@tinycloud/node-sdk 3.9.0-beta.3 → 3.9.0-beta.5

package/dist/credential-pending-store.js

@@ -5,30 +5,59 @@ import * as path from "path";
 
 // src/credentials/email-proof.ts
 import {
-  canonicalDigest as canonicalDigest2,
+  canonicalDigest as canonicalDigest3,
   createEmailCredentialRequirement,
   credentialError,
   credentialRequirementDigest,
-  CredentialError as CredentialError3,
+  CredentialError as CredentialError4,
   descriptorSatisfiesRequirement,
   encodeBase64Url as encodeBase64Url3,
   sha256Base64Url as sha256Base64Url2,
   validateCredentialFlowDescriptor,
+  validateCredentialRequirement,
   verifyIssuedCredential
 } from "@tinycloud/sdk-core";
+import { parseIssuerSet, parsePkhDid, toChecksumAddress, verifyHeldEmailCredential } from "@tinycloud/sdk-core/held-credentials";
 
 // src/credentials/interpreter.ts
 import {
-  CredentialError,
+  CredentialError as CredentialError2,
   encodeBase64Url,
   holderBindingSigningBytes,
   validateCredentialHolderBinding
 } from "@tinycloud/sdk-core";
 
+// src/credentials/held-binding.ts
+import { canonicalDigest, CredentialError } from "@tinycloud/sdk-core";
+
+// src/credentials/pins.ts
+import { ACCOUNT_HOLDER_BINDING_DOMAIN } from "@tinycloud/sdk-core";
+var EMAIL_PROOF_PINS = Object.freeze({
+  witnessOrigin: "https://witness.credentials.org",
+  issuerDid: "did:web:issuer.credentials.org",
+  issuerKid: "did:web:issuer.credentials.org#controller",
+  issuerX: "eEJI4xEobto4HtQ7Pg9R1vBOwcpfGRTlXDG5QfqLnGQ",
+  descriptorDigest: "1tg-qphmKBVtNwzVg9xyz-xxqt_xtMXAsQyXw46m8S0"
+});
+var HELD_ACCOUNT_BINDING_PINS = Object.freeze({
+  type: ACCOUNT_HOLDER_BINDING_DOMAIN,
+  protocol: "tinycloud.credentials/acquisition/v1",
+  profile: "tinycloud.email-held/v1",
+  profileVersion: 1,
+  descriptorDigest: "dc3_DuvzipXwYkTfjKqTaK1c3VS0YSPnaBsYSQriC0w",
+  issuer: EMAIL_PROOF_PINS.issuerDid,
+  issuerKid: EMAIL_PROOF_PINS.issuerKid,
+  audience: "tinycloud://credentials",
+  openerOrigin: "https://localhost",
+  completionOrigin: "https://localhost",
+  completionContext: "sdk-acquisition",
+  credentialLifetimeSeconds: 31536e3
+});
+
 // src/credentials/transport.ts
 import {
-  CredentialError as CredentialError2,
-  canonicalDigest,
+  CredentialError as CredentialError3,
+  canonicalDigest as canonicalDigest2,
   credentialEndpointPath,
   decodeBase64Url,
   encodeBase64Url as encodeBase64Url2,
@@ -38,13 +67,6 @@ import {
 } from "@tinycloud/sdk-core";
 
 // src/credentials/email-proof.ts
-var EMAIL_PROOF_PINS = Object.freeze({
-  witnessOrigin: "https://witness.credentials.org",
-  issuerDid: "did:web:issuer.credentials.org",
-  issuerKid: "did:web:issuer.credentials.org#controller",
-  issuerX: "eEJI4xEobto4HtQ7Pg9R1vBOwcpfGRTlXDG5QfqLnGQ",
-  descriptorDigest: "1tg-qphmKBVtNwzVg9xyz-xxqt_xtMXAsQyXw46m8S0"
-});
 var EMAIL_PROOF_PENDING_MAX_MS = 15 * 6e4;
 var DISCOVERY_URL = `${EMAIL_PROOF_PINS.witnessOrigin}/.well-known/opencredentials`;
 var EMAIL_PROOF_ISSUER_KEYS = [
@@ -58,9 +80,11 @@ var EMAIL_PROOF_ISSUER_KEYS = [
 ];
 var PROFILE_PINS = {
   "tinycloud.email-proof/v1": { descriptorDigest: EMAIL_PROOF_PINS.descriptorDigest, requiredStep: "mailbox_otp", enabled: true },
-  // Held profile: disabled until the held wire path ships. Requests refuse with PROFILE_UNAVAILABLE before any network call.
-  "tinycloud.email-held/v1": { descriptorDigest: "dc3_DuvzipXwYkTfjKqTaK1c3VS0YSPnaBsYSQriC0w", requiredStep: "mailbox_otp", enabled: false }
+  // Held profile: disabled by default. A call enables it only with the per-call opt-in `allowHeldProfile: true` (see `profilePin`).
+  // Without it, requests refuse with PROFILE_UNAVAILABLE before any network call.
+  "tinycloud.email-held/v1": { descriptorDigest: HELD_ACCOUNT_BINDING_PINS.descriptorDigest, requiredStep: "mailbox_otp", enabled: false }
 };
+var OPENER_ORIGIN = HELD_ACCOUNT_BINDING_PINS.openerOrigin;
 var INSPECT = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
 function restoreEmailProofPending(fields) {
   const shown = {
@@ -74,7 +98,8 @@ function restoreEmailProofPending(fields) {
     requirementDigest: fields.requirementDigest,
     openerOrigin: fields.openerOrigin,
     createdAt: fields.createdAt,
-    expiresAt: fields.expiresAt
+    expiresAt: fields.expiresAt,
+    ...fields.serverExpiresAt === void 0 ? {} : { serverExpiresAt: fields.serverExpiresAt }
   };
   const pending = { ...shown };
   hide(pending, "verifier", fields.verifier);
@@ -117,6 +142,7 @@ var FILE_TEXT_FIELDS = [
   "createdAt",
   "expiresAt"
 ];
+var HELD_PROFILE_ID = "tinycloud.email-held/v1";
 var secrets = /* @__PURE__ */ new WeakMap();
 function sha256Hex(text) {
   return createHash("sha256").update(text).digest("hex");
@@ -271,6 +297,11 @@ function isFileRecord(value) {
   if (record.type !== "TinyCloudEmailProofPending" || record.version !== 1) return false;
   if (!FILE_TEXT_FIELDS.every((field) => typeof record[field] === "string")) return false;
   if (record.secret !== void 0 && (typeof record.secret !== "string" || !BASE64.test(record.secret))) return false;
+  if (record.profile === HELD_PROFILE_ID) {
+    if (typeof record.serverExpiresAt !== "string" || !Number.isFinite(Date.parse(record.serverExpiresAt))) return false;
+  } else if (record.serverExpiresAt !== void 0) {
+    return false;
+  }
   return Number.isFinite(Date.parse(record.createdAt)) && Number.isFinite(Date.parse(record.expiresAt));
 }
 function restoreFromFile(record) {
@@ -286,7 +317,8 @@ function restoreFromFile(record) {
     requirementDigest: record.requirementDigest,
     openerOrigin: record.openerOrigin,
     createdAt: record.createdAt,
-    expiresAt: record.expiresAt
+    expiresAt: record.expiresAt,
+    ...record.serverExpiresAt === void 0 ? {} : { serverExpiresAt: record.serverExpiresAt }
   });
 }
 function readEntry(home, file, now) {
@@ -332,6 +364,7 @@ function toFileRecord(pending, secret) {
     openerOrigin: pending.openerOrigin,
     createdAt: pending.createdAt,
     expiresAt: pending.expiresAt,
+    ...pending.serverExpiresAt === void 0 ? {} : { serverExpiresAt: pending.serverExpiresAt },
     ...secret === void 0 ? {} : { secret: Buffer.from(secret).toString("base64") }
   };
 }
@@ -362,7 +395,11 @@ function createFileEmailProofPendingStore(options) {
         if (exceedsWindow(pending)) {
           throw new PendingStoreError("credential-store-invalid", "Pending record expires beyond the 15-minute window and was rejected.");
         }
-        writeOwnerOnly(home, pendingFile(home, pending.requestId), toFileRecord(pending, putOptions?.secret));
+        const record = toFileRecord(pending, putOptions?.secret);
+        if (!isFileRecord(record)) {
+          throw new PendingStoreError("credential-store-invalid", "Pending record is not a valid held or ticket record and was rejected.");
+        }
+        writeOwnerOnly(home, pendingFile(home, pending.requestId), record);
       });
     },
     async delete(requestId) {