@tinycloud/node-sdk 3.9.0-beta.3 → 3.9.0-beta.4

package/dist/credential-pending-store.cjs

@@ -42,15 +42,17 @@ var fs = __toESM(require("fs"), 1);
 var path = __toESM(require("path"), 1);
 
 // src/credentials/email-proof.ts
-var import_sdk_core3 = require("@tinycloud/sdk-core");
+var import_sdk_core5 = require("@tinycloud/sdk-core");
+var import_held_credentials = require("@tinycloud/sdk-core/held-credentials");
 
 // src/credentials/interpreter.ts
-var import_sdk_core = require("@tinycloud/sdk-core");
+var import_sdk_core3 = require("@tinycloud/sdk-core");
 
-// src/credentials/transport.ts
+// src/credentials/held-binding.ts
 var import_sdk_core2 = require("@tinycloud/sdk-core");
 
-// src/credentials/email-proof.ts
+// src/credentials/pins.ts
+var import_sdk_core = require("@tinycloud/sdk-core");
 var EMAIL_PROOF_PINS = Object.freeze({
   witnessOrigin: "https://witness.credentials.org",
   issuerDid: "did:web:issuer.credentials.org",
@@ -58,6 +60,25 @@ var EMAIL_PROOF_PINS = Object.freeze({
   issuerX: "eEJI4xEobto4HtQ7Pg9R1vBOwcpfGRTlXDG5QfqLnGQ",
   descriptorDigest: "1tg-qphmKBVtNwzVg9xyz-xxqt_xtMXAsQyXw46m8S0"
 });
+var HELD_ACCOUNT_BINDING_PINS = Object.freeze({
+  type: import_sdk_core.ACCOUNT_HOLDER_BINDING_DOMAIN,
+  protocol: "tinycloud.credentials/acquisition/v1",
+  profile: "tinycloud.email-held/v1",
+  profileVersion: 1,
+  descriptorDigest: "dc3_DuvzipXwYkTfjKqTaK1c3VS0YSPnaBsYSQriC0w",
+  issuer: EMAIL_PROOF_PINS.issuerDid,
+  issuerKid: EMAIL_PROOF_PINS.issuerKid,
+  audience: "tinycloud://credentials",
+  openerOrigin: "https://localhost",
+  completionOrigin: "https://localhost",
+  completionContext: "sdk-acquisition",
+  credentialLifetimeSeconds: 31536e3
+});
+
+// src/credentials/transport.ts
+var import_sdk_core4 = require("@tinycloud/sdk-core");
+
+// src/credentials/email-proof.ts
 var EMAIL_PROOF_PENDING_MAX_MS = 15 * 6e4;
 var DISCOVERY_URL = `${EMAIL_PROOF_PINS.witnessOrigin}/.well-known/opencredentials`;
 var EMAIL_PROOF_ISSUER_KEYS = [
@@ -71,9 +92,11 @@ var EMAIL_PROOF_ISSUER_KEYS = [
 ];
 var PROFILE_PINS = {
   "tinycloud.email-proof/v1": { descriptorDigest: EMAIL_PROOF_PINS.descriptorDigest, requiredStep: "mailbox_otp", enabled: true },
-  // Held profile: disabled until the held wire path ships. Requests refuse with PROFILE_UNAVAILABLE before any network call.
-  "tinycloud.email-held/v1": { descriptorDigest: "dc3_DuvzipXwYkTfjKqTaK1c3VS0YSPnaBsYSQriC0w", requiredStep: "mailbox_otp", enabled: false }
+  // Held profile: disabled by default. A call enables it only with the per-call opt-in `allowHeldProfile: true` (see `profilePin`).
+  // Without it, requests refuse with PROFILE_UNAVAILABLE before any network call.
+  "tinycloud.email-held/v1": { descriptorDigest: HELD_ACCOUNT_BINDING_PINS.descriptorDigest, requiredStep: "mailbox_otp", enabled: false }
 };
+var OPENER_ORIGIN = HELD_ACCOUNT_BINDING_PINS.openerOrigin;
 var INSPECT = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
 function restoreEmailProofPending(fields) {
   const shown = {
@@ -87,7 +110,8 @@ function restoreEmailProofPending(fields) {
     requirementDigest: fields.requirementDigest,
     openerOrigin: fields.openerOrigin,
     createdAt: fields.createdAt,
-    expiresAt: fields.expiresAt
+    expiresAt: fields.expiresAt,
+    ...fields.serverExpiresAt === void 0 ? {} : { serverExpiresAt: fields.serverExpiresAt }
   };
   const pending = { ...shown };
   hide(pending, "verifier", fields.verifier);
@@ -130,6 +154,7 @@ var FILE_TEXT_FIELDS = [
   "createdAt",
   "expiresAt"
 ];
+var HELD_PROFILE_ID = "tinycloud.email-held/v1";
 var secrets = /* @__PURE__ */ new WeakMap();
 function sha256Hex(text) {
   return (0, import_node_crypto.createHash)("sha256").update(text).digest("hex");
@@ -284,6 +309,11 @@ function isFileRecord(value) {
   if (record.type !== "TinyCloudEmailProofPending" || record.version !== 1) return false;
   if (!FILE_TEXT_FIELDS.every((field) => typeof record[field] === "string")) return false;
   if (record.secret !== void 0 && (typeof record.secret !== "string" || !BASE64.test(record.secret))) return false;
+  if (record.profile === HELD_PROFILE_ID) {
+    if (typeof record.serverExpiresAt !== "string" || !Number.isFinite(Date.parse(record.serverExpiresAt))) return false;
+  } else if (record.serverExpiresAt !== void 0) {
+    return false;
+  }
   return Number.isFinite(Date.parse(record.createdAt)) && Number.isFinite(Date.parse(record.expiresAt));
 }
 function restoreFromFile(record) {
@@ -299,7 +329,8 @@ function restoreFromFile(record) {
     requirementDigest: record.requirementDigest,
     openerOrigin: record.openerOrigin,
     createdAt: record.createdAt,
-    expiresAt: record.expiresAt
+    expiresAt: record.expiresAt,
+    ...record.serverExpiresAt === void 0 ? {} : { serverExpiresAt: record.serverExpiresAt }
   });
 }
 function readEntry(home, file, now) {
@@ -345,6 +376,7 @@ function toFileRecord(pending, secret) {
     openerOrigin: pending.openerOrigin,
     createdAt: pending.createdAt,
     expiresAt: pending.expiresAt,
+    ...pending.serverExpiresAt === void 0 ? {} : { serverExpiresAt: pending.serverExpiresAt },
     ...secret === void 0 ? {} : { secret: Buffer.from(secret).toString("base64") }
   };
 }
@@ -375,7 +407,11 @@ function createFileEmailProofPendingStore(options) {
         if (exceedsWindow(pending)) {
           throw new PendingStoreError("credential-store-invalid", "Pending record expires beyond the 15-minute window and was rejected.");
         }
-        writeOwnerOnly(home, pendingFile(home, pending.requestId), toFileRecord(pending, putOptions?.secret));
+        const record = toFileRecord(pending, putOptions?.secret);
+        if (!isFileRecord(record)) {
+          throw new PendingStoreError("credential-store-invalid", "Pending record is not a valid held or ticket record and was rejected.");
+        }
+        writeOwnerOnly(home, pendingFile(home, pending.requestId), record);
       });
     },
     async delete(requestId) {