@tinycloud/sdk-core 3.9.0-beta.3 → 3.9.0-beta.5

package/dist/{credential-admission-DCJhDFFv.d.ts → credential-admission-5iS1yUHN.d.ts}

@@ -3,6 +3,8 @@ import { z } from 'zod';
 
 declare const CREDENTIAL_ACQUISITION_PROTOCOL: "tinycloud.credentials/acquisition/v1";
 declare const HOLDER_BINDING_DOMAIN: "tinycloud.credentials/holder-binding/v1";
+/** Signing domain of the held (account, EIP-191) binding. Equal to `ACCOUNT_BINDING_DOMAIN` of held-credentials. */
+declare const ACCOUNT_HOLDER_BINDING_DOMAIN: "tinycloud.credentials/account-binding/v1";
 declare const CREDENTIAL_CONTRACT_VERSION: 1;
 declare const CREDENTIAL_STEP_REGISTRY_VERSION: 1;
 declare const CREDENTIAL_FORMAT: "vc+sd-jwt";
@@ -65,14 +67,20 @@ interface CredentialFlowDescriptor {
         readonly vct: string;
     };
     readonly claims: readonly CredentialClaimDescriptor[];
-    readonly subjectRelationship: "holder_is_subject";
+    readonly subjectRelationship: "holder_is_subject" | "account_is_subject";
     readonly inputs: readonly CredentialInputDescriptor[];
     readonly steps: readonly CredentialStepDescriptor[];
+    /** Ticket: `{EdDSA, holder-binding/v1}` with `holder_is_subject`. Held: `{EIP191, account-binding/v1}` with `account_is_subject`. */
     readonly holderBinding: {
         readonly required: true;
         readonly alg: "EdDSA";
         readonly domain: typeof HOLDER_BINDING_DOMAIN;
         readonly version: 1;
+    } | {
+        readonly required: true;
+        readonly alg: "EIP191";
+        readonly domain: typeof ACCOUNT_HOLDER_BINDING_DOMAIN;
+        readonly version: 1;
     };
     readonly endpoints: Readonly<Record<"request" | "state" | "challenge" | "proof" | "holderBinding" | "holderSignature" | "issue" | "result", CredentialEndpointId>>;
     readonly lifecycle: {
@@ -108,7 +116,8 @@ interface CredentialRequirement {
     readonly claims: Readonly<Record<string, string>>;
     readonly maxAgeSeconds?: number;
 }
-interface CredentialHolderBinding {
+/** The ticket (did:key, EdDSA) holder binding: 19 fields. */
+interface TicketHolderBinding {
     readonly type: typeof HOLDER_BINDING_DOMAIN;
     readonly protocol: typeof CREDENTIAL_ACQUISITION_PROTOCOL;
     readonly requestId: string;
@@ -129,6 +138,13 @@ interface CredentialHolderBinding {
     readonly issuedAt: string;
     readonly expiresAt: string;
 }
+/** The held (account, EIP-191) holder binding: the ticket fields plus `credentialLifetimeSeconds`, a `urn:uuid` v4 `jti`, the account `type`. 20 fields. */
+interface AccountHolderBinding extends Omit<TicketHolderBinding, "type"> {
+    readonly type: typeof ACCOUNT_HOLDER_BINDING_DOMAIN;
+    readonly credentialLifetimeSeconds: 31_536_000;
+}
+/** A holder binding is exactly one of the two shapes, keyed on `type`. */
+type CredentialHolderBinding = TicketHolderBinding | AccountHolderBinding;
 interface IssuerVerificationKey {
     readonly kid: string;
     readonly alg: "EdDSA";
@@ -929,4 +945,4 @@ interface PolicyCredentialAdmissionV4 {
 /** Accountless admission. The request deliberately has no account custody fields. */
 declare function admitPolicyCredentialV4(input: AdmitPolicyCredentialV4Input): Promise<PolicyCredentialAdmissionV4>;
 
-export { type RegisterPolicyV3Input as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyChallengeV3 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialAdmissionV3 as F, type PolicyCredentialAdmissionV4 as G, type PolicyCredentialPresentationV3 as H, type PolicyCredentialPresentationV4 as I, type JsonObject as J, type PolicyCredentialRequirementV1 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicyRootStatusV3 as O, type PolicyEngineRecord as P, type PolicyRootV3 as Q, type PolicySessionUcanFactV1 as R, type SignedObjectSigner as S, type PolicySessionUcanV1 as T, type UnsignedPolicyEngineRecord as U, type PolicyStatus as V, ROOT_REVOCATION_V1_DOMAIN as W, ROOT_REVOCATION_V1_SCHEMA as X, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as Y, ROOT_STATUS_RENEWAL_V1_DOMAIN as Z, ROOT_STATUS_V1_DOMAIN as _, type Policy as a, revokePolicyRootV3 as a$, type RegisterPolicyV3Receipt as a0, type SignCompactUcanAuthorizationInput as a1, type SignCompactUcanRootAuthorizationInput as a2, SignatureMaterialError as a3, type SignatureSuite as a4, SignatureVerificationError as a5, SignedObjectCanonicalizationError as a6, SignedObjectDigestError as a7, type SignedObjectErrorCode as a8, SignedObjectIdError as a9, canonicalizeSignedObjectUnsigned as aA, canonicalizeUnifiedPolicyCapability as aB, compactAttenuationContains as aC, contentSourceDigestHex as aD, createAndSignPolicy as aE, createAndSignPolicyEngineRecord as aF, createAndSignPolicyStatus as aG, createAndSignSignedObject as aH, createCompactPolicyDescendant as aI, createCompactPolicyInvocation as aJ, deriveSignedObjectMaterial as aK, getPolicyRootStatusV3 as aL, issuedCredentialEnvelopeFromVerified as aM, mintPolicySessionV3 as aN, normalizeUnifiedPolicyCapability as aO, parseCompactUcanAuthorization as aP, parsePolicySessionUcan as aQ, parseSignedCompactUcanAttenuation as aR, policyCidFromCanonicalBytes as aS, policyDigestHex as aT, policyIdForDigestHex as aU, policyV2DigestHex as aV, projectUnifiedPolicyCapabilities as aW, projectUnifiedPolicyCapability as aX, registerPolicyV3 as aY, renewPolicyRootStatusV3 as aZ, requestPolicyChallengeV3 as a_, type SignedObjectKind as aa, type SignedObjectMaterial as ab, SignedObjectProfileError as ac, SignedObjectSchemaError as ad, type SignedObjectSignature as ae, type SignedObjectVerificationResult as af, type SignedPolicyObject as ag, SigningKeyBindingError as ah, type UnifiedContentSource as ai, type UnifiedEncryptionCapability as aj, type UnifiedKvCapability as ak, type UnifiedNativeCapability as al, type UnifiedPolicyCapability as am, type UnifiedPolicyV1 as an, type UnifiedPolicyV2 as ao, type UnifiedResourceSelector as ap, type UnsignedPolicy as aq, type UnsignedPolicyCredentialPresentationV4 as ar, type UnsignedPolicyObject as as, type UnsignedPolicyStatus as at, type UnsignedUnifiedPolicyV2 as au, UnsupportedSignatureSuiteError as av, admitPolicyCredentialV3 as aw, admitPolicyCredentialV4 as ax, buildPolicyCredentialPresentationV3 as ay, buildPolicyCredentialPresentationV4 as az, type AdmitPolicyCredentialV3Input as b, signCompactPolicyDescendant as b0, signCompactUcanAuthorization as b1, signCompactUcanRootAuthorization as b2, signPolicyCredentialPresentationV4 as b3, signedObjectIdFor as b4, toSignedObjectError as b5, unifiedNativeProjectionHashHex as b6, unifiedPolicyCapabilityContains as b7, unifiedPolicyCapabilityDigestHex as b8, unifiedPolicyCapabilityFromNative as b9, CREDENTIAL_CONTRACT_VERSION as bA, CREDENTIAL_FORMAT as bB, CREDENTIAL_STEP_REGISTRY_VERSION as bC, type CredentialClaimDescriptor as bD, type CredentialEndpointId as bE, type CredentialInputDescriptor as bF, type CredentialProgressEvent as bG, type CredentialStepDescriptor as bH, type CredentialStepType as bI, type CredentialUxState as bJ, HOLDER_BINDING_DOMAIN as bK, type IssuerVerificationKey as bL, validatePolicyCredentialRequirementV1 as ba, validatePolicyEngineRecordSigned as bb, validatePolicyEngineRecordSignedShape as bc, validatePolicyEngineRecordUnsigned as bd, validatePolicySigned as be, validatePolicySignedShape as bf, validatePolicyStatusSigned as bg, validatePolicyStatusSignedShape as bh, validatePolicyStatusUnsigned as bi, validatePolicyUnsigned as bj, validateUnifiedPolicyV2 as bk, verifyPolicy as bl, verifyPolicyEngineRecord as bm, verifyPolicyRootRevocationV3 as bn, verifyPolicyRootStatusCheckpointV3 as bo, verifyPolicyStatus as bp, verifySignedObject as bq, type CredentialHolderBinding as br, type CredentialFlowDescriptor as bs, type CredentialRequirement as bt, type StoredCredentialRecord as bu, type VerifiedCredential as bv, type CredentialStorageReceipt as bw, type IssuedCredentialEnvelope as bx, type CredentialIssuerMetadata as by, CREDENTIAL_ACQUISITION_PROTOCOL as bz, type AdmitPolicyCredentialV4Input as c, type AttestedEnforcerBindingV2 as d, type BuildPolicyCredentialPresentationV4Input as e, type CompactPolicyDescendantInput as f, type CompactPolicyInvocationInput as g, type CompactUcanAuthorizationV1 as h, EIP191_JCS_SIGNATURE_SUITE as i, LAST_V2_READ_AT as j, POLICY_CAPABILITY_V1_DOMAIN as k, POLICY_CAPABILITY_V1_SCHEMA as l, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as m, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as n, POLICY_ENGINE_RECORD_SCHEMA as o, POLICY_PRESENTATION_V3_DOMAIN as p, POLICY_PRESENTATION_V3_SCHEMA as q, POLICY_PRESENTATION_V4_DOMAIN as r, POLICY_PRESENTATION_V4_SCHEMA as s, POLICY_SCHEMA as t, POLICY_SESSION_UCAN_V1_PROFILE as u, POLICY_STATUS_SCHEMA as v, POLICY_V1_DOMAIN as w, POLICY_V1_SCHEMA as x, POLICY_V2_DOMAIN as y, POLICY_V2_SCHEMA as z };
+export { type RegisterPolicyV3Input as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyChallengeV3 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialAdmissionV3 as F, type PolicyCredentialAdmissionV4 as G, type PolicyCredentialPresentationV3 as H, type PolicyCredentialPresentationV4 as I, type JsonObject as J, type PolicyCredentialRequirementV1 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicyRootStatusV3 as O, type PolicyEngineRecord as P, type PolicyRootV3 as Q, type PolicySessionUcanFactV1 as R, type SignedObjectSigner as S, type PolicySessionUcanV1 as T, type UnsignedPolicyEngineRecord as U, type PolicyStatus as V, ROOT_REVOCATION_V1_DOMAIN as W, ROOT_REVOCATION_V1_SCHEMA as X, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as Y, ROOT_STATUS_RENEWAL_V1_DOMAIN as Z, ROOT_STATUS_V1_DOMAIN as _, type Policy as a, revokePolicyRootV3 as a$, type RegisterPolicyV3Receipt as a0, type SignCompactUcanAuthorizationInput as a1, type SignCompactUcanRootAuthorizationInput as a2, SignatureMaterialError as a3, type SignatureSuite as a4, SignatureVerificationError as a5, SignedObjectCanonicalizationError as a6, SignedObjectDigestError as a7, type SignedObjectErrorCode as a8, SignedObjectIdError as a9, canonicalizeSignedObjectUnsigned as aA, canonicalizeUnifiedPolicyCapability as aB, compactAttenuationContains as aC, contentSourceDigestHex as aD, createAndSignPolicy as aE, createAndSignPolicyEngineRecord as aF, createAndSignPolicyStatus as aG, createAndSignSignedObject as aH, createCompactPolicyDescendant as aI, createCompactPolicyInvocation as aJ, deriveSignedObjectMaterial as aK, getPolicyRootStatusV3 as aL, issuedCredentialEnvelopeFromVerified as aM, mintPolicySessionV3 as aN, normalizeUnifiedPolicyCapability as aO, parseCompactUcanAuthorization as aP, parsePolicySessionUcan as aQ, parseSignedCompactUcanAttenuation as aR, policyCidFromCanonicalBytes as aS, policyDigestHex as aT, policyIdForDigestHex as aU, policyV2DigestHex as aV, projectUnifiedPolicyCapabilities as aW, projectUnifiedPolicyCapability as aX, registerPolicyV3 as aY, renewPolicyRootStatusV3 as aZ, requestPolicyChallengeV3 as a_, type SignedObjectKind as aa, type SignedObjectMaterial as ab, SignedObjectProfileError as ac, SignedObjectSchemaError as ad, type SignedObjectSignature as ae, type SignedObjectVerificationResult as af, type SignedPolicyObject as ag, SigningKeyBindingError as ah, type UnifiedContentSource as ai, type UnifiedEncryptionCapability as aj, type UnifiedKvCapability as ak, type UnifiedNativeCapability as al, type UnifiedPolicyCapability as am, type UnifiedPolicyV1 as an, type UnifiedPolicyV2 as ao, type UnifiedResourceSelector as ap, type UnsignedPolicy as aq, type UnsignedPolicyCredentialPresentationV4 as ar, type UnsignedPolicyObject as as, type UnsignedPolicyStatus as at, type UnsignedUnifiedPolicyV2 as au, UnsupportedSignatureSuiteError as av, admitPolicyCredentialV3 as aw, admitPolicyCredentialV4 as ax, buildPolicyCredentialPresentationV3 as ay, buildPolicyCredentialPresentationV4 as az, type AdmitPolicyCredentialV3Input as b, signCompactPolicyDescendant as b0, signCompactUcanAuthorization as b1, signCompactUcanRootAuthorization as b2, signPolicyCredentialPresentationV4 as b3, signedObjectIdFor as b4, toSignedObjectError as b5, unifiedNativeProjectionHashHex as b6, unifiedPolicyCapabilityContains as b7, unifiedPolicyCapabilityDigestHex as b8, unifiedPolicyCapabilityFromNative as b9, ACCOUNT_HOLDER_BINDING_DOMAIN as bA, type AccountHolderBinding as bB, CREDENTIAL_ACQUISITION_PROTOCOL as bC, CREDENTIAL_CONTRACT_VERSION as bD, CREDENTIAL_FORMAT as bE, CREDENTIAL_STEP_REGISTRY_VERSION as bF, type CredentialClaimDescriptor as bG, type CredentialEndpointId as bH, type CredentialInputDescriptor as bI, type CredentialProgressEvent as bJ, type CredentialStepDescriptor as bK, type CredentialStepType as bL, type CredentialUxState as bM, HOLDER_BINDING_DOMAIN as bN, type IssuerVerificationKey as bO, validatePolicyCredentialRequirementV1 as ba, validatePolicyEngineRecordSigned as bb, validatePolicyEngineRecordSignedShape as bc, validatePolicyEngineRecordUnsigned as bd, validatePolicySigned as be, validatePolicySignedShape as bf, validatePolicyStatusSigned as bg, validatePolicyStatusSignedShape as bh, validatePolicyStatusUnsigned as bi, validatePolicyUnsigned as bj, validateUnifiedPolicyV2 as bk, verifyPolicy as bl, verifyPolicyEngineRecord as bm, verifyPolicyRootRevocationV3 as bn, verifyPolicyRootStatusCheckpointV3 as bo, verifyPolicyStatus as bp, verifySignedObject as bq, type TicketHolderBinding as br, type CredentialHolderBinding as bs, type CredentialFlowDescriptor as bt, type CredentialRequirement as bu, type StoredCredentialRecord as bv, type VerifiedCredential as bw, type CredentialStorageReceipt as bx, type IssuedCredentialEnvelope as by, type CredentialIssuerMetadata as bz, type AdmitPolicyCredentialV4Input as c, type AttestedEnforcerBindingV2 as d, type BuildPolicyCredentialPresentationV4Input as e, type CompactPolicyDescendantInput as f, type CompactPolicyInvocationInput as g, type CompactUcanAuthorizationV1 as h, EIP191_JCS_SIGNATURE_SUITE as i, LAST_V2_READ_AT as j, POLICY_CAPABILITY_V1_DOMAIN as k, POLICY_CAPABILITY_V1_SCHEMA as l, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as m, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as n, POLICY_ENGINE_RECORD_SCHEMA as o, POLICY_PRESENTATION_V3_DOMAIN as p, POLICY_PRESENTATION_V3_SCHEMA as q, POLICY_PRESENTATION_V4_DOMAIN as r, POLICY_PRESENTATION_V4_SCHEMA as s, POLICY_SCHEMA as t, POLICY_SESSION_UCAN_V1_PROFILE as u, POLICY_STATUS_SCHEMA as v, POLICY_V1_DOMAIN as w, POLICY_V1_SCHEMA as x, POLICY_V2_DOMAIN as y, POLICY_V2_SCHEMA as z };

package/dist/{credential-admission-B7_F6Yb3.d.cts → credential-admission-CB37nOWk.d.cts}

@@ -3,6 +3,8 @@ import { z } from 'zod';
 
 declare const CREDENTIAL_ACQUISITION_PROTOCOL: "tinycloud.credentials/acquisition/v1";
 declare const HOLDER_BINDING_DOMAIN: "tinycloud.credentials/holder-binding/v1";
+/** Signing domain of the held (account, EIP-191) binding. Equal to `ACCOUNT_BINDING_DOMAIN` of held-credentials. */
+declare const ACCOUNT_HOLDER_BINDING_DOMAIN: "tinycloud.credentials/account-binding/v1";
 declare const CREDENTIAL_CONTRACT_VERSION: 1;
 declare const CREDENTIAL_STEP_REGISTRY_VERSION: 1;
 declare const CREDENTIAL_FORMAT: "vc+sd-jwt";
@@ -65,14 +67,20 @@ interface CredentialFlowDescriptor {
         readonly vct: string;
     };
     readonly claims: readonly CredentialClaimDescriptor[];
-    readonly subjectRelationship: "holder_is_subject";
+    readonly subjectRelationship: "holder_is_subject" | "account_is_subject";
     readonly inputs: readonly CredentialInputDescriptor[];
     readonly steps: readonly CredentialStepDescriptor[];
+    /** Ticket: `{EdDSA, holder-binding/v1}` with `holder_is_subject`. Held: `{EIP191, account-binding/v1}` with `account_is_subject`. */
     readonly holderBinding: {
         readonly required: true;
         readonly alg: "EdDSA";
         readonly domain: typeof HOLDER_BINDING_DOMAIN;
         readonly version: 1;
+    } | {
+        readonly required: true;
+        readonly alg: "EIP191";
+        readonly domain: typeof ACCOUNT_HOLDER_BINDING_DOMAIN;
+        readonly version: 1;
     };
     readonly endpoints: Readonly<Record<"request" | "state" | "challenge" | "proof" | "holderBinding" | "holderSignature" | "issue" | "result", CredentialEndpointId>>;
     readonly lifecycle: {
@@ -108,7 +116,8 @@ interface CredentialRequirement {
     readonly claims: Readonly<Record<string, string>>;
     readonly maxAgeSeconds?: number;
 }
-interface CredentialHolderBinding {
+/** The ticket (did:key, EdDSA) holder binding: 19 fields. */
+interface TicketHolderBinding {
     readonly type: typeof HOLDER_BINDING_DOMAIN;
     readonly protocol: typeof CREDENTIAL_ACQUISITION_PROTOCOL;
     readonly requestId: string;
@@ -129,6 +138,13 @@ interface CredentialHolderBinding {
     readonly issuedAt: string;
     readonly expiresAt: string;
 }
+/** The held (account, EIP-191) holder binding: the ticket fields plus `credentialLifetimeSeconds`, a `urn:uuid` v4 `jti`, the account `type`. 20 fields. */
+interface AccountHolderBinding extends Omit<TicketHolderBinding, "type"> {
+    readonly type: typeof ACCOUNT_HOLDER_BINDING_DOMAIN;
+    readonly credentialLifetimeSeconds: 31_536_000;
+}
+/** A holder binding is exactly one of the two shapes, keyed on `type`. */
+type CredentialHolderBinding = TicketHolderBinding | AccountHolderBinding;
 interface IssuerVerificationKey {
     readonly kid: string;
     readonly alg: "EdDSA";
@@ -929,4 +945,4 @@ interface PolicyCredentialAdmissionV4 {
 /** Accountless admission. The request deliberately has no account custody fields. */
 declare function admitPolicyCredentialV4(input: AdmitPolicyCredentialV4Input): Promise<PolicyCredentialAdmissionV4>;
 
-export { type RegisterPolicyV3Input as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyChallengeV3 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialAdmissionV3 as F, type PolicyCredentialAdmissionV4 as G, type PolicyCredentialPresentationV3 as H, type PolicyCredentialPresentationV4 as I, type JsonObject as J, type PolicyCredentialRequirementV1 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicyRootStatusV3 as O, type PolicyEngineRecord as P, type PolicyRootV3 as Q, type PolicySessionUcanFactV1 as R, type SignedObjectSigner as S, type PolicySessionUcanV1 as T, type UnsignedPolicyEngineRecord as U, type PolicyStatus as V, ROOT_REVOCATION_V1_DOMAIN as W, ROOT_REVOCATION_V1_SCHEMA as X, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as Y, ROOT_STATUS_RENEWAL_V1_DOMAIN as Z, ROOT_STATUS_V1_DOMAIN as _, type Policy as a, revokePolicyRootV3 as a$, type RegisterPolicyV3Receipt as a0, type SignCompactUcanAuthorizationInput as a1, type SignCompactUcanRootAuthorizationInput as a2, SignatureMaterialError as a3, type SignatureSuite as a4, SignatureVerificationError as a5, SignedObjectCanonicalizationError as a6, SignedObjectDigestError as a7, type SignedObjectErrorCode as a8, SignedObjectIdError as a9, canonicalizeSignedObjectUnsigned as aA, canonicalizeUnifiedPolicyCapability as aB, compactAttenuationContains as aC, contentSourceDigestHex as aD, createAndSignPolicy as aE, createAndSignPolicyEngineRecord as aF, createAndSignPolicyStatus as aG, createAndSignSignedObject as aH, createCompactPolicyDescendant as aI, createCompactPolicyInvocation as aJ, deriveSignedObjectMaterial as aK, getPolicyRootStatusV3 as aL, issuedCredentialEnvelopeFromVerified as aM, mintPolicySessionV3 as aN, normalizeUnifiedPolicyCapability as aO, parseCompactUcanAuthorization as aP, parsePolicySessionUcan as aQ, parseSignedCompactUcanAttenuation as aR, policyCidFromCanonicalBytes as aS, policyDigestHex as aT, policyIdForDigestHex as aU, policyV2DigestHex as aV, projectUnifiedPolicyCapabilities as aW, projectUnifiedPolicyCapability as aX, registerPolicyV3 as aY, renewPolicyRootStatusV3 as aZ, requestPolicyChallengeV3 as a_, type SignedObjectKind as aa, type SignedObjectMaterial as ab, SignedObjectProfileError as ac, SignedObjectSchemaError as ad, type SignedObjectSignature as ae, type SignedObjectVerificationResult as af, type SignedPolicyObject as ag, SigningKeyBindingError as ah, type UnifiedContentSource as ai, type UnifiedEncryptionCapability as aj, type UnifiedKvCapability as ak, type UnifiedNativeCapability as al, type UnifiedPolicyCapability as am, type UnifiedPolicyV1 as an, type UnifiedPolicyV2 as ao, type UnifiedResourceSelector as ap, type UnsignedPolicy as aq, type UnsignedPolicyCredentialPresentationV4 as ar, type UnsignedPolicyObject as as, type UnsignedPolicyStatus as at, type UnsignedUnifiedPolicyV2 as au, UnsupportedSignatureSuiteError as av, admitPolicyCredentialV3 as aw, admitPolicyCredentialV4 as ax, buildPolicyCredentialPresentationV3 as ay, buildPolicyCredentialPresentationV4 as az, type AdmitPolicyCredentialV3Input as b, signCompactPolicyDescendant as b0, signCompactUcanAuthorization as b1, signCompactUcanRootAuthorization as b2, signPolicyCredentialPresentationV4 as b3, signedObjectIdFor as b4, toSignedObjectError as b5, unifiedNativeProjectionHashHex as b6, unifiedPolicyCapabilityContains as b7, unifiedPolicyCapabilityDigestHex as b8, unifiedPolicyCapabilityFromNative as b9, CREDENTIAL_CONTRACT_VERSION as bA, CREDENTIAL_FORMAT as bB, CREDENTIAL_STEP_REGISTRY_VERSION as bC, type CredentialClaimDescriptor as bD, type CredentialEndpointId as bE, type CredentialInputDescriptor as bF, type CredentialProgressEvent as bG, type CredentialStepDescriptor as bH, type CredentialStepType as bI, type CredentialUxState as bJ, HOLDER_BINDING_DOMAIN as bK, type IssuerVerificationKey as bL, validatePolicyCredentialRequirementV1 as ba, validatePolicyEngineRecordSigned as bb, validatePolicyEngineRecordSignedShape as bc, validatePolicyEngineRecordUnsigned as bd, validatePolicySigned as be, validatePolicySignedShape as bf, validatePolicyStatusSigned as bg, validatePolicyStatusSignedShape as bh, validatePolicyStatusUnsigned as bi, validatePolicyUnsigned as bj, validateUnifiedPolicyV2 as bk, verifyPolicy as bl, verifyPolicyEngineRecord as bm, verifyPolicyRootRevocationV3 as bn, verifyPolicyRootStatusCheckpointV3 as bo, verifyPolicyStatus as bp, verifySignedObject as bq, type CredentialHolderBinding as br, type CredentialFlowDescriptor as bs, type CredentialRequirement as bt, type StoredCredentialRecord as bu, type VerifiedCredential as bv, type CredentialStorageReceipt as bw, type IssuedCredentialEnvelope as bx, type CredentialIssuerMetadata as by, CREDENTIAL_ACQUISITION_PROTOCOL as bz, type AdmitPolicyCredentialV4Input as c, type AttestedEnforcerBindingV2 as d, type BuildPolicyCredentialPresentationV4Input as e, type CompactPolicyDescendantInput as f, type CompactPolicyInvocationInput as g, type CompactUcanAuthorizationV1 as h, EIP191_JCS_SIGNATURE_SUITE as i, LAST_V2_READ_AT as j, POLICY_CAPABILITY_V1_DOMAIN as k, POLICY_CAPABILITY_V1_SCHEMA as l, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as m, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as n, POLICY_ENGINE_RECORD_SCHEMA as o, POLICY_PRESENTATION_V3_DOMAIN as p, POLICY_PRESENTATION_V3_SCHEMA as q, POLICY_PRESENTATION_V4_DOMAIN as r, POLICY_PRESENTATION_V4_SCHEMA as s, POLICY_SCHEMA as t, POLICY_SESSION_UCAN_V1_PROFILE as u, POLICY_STATUS_SCHEMA as v, POLICY_V1_DOMAIN as w, POLICY_V1_SCHEMA as x, POLICY_V2_DOMAIN as y, POLICY_V2_SCHEMA as z };
+export { type RegisterPolicyV3Input as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyChallengeV3 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialAdmissionV3 as F, type PolicyCredentialAdmissionV4 as G, type PolicyCredentialPresentationV3 as H, type PolicyCredentialPresentationV4 as I, type JsonObject as J, type PolicyCredentialRequirementV1 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicyRootStatusV3 as O, type PolicyEngineRecord as P, type PolicyRootV3 as Q, type PolicySessionUcanFactV1 as R, type SignedObjectSigner as S, type PolicySessionUcanV1 as T, type UnsignedPolicyEngineRecord as U, type PolicyStatus as V, ROOT_REVOCATION_V1_DOMAIN as W, ROOT_REVOCATION_V1_SCHEMA as X, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as Y, ROOT_STATUS_RENEWAL_V1_DOMAIN as Z, ROOT_STATUS_V1_DOMAIN as _, type Policy as a, revokePolicyRootV3 as a$, type RegisterPolicyV3Receipt as a0, type SignCompactUcanAuthorizationInput as a1, type SignCompactUcanRootAuthorizationInput as a2, SignatureMaterialError as a3, type SignatureSuite as a4, SignatureVerificationError as a5, SignedObjectCanonicalizationError as a6, SignedObjectDigestError as a7, type SignedObjectErrorCode as a8, SignedObjectIdError as a9, canonicalizeSignedObjectUnsigned as aA, canonicalizeUnifiedPolicyCapability as aB, compactAttenuationContains as aC, contentSourceDigestHex as aD, createAndSignPolicy as aE, createAndSignPolicyEngineRecord as aF, createAndSignPolicyStatus as aG, createAndSignSignedObject as aH, createCompactPolicyDescendant as aI, createCompactPolicyInvocation as aJ, deriveSignedObjectMaterial as aK, getPolicyRootStatusV3 as aL, issuedCredentialEnvelopeFromVerified as aM, mintPolicySessionV3 as aN, normalizeUnifiedPolicyCapability as aO, parseCompactUcanAuthorization as aP, parsePolicySessionUcan as aQ, parseSignedCompactUcanAttenuation as aR, policyCidFromCanonicalBytes as aS, policyDigestHex as aT, policyIdForDigestHex as aU, policyV2DigestHex as aV, projectUnifiedPolicyCapabilities as aW, projectUnifiedPolicyCapability as aX, registerPolicyV3 as aY, renewPolicyRootStatusV3 as aZ, requestPolicyChallengeV3 as a_, type SignedObjectKind as aa, type SignedObjectMaterial as ab, SignedObjectProfileError as ac, SignedObjectSchemaError as ad, type SignedObjectSignature as ae, type SignedObjectVerificationResult as af, type SignedPolicyObject as ag, SigningKeyBindingError as ah, type UnifiedContentSource as ai, type UnifiedEncryptionCapability as aj, type UnifiedKvCapability as ak, type UnifiedNativeCapability as al, type UnifiedPolicyCapability as am, type UnifiedPolicyV1 as an, type UnifiedPolicyV2 as ao, type UnifiedResourceSelector as ap, type UnsignedPolicy as aq, type UnsignedPolicyCredentialPresentationV4 as ar, type UnsignedPolicyObject as as, type UnsignedPolicyStatus as at, type UnsignedUnifiedPolicyV2 as au, UnsupportedSignatureSuiteError as av, admitPolicyCredentialV3 as aw, admitPolicyCredentialV4 as ax, buildPolicyCredentialPresentationV3 as ay, buildPolicyCredentialPresentationV4 as az, type AdmitPolicyCredentialV3Input as b, signCompactPolicyDescendant as b0, signCompactUcanAuthorization as b1, signCompactUcanRootAuthorization as b2, signPolicyCredentialPresentationV4 as b3, signedObjectIdFor as b4, toSignedObjectError as b5, unifiedNativeProjectionHashHex as b6, unifiedPolicyCapabilityContains as b7, unifiedPolicyCapabilityDigestHex as b8, unifiedPolicyCapabilityFromNative as b9, ACCOUNT_HOLDER_BINDING_DOMAIN as bA, type AccountHolderBinding as bB, CREDENTIAL_ACQUISITION_PROTOCOL as bC, CREDENTIAL_CONTRACT_VERSION as bD, CREDENTIAL_FORMAT as bE, CREDENTIAL_STEP_REGISTRY_VERSION as bF, type CredentialClaimDescriptor as bG, type CredentialEndpointId as bH, type CredentialInputDescriptor as bI, type CredentialProgressEvent as bJ, type CredentialStepDescriptor as bK, type CredentialStepType as bL, type CredentialUxState as bM, HOLDER_BINDING_DOMAIN as bN, type IssuerVerificationKey as bO, validatePolicyCredentialRequirementV1 as ba, validatePolicyEngineRecordSigned as bb, validatePolicyEngineRecordSignedShape as bc, validatePolicyEngineRecordUnsigned as bd, validatePolicySigned as be, validatePolicySignedShape as bf, validatePolicyStatusSigned as bg, validatePolicyStatusSignedShape as bh, validatePolicyStatusUnsigned as bi, validatePolicyUnsigned as bj, validateUnifiedPolicyV2 as bk, verifyPolicy as bl, verifyPolicyEngineRecord as bm, verifyPolicyRootRevocationV3 as bn, verifyPolicyRootStatusCheckpointV3 as bo, verifyPolicyStatus as bp, verifySignedObject as bq, type TicketHolderBinding as br, type CredentialHolderBinding as bs, type CredentialFlowDescriptor as bt, type CredentialRequirement as bu, type StoredCredentialRecord as bv, type VerifiedCredential as bw, type CredentialStorageReceipt as bx, type IssuedCredentialEnvelope as by, type CredentialIssuerMetadata as bz, type AdmitPolicyCredentialV4Input as c, type AttestedEnforcerBindingV2 as d, type BuildPolicyCredentialPresentationV4Input as e, type CompactPolicyDescendantInput as f, type CompactPolicyInvocationInput as g, type CompactUcanAuthorizationV1 as h, EIP191_JCS_SIGNATURE_SUITE as i, LAST_V2_READ_AT as j, POLICY_CAPABILITY_V1_DOMAIN as k, POLICY_CAPABILITY_V1_SCHEMA as l, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as m, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as n, POLICY_ENGINE_RECORD_SCHEMA as o, POLICY_PRESENTATION_V3_DOMAIN as p, POLICY_PRESENTATION_V3_SCHEMA as q, POLICY_PRESENTATION_V4_DOMAIN as r, POLICY_PRESENTATION_V4_SCHEMA as s, POLICY_SCHEMA as t, POLICY_SESSION_UCAN_V1_PROFILE as u, POLICY_STATUS_SCHEMA as v, POLICY_V1_DOMAIN as w, POLICY_V1_SCHEMA as x, POLICY_V2_DOMAIN as y, POLICY_V2_SCHEMA as z };

package/dist/index.cjs

@@ -39,6 +39,7 @@ var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ACCOUNT_HOLDER_BINDING_DOMAIN: () => ACCOUNT_HOLDER_BINDING_DOMAIN,
   ACCOUNT_INDEX_SCHEMA: () => import_bootstrap4.ACCOUNT_INDEX_SCHEMA,
   ACCOUNT_MANIFEST_PERMISSIONS: () => import_bootstrap4.ACCOUNT_MANIFEST_PERMISSIONS,
   ACCOUNT_REGISTRY_PATH: () => ACCOUNT_REGISTRY_PATH,
@@ -822,6 +823,7 @@ var CREDENTIAL_ERROR_CODES = [
   "HOLDER_MISMATCH",
   "ISSUER_UNREADY",
   "OFFLINE",
+  "PERMISSION_DENIED",
   "POPUP_BLOCKED",
   "PROOF_REJECTED",
   "REQUEST_EXPIRED",
@@ -864,6 +866,7 @@ function credentialError(value, fallbackCode = "VERIFICATION_FAILED") {
 // src/credentials/types.ts
 var CREDENTIAL_ACQUISITION_PROTOCOL = "tinycloud.credentials/acquisition/v1";
 var HOLDER_BINDING_DOMAIN = "tinycloud.credentials/holder-binding/v1";
+var ACCOUNT_HOLDER_BINDING_DOMAIN = "tinycloud.credentials/account-binding/v1";
 var CREDENTIAL_CONTRACT_VERSION = 1;
 var CREDENTIAL_STEP_REGISTRY_VERSION = 1;
 var CREDENTIAL_FORMAT = "vc+sd-jwt";
@@ -871,18 +874,22 @@ var CREDENTIAL_FORMAT = "vc+sd-jwt";
 // src/credentials/binding.ts
 var OPAQUE = /^[A-Za-z0-9_-]{16,128}$/;
 var DIGEST = /^[A-Za-z0-9_-]{43}$/;
+var JTI_V4 = /^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var ACCOUNT_CREDENTIAL_LIFETIME_SECONDS = 31536e3;
 function createHolderBinding(input) {
   return validateCredentialHolderBinding({ type: HOLDER_BINDING_DOMAIN, protocol: CREDENTIAL_ACQUISITION_PROTOCOL, ...input });
 }
 function validateCredentialHolderBinding(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CredentialError("REQUEST_SUBSTITUTED", "Holder binding is invalid");
   const raw = value;
-  const fields = ["type", "protocol", "requestId", "profile", "profileVersion", "descriptorDigest", "requirementDigest", "issuer", "issuerKid", "holderDid", "normalizedClaimsDigest", "challengeNonce", "audience", "openerOrigin", "completionOrigin", "completionContext", "jti", "issuedAt", "expiresAt"].sort();
+  const account = raw.type === ACCOUNT_HOLDER_BINDING_DOMAIN;
+  const fields = ["type", "protocol", "requestId", "profile", "profileVersion", "descriptorDigest", "requirementDigest", "issuer", "issuerKid", "holderDid", "normalizedClaimsDigest", "challengeNonce", "audience", "openerOrigin", "completionOrigin", "completionContext", "jti", "issuedAt", "expiresAt", ...account ? ["credentialLifetimeSeconds"] : []].sort();
   const actual = Object.keys(raw).sort();
-  if (actual.length !== fields.length || actual.some((key, index) => key !== fields[index]) || raw.type !== HOLDER_BINDING_DOMAIN || raw.protocol !== CREDENTIAL_ACQUISITION_PROTOCOL || raw.profileVersion !== 1) throw new CredentialError("REQUEST_SUBSTITUTED", "Holder binding version is unsupported");
+  if (actual.length !== fields.length || actual.some((key, index) => key !== fields[index]) || !account && raw.type !== HOLDER_BINDING_DOMAIN || account && raw.credentialLifetimeSeconds !== ACCOUNT_CREDENTIAL_LIFETIME_SECONDS || raw.protocol !== CREDENTIAL_ACQUISITION_PROTOCOL || raw.profileVersion !== 1) throw new CredentialError("REQUEST_SUBSTITUTED", "Holder binding version is unsupported");
   for (const name2 of ["requestId", "profile", "descriptorDigest", "requirementDigest", "issuer", "issuerKid", "holderDid", "normalizedClaimsDigest", "challengeNonce", "audience", "openerOrigin", "completionOrigin", "completionContext", "jti", "issuedAt", "expiresAt"]) if (typeof raw[name2] !== "string" || raw[name2].length === 0) throw new CredentialError("REQUEST_SUBSTITUTED", "Holder binding field is invalid");
   for (const name2 of ["descriptorDigest", "requirementDigest", "normalizedClaimsDigest"]) if (!DIGEST.test(raw[name2])) throw new CredentialError("REQUEST_SUBSTITUTED", "Holder binding digest is invalid");
-  for (const name2 of ["requestId", "challengeNonce", "jti"]) if (!OPAQUE.test(raw[name2])) throw new CredentialError("REQUEST_SUBSTITUTED", "Holder binding nonce is invalid");
+  for (const name2 of ["requestId", "challengeNonce"]) if (!OPAQUE.test(raw[name2])) throw new CredentialError("REQUEST_SUBSTITUTED", "Holder binding nonce is invalid");
+  if (!(account ? JTI_V4 : OPAQUE).test(raw.jti)) throw new CredentialError("REQUEST_SUBSTITUTED", "Holder binding nonce is invalid");
   for (const name2 of ["openerOrigin", "completionOrigin"]) {
     let url;
     try {
@@ -901,7 +908,8 @@ function holderBindingCanonicalBytes(binding) {
   return new TextEncoder().encode(jcsCanonicalize(validateCredentialHolderBinding(binding)));
 }
 function holderBindingSigningBytes(binding) {
-  return new TextEncoder().encode(`${HOLDER_BINDING_DOMAIN}\0${jcsCanonicalize(validateCredentialHolderBinding(binding))}`);
+  const valid = validateCredentialHolderBinding(binding);
+  return new TextEncoder().encode(`${valid.type}\0${jcsCanonicalize(valid)}`);
 }
 
 // src/credentials/descriptor.ts
@@ -991,7 +999,7 @@ function validateCredentialFlowDescriptor(value) {
     if (claimNames.has(name2) || claim.matching !== "normalized_exact" || typeof claim.selectiveDisclosure !== "boolean") fail("claim is invalid");
     claimNames.add(name2);
   }
-  if (raw.subjectRelationship !== "holder_is_subject") unsupported("Subject relationship is unsupported");
+  if (raw.subjectRelationship !== "holder_is_subject" && raw.subjectRelationship !== "account_is_subject") unsupported("Subject relationship is unsupported");
   if (!Array.isArray(raw.inputs) || raw.inputs.length === 0 || raw.inputs.length > 64) fail("inputs are invalid");
   const inputIds = /* @__PURE__ */ new Set();
   for (const value2 of raw.inputs) {
@@ -1025,7 +1033,8 @@ function validateCredentialFlowDescriptor(value) {
   if (!raw.steps.some((step) => step.type === "holder_signature")) fail("holder_signature is required");
   const binding = object(raw.holderBinding, "holderBinding");
   exact(binding, ["required", "alg", "domain", "version"], "holderBinding");
-  if (binding.required !== true || binding.alg !== "EdDSA" || binding.domain !== HOLDER_BINDING_DOMAIN || binding.version !== 1) unsupported("Holder binding is unsupported");
+  const held = raw.subjectRelationship === "account_is_subject";
+  if (binding.required !== true || binding.alg !== (held ? "EIP191" : "EdDSA") || binding.domain !== (held ? ACCOUNT_HOLDER_BINDING_DOMAIN : HOLDER_BINDING_DOMAIN) || binding.version !== 1) unsupported("Holder binding is unsupported");
   const endpoints = object(raw.endpoints, "endpoints");
   exact(endpoints, Object.keys(ENDPOINTS), "endpoints");
   for (const [name2, id] of Object.entries(ENDPOINTS)) if (endpoints[name2] !== id) fail("endpoint identifiers must use the registered vocabulary");