@tinycloud/node-sdk 3.9.0-beta.3 → 3.9.0-beta.5

package/dist/credentials-core.js

@@ -1,10 +1,52 @@
 // src/credentials/interpreter.ts
 import {
-  CredentialError,
+  CredentialError as CredentialError2,
   encodeBase64Url,
   holderBindingSigningBytes,
   validateCredentialHolderBinding
 } from "@tinycloud/sdk-core";
+
+// src/credentials/held-binding.ts
+import { canonicalDigest, CredentialError } from "@tinycloud/sdk-core";
+
+// src/credentials/pins.ts
+import { ACCOUNT_HOLDER_BINDING_DOMAIN } from "@tinycloud/sdk-core";
+var EMAIL_PROOF_PINS = Object.freeze({
+  witnessOrigin: "https://witness.credentials.org",
+  issuerDid: "did:web:issuer.credentials.org",
+  issuerKid: "did:web:issuer.credentials.org#controller",
+  issuerX: "eEJI4xEobto4HtQ7Pg9R1vBOwcpfGRTlXDG5QfqLnGQ",
+  descriptorDigest: "1tg-qphmKBVtNwzVg9xyz-xxqt_xtMXAsQyXw46m8S0"
+});
+var HELD_ACCOUNT_BINDING_PINS = Object.freeze({
+  type: ACCOUNT_HOLDER_BINDING_DOMAIN,
+  protocol: "tinycloud.credentials/acquisition/v1",
+  profile: "tinycloud.email-held/v1",
+  profileVersion: 1,
+  descriptorDigest: "dc3_DuvzipXwYkTfjKqTaK1c3VS0YSPnaBsYSQriC0w",
+  issuer: EMAIL_PROOF_PINS.issuerDid,
+  issuerKid: EMAIL_PROOF_PINS.issuerKid,
+  audience: "tinycloud://credentials",
+  openerOrigin: "https://localhost",
+  completionOrigin: "https://localhost",
+  completionContext: "sdk-acquisition",
+  credentialLifetimeSeconds: 31536e3
+});
+
+// src/credentials/held-binding.ts
+var REQUEST_TTL_MS = 6e5;
+var substituted = () => new CredentialError("REQUEST_SUBSTITUTED", "Holder binding was substituted");
+async function assertHeldBinding(binding, expected) {
+  const { descriptor } = expected;
+  if (descriptor.holderBinding.alg !== "EIP191" || binding.type !== descriptor.holderBinding.domain || binding.requestId !== expected.requestId || binding.descriptorDigest !== expected.descriptorDigest || binding.requirementDigest !== expected.requirementDigest || binding.holderDid !== expected.holderDid || binding.issuer !== descriptor.issuer.did || binding.issuerKid !== descriptor.issuer.kid || binding.profile !== descriptor.profile || binding.openerOrigin !== expected.openerOrigin || binding.completionOrigin !== expected.openerOrigin || binding.audience !== HELD_ACCOUNT_BINDING_PINS.audience || binding.completionContext !== HELD_ACCOUNT_BINDING_PINS.completionContext || // The static fields, against the one frozen object the request body and the account signer also use (A2.4).
+  binding.type !== HELD_ACCOUNT_BINDING_PINS.type || binding.protocol !== HELD_ACCOUNT_BINDING_PINS.protocol || binding.profile !== HELD_ACCOUNT_BINDING_PINS.profile || binding.profileVersion !== HELD_ACCOUNT_BINDING_PINS.profileVersion || binding.descriptorDigest !== HELD_ACCOUNT_BINDING_PINS.descriptorDigest || binding.issuer !== HELD_ACCOUNT_BINDING_PINS.issuer || binding.issuerKid !== HELD_ACCOUNT_BINDING_PINS.issuerKid || binding.openerOrigin !== HELD_ACCOUNT_BINDING_PINS.openerOrigin || binding.completionOrigin !== HELD_ACCOUNT_BINDING_PINS.completionOrigin || binding.credentialLifetimeSeconds !== HELD_ACCOUNT_BINDING_PINS.credentialLifetimeSeconds) throw substituted();
+  if (expected.challengeNonce === void 0 || binding.challengeNonce !== expected.challengeNonce) throw substituted();
+  if (binding.normalizedClaimsDigest !== await canonicalDigest(expected.requirement.claims)) throw substituted();
+  const expires = Date.parse(binding.expiresAt);
+  if (expected.serverExpiresAt === void 0 || expires !== Date.parse(expected.serverExpiresAt) || Date.parse(binding.issuedAt) !== expires - REQUEST_TTL_MS) throw substituted();
+}
+
+// src/credentials/interpreter.ts
 var delay = (ms, signal) => new Promise((resolve, reject) => {
   const timer = setTimeout(resolve, ms);
   signal?.addEventListener("abort", () => {
@@ -17,18 +59,36 @@ function mailboxSubject(requirement) {
   return typeof email === "string" && email.length > 0 ? Object.freeze({ kind: "email", value: email }) : void 0;
 }
 async function interpretCredentialFlow(input) {
+  const held = input.descriptor.subjectRelationship === "account_is_subject";
+  if (held && input.allowAccountSubject !== true) throw new CredentialError2("UNSUPPORTED_PROFILE", "The held credential profile requires an explicit opt-in");
   const steps = new Map(input.descriptor.steps.map((step) => [step.type, step]));
   const completed = /* @__PURE__ */ new Set();
   let lastTransition = "";
+  const checkBinding = async (value) => {
+    const binding = validateCredentialHolderBinding(value);
+    if (binding.requestId !== input.requestId || binding.descriptorDigest !== input.descriptorDigest || binding.requirementDigest !== input.requirementDigest || binding.holderDid !== input.holderDid || binding.issuer !== input.descriptor.issuer.did || binding.issuerKid !== input.descriptor.issuer.kid || binding.profile !== input.descriptor.profile || binding.openerOrigin !== input.openerOrigin || binding.completionOrigin !== input.openerOrigin || binding.audience !== "tinycloud://credentials") throw new CredentialError2("REQUEST_SUBSTITUTED", "Holder binding was substituted");
+    const alg = input.descriptor.holderBinding.alg;
+    if (binding.type !== input.descriptor.holderBinding.domain || alg === "EIP191" && !input.transport.challengeNonce) throw new CredentialError2("REQUEST_SUBSTITUTED", "Holder binding was substituted");
+    if (alg === "EIP191") await assertHeldBinding(binding, { descriptor: input.descriptor, requirement: input.requirement, requestId: input.requestId, descriptorDigest: input.descriptorDigest, requirementDigest: input.requirementDigest, holderDid: input.holderDid, openerOrigin: input.openerOrigin, challengeNonce: input.transport.challengeNonce(input.requestId), serverExpiresAt: input.expiresAt });
+    return binding;
+  };
+  const ensureHeldBinding = async () => {
+    if (!held || input.transport.signedBinding?.(input.requestId) !== void 0) return;
+    await checkBinding(await input.transport.holderBinding(input.requestId, input.verifier, input.signal));
+  };
   for (; ; ) {
     input.signal?.throwIfAborted();
     const state = await input.transport.state(input.requestId, input.verifier, input.signal);
-    if (state.requestId !== input.requestId) throw new CredentialError("REQUEST_SUBSTITUTED", "Credential request identity changed");
-    if (state.state === "expired") throw new CredentialError("REQUEST_EXPIRED", "Credential request expired", { state: state.state, correlationId: state.correlationId });
-    if (state.state === "canceled") throw new CredentialError("CANCELED", "Credential request was canceled", { state: state.state, correlationId: state.correlationId });
-    if (state.state === "issuer_unready") throw new CredentialError("ISSUER_UNREADY", "Credential issuer is not ready", { retryAfterMs: state.retryAfterMs, state: state.state, correlationId: state.correlationId });
-    if (state.state === "complete") return;
+    if (state.requestId !== input.requestId) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential request identity changed");
+    if (state.state === "expired") throw new CredentialError2("REQUEST_EXPIRED", "Credential request expired", { state: state.state, correlationId: state.correlationId });
+    if (state.state === "canceled") throw new CredentialError2("CANCELED", "Credential request was canceled", { state: state.state, correlationId: state.correlationId });
+    if (state.state === "issuer_unready") throw new CredentialError2("ISSUER_UNREADY", "Credential issuer is not ready", { retryAfterMs: state.retryAfterMs, state: state.state, correlationId: state.correlationId });
+    if (state.state === "complete") {
+      await ensureHeldBinding();
+      return;
+    }
     if (state.state === "ready_to_issue" || state.state === "issued") {
+      await ensureHeldBinding();
       if (state.state === "ready_to_issue" && !completed.has("issue")) {
         await input.transport.issue(input.requestId, input.verifier, input.signal);
         completed.add("issue");
@@ -41,7 +101,7 @@ async function interpretCredentialFlow(input) {
       continue;
     }
     const declared = steps.get(next.type);
-    if (next.id !== next.type || !declared || declared.type !== next.type || declared.version !== next.version) throw new CredentialError("REQUEST_SUBSTITUTED", "Server selected an undeclared credential step");
+    if (next.id !== next.type || !declared || declared.type !== next.type || declared.version !== next.version) throw new CredentialError2("REQUEST_SUBSTITUTED", "Server selected an undeclared credential step");
     if (completed.has(next.id) || state.transitionId === lastTransition) {
       await (input.onWait?.() ?? delay(state.retryAfterMs ?? 50, input.signal));
       continue;
@@ -49,21 +109,22 @@ async function interpretCredentialFlow(input) {
     lastTransition = state.transitionId;
     if (next.type === "holder_signature") {
       input.onProgress?.({ state: "signing", stepId: next.id, correlationId: state.correlationId });
-      const binding = validateCredentialHolderBinding(await input.transport.holderBinding(input.requestId, input.verifier, input.signal));
-      if (binding.requestId !== input.requestId || binding.descriptorDigest !== input.descriptorDigest || binding.requirementDigest !== input.requirementDigest || binding.holderDid !== input.holderDid || binding.issuer !== input.descriptor.issuer.did || binding.issuerKid !== input.descriptor.issuer.kid || binding.profile !== input.descriptor.profile || binding.openerOrigin !== input.openerOrigin || binding.completionOrigin !== input.openerOrigin || binding.audience !== "tinycloud://credentials") throw new CredentialError("REQUEST_SUBSTITUTED", "Holder binding was substituted");
+      const binding = await checkBinding(await input.transport.holderBinding(input.requestId, input.verifier, input.signal));
+      const alg = input.descriptor.holderBinding.alg;
+      if (alg === "EIP191" !== (input.signing.holderKey?.alg === "EIP191")) throw new CredentialError2("REQUEST_SUBSTITUTED", "Holder binding was substituted");
       const bytes = holderBindingSigningBytes(binding);
       let signature = await input.signing.autoSign?.(binding, bytes, input.signal);
       if (signature === void 0) {
-        if (!input.signing.requestApproval) throw new CredentialError("SIGNATURE_REJECTED", "OpenKey approval is required");
+        if (!input.signing.requestApproval) throw new CredentialError2("SIGNATURE_REJECTED", "OpenKey approval is required");
         try {
           signature = await input.signing.requestApproval(binding, bytes, input.signal);
         } catch (cause) {
-          if (cause instanceof CredentialError) throw cause;
-          throw new CredentialError("SIGNATURE_REJECTED", "OpenKey approval was rejected", { cause });
+          if (cause instanceof CredentialError2) throw cause;
+          throw new CredentialError2("SIGNATURE_REJECTED", "OpenKey approval was rejected", { cause });
         }
       }
-      if (!(signature instanceof Uint8Array) || signature.length === 0) throw new CredentialError("SIGNATURE_REJECTED", "OpenKey signature is invalid");
-      await input.transport.submitHolderSignature(input.requestId, input.verifier, encodeBase64Url(signature), input.signal, input.signing.holderKey);
+      if (!(signature instanceof Uint8Array) || signature.length === 0) throw new CredentialError2("SIGNATURE_REJECTED", "OpenKey signature is invalid");
+      await input.transport.submitHolderSignature(input.requestId, input.verifier, alg === "EIP191" ? `0x${Array.from(signature, (byte) => byte.toString(16).padStart(2, "0")).join("")}` : encodeBase64Url(signature), input.signal, input.signing.holderKey);
     } else {
       input.onProgress?.({ state: next.type === "collect_input" ? "collecting" : "proving", stepId: next.id, correlationId: state.correlationId });
       const handler = input.handlers?.[next.type];
@@ -97,9 +158,9 @@ async function interpretCredentialFlow(input) {
             await input.transport.submitStep(input.requestId, input.verifier, next.id, proof, input.signal);
             break;
           } catch (cause) {
-            if (!(cause instanceof CredentialError) || cause.code !== "PROOF_REJECTED") throw cause;
+            if (!(cause instanceof CredentialError2) || cause.code !== "PROOF_REJECTED") throw cause;
             const attemptsRemaining = input.descriptor.lifecycle.maxProofAttempts - attempt;
-            if (next.type !== "mailbox_otp" || attemptsRemaining <= 0) throw new CredentialError("VERIFICATION_FAILED", "The proof was not accepted", { state: attemptsRemaining <= 0 ? "proof_attempts_exhausted" : "proof_rejected", cause });
+            if (next.type !== "mailbox_otp" || attemptsRemaining <= 0) throw new CredentialError2("VERIFICATION_FAILED", "The proof was not accepted", { state: attemptsRemaining <= 0 ? "proof_attempts_exhausted" : "proof_rejected", cause });
             feedback = { kind: "rejected", attemptsRemaining };
           }
         }
@@ -111,8 +172,8 @@ async function interpretCredentialFlow(input) {
 
 // src/credentials/transport.ts
 import {
-  CredentialError as CredentialError2,
-  canonicalDigest,
+  CredentialError as CredentialError3,
+  canonicalDigest as canonicalDigest2,
   credentialEndpointPath,
   decodeBase64Url,
   encodeBase64Url as encodeBase64Url2,
@@ -121,25 +182,25 @@ import {
   validateCredentialHolderBinding as validateCredentialHolderBinding2
 } from "@tinycloud/sdk-core";
 function object(value, label) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CredentialError2("VERIFICATION_FAILED", `${label} is invalid`);
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CredentialError3("VERIFICATION_FAILED", `${label} is invalid`);
   return value;
 }
 function opaque(value, label) {
-  if (typeof value !== "string" || !/^[A-Za-z0-9_-]{16,128}$/.test(value)) throw new CredentialError2("REQUEST_SUBSTITUTED", `${label} is invalid`);
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]{16,128}$/.test(value)) throw new CredentialError3("REQUEST_SUBSTITUTED", `${label} is invalid`);
   return value;
 }
 function timestamp(value, label) {
-  if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) throw new CredentialError2("VERIFICATION_FAILED", `${label} is invalid`);
+  if (typeof value !== "string" || !Number.isFinite(Date.parse(value))) throw new CredentialError3("VERIFICATION_FAILED", `${label} is invalid`);
   return new Date(value).toISOString();
 }
 function jwtPayload(credential) {
   const part = credential.split("~", 1)[0]?.split(".")[1];
-  if (!part) throw new CredentialError2("VERIFICATION_FAILED", "Issued SD-JWT is invalid");
+  if (!part) throw new CredentialError3("VERIFICATION_FAILED", "Issued SD-JWT is invalid");
   try {
     return object(JSON.parse(new TextDecoder().decode(decodeBase64Url(part))), "SD-JWT payload");
   } catch (cause) {
-    if (cause instanceof CredentialError2) throw cause;
-    throw new CredentialError2("VERIFICATION_FAILED", "Issued SD-JWT is invalid", { cause });
+    if (cause instanceof CredentialError3) throw cause;
+    throw new CredentialError3("VERIFICATION_FAILED", "Issued SD-JWT is invalid", { cause });
   }
 }
 var SERVER_CODES = /* @__PURE__ */ new Set(["REQUEST_EXPIRED", "ISSUER_UNREADY", "UNSUPPORTED_PROFILE", "UNSUPPORTED_VERSION", "SIGNATURE_REJECTED"]);
@@ -148,12 +209,13 @@ function serverError(value, response, honorServerRecoverable) {
   const body = value;
   const keys = Object.keys(body).sort();
   if (keys.join(",") !== "code,correlationId,recoverable,state,type" || body.type !== "tinycloud.credentials/error/v1" || typeof body.code !== "string" || typeof body.recoverable !== "boolean" || typeof body.state !== "string" || typeof body.correlationId !== "string") return void 0;
-  if (body.code === "PROOF_REJECTED") return body.recoverable ? new CredentialError2("PROOF_REJECTED", "The proof was not accepted", { state: body.state, correlationId: body.correlationId }) : new CredentialError2("VERIFICATION_FAILED", "The proof attempt limit was reached", { state: "proof_attempts_exhausted", correlationId: body.correlationId });
-  if (body.code === "RATE_LIMITED") return new CredentialError2("ISSUER_UNREADY", "Too many verification codes were requested", { state: "rate_limited", correlationId: body.correlationId, retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0, recoverable: honorServerRecoverable ? body.recoverable : void 0 });
-  if (body.code === "CHALLENGE_EXPIRED") return new CredentialError2("REQUEST_EXPIRED", "The credential challenge expired", { state: body.state, correlationId: body.correlationId, recoverable: honorServerRecoverable ? body.recoverable : void 0 });
+  if (body.code === "PROOF_REJECTED") return body.recoverable ? new CredentialError3("PROOF_REJECTED", "The proof was not accepted", { state: body.state, correlationId: body.correlationId }) : new CredentialError3("VERIFICATION_FAILED", "The proof attempt limit was reached", { state: "proof_attempts_exhausted", correlationId: body.correlationId });
+  if (body.code === "RATE_LIMITED") return new CredentialError3("ISSUER_UNREADY", "Too many verification codes were requested", { state: "rate_limited", correlationId: body.correlationId, retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0, recoverable: honorServerRecoverable ? body.recoverable : void 0 });
+  if (body.code === "CHALLENGE_EXPIRED") return new CredentialError3("REQUEST_EXPIRED", "The credential challenge expired", { state: body.state, correlationId: body.correlationId, recoverable: honorServerRecoverable ? body.recoverable : void 0 });
+  if (body.code === "DESCRIPTOR_MISMATCH") body.code = "UNSUPPORTED_PROFILE";
   if (!SERVER_CODES.has(body.code)) return void 0;
   const code = body.code;
-  return new CredentialError2(code, `OpenCredentials rejected the request: ${code}`, {
+  return new CredentialError3(code, `OpenCredentials rejected the request: ${code}`, {
     state: body.state,
     correlationId: body.correlationId,
     retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0,
@@ -161,12 +223,17 @@ function serverError(value, response, honorServerRecoverable) {
   });
 }
 var OpenCredentialsHttpTransport = class {
+  /**
+   * `allowAccountSubject` is passed only by the email-proof functions, after the per-call held opt-in was accepted. Without it an account-bound
+   * (held) descriptor is refused here, before any request (TC-2254 A2.5).
+   */
   constructor(descriptor, fetchFn = globalThis.fetch.bind(globalThis), options = {}) {
     this.descriptor = descriptor;
     this.fetchFn = fetchFn;
     this.options = options;
     this.nonces = /* @__PURE__ */ new Map();
     this.bindings = /* @__PURE__ */ new Map();
+    if (descriptor.subjectRelationship === "account_is_subject" && options.allowAccountSubject !== true) throw new CredentialError3("UNSUPPORTED_PROFILE", "The held credential profile requires an explicit opt-in");
   }
   url(endpoint, id) {
     return new URL(credentialEndpointPath(endpoint, id), this.descriptor.issuer.origin).href;
@@ -177,8 +244,8 @@ var OpenCredentialsHttpTransport = class {
       const init = { method: input.method ?? "GET", credentials: "omit", cache: "no-store", redirect: "error", referrerPolicy: "no-referrer", signal: input.signal, headers: { accept: "application/json", ...input.body === void 0 ? {} : { "content-type": "application/json" }, ...input.verifier === void 0 ? {} : { authorization: `Bearer ${input.verifier}` } }, ...input.body === void 0 ? {} : { body: JSON.stringify(input.body) } };
       response = await this.fetchFn(this.url(endpoint, input.id), init);
     } catch (cause) {
-      if (cause instanceof DOMException && cause.name === "AbortError") throw new CredentialError2("CANCELED", "Credential acquisition was canceled", { cause });
-      throw new CredentialError2("OFFLINE", "OpenCredentials is unavailable", { cause });
+      if (cause instanceof DOMException && cause.name === "AbortError") throw new CredentialError3("CANCELED", "Credential acquisition was canceled", { cause });
+      throw new CredentialError3("OFFLINE", "OpenCredentials is unavailable", { cause });
     }
     if (!response.ok) {
       let parsed;
@@ -189,95 +256,112 @@ var OpenCredentialsHttpTransport = class {
       }
       const typed = serverError(parsed, response, this.options.honorServerRecoverable === true);
       if (typed) throw typed;
-      if (response.status === 410) throw new CredentialError2("REQUEST_EXPIRED", "Credential request expired");
-      if (response.status === 409) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential request was replayed or substituted");
-      if (response.status === 503) throw new CredentialError2("ISSUER_UNREADY", "Credential issuer is not ready", { retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0 });
-      throw new CredentialError2("VERIFICATION_FAILED", "OpenCredentials rejected the request");
+      if (response.status === 410) throw new CredentialError3("REQUEST_EXPIRED", "Credential request expired");
+      if (response.status === 409) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential request was replayed or substituted");
+      if (response.status === 503) throw new CredentialError3("ISSUER_UNREADY", "Credential issuer is not ready", { retryAfterMs: Number(response.headers.get("retry-after")) * 1e3 || void 0 });
+      throw new CredentialError3("VERIFICATION_FAILED", "OpenCredentials rejected the request");
     }
     if (response.status === 204) return void 0;
     try {
       return await response.json();
     } catch (cause) {
-      throw new CredentialError2("VERIFICATION_FAILED", "OpenCredentials response is invalid", { cause });
+      throw new CredentialError3("VERIFICATION_FAILED", "OpenCredentials response is invalid", { cause });
     }
   }
   async create(input) {
-    const body = object(await this.request("request", { method: "POST", body: { protocol: input.descriptor.protocol, profile: input.descriptor.profile, profileVersion: input.descriptor.profileVersion, descriptorDigest: input.descriptorDigest, requirementDigest: input.requirementDigest, holderDid: input.holderDid, inputs: input.inputs ?? input.requirement.claims, audience: "tinycloud://credentials", openerOrigin: input.openerOrigin, completionOrigin: input.openerOrigin, completionContext: "sdk-acquisition", completionVerifierChallenge: input.completionVerifierChallenge }, signal: input.signal }), "create response");
-    if (body.type !== "tinycloud.credentials/acquisition-request/v1" || body.protocol !== input.descriptor.protocol || body.next !== "challenge" || body.endpoint !== "challenge") throw new CredentialError2("VERIFICATION_FAILED", "create response is invalid");
+    const body = object(await this.request("request", { method: "POST", body: { protocol: input.descriptor.protocol, profile: input.descriptor.profile, profileVersion: input.descriptor.profileVersion, descriptorDigest: input.descriptorDigest, requirementDigest: input.requirementDigest, holderDid: input.holderDid, inputs: input.inputs ?? input.requirement.claims, audience: HELD_ACCOUNT_BINDING_PINS.audience, openerOrigin: input.openerOrigin, completionOrigin: input.openerOrigin, completionContext: HELD_ACCOUNT_BINDING_PINS.completionContext, completionVerifierChallenge: input.completionVerifierChallenge }, signal: input.signal }), "create response");
+    if (body.type !== "tinycloud.credentials/acquisition-request/v1" || body.protocol !== input.descriptor.protocol || body.next !== "challenge" || body.endpoint !== "challenge") throw new CredentialError3("VERIFICATION_FAILED", "create response is invalid");
     const requestId = opaque(body.requestId, "requestId");
     return { requestId, locator: requestId, expiresAt: timestamp(body.expiresAt, "expiresAt"), correlationId: requestId };
   }
+  /** The nonce stored from R3 or R2 for this request. Held acquisition compares the signed binding with it. */
+  challengeNonce(id) {
+    return this.nonces.get(id);
+  }
+  /** The binding fetched and validated for this request, as the account signed it. */
+  signedBinding(id) {
+    return this.bindings.get(id);
+  }
   proofStep() {
     return this.descriptor.steps.some((step) => step.type === "mailbox_otp") ? "mailbox_otp" : "collect_input";
   }
   async state(id, verifier, signal) {
     const raw = object(await this.request("state", { id, verifier, signal }), "state response");
-    if (raw.type !== "tinycloud.credentials/acquisition-state/v1" || raw.requestId !== id || raw.profile !== this.descriptor.profile || raw.profileVersion !== 1) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential state response is substituted");
+    if (raw.type !== "tinycloud.credentials/acquisition-state/v1" || raw.requestId !== id || raw.profile !== this.descriptor.profile || raw.profileVersion !== 1) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential state response is substituted");
     const base = { type: "OpenCredentialsAcquisitionState", version: 1, requestId: id, transitionId: `${String(raw.state)}:${String(raw.resultPreviouslyRead ?? false)}`, correlationId: id };
     if (raw.state === "challenge_required") {
       const type = this.proofStep();
       return { ...base, state: "pending", nextStep: { id: type, type, version: 1, constraints: { challengeRequired: true } } };
     }
+    if (this.descriptor.subjectRelationship === "account_is_subject" && (raw.state === "proof_required" || raw.state === "holder_binding_required" || raw.state === "holder_signature_required" || raw.state === "ready_to_issue" || raw.state === "issued")) {
+      const nonce = raw.challengeNonce;
+      const prior = this.nonces.get(id);
+      if (typeof nonce !== "string" || nonce === "" || prior !== void 0 && prior !== nonce) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential challenge nonce is missing or changed");
+      this.nonces.set(id, opaque(nonce, "challengeNonce"));
+    }
     if (raw.state === "proof_required") {
       const type = this.proofStep();
-      this.nonces.set(id, opaque(raw.challengeNonce, "challengeNonce"));
+      if (this.descriptor.subjectRelationship !== "account_is_subject") this.nonces.set(id, opaque(raw.challengeNonce, "challengeNonce"));
       return { ...base, state: "pending", nextStep: { id: type, type, version: 1, constraints: {} } };
     }
     if (raw.state === "holder_binding_required" || raw.state === "holder_signature_required") return { ...base, state: "pending", nextStep: { id: "holder_signature", type: "holder_signature", version: 1, constraints: {} } };
     if (raw.state === "ready_to_issue") return { ...base, state: "ready_to_issue" };
     if (raw.state === "issued") return { ...base, state: "complete" };
-    throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential state is unsupported");
+    throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential state is unsupported");
   }
   async beginStep(id, verifier, stepId, signal) {
     const step = this.proofStep();
-    if (stepId !== step) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential challenge step is substituted");
+    if (stepId !== step) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential challenge step is substituted");
     const challenge = object(await this.request("challenge", { id, verifier, method: "POST", body: { step, stepVersion: 1 }, signal }), "challenge response");
-    if (challenge.type !== "tinycloud.credentials/challenge/v1" || challenge.step !== step || challenge.stepVersion !== 1) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential challenge is substituted");
+    if (challenge.type !== "tinycloud.credentials/challenge/v1" || challenge.step !== step || challenge.stepVersion !== 1) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential challenge is substituted");
     this.nonces.set(id, opaque(challenge.challengeNonce, "challengeNonce"));
   }
   async submitStep(id, verifier, stepId, proof, signal) {
     const step = this.proofStep();
-    if (stepId !== step) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential proof step is substituted");
+    if (stepId !== step) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential proof step is substituted");
     const nonce = this.nonces.get(id);
-    if (!nonce) throw new CredentialError2("REQUEST_SUBSTITUTED", "Credential challenge is missing");
+    if (!nonce) throw new CredentialError3("REQUEST_SUBSTITUTED", "Credential challenge is missing");
     await this.request("proof", { id, verifier, method: "POST", body: { step, stepVersion: 1, challengeNonce: nonce, proof }, signal });
   }
   async holderBinding(id, verifier, signal) {
     const raw = object(await this.request("holder_binding", { id, verifier, signal }), "holder binding response");
-    if (raw.type !== "tinycloud.credentials/holder-binding-request/v1" || raw.signingDomain !== "tinycloud.credentials/holder-binding/v1" || raw.alg !== "EdDSA" || typeof raw.canonical !== "string") throw new CredentialError2("REQUEST_SUBSTITUTED", "Holder binding response is invalid");
+    if (raw.type !== "tinycloud.credentials/holder-binding-request/v1" || raw.signingDomain !== this.descriptor.holderBinding.domain || raw.alg !== this.descriptor.holderBinding.alg || typeof raw.canonical !== "string") throw new CredentialError3("REQUEST_SUBSTITUTED", "Holder binding response is invalid");
     const binding = validateCredentialHolderBinding2(raw.binding);
-    if (encodeBase64Url2(holderBindingCanonicalBytes(binding)) !== raw.canonical) throw new CredentialError2("REQUEST_SUBSTITUTED", "Holder binding canonical bytes were substituted");
+    if (binding.type !== raw.signingDomain) throw new CredentialError3("REQUEST_SUBSTITUTED", "Holder binding type does not match its signing domain");
+    if (encodeBase64Url2(holderBindingCanonicalBytes(binding)) !== raw.canonical) throw new CredentialError3("REQUEST_SUBSTITUTED", "Holder binding canonical bytes were substituted");
     this.bindings.set(id, binding);
     return binding;
   }
   async submitHolderSignature(id, verifier, signature, signal, key) {
     const binding = this.bindings.get(id);
-    if (!binding) throw new CredentialError2("REQUEST_SUBSTITUTED", "Holder binding was not retrieved");
+    if (!binding) throw new CredentialError3("REQUEST_SUBSTITUTED", "Holder binding was not retrieved");
+    if (this.descriptor.holderBinding.alg === "EIP191" && !key) throw new CredentialError3("REQUEST_SUBSTITUTED", "An account holder must name its key and algorithm");
+    const alg = key?.alg ?? "EdDSA";
     const kid = key?.kid ?? `${binding.holderDid}#${binding.holderDid.replace("did:key:", "")}`;
-    await this.request("holder_signature", { id, verifier, method: "POST", body: { alg: key?.alg ?? "EdDSA", kid, signature }, signal });
+    await this.request("holder_signature", { id, verifier, method: "POST", body: { alg, kid, signature }, signal });
   }
   async issue(id, verifier, signal) {
     await this.request("issue", { id, verifier, method: "POST", signal });
   }
   async result(id, verifier, signal) {
     const raw = object(await this.request("result", { id, verifier, signal }), "result response");
-    if (raw.type !== "tinycloud.credentials/result/v1" || raw.protocol !== this.descriptor.protocol || raw.profile !== this.descriptor.profile || raw.profileVersion !== 1 || raw.format !== "vc+sd-jwt" || raw.descriptorDigest !== await canonicalDigest(this.descriptor) || raw.issuer !== this.descriptor.issuer.did || raw.issuerKid !== this.descriptor.issuer.kid || typeof raw.credential !== "string" || await sha256Base64Url(raw.credential) !== raw.credentialDigest) throw new CredentialError2("VERIFICATION_FAILED", "Issued result metadata is invalid");
+    if (raw.type !== "tinycloud.credentials/result/v1" || raw.protocol !== this.descriptor.protocol || raw.profile !== this.descriptor.profile || raw.profileVersion !== 1 || raw.format !== "vc+sd-jwt" || raw.descriptorDigest !== await canonicalDigest2(this.descriptor) || raw.issuer !== this.descriptor.issuer.did || raw.issuerKid !== this.descriptor.issuer.kid || typeof raw.credential !== "string" || await sha256Base64Url(raw.credential) !== raw.credentialDigest) throw new CredentialError3("VERIFICATION_FAILED", "Issued result metadata is invalid");
     const holder = object(raw.holderBinding, "result holder binding");
-    if (raw.subject !== holder.did || holder.signingDomain !== "tinycloud.credentials/holder-binding/v1") throw new CredentialError2("HOLDER_MISMATCH", "Issued holder binding is invalid");
+    if (raw.subject !== holder.did || holder.signingDomain !== this.descriptor.holderBinding.domain) throw new CredentialError3("HOLDER_MISMATCH", "Issued holder binding is invalid");
     const claimsRaw = object(raw.claims, "result claims");
     const claims = {};
     for (const [name, value] of Object.entries(claimsRaw)) {
-      if (typeof value !== "string") throw new CredentialError2("VERIFICATION_FAILED", "Issued claims are invalid");
+      if (typeof value !== "string") throw new CredentialError3("VERIFICATION_FAILED", "Issued claims are invalid");
       claims[name] = value;
     }
     const validity = object(raw.validity, "result validity");
     const payload = jwtPayload(raw.credential);
-    if (typeof payload.jti !== "string") throw new CredentialError2("VERIFICATION_FAILED", "Credential id is invalid");
+    if (typeof payload.jti !== "string") throw new CredentialError3("VERIFICATION_FAILED", "Credential id is invalid");
     const issuedAt = timestamp(validity.issuedAt, "issuedAt");
     const expiresAt = timestamp(validity.expiresAt, "expiresAt");
     const status = object(raw.status, "result status");
-    if (status.type !== "none" || status.freshnessSeconds !== this.descriptor.status.freshnessSeconds) throw new CredentialError2("VERIFICATION_FAILED", "Credential status is invalid");
-    return { type: "OpenCredentialsIssuedCredential", version: 1, protocol: this.descriptor.protocol, profile: { id: this.descriptor.profile, version: 1 }, credentialType: { id: this.descriptor.format.vct, version: 1 }, schema: this.descriptor.format.vct, format: "vc+sd-jwt", issuerDid: raw.issuer, issuerKid: raw.issuerKid, subjectDid: raw.subject, holderDid: raw.subject, claims, claimsDigest: await canonicalDigest(claims), descriptorDigest: raw.descriptorDigest, credentialId: payload.jti, issuedAt, notBefore: issuedAt, expiresAt, status: { method: "none", freshnessSeconds: status.freshnessSeconds }, credential: raw.credential };
+    if (status.type !== "none" || status.freshnessSeconds !== this.descriptor.status.freshnessSeconds) throw new CredentialError3("VERIFICATION_FAILED", "Credential status is invalid");
+    return { type: "OpenCredentialsIssuedCredential", version: 1, protocol: this.descriptor.protocol, profile: { id: this.descriptor.profile, version: 1 }, credentialType: { id: this.descriptor.format.vct, version: 1 }, schema: this.descriptor.format.vct, format: "vc+sd-jwt", issuerDid: raw.issuer, issuerKid: raw.issuerKid, subjectDid: raw.subject, holderDid: raw.subject, claims, claimsDigest: await canonicalDigest2(claims), descriptorDigest: raw.descriptorDigest, credentialId: payload.jti, issuedAt, notBefore: issuedAt, expiresAt, status: { method: "none", freshnessSeconds: status.freshnessSeconds }, credential: raw.credential };
   }
   async issuerMetadata(signal) {
     return await this.request("issuer_metadata", { signal });