@tinycloud/web-sdk 2.11.0-beta.9 → 2.11.0

package/dist/credentials/browser.d.ts

@@ -0,0 +1,33 @@
+import type { CredentialFlowDescriptor } from "@tinycloud/sdk-core";
+import type { CredentialInteractionAdapter, CredentialRedirectResumeState, CredentialRedirectStore } from "./types";
+interface BrowserSurface {
+    readonly opener: Window;
+    open(url: string): Window | null;
+    redirect(url: string): void;
+}
+/** Exact-origin, locator-only browser interaction. Messages are non-secret wake signals. */
+export declare class BrowserCredentialInteraction implements CredentialInteractionAdapter {
+    private readonly surface;
+    readonly kind: "popup" | "redirect";
+    constructor(kind?: "popup" | "redirect", surface?: BrowserSurface);
+    start(input: {
+        interaction: CredentialFlowDescriptor["interaction"];
+        locator: string;
+        signal?: AbortSignal;
+    }): Promise<{
+        wake: () => Promise<any>;
+        close: () => any;
+        closed: () => boolean;
+    }>;
+}
+/** Request-scoped redirect continuation. It stores no TinyCloud session or key material. */
+export declare class BrowserCredentialRedirectStore implements CredentialRedirectStore {
+    private readonly storage;
+    private readonly key;
+    constructor(storage?: Pick<Storage, "getItem" | "setItem" | "removeItem">, key?: string);
+    load(): Promise<CredentialRedirectResumeState | undefined>;
+    save(state: CredentialRedirectResumeState): Promise<void>;
+    clear(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=browser.d.ts.map

package/dist/credentials/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./browser";
+export * from "./interpreter";
+export * from "./renderer";
+export * from "./service";
+export * from "./storage";
+export * from "./transport";
+export * from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/credentials/interpreter.d.ts

@@ -0,0 +1,20 @@
+import { type CredentialFlowDescriptor, type CredentialProgressEvent, type CredentialRequirement } from "@tinycloud/sdk-core";
+import type { CredentialAcquisitionTransport, CredentialSigningAdapter, PrimitiveStepHandler } from "./types";
+/** Finite step interpreter. Dispatch is exclusively by registered primitive and version. */
+export declare function interpretCredentialFlow(input: {
+    readonly descriptor: CredentialFlowDescriptor;
+    readonly requirement: CredentialRequirement;
+    readonly requestId: string;
+    readonly verifier: string;
+    readonly holderDid: string;
+    readonly descriptorDigest: string;
+    readonly requirementDigest: string;
+    readonly openerOrigin: string;
+    readonly transport: CredentialAcquisitionTransport;
+    readonly signing: CredentialSigningAdapter;
+    readonly handlers?: Partial<Record<"collect_input" | "mailbox_otp", PrimitiveStepHandler>>;
+    readonly signal?: AbortSignal;
+    readonly onProgress?: (event: CredentialProgressEvent) => void;
+    readonly onWait?: () => Promise<void>;
+}): Promise<void>;
+//# sourceMappingURL=interpreter.d.ts.map

package/dist/credentials/renderer.d.ts

@@ -0,0 +1,23 @@
+import type { CredentialFlowDescriptor, CredentialUxState } from "@tinycloud/sdk-core";
+export interface CredentialRendererModel {
+    readonly title: string;
+    readonly description: string;
+    readonly consent: string;
+    readonly fields: readonly {
+        readonly id: string;
+        readonly label: string;
+        readonly required: true;
+        readonly inputMode: "email" | "text";
+    }[];
+    readonly steps: readonly {
+        readonly id: string;
+        readonly primitive: string;
+        readonly title: string;
+        readonly description: string;
+    }[];
+    readonly stateLabels: Readonly<Record<"progress" | "success" | "recovery", string>>;
+    readonly state: CredentialUxState;
+}
+/** Shared descriptor-driven UX model. Dispatch is only by the finite primitive registry. */
+export declare function renderCredentialDescriptor(descriptor: CredentialFlowDescriptor, state?: CredentialUxState): CredentialRendererModel;
+//# sourceMappingURL=renderer.d.ts.map

package/dist/credentials/service.d.ts

@@ -0,0 +1,25 @@
+import { type CredentialFlowDescriptor, type CredentialIssuerMetadata, type CredentialRequirement, type IssuedCredentialEnvelope, type StoredCredentialRecord, type VerifiedCredential } from "@tinycloud/sdk-core";
+import { OpenCredentialsHttpTransport } from "./transport";
+import type { CredentialClient, CredentialsAcquireOptions, CredentialsEnsureOptions, CredentialsEnsureResult, CredentialsOperationOptions } from "./types";
+export declare class CredentialsService {
+    private readonly client;
+    constructor(client: CredentialClient);
+    private descriptor;
+    find(requirementValue: CredentialRequirement, options?: CredentialsOperationOptions): Promise<StoredCredentialRecord | undefined>;
+    verify(envelope: IssuedCredentialEnvelope, input: {
+        readonly descriptor: CredentialFlowDescriptor;
+        readonly requirement: CredentialRequirement;
+        readonly transport?: OpenCredentialsHttpTransport;
+        readonly issuerMetadata?: CredentialIssuerMetadata;
+        readonly fetch?: typeof fetch;
+        readonly signal?: AbortSignal;
+        readonly now?: Date;
+    }): Promise<VerifiedCredential>;
+    store(verified: VerifiedCredential, requirementValue: CredentialRequirement, options?: CredentialsOperationOptions): Promise<{
+        readonly record: StoredCredentialRecord;
+        readonly receipt: import("@tinycloud/sdk-core").CredentialStorageReceipt;
+    }>;
+    acquire(requirementValue: CredentialRequirement, options: CredentialsAcquireOptions): Promise<VerifiedCredential>;
+    ensure(requirementValue: CredentialRequirement, options: CredentialsEnsureOptions): Promise<CredentialsEnsureResult>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/credentials/storage.d.ts

@@ -0,0 +1,21 @@
+import { type CredentialRequirement, type CredentialStorageReceipt, type IKVService, type StoredCredentialRecord, type VerifiedCredential } from "@tinycloud/sdk-core";
+export declare function findStoredCredential(input: {
+    readonly kv: IKVService;
+    readonly requirement: CredentialRequirement;
+    readonly holderDid: string;
+    readonly ownerDid: string;
+    readonly now?: Date;
+}): Promise<StoredCredentialRecord | undefined>;
+export declare function storeCredential(input: {
+    readonly kv: IKVService;
+    readonly verified: VerifiedCredential;
+    readonly requirement: CredentialRequirement;
+    readonly requirementDigest: string;
+    readonly activeHolderDid: string;
+    readonly activeOwnerDid: string;
+    readonly now?: Date;
+}): Promise<{
+    readonly record: StoredCredentialRecord;
+    readonly receipt: CredentialStorageReceipt;
+}>;
+//# sourceMappingURL=storage.d.ts.map

package/dist/credentials/transport.d.ts

@@ -0,0 +1,37 @@
+import { type CredentialFlowDescriptor, type CredentialHolderBinding, type CredentialIssuerMetadata, type CredentialRequirement, type IssuedCredentialEnvelope } from "@tinycloud/sdk-core";
+import type { CredentialAcquisitionTransport, CredentialRequestState, PrimitiveStepResult } from "./types";
+export declare class OpenCredentialsHttpTransport implements CredentialAcquisitionTransport {
+    private readonly descriptor;
+    private readonly fetchFn;
+    private readonly nonces;
+    private readonly bindings;
+    constructor(descriptor: CredentialFlowDescriptor, fetchFn?: typeof fetch);
+    private url;
+    private request;
+    create(input: {
+        descriptor: CredentialFlowDescriptor;
+        descriptorDigest: string;
+        requirement: CredentialRequirement;
+        requirementDigest: string;
+        holderDid: string;
+        openerOrigin: string;
+        completionVerifierChallenge: string;
+        signal?: AbortSignal;
+    }): Promise<{
+        requestId: string;
+        locator: string;
+        expiresAt: string;
+        correlationId: string;
+    }>;
+    private proofStep;
+    state(id: string, verifier: string, signal?: AbortSignal): Promise<CredentialRequestState>;
+    beginStep(id: string, verifier: string, stepId: "collect_input" | "mailbox_otp", signal?: AbortSignal): Promise<void>;
+    submitStep(id: string, verifier: string, stepId: string, proof: PrimitiveStepResult, signal?: AbortSignal): Promise<void>;
+    holderBinding(id: string, verifier: string, signal?: AbortSignal): Promise<CredentialHolderBinding>;
+    submitHolderSignature(id: string, verifier: string, signature: string, signal?: AbortSignal): Promise<void>;
+    issue(id: string, verifier: string, signal?: AbortSignal): Promise<void>;
+    result(id: string, verifier: string, signal?: AbortSignal): Promise<IssuedCredentialEnvelope>;
+    issuerMetadata(signal?: AbortSignal): Promise<CredentialIssuerMetadata>;
+    checkStatus(status: IssuedCredentialEnvelope["status"], _signal?: AbortSignal): Promise<boolean>;
+}
+//# sourceMappingURL=transport.d.ts.map

package/dist/credentials/types.d.ts

@@ -0,0 +1,126 @@
+import type { ClientSession, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialProgressEvent, CredentialRequirement, CredentialStorageReceipt, IssuedCredentialEnvelope, IKVService, StoredCredentialRecord, VerifiedCredential } from "@tinycloud/sdk-core";
+export interface CredentialClient {
+    readonly sessionDid: string;
+    readonly credentialHolderDid: string;
+    readonly credentialHolderKid: string;
+    session(): ClientSession | undefined;
+    signSessionBytes(bytes: Uint8Array): Promise<Uint8Array>;
+    autoSignCredentialBytes?(bytes: Uint8Array): Promise<Uint8Array | undefined>;
+    approveCredentialBytes?(bytes: Uint8Array): Promise<Uint8Array>;
+    ensureOwnedSpaceHosted(name: string): Promise<string>;
+    credentialSpaceOwnerDid(spaceId: string): string;
+    kvForSpace(spaceId: string): IKVService;
+}
+export interface CredentialSigningAdapter {
+    /** Return undefined when the existing exact-request auto-sign policy does not apply. */
+    readonly autoSign?: (binding: CredentialHolderBinding, bytes: Uint8Array, signal?: AbortSignal) => Promise<Uint8Array | undefined>;
+    /** Invoke the normal OpenKey approval surface. */
+    readonly requestApproval?: (binding: CredentialHolderBinding, bytes: Uint8Array, signal?: AbortSignal) => Promise<Uint8Array>;
+}
+export type PrimitiveStepResult = Readonly<Record<string, string | boolean>>;
+export type PrimitiveStepHandler = (input: {
+    readonly descriptor: CredentialFlowDescriptor;
+    readonly requirement: CredentialRequirement;
+    readonly stepId: string;
+    readonly constraints: Readonly<Record<string, unknown>>;
+    readonly signal?: AbortSignal;
+}) => Promise<PrimitiveStepResult>;
+export interface CredentialInteractionAdapter {
+    readonly kind: "popup" | "redirect" | "headless";
+    start(input: {
+        readonly interaction: CredentialFlowDescriptor["interaction"];
+        readonly locator: string;
+        readonly signal?: AbortSignal;
+    }): Promise<{
+        readonly wake: () => Promise<void>;
+        readonly close: () => void;
+        readonly closed: () => boolean;
+    }>;
+}
+export interface CredentialRedirectResumeState {
+    readonly type: "TinyCloudCredentialRedirectResume";
+    readonly version: 1;
+    readonly requestId: string;
+    readonly locator: string;
+    readonly verifier: string;
+    readonly expiresAt: string;
+    readonly correlationId: string;
+    readonly holderDid: string;
+    readonly descriptorDigest: string;
+    readonly requirementDigest: string;
+    readonly openerOrigin: string;
+}
+export interface CredentialRedirectStore {
+    load(): Promise<CredentialRedirectResumeState | undefined>;
+    save(state: CredentialRedirectResumeState): Promise<void>;
+    clear(): Promise<void>;
+}
+export interface CredentialRequestState {
+    readonly type: "OpenCredentialsAcquisitionState";
+    readonly version: 1;
+    readonly requestId: string;
+    readonly transitionId: string;
+    readonly state: "pending" | "ready_to_issue" | "issued" | "complete" | "expired" | "canceled" | "issuer_unready";
+    readonly nextStep?: {
+        readonly id: string;
+        readonly type: "collect_input" | "mailbox_otp" | "holder_signature";
+        readonly version: 1;
+        readonly constraints: Readonly<Record<string, unknown>>;
+    };
+    readonly retryAfterMs?: number;
+    readonly correlationId: string;
+}
+export interface CredentialAcquisitionTransport {
+    create(input: {
+        readonly descriptor: CredentialFlowDescriptor;
+        readonly descriptorDigest: string;
+        readonly requirement: CredentialRequirement;
+        readonly requirementDigest: string;
+        readonly holderDid: string;
+        readonly openerOrigin: string;
+        readonly completionVerifierChallenge: string;
+        readonly signal?: AbortSignal;
+    }): Promise<{
+        readonly requestId: string;
+        readonly locator: string;
+        readonly expiresAt: string;
+        readonly correlationId: string;
+    }>;
+    state(requestId: string, verifier: string, signal?: AbortSignal): Promise<CredentialRequestState>;
+    beginStep(requestId: string, verifier: string, stepId: "collect_input" | "mailbox_otp", signal?: AbortSignal): Promise<void>;
+    submitStep(requestId: string, verifier: string, stepId: string, proof: PrimitiveStepResult, signal?: AbortSignal): Promise<void>;
+    holderBinding(requestId: string, verifier: string, signal?: AbortSignal): Promise<CredentialHolderBinding>;
+    submitHolderSignature(requestId: string, verifier: string, signature: string, signal?: AbortSignal): Promise<void>;
+    issue(requestId: string, verifier: string, signal?: AbortSignal): Promise<void>;
+    result(requestId: string, verifier: string, signal?: AbortSignal): Promise<IssuedCredentialEnvelope>;
+    issuerMetadata(signal?: AbortSignal): Promise<CredentialIssuerMetadata>;
+    checkStatus(status: IssuedCredentialEnvelope["status"], signal?: AbortSignal): Promise<boolean>;
+}
+export interface CredentialsOperationOptions {
+    readonly descriptor?: CredentialFlowDescriptor;
+    readonly discoveryUrl?: string;
+    readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
+    readonly timeoutMs?: number;
+    readonly onProgress?: (event: CredentialProgressEvent) => void;
+    readonly now?: () => Date;
+}
+export interface CredentialsAcquireOptions extends CredentialsOperationOptions {
+    readonly interaction?: "popup" | "redirect" | "headless";
+    readonly browser?: CredentialInteractionAdapter;
+    readonly transport?: CredentialAcquisitionTransport;
+    readonly signing?: CredentialSigningAdapter;
+    readonly stepHandlers?: Partial<Record<"collect_input" | "mailbox_otp", PrimitiveStepHandler>>;
+    readonly openerOrigin?: string;
+    /** Same-origin, request-scoped persistence used to resume a full-page redirect. */
+    readonly redirectStore?: CredentialRedirectStore;
+}
+export interface CredentialsEnsureOptions extends CredentialsAcquireOptions {
+}
+export interface CredentialsEnsureResult {
+    readonly status: "reused" | "acquired";
+    readonly credential: VerifiedCredential;
+    readonly record: StoredCredentialRecord;
+    readonly receipt?: CredentialStorageReceipt;
+}
+//# sourceMappingURL=types.d.ts.map