", body: { protocol: input.descriptor.protocol, profile: input.descriptor.profile, profileVersion: input.descriptor.profileVersion, descriptorDigest: input.descriptorDigest, requirementDigest: input.requirementDigest, holderDid: input.holderDid, inputs: input.inputs ?? input.requirement.claims, audience: "tinycloud://credentials", openerOrigin: input.openerOrigin, completionOrigin: input.openerOrigin, completionContext: "sdk-acquisition", completionVerifierChallenge: input.completionVerifierChallenge }, signal: input.signal }), "create response");
-    if (body.type !== "tinycloud.credentials/acquisition-request/v1" || body.protocol !== input.descriptor.protocol || body.next !== "challenge" || body.endpoint !== "challenge") throw new CredentialError2("VERIFICATION_FAILED", "create response is invalid");
+    const body = object(await this.request("request", { method: "POST", body: { protocol: input.descriptor.protocol, profile: input.descriptor.profile, profileVersion: input.descriptor.profileVersion, descriptorDigest: input.descriptorDigest, requirementDigest: input.requirementDigest, holderDid: input.holderDid, inputs: input.inputs ?? input.requirement.claims, audience: HELD_ACCOUNT_BINDING_PINS.audience, openerOrigin: input.openerOrigin, completionOrigin: input.openerOrigin, completionContext: HELD_ACCOUNT_BINDING_PINS.completionContext, completionVerifierChallenge: input.completionVerifierChallenge }, signal: input.signal }), "create response");
+    if (body.type !== "tinycloud.credentials/acquisition-request/v1" || body.protocol !== input.descriptor.protocol || body.next !== "challenge" || body.endpoint !== "challenge") throw new CredentialError3("VERIFICATION_FAILED", "create response is invalid");
     const requestId = opaque(body.requestId, "requestId");
     return { requestId, locator: requestId, expiresAt: timestamp(body.expiresAt, "expiresAt"), correlationId: requestId };
   }
+  /** The nonce stored from R3 or R2 for this request. Held acquisition compares the signed binding with it. */
+  challengeNonce(id) {
+    return this.nonces.get(id);
+  }
+  /** The binding fetched and validated for this request, as the account signed it. */
+  signedBinding(id) {
+    return this.bindings.get(id);
+  }
   proofStep() {
     return this.descriptor.steps.some((step) => step.type === "mailbox_otp") ? "mailbox_otp" : "collect_input";
   }
   async state(id, verifier, signal) {
     const raw = object(await this.request("state", { id, verifier, signal }), "state response");
-    if (raw.type !== "tinycloud.credentials/acquisition-state/v1" || raw.requestId !== id || raw.profile !== this.descriptor.profile || raw.profileVersion !== 1) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential state response is substituted");
+    if (raw.type !== "tinycloud.credentials/acquisition-state/v1" || raw.requestId !== id || raw.profile !== this.descriptor.profile || raw.profileVersion !== 1) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential state response is substituted");
     const base = { type: "OpenCredentialsAcquisitionState", version: 1, requestId: id, transitionId: `${String(raw.state)}:${String(raw.resultPreviouslyRead ?? false)}`, correlationId: id };
     if (raw.state === "challenge_required") {
       const type = this.proofStep();
       return { ...base, state: "pending", nextStep: { id: type, type, version: 1, constraints: { challengeRequired: true } } };
     }
+    if (this.descriptor.subjectRelationship === "account_is_subject" && (raw.state === "proof_required" || raw.state === "holder_binding_required" || raw.state === "holder_signature_required" || raw.state === "ready_to_issue" || raw.state === "issued")) {
+      const nonce = raw.challengeNonce;
+      const prior = this.nonces.get(id);
+      if (typeof nonce !== "string" || nonce === "" || prior !== void 0 && prior !== nonce) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential challenge nonce is missing or changed");
+      this.nonces.set(id, opaque(nonce, "challengeNonce"));
+    }
     if (raw.state === "proof_required") {
       const type = this.proofStep();
-      this.nonces.set(id, opaque(raw.challengeNonce, "challengeNonce"));
+      if (this.descriptor.subjectRelationship !== "account_is_subject") this.nonces.set(id, opaque(raw.challengeNonce, "challengeNonce"));
       return { ...base, state: "pending", nextStep: { id: type, type, version: 1, constraints: {} } };
     }
     if (raw.state === "holder_binding_required" || raw.state === "holder_signature_required") return { ...base, state: "pending", nextStep: { id: "holder_signature", type: "holder_signature", version: 1, constraints: {} } };
     if (raw.state === "ready_to_issue") return { ...base, state: "ready_to_issue" };
     if (raw.state === "issued") return { ...base, state: "complete" };
-    throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential state is unsupported");
+    throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential state is unsupported");
   }
   async beginStep(id, verifier, stepId, signal) {
     const step = this.proofStep();
-    if (stepId !== step) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential challenge step is substituted");
+    if (stepId !== step) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential challenge step is substituted");
     const challenge = object(await this.request("challenge", { id, verifier, method: "POST", body: { step, stepVersion: 1 }, signal }), "challenge response");
-    if (challenge.type !== "tinycloud.credentials/challenge/v1" || challenge.step !== step || challenge.stepVersion !== 1) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential challenge is substituted");
+    if (challenge.type !== "tinycloud.credentials/challenge/v1" || challenge.step !== step || challenge.stepVersion !== 1) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential challenge is substituted");
     this.nonces.set(id, opaque(challenge.challengeNonce, "challengeNonce"));
   }
   async submitStep(id, verifier, stepId, proof, signal) {
     const step = this.proofStep();
-    if (stepId !== step) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential proof step is substituted");
+    if (stepId !== step) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential proof step is substituted");
     const nonce = this.nonces.get(id);
-    if (!nonce) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential challenge is missing");
+    if (!nonce) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential challenge is missing");
     await this.request("proof", { id, verifier, method: "POST", body: { step, stepVersion: 1, challengeNonce: nonce, proof }, signal });
   }
   async holderBinding(id, verifier, signal) {
     const raw = object(await this.request("holder_binding", { id, verifier, signal }), "holder binding response");
-    if (raw.type !== "tinycloud.credentials/holder-binding-request/v1" || raw.signingDomain !== "tinycloud.credentials/holder-binding/v1" || raw.alg !== "EdDSA" || typeof raw.canonical !== "string") throw new CredentialError2("REQUEST_SUBSTITUTED", "Holder binding response is invalid");
+    if (raw.type !== "tinycloud.credentials/holder-binding-request/v1" || raw.signingDomain !== this.descriptor.holderBinding.domain || raw.alg !== this.descriptor.holderBinding.alg || typeof raw.canonical !== "string") throw new CredentialError3("REQUEST_SUBSTITUTED", "Holder binding response is invalid");
     const binding = validateCredentialHolderBinding2(raw.binding);
-    if (encodeBase64Url2(holderBindingCanonicalBytes(binding)) !== raw.canonical) throw new CredentialError2("REQUEST_SUBSTITUTED", "Holder binding canonical bytes were substituted");
+    if (binding.type !== raw.signingDomain) throw new CredentialError3("REQUEST_SUBSTITUTED", "Holder binding type does not match its signing domain");
+    if (encodeBase64Url2(holderBindingCanonicalBytes(binding)) !== raw.canonical) throw new CredentialError3("REQUEST_SUBSTITUTED", "Holder binding canonical bytes were substituted");
     this.bindings.set(id, binding);
     return binding;
   }
   async submitHolderSignature(id, verifier, signature, signal, key) {
     const binding = this.bindings.get(id);
-    if (!binding) throw new CredentialError2("REQUEST_SUBSTITUTED", "Holder binding was not retrieved");
+    if (!binding) throw new CredentialError3("REQUEST_SUBSTITUTED", "Holder binding was not retrieved");
+    if (this.descriptor.holderBinding.alg === "EIP191" && !key) throw new CredentialError3("REQUEST_SUBSTITUTED", "An account holder must name its key and algorithm");
+    const alg = key?.alg ?? "EdDSA";
     const kid = key?.kid ?? `${binding.holderDid}#${binding.holderDid.replace("did:key:", "")}`;
-    await this.request("holder_signature", { id, verifier, method: "POST", body: { alg: key?.alg ?? "EdDSA", kid, signature }, signal });
+    await this.request("holder_signature", { id, verifier, method: "POST", body: { alg, kid, signature }, signal });
   }
   async issue(id, verifier, signal) {
     await this.request("issue", { id, verifier, method: "POST", signal });
   }
   async result(id, verifier, signal) {
     const raw = object(await this.request("result", { id, verifier, signal }), "result response");
-    if (raw.type !== "tinycloud.credentials/result/v1" || raw.protocol !== this.descriptor.protocol || raw.profile !== this.descriptor.profile || raw.profileVersion !== 1 || raw.format !== "vc+sd-jwt" || raw.descriptorDigest !== await canonicalDigest(this.descriptor) || raw.issuer !== this.descriptor.issuer.did || raw.issuerKid !== this.descriptor.issuer.kid || typeof raw.credential !== "string" || await sha256Base64Url(raw.credential) !== raw.credentialDigest) throw new CredentialError2("VERIFICATION_FAILED", "Issued result metadata is invalid");
+    if (raw.type !== "tinycloud.credentials/result/v1" || raw.protocol !== this.descriptor.protocol || raw.profile !== this.descriptor.profile || raw.profileVersion !== 1 || raw.format !== "vc+sd-jwt" || raw.descriptorDigest !== await canonicalDigest2(this.descriptor) || raw.issuer !== this.descriptor.issuer.did || raw.issuerKid !== this.descriptor.issuer.kid || typeof raw.credential !== "string" || await sha256Base64Url(raw.credential) !== raw.credentialDigest) throw new CredentialError3("VERIFICATION_FAILED", "Issued result metadata is invalid");
     const holder = object(raw.holderBinding, "result holder binding");
-    if (raw.subject !== holder.did || holder.signingDomain !== "tinycloud.credentials/holder-binding/v1") throw new CredentialError2("HOLDER_MISMATCH", "Issued holder binding is invalid");
+    if (raw.subject !== holder.did || holder.signingDomain !== this.descriptor.holderBinding.domain) throw new CredentialError3("HOLDER_MISMATCH", "Issued holder binding is invalid");
     const claimsRaw = object(raw.claims, "result claims");
     const claims = {};
     for (const [name, value] of Object.entries(claimsRaw)) {
-      if (typeof value !== "string") throw new CredentialError2("VERIFICATION_FAILED", "Issued claims are invalid");
+      if (typeof value !== "string") throw new CredentialError3("VERIFICATION_FAILED", "Issued claims are invalid");
       claims[name] = value;
     }
     const validity = object(raw.validity, "result validity");
     const payload = jwtPayload(raw.credential);
-    if (typeof payload.jti !== "string") throw new CredentialError2("VERIFICATION_FAILED", "Credential id is invalid");
+    if (typeof payload.jti !== "string") throw new CredentialError3("VERIFICATION_FAILED", "Credential id is invalid");
     const issuedAt = timestamp(validity.issuedAt, "issuedAt");
     const expiresAt = timestamp(validity.expiresAt, "expiresAt");
     const status = object(raw.status, "result status");
-    if (status.type !== "none" || status.freshnessSeconds !== this.descriptor.status.freshnessSeconds) throw new CredentialError2("VERIFICATION_FAILED", "Credential status is invalid");
-    return { type: "OpenCredentialsIssuedCredential", version: 1, protocol: this.descriptor.protocol, profile: { id: this.descriptor.profile, version: 1 }, credentialType: { id: this.descriptor.format.vct, version: 1 }, schema: this.descriptor.format.vct, format: "vc+sd-jwt", issuerDid: raw.issuer, issuerKid: raw.issuerKid, subjectDid: raw.subject, holderDid: raw.subject, claims, claimsDigest: await canonicalDigest(claims), descriptorDigest: raw.descriptorDigest, credentialId: payload.jti, issuedAt, notBefore: issuedAt, expiresAt, status: { method: "none", freshnessSeconds: status.freshnessSeconds }, credential: raw.credential };
+    if (status.type !== "none" || status.freshnessSeconds !== this.descriptor.status.freshnessSeconds) throw new CredentialError3("VERIFICATION_FAILED", "Credential status is invalid");
+    return { type: "OpenCredentialsIssuedCredential", version: 1, protocol: this.descriptor.protocol, profile: { id: this.descriptor.profile, version: 1 }, credentialType: { id: this.descriptor.format.vct, version: 1 }, schema: this.descriptor.format.vct, format: "vc+sd-jwt", issuerDid: raw.issuer, issuerKid: raw.issuerKid, subjectDid: raw.subject, holderDid: raw.subject, claims, claimsDigest: await canonicalDigest2(claims), descriptorDigest: raw.descriptorDigest, credentialId: payload.jti, issuedAt, notBefore: issuedAt, expiresAt, status: { method: "none", freshnessSeconds: status.freshnessSeconds }, credential: raw.credential };
   }
   async issuerMetadata(signal) {
     return await this.request("issuer_metadata", { signal });
@@ -289,24 +373,19 @@ var OpenCredentialsHttpTransport = class {
 
 // src/credentials/email-proof.ts
 import {
-  canonicalDigest as canonicalDigest2,
+  canonicalDigest as canonicalDigest3,
   createEmailCredentialRequirement,
   credentialError,
   credentialRequirementDigest,
-  CredentialError as CredentialError3,
+  CredentialError as CredentialError4,
   descriptorSatisfiesRequirement,
   encodeBase64Url as encodeBase64Url3,
   sha256Base64Url as sha256Base64Url2,
   validateCredentialFlowDescriptor,
+  validateCredentialRequirement,
   verifyIssuedCredential
 } from "@tinycloud/sdk-core";
-var EMAIL_PROOF_PINS = Object.freeze({
-  witnessOrigin: "https://witness.credentials.org",
-  issuerDid: "did:web:issuer.credentials.org",
-  issuerKid: "did:web:issuer.credentials.org#controller",
-  issuerX: "eEJI4xEobto4HtQ7Pg9R1vBOwcpfGRTlXDG5QfqLnGQ",
-  descriptorDigest: "1tg-qphmKBVtNwzVg9xyz-xxqt_xtMXAsQyXw46m8S0"
-});
+import { parseIssuerSet, parsePkhDid, toChecksumAddress, verifyHeldEmailCredential } from "@tinycloud/sdk-core/held-credentials";
 var EMAIL_PROOF_CREDENTIAL_TYPE = { id: "opencredentials.email/v1", version: 1 };
 var EMAIL_PROOF_PENDING_MAX_MS = 15 * 6e4;
 var DISCOVERY_URL = `${EMAIL_PROOF_PINS.witnessOrigin}/.well-known/opencredentials`;
@@ -322,10 +401,16 @@ var EMAIL_PROOF_ISSUER_KEYS = [
 var DEFAULT_EMAIL_PROOF_PROFILE = "tinycloud.email-proof/v1";
 var PROFILE_PINS = {
   "tinycloud.email-proof/v1": { descriptorDigest: EMAIL_PROOF_PINS.descriptorDigest, requiredStep: "mailbox_otp", enabled: true },
-  // Held profile: disabled until the held wire path ships. Requests refuse with PROFILE_UNAVAILABLE before any network call.
-  "tinycloud.email-held/v1": { descriptorDigest: "dc3_DuvzipXwYkTfjKqTaK1c3VS0YSPnaBsYSQriC0w", requiredStep: "mailbox_otp", enabled: false }
+  // Held profile: disabled by default. A call enables it only with the per-call opt-in `allowHeldProfile: true` (see `profilePin`).
+  // Without it, requests refuse with PROFILE_UNAVAILABLE before any network call.
+  "tinycloud.email-held/v1": { descriptorDigest: HELD_ACCOUNT_BINDING_PINS.descriptorDigest, requiredStep: "mailbox_otp", enabled: false }
 };
-var OPENER_ORIGIN = "https://localhost";
+var OPENER_ORIGIN = HELD_ACCOUNT_BINDING_PINS.openerOrigin;
+var HELD_PROFILE = "tinycloud.email-held/v1";
+var HELD_KID_FRAGMENT = "blockchainAccountId";
+var HELD_MAX_AGE_SECONDS = 31536e3;
+var HELD_REQUEST_TTL_MS = 6e5;
+var CLOCK_SKEW_BOUND_MS = 3e5;
 var STEP_TIMEOUT_MS = 6e4;
 var HOLDER_DID_PREFIX = "did:key:";
 var HOLDER_DID_PATTERN = /^did:key:z6Mk[^#]+$/;
@@ -345,6 +430,7 @@ var RECOVERABILITY = {
   CREDENTIAL_INVALID: false,
   SESSION_EXPIRED: false,
   SESSION_INVALID: false,
+  CLIENT_CLOCK_SKEW: false,
   CANCELED: false,
   FAILED: false
 };
@@ -361,6 +447,7 @@ var MESSAGES = {
   CREDENTIAL_INVALID: "Issued credential failed verification.",
   SESSION_EXPIRED: "Email verification request expired. Request a new code.",
   SESSION_INVALID: "Email verification request is no longer valid. Request a new code.",
+  CLIENT_CLOCK_SKEW: "Your device clock is more than 5 minutes behind. Correct it and try again.",
   CANCELED: "Email verification was canceled.",
   FAILED: "Email verification failed."
 };
@@ -399,7 +486,8 @@ function restoreEmailProofPending(fields) {
     requirementDigest: fields.requirementDigest,
     openerOrigin: fields.openerOrigin,
     createdAt: fields.createdAt,
-    expiresAt: fields.expiresAt
+    expiresAt: fields.expiresAt,
+    ...fields.serverExpiresAt === void 0 ? {} : { serverExpiresAt: fields.serverExpiresAt }
   };
   const pending = { ...shown };
   hide(pending, "verifier", fields.verifier);
@@ -439,6 +527,9 @@ function createMemoryEmailProofPendingStore() {
     }
   };
 }
+function isTicketEmailProofResult(result) {
+  return result.envelope.profile.id !== HELD_PROFILE;
+}
 var CodeRequested = class extends Error {
 };
 var pauseForCode = async () => {
@@ -446,17 +537,19 @@ var pauseForCode = async () => {
 };
 async function requestEmailProofCode(input) {
   const profile = input.profile ?? DEFAULT_EMAIL_PROOF_PROFILE;
-  profilePin(profile, "request");
-  const address = normalizeAddress(input.address);
-  assertHolder(input.holder, "request");
+  profilePin(profile, "request", input.allowHeldProfile);
+  const held = profile === HELD_PROFILE;
+  if (held) assertHolder(input.holder, "request", profile);
+  const address = normalizeAddress(input.address, profile);
+  if (!held) assertHolder(input.holder, "request", profile);
   const now = input.now ?? (() => /* @__PURE__ */ new Date());
   const signal = input.signal ?? AbortSignal.timeout(STEP_TIMEOUT_MS);
   const requirement = emailRequirement(address, profile);
   const requirementDigest = await credentialRequirementDigest(requirement);
-  const descriptor = await witnessDescriptor(profile, requirement, { fetch: input.fetch, signal }, "request");
-  const descriptorDigest = await canonicalDigest2(descriptor);
+  const descriptor = await witnessDescriptor(profile, requirement, { fetch: input.fetch, signal }, "request", input.allowHeldProfile);
+  const descriptorDigest = await canonicalDigest3(descriptor);
   const verifier = randomVerifier();
-  const transport = new OpenCredentialsHttpTransport(descriptor, input.fetch, { honorServerRecoverable: true });
+  const transport = new OpenCredentialsHttpTransport(descriptor, input.fetch, { honorServerRecoverable: true, ...held ? { allowAccountSubject: true } : {} });
   const createdAtMs = now().getTime();
   let created;
   try {
@@ -475,6 +568,8 @@ async function requestEmailProofCode(input) {
   }
   const serverExpiry = Date.parse(created.expiresAt);
   if (!Number.isFinite(serverExpiry)) throw new EmailProofError("request", "FAILED");
+  const serverNowMs = serverExpiry - HELD_REQUEST_TTL_MS;
+  if (held && serverNowMs - now().getTime() > CLOCK_SKEW_BOUND_MS) throw new EmailProofError("request", "CLIENT_CLOCK_SKEW");
   const pending = restoreEmailProofPending({
     type: "TinyCloudEmailProofPending",
     version: 1,
@@ -487,11 +582,14 @@ async function requestEmailProofCode(input) {
     requirementDigest,
     openerOrigin: OPENER_ORIGIN,
     createdAt: new Date(createdAtMs).toISOString(),
-    expiresAt: new Date(Math.min(serverExpiry, createdAtMs + EMAIL_PROOF_PENDING_MAX_MS)).toISOString()
+    // Held: the deadline is measured on the client clock (a fast client must not lose window), the witness enforces its own 600 s.
+    expiresAt: new Date(held ? createdAtMs + Math.min(serverExpiry - serverNowMs, EMAIL_PROOF_PENDING_MAX_MS) : Math.min(serverExpiry, createdAtMs + EMAIL_PROOF_PENDING_MAX_MS)).toISOString(),
+    ...held ? { serverExpiresAt: created.expiresAt } : {}
   });
   try {
     await interpretCredentialFlow({
       descriptor,
+      ...held ? { allowAccountSubject: true } : {},
       requirement,
       requestId: created.requestId,
       verifier,
@@ -499,8 +597,9 @@ async function requestEmailProofCode(input) {
       descriptorDigest,
       requirementDigest,
       openerOrigin: OPENER_ORIGIN,
+      ...held ? { expiresAt: created.expiresAt } : {},
       transport,
-      signing: holderSigning(input.holder),
+      signing: holderSigning(input.holder, held),
       handlers: { mailbox_otp: pauseForCode },
       signal
     });
@@ -517,22 +616,26 @@ async function completeWithIssuerKeys(input, issuerKeys) {
   const { pending } = input;
   const now = input.now ?? (() => /* @__PURE__ */ new Date());
   if (!isPending(pending)) throw new EmailProofError("session", "SESSION_INVALID");
+  profilePin(pending.profile, "session", input.allowHeldProfile);
+  const held = pending.profile === HELD_PROFILE;
+  if (held && !Number.isFinite(Date.parse(pending.serverExpiresAt ?? ""))) throw new EmailProofError("session", "SESSION_INVALID");
   if (pendingDeadlineMs(pending) <= now().getTime()) throw new EmailProofError("session", "SESSION_EXPIRED");
   if (!/^\d{8}$/.test(input.code)) throw new EmailProofError("code", "CODE_INVALID");
-  assertHolder(input.holder, "code");
+  assertHolder(input.holder, "code", pending.profile);
   if (input.holder.did !== pending.holderDid) throw new EmailProofError("session", "SESSION_INVALID");
   const signal = input.signal ?? AbortSignal.timeout(STEP_TIMEOUT_MS);
   const requirement = emailRequirement(pending.address, pending.profile);
   if (await credentialRequirementDigest(requirement) !== pending.requirementDigest) throw new EmailProofError("session", "SESSION_INVALID");
-  const descriptor = await witnessDescriptor(pending.profile, requirement, { fetch: input.fetch, signal }, "session");
-  const descriptorDigest = await canonicalDigest2(descriptor);
+  const descriptor = await witnessDescriptor(pending.profile, requirement, { fetch: input.fetch, signal }, "session", input.allowHeldProfile);
+  const descriptorDigest = await canonicalDigest3(descriptor);
   if (descriptorDigest !== pending.descriptorDigest) throw new EmailProofError("session", "SESSION_INVALID");
-  const transport = new OpenCredentialsHttpTransport(descriptor, input.fetch, { honorServerRecoverable: true });
+  const transport = new OpenCredentialsHttpTransport(descriptor, input.fetch, { honorServerRecoverable: true, ...held ? { allowAccountSubject: true } : {} });
   try {
     const state = await transport.state(pending.requestId, pending.verifier, signal);
     if (state.nextStep?.constraints.challengeRequired === true) throw new EmailProofError("session", "SESSION_INVALID");
     await interpretCredentialFlow({
       descriptor,
+      ...held ? { allowAccountSubject: true } : {},
       requirement,
       requestId: pending.requestId,
       verifier: pending.verifier,
@@ -540,8 +643,9 @@ async function completeWithIssuerKeys(input, issuerKeys) {
       descriptorDigest,
       requirementDigest: pending.requirementDigest,
       openerOrigin: pending.openerOrigin,
+      ...held ? { expiresAt: pending.serverExpiresAt } : {},
       transport,
-      signing: holderSigning(input.holder),
+      signing: holderSigning(input.holder, held),
       handlers: { mailbox_otp: async () => ({ otp: input.code }) },
       signal
     });
@@ -550,6 +654,10 @@ async function completeWithIssuerKeys(input, issuerKeys) {
   }
   try {
     const envelope = await transport.result(pending.requestId, pending.verifier, signal);
+    if (held) {
+      const verified2 = await verifyHeldResult({ envelope, pending, descriptor, descriptorDigest, transport, issuerKeys, now });
+      return { envelope, verified: verified2, credentialId: verified2.credentialId, issuedAt: verified2.issuedAt.toISOString(), expiresAt: verified2.expiresAt.toISOString(), descriptor };
+    }
     const verified = await verifyIssuedCredential({
       envelope,
       descriptor,
@@ -570,12 +678,17 @@ async function acquireEmailProof(input) {
   return acquireWithIssuerKeys(input, EMAIL_PROOF_ISSUER_KEYS);
 }
 async function acquireWithIssuerKeys(input, issuerKeys) {
-  const address = normalizeAddress(input.address);
+  const profile = input.profile ?? DEFAULT_EMAIL_PROOF_PROFILE;
+  profilePin(profile, "request", input.allowHeldProfile);
+  const address = normalizeAddress(input.address, profile);
   const now = input.now ?? (() => /* @__PURE__ */ new Date());
   const store = input.pendingStore;
-  const profile = input.profile ?? DEFAULT_EMAIL_PROOF_PROFILE;
   const live = store ? await store.findLive(address, now()) : void 0;
   let pending = live?.profile === profile ? live : void 0;
+  if (pending && profile === HELD_PROFILE && !Number.isFinite(Date.parse(pending.serverExpiresAt ?? ""))) {
+    await store?.delete(pending.requestId).catch(() => void 0);
+    throw new EmailProofError("session", "SESSION_INVALID");
+  }
   if (!pending) {
     pending = await requestEmailProofCode({ ...input, address });
     await store?.put(pending);
@@ -599,30 +712,52 @@ async function acquireWithIssuerKeys(input, issuerKeys) {
     throw error;
   }
 }
-function normalizeAddress(address) {
+function normalizeAddress(address, profile) {
+  if (profile === HELD_PROFILE) return normalizeHeldAddress(address);
   const value = address.trim();
   if (value.length > 254 || !EMAIL_PATTERN.test(value)) throw new EmailProofError("request", "ADDRESS_INVALID");
   return value;
 }
+var HELD_LOCAL_ATOM = /^[a-z0-9!#$%&'*+\-/=?^_`{|}~]+(\.[a-z0-9!#$%&'*+\-/=?^_`{|}~]+)*$/;
+var HELD_DOMAIN_LABEL = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+function normalizeHeldAddress(address) {
+  const invalid = () => new EmailProofError("request", "ADDRESS_INVALID");
+  const trimmed = address.trim();
+  if (/[^\x00-\x7f]/.test(trimmed)) throw invalid();
+  const value = trimmed.toLowerCase();
+  const parts = value.split("@");
+  if (value.length < 3 || value.length > 254 || parts.length !== 2 || /[^\x21-\x7e]/.test(value)) throw invalid();
+  const [local, domain] = parts;
+  if (local.length > 64 || !HELD_LOCAL_ATOM.test(local) || local.startsWith("+")) throw invalid();
+  if (domain.length > 253 || !domain.includes(".") || !domain.split(".").every((label) => label.length <= 63 && HELD_DOMAIN_LABEL.test(label))) throw invalid();
+  return value;
+}
 function holderKid(did) {
   return `${did}#${did.slice(HOLDER_DID_PREFIX.length)}`;
 }
-function assertHolder(holder, step) {
+function assertHeldHolder(holder, step) {
+  const parsed = parsePkhDid(holder.did);
+  const canonical = parsed !== null && parsed.chainId === "1" ? `did:pkh:eip155:1:${toChecksumAddress(parsed.address)}` : void 0;
+  if (canonical === void 0 || holder.did !== canonical || holder.alg !== "EIP191" || holder.kid !== `${canonical}#${HELD_KID_FRAGMENT}`) throw new EmailProofError(step, "HOLDER_INVALID");
+}
+function assertHolder(holder, step, profile) {
+  if (profile === HELD_PROFILE) return assertHeldHolder(holder, step);
   if (!HOLDER_DID_PATTERN.test(holder.did) || holder.alg !== "EdDSA" || holder.kid !== holderKid(holder.did)) throw new EmailProofError(step, "HOLDER_INVALID");
 }
-function profilePin(profile, step) {
+function profilePin(profile, step, allowHeld) {
   const entry = Object.prototype.hasOwnProperty.call(PROFILE_PINS, profile) ? PROFILE_PINS[profile] : void 0;
-  if (!entry || !entry.enabled) throw new EmailProofError(step, "PROFILE_UNAVAILABLE");
+  if (!entry || !entry.enabled && !(allowHeld === true && profile === HELD_PROFILE)) throw new EmailProofError(step, "PROFILE_UNAVAILABLE");
   return entry;
 }
 function emailRequirement(address, profile) {
+  if (profile === HELD_PROFILE) return validateCredentialRequirement({ type: "TinyCloudCredentialRequirement", version: 1, profile: { id: profile, version: 1 }, credentialType: EMAIL_PROOF_CREDENTIAL_TYPE, claims: { email: address }, maxAgeSeconds: HELD_MAX_AGE_SECONDS });
   return createEmailCredentialRequirement({ email: address, profile: { id: profile, version: 1 }, credentialType: EMAIL_PROOF_CREDENTIAL_TYPE });
 }
 function emailProofRequirement(address) {
-  return emailRequirement(normalizeAddress(address), DEFAULT_EMAIL_PROOF_PROFILE);
+  return emailRequirement(normalizeAddress(address, DEFAULT_EMAIL_PROOF_PROFILE), DEFAULT_EMAIL_PROOF_PROFILE);
 }
-async function witnessDescriptor(profile, requirement, options, step) {
-  const pin = profilePin(profile, step);
+async function witnessDescriptor(profile, requirement, options, step, allowHeld) {
+  const pin = profilePin(profile, step, allowHeld);
   let descriptor;
   try {
     descriptor = await discoverCatalogDescriptor(requirement, DISCOVERY_URL, { fetch: options.fetch, signal: options.signal });
@@ -632,7 +767,7 @@ async function witnessDescriptor(profile, requirement, options, step) {
   if (descriptor.issuer.origin !== EMAIL_PROOF_PINS.witnessOrigin || descriptor.issuer.did !== EMAIL_PROOF_PINS.issuerDid || !descriptor.steps.some((candidate) => candidate.type === pin.requiredStep)) {
     throw new EmailProofError(step, "PROFILE_UNAVAILABLE");
   }
-  if (await canonicalDigest2(descriptor) !== pin.descriptorDigest) throw new EmailProofError(step, "PROFILE_UNAVAILABLE");
+  if (await canonicalDigest3(descriptor) !== pin.descriptorDigest) throw new EmailProofError(step, "PROFILE_UNAVAILABLE");
   return descriptor;
 }
 async function discoverCatalogDescriptor(requirement, discoveryUrl, options = {}) {
@@ -640,30 +775,30 @@ async function discoverCatalogDescriptor(requirement, discoveryUrl, options = {}
   try {
     url = new URL(discoveryUrl);
   } catch {
-    throw new CredentialError3("UNSUPPORTED_PROFILE", "Discovery URL is invalid");
+    throw new CredentialError4("UNSUPPORTED_PROFILE", "Discovery URL is invalid");
   }
-  if (url.protocol !== "https:" || !["/.well-known/opencredentials", "/v1/credential-types"].includes(url.pathname) || url.search || url.hash) throw new CredentialError3("UNSUPPORTED_PROFILE", "Discovery URL is not an allowed catalog endpoint");
+  if (url.protocol !== "https:" || !["/.well-known/opencredentials", "/v1/credential-types"].includes(url.pathname) || url.search || url.hash) throw new CredentialError4("UNSUPPORTED_PROFILE", "Discovery URL is not an allowed catalog endpoint");
   const init = { credentials: "omit", cache: "no-store", redirect: "error", referrerPolicy: "no-referrer", signal: options.signal };
   let response;
   try {
     response = await (options.fetch ?? globalThis.fetch.bind(globalThis))(url, init);
   } catch (cause) {
-    throw new CredentialError3("OFFLINE", "Credential discovery is unavailable", { cause });
+    throw new CredentialError4("OFFLINE", "Credential discovery is unavailable", { cause });
   }
-  if (!response.ok) throw new CredentialError3(response.status === 503 ? "ISSUER_UNREADY" : "OFFLINE", "Credential discovery is unavailable");
+  if (!response.ok) throw new CredentialError4(response.status === 503 ? "ISSUER_UNREADY" : "OFFLINE", "Credential discovery is unavailable");
   const catalog = await response.json();
-  if (catalog.type !== "tinycloud.credentials/catalog/v1" || catalog.protocol !== "tinycloud.credentials/acquisition/v1" || catalog.catalogVersion !== 1 || !Array.isArray(catalog.profiles)) throw new CredentialError3("DESCRIPTOR_INVALID", "Credential catalog is invalid");
+  if (catalog.type !== "tinycloud.credentials/catalog/v1" || catalog.protocol !== "tinycloud.credentials/acquisition/v1" || catalog.catalogVersion !== 1 || !Array.isArray(catalog.profiles)) throw new CredentialError4("DESCRIPTOR_INVALID", "Credential catalog is invalid");
   for (const entryValue of catalog.profiles) {
     if (typeof entryValue !== "object" || entryValue === null || Array.isArray(entryValue)) continue;
     const entry = entryValue;
     if (entry.supported !== true || entry.enabled !== true || entry.readiness !== "ready" && entry.readiness !== "degraded") continue;
     try {
       const candidate = validateCredentialFlowDescriptor(entry.descriptor);
-      if (descriptorSatisfiesRequirement(candidate, requirement) && entry.descriptorDigest === await canonicalDigest2(candidate)) return candidate;
+      if (descriptorSatisfiesRequirement(candidate, requirement) && entry.descriptorDigest === await canonicalDigest3(candidate)) return candidate;
     } catch {
     }
   }
-  throw new CredentialError3("UNSUPPORTED_PROFILE", "No available credential profile satisfies the requirement");
+  throw new CredentialError4("UNSUPPORTED_PROFILE", "No available credential profile satisfies the requirement");
 }
 function discoveryFailure(error, signal, step) {
   if (signal.aborted && signal.reason?.name !== "TimeoutError") return new EmailProofError(step, "CANCELED");
@@ -678,8 +813,8 @@ async function verifyStoredEmailProof(input) {
 async function verifyStoredWithIssuerKeys(input, issuerKeys) {
   const { record, requirement, holderDid } = input;
   const descriptor = record.descriptor;
-  if (record.descriptorDigest !== EMAIL_PROOF_PINS.descriptorDigest || await canonicalDigest2(descriptor) !== EMAIL_PROOF_PINS.descriptorDigest) {
-    throw new CredentialError3("VERIFICATION_FAILED", "stored descriptor does not match the pinned descriptor digest");
+  if (record.descriptorDigest !== EMAIL_PROOF_PINS.descriptorDigest || await canonicalDigest3(descriptor) !== EMAIL_PROOF_PINS.descriptorDigest) {
+    throw new CredentialError4("VERIFICATION_FAILED", "stored descriptor does not match the pinned descriptor digest");
   }
   const envelope = {
     type: "OpenCredentialsIssuedCredential",
@@ -714,14 +849,58 @@ async function verifyStoredWithIssuerKeys(input, issuerKeys) {
     checkStatus: async (status) => status.method === "none" && status.freshnessSeconds === descriptor.status.freshnessSeconds,
     signal: input.signal
   });
-  if (record.holderDid !== holderDid || record.ownerDid !== holderDid) throw new CredentialError3("HOLDER_MISMATCH", "stored record belongs to another holder");
-  if (record.credentialDigest !== verified.credentialDigest) throw new CredentialError3("VERIFICATION_FAILED", "stored credential digest does not match the verified credential");
-  if (record.requirementDigest !== await credentialRequirementDigest(requirement)) throw new CredentialError3("VERIFICATION_FAILED", "stored requirement digest does not match the requirement");
-  if (record.recordId !== await canonicalDigest2({ credentialDigest: verified.credentialDigest, holderDid: record.ownerDid })) throw new CredentialError3("VERIFICATION_FAILED", "stored record id does not match its credential");
+  if (record.holderDid !== holderDid || record.ownerDid !== holderDid) throw new CredentialError4("HOLDER_MISMATCH", "stored record belongs to another holder");
+  if (record.credentialDigest !== verified.credentialDigest) throw new CredentialError4("VERIFICATION_FAILED", "stored credential digest does not match the verified credential");
+  if (record.requirementDigest !== await credentialRequirementDigest(requirement)) throw new CredentialError4("VERIFICATION_FAILED", "stored requirement digest does not match the requirement");
+  if (record.recordId !== await canonicalDigest3({ credentialDigest: verified.credentialDigest, holderDid: record.ownerDid })) throw new CredentialError4("VERIFICATION_FAILED", "stored record id does not match its credential");
+  return verified;
+}
+async function verifyHeldResult(input) {
+  const { envelope, pending, descriptor } = input;
+  const refuse = (message) => new CredentialError4("VERIFICATION_FAILED", message);
+  const iatMs = Date.parse(envelope.issuedAt);
+  const clientMs = input.now().getTime();
+  if (!Number.isFinite(iatMs) || iatMs - clientMs > CLOCK_SKEW_BOUND_MS) throw refuse("client clock is more than 5 minutes behind the issuer");
+  const key = input.issuerKeys.find((candidate) => candidate.kid === EMAIL_PROOF_PINS.issuerKid);
+  if (!key) throw refuse("no pinned issuer key");
+  const issuerSet = parseIssuerSet(
+    { format: "tinycloud.credentials-issuers/v1", version: 1, issuers: [{ issuerDid: EMAIL_PROOF_PINS.issuerDid, kid: EMAIL_PROOF_PINS.issuerKid, alg: "EdDSA", publicKey: key.jwk.x, vcts: [EMAIL_PROOF_CREDENTIAL_TYPE.id], profiles: [HELD_PROFILE], notBefore: "2020-01-01T00:00:00Z", retiredAt: null, notAfter: null }] },
+    { didMethods: { issuer: ["web"] } }
+  );
+  const verified = verifyHeldEmailCredential(envelope.credential, {
+    now: new Date(Math.max(clientMs, iatMs)),
+    owner: pending.holderDid,
+    didMethods: { issuer: ["web"] },
+    acceptedIssuers: [{ issuerDid: EMAIL_PROOF_PINS.issuerDid, kid: EMAIL_PROOF_PINS.issuerKid }],
+    issuerSet
+  });
+  const signed = input.transport.signedBinding(pending.requestId);
+  const claims = Object.keys(envelope.claims).sort().join();
+  const toSecond = (ms) => Math.floor(ms / 1e3);
+  if (
+    // (i) the holder, as the one EIP-55 string
+    envelope.subjectDid !== pending.holderDid || envelope.holderDid !== pending.holderDid || // (ii) exactly {email, emailDomain}, equal to the credential's, and the requested mailbox
+    claims !== "email,emailDomain" || envelope.claims.email !== verified.claims.email || envelope.claims.emailDomain !== verified.claims.emailDomain || envelope.claims.email !== pending.address || // (iii) validity to the second
+    toSecond(Date.parse(envelope.issuedAt)) !== toSecond(verified.issuedAt.getTime()) || toSecond(Date.parse(envelope.expiresAt)) !== toSecond(verified.expiresAt.getTime()) || // (v) the pins
+    envelope.descriptorDigest !== input.descriptorDigest || envelope.profile.id !== HELD_PROFILE || envelope.profile.version !== 1 || envelope.issuerDid !== EMAIL_PROOF_PINS.issuerDid || envelope.issuerKid !== EMAIL_PROOF_PINS.issuerKid || envelope.format !== "vc+sd-jwt" || envelope.status.method !== "none" || envelope.status.freshnessSeconds !== descriptor.status.freshnessSeconds
+  ) throw refuse("issued credential does not match the request");
+  if (signed?.type !== descriptor.holderBinding.domain || !("credentialLifetimeSeconds" in signed)) throw refuse("signed binding is missing");
+  if (verified.credentialId !== signed.jti || (verified.expiresAt.getTime() - verified.issuedAt.getTime()) / 1e3 !== signed.credentialLifetimeSeconds) throw refuse("credential does not match the binding the account signed");
   return verified;
 }
-function holderSigning(holder) {
-  return { autoSign: async (_binding, bytes) => holder.sign(bytes), holderKey: { alg: "EdDSA", kid: holder.kid } };
+function holderSigning(holder, held) {
+  return {
+    autoSign: async (_binding, bytes) => {
+      try {
+        return await holder.sign(bytes);
+      } catch (error) {
+        const aborted = error instanceof DOMException && (error.name === "TimeoutError" || error.name === "AbortError");
+        if (!held || error instanceof EmailProofError || aborted) throw error;
+        throw new EmailProofError("credential", "SIGNATURE_REJECTED");
+      }
+    },
+    holderKey: { alg: holder.alg, kid: holder.kid }
+  };
 }
 function randomVerifier() {
   return encodeBase64Url3(crypto.getRandomValues(new Uint8Array(32)));
@@ -743,6 +922,7 @@ function mapError(value, step, signal) {
       if (signal?.aborted && signal.reason?.name !== "TimeoutError") return new EmailProofError(step, "CANCELED");
       return new EmailProofError(step, "NETWORK");
     case "UNSUPPORTED_PROFILE":
+    case "UNSUPPORTED_VERSION":
     case "DESCRIPTOR_INVALID":
       return new EmailProofError(step, "PROFILE_UNAVAILABLE");
     case "PROOF_REJECTED":
@@ -770,7 +950,9 @@ export {
   DEFAULT_EMAIL_PROOF_PROFILE,
   EMAIL_PROOF_CREDENTIAL_TYPE,
   EMAIL_PROOF_PENDING_MAX_MS,
+  EMAIL_PROOF_PINS,
   EmailProofError,
+  HELD_ACCOUNT_BINDING_PINS,
   OpenCredentialsHttpTransport,
   acquireEmailProof,
   completeEmailProof,
@@ -778,6 +960,7 @@ export {
   createMemoryEmailProofPendingStore,
   emailProofRequirement,
   interpretCredentialFlow,
+  isTicketEmailProofResult,
   mailboxSubject,
   requestEmailProofCode,
   verifyStoredEmailProof