@eudiplo/sdk-core 1.14.0-main.1b9bbd4 → 1.14.0-main.256e1f0

package/README.md

@@ -82,6 +82,156 @@ await waitForCompletion();
 | `verifyAndWait(options)` | One-liner: create request + wait for result                                               |
 | `issueAndWait(options)`  | One-liner: create offer + wait for result                                                 |
 
+### Digital Credentials API (Browser Native)
+
+The SDK includes utilities for the [Digital Credentials API](https://wicg.github.io/digital-credentials/), enabling browser-native credential presentation without QR codes.
+
+```typescript
+import { isDcApiAvailable, verifyWithDcApi } from '@eudiplo/sdk-core';
+
+// Check if browser supports DC API
+if (isDcApiAvailable()) {
+  const result = await verifyWithDcApi({
+    baseUrl: 'https://eudiplo.example.com',
+    clientId: 'my-demo',
+    clientSecret: 'secret',
+    configId: 'age-over-18',
+  });
+
+  console.log('Verified!', result.session.credentials);
+} else {
+  // Fall back to QR code flow
+  const session = await verifyAndWait({...});
+}
+```
+
+#### DC API Functions
+
+| Function               | Description                                         |
+| ---------------------- | --------------------------------------------------- |
+| `isDcApiAvailable()`   | Check if browser supports Digital Credentials API   |
+| `verifyWithDcApi()`    | Complete verification flow using browser-native API |
+| `createDcApiRequest()` | Create a `DigitalCredentialRequestOptions` object   |
+
+#### Lower-level DC API Usage
+
+```typescript
+import { createDcApiRequest, EudiploClient } from '@eudiplo/sdk-core';
+
+const client = new EudiploClient({...});
+
+// Create presentation request
+const { uri, sessionId } = await client.createPresentationRequest({
+  configId: 'age-over-18',
+  responseType: 'dc-api',
+});
+
+// Create the browser request object
+const request = createDcApiRequest(uri);
+
+// Call the browser API directly
+const credential = await navigator.credentials.get(request);
+
+// Submit the response and get verified session
+const session = await client.submitDcApiResponse(sessionId, credential);
+```
+
+#### Secure Server/Client Deployment (Recommended for Production)
+
+When deploying to production, you should **never expose your client credentials to the browser**. The SDK provides helper functions to split the DC API flow between your server (where credentials are safe) and the browser (where the DC API runs).
+
+**Server-side Functions:**
+| Function | Description |
+| ---------------------- | --------------------------------------------------- |
+| `createDcApiRequestForBrowser()` | Create request on server, return safe data for browser |
+| `submitDcApiWalletResponse()` | Submit wallet response to EUDIPLO from server |
+
+**Browser-side Functions:**
+| Function | Description |
+| ---------------------- | --------------------------------------------------- |
+| `callDcApi()` | Call the native DC API with a request from your server |
+
+##### Example: Express.js Backend + Browser Frontend
+
+**Server (Express.js / Next.js API route):**
+
+```typescript
+import {
+  createDcApiRequestForBrowser,
+  submitDcApiWalletResponse,
+} from '@eudiplo/sdk-core';
+
+// POST /api/start-verification
+app.post('/api/start-verification', async (req, res) => {
+  const requestData = await createDcApiRequestForBrowser({
+    baseUrl: process.env.EUDIPLO_URL,
+    clientId: process.env.EUDIPLO_CLIENT_ID,     // ✅ Safe on server
+    clientSecret: process.env.EUDIPLO_SECRET,   // ✅ Safe on server
+    configId: 'age-over-18',
+  });
+
+  // Only safe data is sent to browser (no secrets)
+  res.json(requestData);
+});
+
+// POST /api/complete-verification
+app.post('/api/complete-verification', async (req, res) => {
+  const { responseUri, walletResponse } = req.body;
+
+  const result = await submitDcApiWalletResponse({
+    responseUri,
+    walletResponse,
+    sendResponse: true,  // Get verified claims back
+  });
+
+  // result.credentials contains the verified data
+  res.json(result);
+});
+```
+
+**Browser (React / vanilla JS):**
+
+```typescript
+import { callDcApi, isDcApiAvailable } from '@eudiplo/sdk-core';
+
+async function verifyAge() {
+  // 1. Get the request from your server (credentials stay on server)
+  const requestData = await fetch('/api/start-verification', {
+    method: 'POST',
+  }).then((r) => r.json());
+
+  // 2. Check DC API support and call it locally
+  if (!isDcApiAvailable()) {
+    throw new Error('Digital Credentials API not supported');
+  }
+
+  const walletResponse = await callDcApi(requestData.requestObject);
+
+  // 3. Send the wallet response back to your server for verification
+  const result = await fetch('/api/complete-verification', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      responseUri: requestData.responseUri,
+      walletResponse,
+    }),
+  }).then((r) => r.json());
+
+  console.log('Verified!', result.credentials);
+  return result;
+}
+```
+
+**What stays where:**
+
+| Data | Location | Safe to expose? |
+|------|----------|-----------------|
+| `clientId` / `clientSecret` | Server only | ❌ Never expose |
+| `requestObject` (signed JWT) | Server → Browser | ✅ Yes |
+| `responseUri` | Server → Browser | ✅ Yes |
+| Wallet response (encrypted VP) | Browser → Server | ✅ Yes |
+| Verified credentials | Server only | Depends on use case |
+
 ### Class-based API (More Control)
 
 ```typescript

package/dist/api/client/client.gen.d.mts

@@ -0,0 +1,5 @@
+import { b as Config, C as Client } from '../../types.gen-DDunhhsd.mjs';
+
+declare const createClient: (config?: Config) => Client;
+
+export { createClient };

package/dist/api/client/client.gen.d.ts

@@ -0,0 +1,5 @@
+import { b as Config, C as Client } from '../../types.gen-DDunhhsd.js';
+
+declare const createClient: (config?: Config) => Client;
+
+export { createClient };