@tinycloud/web-sdk 2.11.0-beta.9 → 3.0.0-beta.0

package/dist/adapters/BrowserENSResolver.d.ts

@@ -1,8 +1,8 @@
 import { IENSResolver } from "@tinycloud/sdk-core";
-import { providers } from "ethers";
+import type { BrowserWalletProvider } from "./browserProvider";
 export declare class BrowserENSResolver implements IENSResolver {
-    private provider;
-    constructor(provider: providers.Web3Provider);
+    private readonly provider;
+    constructor(provider: BrowserWalletProvider);
     resolveAddress(ensName: string): Promise<string | null>;
     resolveName(address: string): Promise<string | null>;
     resolveAvatar(ensName: string): Promise<string | null>;

package/dist/adapters/BrowserWalletSigner.d.ts

@@ -1,23 +1,22 @@
 import { ISigner, Bytes } from "@tinycloud/sdk-core";
-import { providers } from "ethers";
+import { type BrowserProvider, type BrowserWalletProvider } from "./browserProvider";
 /**
- * Browser wallet signer that wraps ethers.js Web3Provider.
+ * Browser wallet signer that wraps an EIP-1193 provider.
  * Supports MetaMask, WalletConnect, and any EIP-1193 provider.
  *
- * The wallet popup is triggered implicitly by ethers.js when
- * signMessage() is called -- no separate "strategy" type needed.
+ * The wallet popup is triggered by eth_requestAccounts when getAddress() is
+ * called -- no separate "strategy" type needed.
  */
 export declare class BrowserWalletSigner implements ISigner {
     private provider;
-    private signer;
     private cachedAddress?;
     private cachedChainId?;
-    constructor(externalProvider: providers.ExternalProvider | providers.Web3Provider);
+    constructor(provider: BrowserWalletProvider);
     getAddress(): Promise<string>;
     getConnectedAddress(): Promise<string | undefined>;
     getChainId(): Promise<number>;
     signMessage(message: Bytes | string): Promise<string>;
-    /** Get the underlying ethers.js Web3Provider (for advanced use) */
-    getProvider(): providers.Web3Provider;
+    /** Get the underlying EIP-1193 provider (for advanced use). */
+    getProvider(): BrowserProvider;
 }
 //# sourceMappingURL=BrowserWalletSigner.d.ts.map

package/dist/adapters/browserProvider.d.ts

@@ -0,0 +1,6 @@
+import type { EIP1193Provider } from "viem";
+/** The EIP-1193 provider supplied by an injected wallet. */
+export type BrowserWalletProvider = EIP1193Provider;
+/** The EIP-1193 provider used by the browser-facing SDK. */
+export type BrowserProvider = EIP1193Provider;
+//# sourceMappingURL=browserProvider.d.ts.map

package/dist/adapters/index.d.ts

@@ -1,4 +1,5 @@
 export { BrowserWalletSigner } from "./BrowserWalletSigner";
+export { type BrowserProvider, type BrowserWalletProvider, } from "./browserProvider";
 export { BrowserSessionStorage } from "./BrowserSessionStorage";
 export type { BrowserSessionLoadResult, BrowserSessionLoadStatus, BrowserSessionStorageOptions, } from "./BrowserSessionStorage";
 export { BrowserENSResolver } from "./BrowserENSResolver";

package/dist/credentials/browser.d.ts

@@ -0,0 +1,49 @@
+import type { CredentialFlowDescriptor } from "@tinycloud/sdk-core";
+import type { CredentialBrowserInteractionAdapter, CredentialInlineInteractionAdapter, CredentialInteractionSurface, CredentialRedirectResumeState, CredentialRedirectStore } from "./types";
+interface BrowserSurface {
+    readonly opener: Window;
+    open(url: string): Window | null;
+    redirect(url: string): void;
+}
+/** Exact-origin, locator-only browser interaction. Messages are non-secret wake signals. */
+export declare class BrowserCredentialInteraction implements CredentialBrowserInteractionAdapter {
+    private readonly surface;
+    readonly kind: "popup" | "redirect";
+    constructor(kind?: "popup" | "redirect", surface?: BrowserSurface);
+    start(input: {
+        interaction: CredentialFlowDescriptor["interaction"];
+        locator: string;
+        signal?: AbortSignal;
+    }): Promise<{
+        wake: () => Promise<any>;
+        close: () => any;
+        closed: () => boolean;
+    }>;
+}
+/**
+ * Adapter for a host application's in-page acquisition view. It intentionally
+ * exposes no OpenCredentials locator or verifier to the host: the host can
+ * render an accessible local proof form, but only the SDK may submit that
+ * proof to OpenCredentials.
+ */
+export declare class InlineCredentialInteraction implements CredentialInlineInteractionAdapter {
+    private readonly present;
+    readonly kind: "inline";
+    constructor(present: (input: {
+        readonly signal?: AbortSignal;
+    }) => Promise<CredentialInteractionSurface>);
+    start(input: {
+        signal?: AbortSignal;
+    }): Promise<CredentialInteractionSurface>;
+}
+/** Request-scoped redirect continuation. It stores no TinyCloud session or key material. */
+export declare class BrowserCredentialRedirectStore implements CredentialRedirectStore {
+    private readonly storage;
+    private readonly key;
+    constructor(storage?: Pick<Storage, "getItem" | "setItem" | "removeItem">, key?: string);
+    load(): Promise<CredentialRedirectResumeState | undefined>;
+    save(state: CredentialRedirectResumeState): Promise<void>;
+    clear(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=browser.d.ts.map

package/dist/credentials/element.d.ts

@@ -0,0 +1,42 @@
+import { type CredentialFlowDescriptor } from "@tinycloud/sdk-core";
+import type { CredentialAcquisitionTheme, CredentialInteractionSurface, InlineCredentialProofRequest, PrimitiveStepResult } from "./types";
+export declare const TINYCLOUD_CREDENTIAL_ACQUISITION_TAG = "tinycloud-credential-acquisition";
+declare const ElementBase: typeof HTMLElement;
+/** SDK-owned Shadow-DOM view. It is deliberately unaware of locators, verifiers, sessions, and transport. */
+export declare class TinyCloudCredentialAcquisitionElement extends ElementBase {
+    private root?;
+    private resolver?;
+    private rejecter?;
+    private closed;
+    connectedCallback(): void;
+    disconnectedCallback(): void;
+    configure(theme?: CredentialAcquisitionTheme): void;
+    requestProof(request: InlineCredentialProofRequest): Promise<PrimitiveStepResult>;
+    report(state: "signing" | "verifying" | "saving" | "success" | "recovery", message?: string): void;
+    finish(): void;
+    cancel(): void;
+    isClosed(): boolean;
+    private renderShell;
+    private renderPrompt;
+}
+/** Registers the element once in a browser document. */
+export declare function defineTinyCloudCredentialAcquisitionElement(): void;
+/** Controller that turns the SDK element into the safe low-level inline interaction surface. */
+export declare class CredentialAcquisitionController {
+    private readonly options;
+    private element?;
+    constructor(options: {
+        readonly descriptor: CredentialFlowDescriptor;
+        readonly mountTarget?: Element | string;
+        readonly theme?: CredentialAcquisitionTheme;
+    });
+    start(input: {
+        readonly signal?: AbortSignal;
+    }): Promise<CredentialInteractionSurface>;
+    progress(state: "signing" | "verifying" | "saving" | "success" | "recovery"): void;
+    finish(): void;
+    fail(): void;
+    private target;
+}
+export {};
+//# sourceMappingURL=element.d.ts.map

package/dist/credentials/index.d.ts

@@ -0,0 +1,9 @@
+export * from "./browser";
+export * from "./element";
+export * from "./interpreter";
+export * from "./renderer";
+export * from "./service";
+export * from "./storage";
+export * from "./transport";
+export * from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/credentials/interpreter.d.ts

@@ -0,0 +1,25 @@
+import { type CredentialFlowDescriptor, type CredentialProgressEvent, type CredentialRequirement } from "@tinycloud/sdk-core";
+import type { CredentialAcquisitionTransport, CredentialSigningAdapter, InlineCredentialProofHandler, PrimitiveStepHandler } from "./types";
+/** Finite step interpreter. Dispatch is exclusively by registered primitive and version. */
+export declare function interpretCredentialFlow(input: {
+    readonly descriptor: CredentialFlowDescriptor;
+    readonly requirement: CredentialRequirement;
+    readonly requestId: string;
+    readonly verifier: string;
+    readonly holderDid: string;
+    readonly descriptorDigest: string;
+    readonly requirementDigest: string;
+    readonly openerOrigin: string;
+    readonly transport: CredentialAcquisitionTransport;
+    readonly signing: CredentialSigningAdapter;
+    /**
+     * Fallback for a host-owned surface. It receives every declared proof step,
+     * including primitives added by a later protocol version.
+     */
+    readonly proofHandler?: InlineCredentialProofHandler;
+    readonly handlers?: Partial<Record<"collect_input" | "mailbox_otp", PrimitiveStepHandler>>;
+    readonly signal?: AbortSignal;
+    readonly onProgress?: (event: CredentialProgressEvent) => void;
+    readonly onWait?: () => Promise<void>;
+}): Promise<void>;
+//# sourceMappingURL=interpreter.d.ts.map

package/dist/credentials/renderer.d.ts

@@ -0,0 +1,23 @@
+import type { CredentialFlowDescriptor, CredentialUxState } from "@tinycloud/sdk-core";
+export interface CredentialRendererModel {
+    readonly title: string;
+    readonly description: string;
+    readonly consent: string;
+    readonly fields: readonly {
+        readonly id: string;
+        readonly label: string;
+        readonly required: true;
+        readonly inputMode: "email" | "text";
+    }[];
+    readonly steps: readonly {
+        readonly id: string;
+        readonly primitive: string;
+        readonly title: string;
+        readonly description: string;
+    }[];
+    readonly stateLabels: Readonly<Record<"progress" | "success" | "recovery", string>>;
+    readonly state: CredentialUxState;
+}
+/** Shared descriptor-driven UX model. Dispatch is only by the finite primitive registry. */
+export declare function renderCredentialDescriptor(descriptor: CredentialFlowDescriptor, state?: CredentialUxState): CredentialRendererModel;
+//# sourceMappingURL=renderer.d.ts.map

package/dist/credentials/service.d.ts

@@ -0,0 +1,26 @@
+import { type CredentialFlowDescriptor, type CredentialIssuerMetadata, type CredentialRequirement, type IssuedCredentialEnvelope, type StoredCredentialRecord, type VerifiedCredential } from "@tinycloud/sdk-core";
+import { OpenCredentialsHttpTransport } from "./transport";
+import type { CredentialClient, CredentialsAcquireOptions, CredentialsEnsureOptions, CredentialsEnsureResult, CredentialsOperationOptions, CredentialsPolicyAdmissionOptions, CredentialsPolicyAdmissionResult } from "./types";
+export declare class CredentialsService {
+    private readonly client;
+    constructor(client: CredentialClient);
+    private descriptor;
+    find(requirementValue: CredentialRequirement, options?: CredentialsOperationOptions): Promise<StoredCredentialRecord | undefined>;
+    verify(envelope: IssuedCredentialEnvelope, input: {
+        readonly descriptor: CredentialFlowDescriptor;
+        readonly requirement: CredentialRequirement;
+        readonly transport?: OpenCredentialsHttpTransport;
+        readonly issuerMetadata?: CredentialIssuerMetadata;
+        readonly fetch?: typeof fetch;
+        readonly signal?: AbortSignal;
+        readonly now?: Date;
+    }): Promise<VerifiedCredential>;
+    store(verified: VerifiedCredential, requirementValue: CredentialRequirement, options?: CredentialsOperationOptions): Promise<{
+        readonly record: StoredCredentialRecord;
+        readonly receipt: import("@tinycloud/sdk-core").CredentialStorageReceipt;
+    }>;
+    acquire(requirementValue: CredentialRequirement, options: CredentialsAcquireOptions): Promise<VerifiedCredential>;
+    ensure(requirementValue: CredentialRequirement, options: CredentialsEnsureOptions): Promise<CredentialsEnsureResult>;
+    admitPolicy(options: CredentialsPolicyAdmissionOptions): Promise<CredentialsPolicyAdmissionResult>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/credentials/storage.d.ts

@@ -0,0 +1,21 @@
+import { type CredentialRequirement, type CredentialStorageReceipt, type IKVService, type StoredCredentialRecord, type VerifiedCredential } from "@tinycloud/sdk-core";
+export declare function findStoredCredential(input: {
+    readonly kv: IKVService;
+    readonly requirement: CredentialRequirement;
+    readonly holderDid: string;
+    readonly ownerDid: string;
+    readonly now?: Date;
+}): Promise<StoredCredentialRecord | undefined>;
+export declare function storeCredential(input: {
+    readonly kv: IKVService;
+    readonly verified: VerifiedCredential;
+    readonly requirement: CredentialRequirement;
+    readonly requirementDigest: string;
+    readonly activeHolderDid: string;
+    readonly activeOwnerDid: string;
+    readonly now?: Date;
+}): Promise<{
+    readonly record: StoredCredentialRecord;
+    readonly receipt: CredentialStorageReceipt;
+}>;
+//# sourceMappingURL=storage.d.ts.map

package/dist/credentials/transport.d.ts

@@ -0,0 +1,37 @@
+import { type CredentialFlowDescriptor, type CredentialHolderBinding, type CredentialIssuerMetadata, type CredentialRequirement, type IssuedCredentialEnvelope } from "@tinycloud/sdk-core";
+import type { CredentialAcquisitionTransport, CredentialRequestState, PrimitiveStepResult } from "./types";
+export declare class OpenCredentialsHttpTransport implements CredentialAcquisitionTransport {
+    private readonly descriptor;
+    private readonly fetchFn;
+    private readonly nonces;
+    private readonly bindings;
+    constructor(descriptor: CredentialFlowDescriptor, fetchFn?: typeof fetch);
+    private url;
+    private request;
+    create(input: {
+        descriptor: CredentialFlowDescriptor;
+        descriptorDigest: string;
+        requirement: CredentialRequirement;
+        requirementDigest: string;
+        holderDid: string;
+        openerOrigin: string;
+        completionVerifierChallenge: string;
+        signal?: AbortSignal;
+    }): Promise<{
+        requestId: string;
+        locator: string;
+        expiresAt: string;
+        correlationId: string;
+    }>;
+    private proofStep;
+    state(id: string, verifier: string, signal?: AbortSignal): Promise<CredentialRequestState>;
+    beginStep(id: string, verifier: string, stepId: "collect_input" | "mailbox_otp", signal?: AbortSignal): Promise<void>;
+    submitStep(id: string, verifier: string, stepId: string, proof: PrimitiveStepResult, signal?: AbortSignal): Promise<void>;
+    holderBinding(id: string, verifier: string, signal?: AbortSignal): Promise<CredentialHolderBinding>;
+    submitHolderSignature(id: string, verifier: string, signature: string, signal?: AbortSignal): Promise<void>;
+    issue(id: string, verifier: string, signal?: AbortSignal): Promise<void>;
+    result(id: string, verifier: string, signal?: AbortSignal): Promise<IssuedCredentialEnvelope>;
+    issuerMetadata(signal?: AbortSignal): Promise<CredentialIssuerMetadata>;
+    checkStatus(status: IssuedCredentialEnvelope["status"], _signal?: AbortSignal): Promise<boolean>;
+}
+//# sourceMappingURL=transport.d.ts.map

package/dist/credentials/types.d.ts

@@ -0,0 +1,209 @@
+import type { ClientSession, CredentialFlowDescriptor, CredentialHolderBinding, CredentialIssuerMetadata, CredentialProgressEvent, CredentialRequirement, CredentialStorageReceipt, IssuedCredentialEnvelope, IKVService, StoredCredentialRecord, VerifiedCredential, PolicyCredentialAdmissionV3, UnifiedPolicyCapability, UnifiedPolicyV2 } from "@tinycloud/sdk-core";
+import type { ValidatedRuntimeDelegation } from "@tinycloud/node-sdk/core";
+export interface CredentialClient {
+    readonly sessionDid: string;
+    readonly credentialHolderDid: string;
+    readonly credentialHolderKid: string;
+    session(): ClientSession | undefined;
+    signSessionBytes(bytes: Uint8Array): Promise<Uint8Array>;
+    autoSignCredentialBytes?(bytes: Uint8Array): Promise<Uint8Array | undefined>;
+    approveCredentialBytes?(bytes: Uint8Array): Promise<Uint8Array>;
+    activateCompactRuntimeDelegation?(input: {
+        readonly authorization: string;
+        readonly cid: string;
+        readonly host: string;
+    }): Promise<ValidatedRuntimeDelegation>;
+    ensureOwnedSpaceHosted(name: string): Promise<string>;
+    credentialSpaceOwnerDid(spaceId: string): string;
+    kvForSpace(spaceId: string): IKVService;
+    /**
+     * Root authorization CID of the active account session. Exposed here rather
+     * than on {@link ClientSession} so the CID stays out of the public session.
+     */
+    accountAuthorizationCid(): string;
+}
+export interface CredentialSigningAdapter {
+    /** Return undefined when the existing exact-request auto-sign policy does not apply. */
+    readonly autoSign?: (binding: CredentialHolderBinding, bytes: Uint8Array, signal?: AbortSignal) => Promise<Uint8Array | undefined>;
+    /** Invoke the normal OpenKey approval surface. */
+    readonly requestApproval?: (binding: CredentialHolderBinding, bytes: Uint8Array, signal?: AbortSignal) => Promise<Uint8Array>;
+}
+export type PrimitiveStepResult = Readonly<Record<string, string | boolean>>;
+export type PrimitiveStepHandler = (input: {
+    readonly descriptor: CredentialFlowDescriptor;
+    readonly requirement: CredentialRequirement;
+    readonly stepId: string;
+    readonly constraints: Readonly<Record<string, unknown>>;
+    readonly signal?: AbortSignal;
+}) => Promise<PrimitiveStepResult>;
+/**
+ * The bounded view a host-owned inline surface may receive. It deliberately
+ * excludes requirement values, which can contain private policy inputs.
+ */
+export interface InlineCredentialProofRequest {
+    readonly stepId: string;
+    readonly constraints: Readonly<Record<string, unknown>>;
+    readonly display: {
+        readonly title: string;
+        readonly description: string;
+        readonly consent: string;
+        readonly progressLabel: string;
+        readonly errorLiveRegion: "assertive";
+    };
+    readonly inputs: readonly {
+        readonly id: string;
+        readonly label: string;
+        readonly schema: CredentialFlowDescriptor["inputs"][number]["schema"];
+    }[];
+    readonly signal?: AbortSignal;
+}
+export type InlineCredentialProofHandler = (input: InlineCredentialProofRequest) => Promise<PrimitiveStepResult>;
+export type CredentialInteractionKind = "popup" | "redirect" | "headless" | "inline";
+export interface CredentialInteractionSurface {
+    readonly wake: () => Promise<void>;
+    readonly close: () => void;
+    readonly closed: () => boolean;
+    /**
+     * A bounded, local UI callback for a declared primitive step. The adapter
+     * returns user-entered proof bytes to the SDK; it never receives an
+     * acquisition locator, request verifier, or transport capability.
+     */
+    readonly requestProof?: InlineCredentialProofHandler;
+}
+/** A browser-owned interaction that navigates to the OpenCredentials locator. */
+export interface CredentialBrowserInteractionAdapter {
+    readonly kind: Exclude<CredentialInteractionKind, "inline">;
+    start(input: {
+        readonly interaction: CredentialFlowDescriptor["interaction"];
+        readonly locator: string;
+        readonly signal?: AbortSignal;
+    }): Promise<CredentialInteractionSurface>;
+}
+/**
+ * A host-owned, in-page acquisition surface. It intentionally receives no
+ * OpenCredentials locator, request verifier, or transport capability. The SDK
+ * owns every OpenCredentials request, including submission of returned proof.
+ */
+export interface CredentialInlineInteractionAdapter {
+    readonly kind: "inline";
+    start(input: {
+        readonly signal?: AbortSignal;
+    }): Promise<CredentialInteractionSurface>;
+}
+export type CredentialInteractionAdapter = CredentialBrowserInteractionAdapter | CredentialInlineInteractionAdapter;
+export interface CredentialRedirectResumeState {
+    readonly type: "TinyCloudCredentialRedirectResume";
+    readonly version: 1;
+    readonly requestId: string;
+    readonly locator: string;
+    readonly verifier: string;
+    readonly expiresAt: string;
+    readonly correlationId: string;
+    readonly holderDid: string;
+    readonly descriptorDigest: string;
+    readonly requirementDigest: string;
+    readonly openerOrigin: string;
+}
+export interface CredentialRedirectStore {
+    load(): Promise<CredentialRedirectResumeState | undefined>;
+    save(state: CredentialRedirectResumeState): Promise<void>;
+    clear(): Promise<void>;
+}
+export interface CredentialRequestState {
+    readonly type: "OpenCredentialsAcquisitionState";
+    readonly version: 1;
+    readonly requestId: string;
+    readonly transitionId: string;
+    readonly state: "pending" | "ready_to_issue" | "issued" | "complete" | "expired" | "canceled" | "issuer_unready";
+    readonly nextStep?: {
+        readonly id: string;
+        readonly type: "collect_input" | "mailbox_otp" | "holder_signature";
+        readonly version: 1;
+        readonly constraints: Readonly<Record<string, unknown>>;
+    };
+    readonly retryAfterMs?: number;
+    readonly correlationId: string;
+}
+export interface CredentialAcquisitionTransport {
+    create(input: {
+        readonly descriptor: CredentialFlowDescriptor;
+        readonly descriptorDigest: string;
+        readonly requirement: CredentialRequirement;
+        readonly requirementDigest: string;
+        readonly holderDid: string;
+        readonly openerOrigin: string;
+        readonly completionVerifierChallenge: string;
+        readonly signal?: AbortSignal;
+    }): Promise<{
+        readonly requestId: string;
+        readonly locator: string;
+        readonly expiresAt: string;
+        readonly correlationId: string;
+    }>;
+    state(requestId: string, verifier: string, signal?: AbortSignal): Promise<CredentialRequestState>;
+    beginStep(requestId: string, verifier: string, stepId: "collect_input" | "mailbox_otp", signal?: AbortSignal): Promise<void>;
+    submitStep(requestId: string, verifier: string, stepId: string, proof: PrimitiveStepResult, signal?: AbortSignal): Promise<void>;
+    holderBinding(requestId: string, verifier: string, signal?: AbortSignal): Promise<CredentialHolderBinding>;
+    submitHolderSignature(requestId: string, verifier: string, signature: string, signal?: AbortSignal): Promise<void>;
+    issue(requestId: string, verifier: string, signal?: AbortSignal): Promise<void>;
+    result(requestId: string, verifier: string, signal?: AbortSignal): Promise<IssuedCredentialEnvelope>;
+    issuerMetadata(signal?: AbortSignal): Promise<CredentialIssuerMetadata>;
+    checkStatus(status: IssuedCredentialEnvelope["status"], signal?: AbortSignal): Promise<boolean>;
+}
+export interface CredentialsOperationOptions {
+    readonly descriptor?: CredentialFlowDescriptor;
+    readonly discoveryUrl?: string;
+    readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
+    readonly timeoutMs?: number;
+    readonly onProgress?: (event: CredentialProgressEvent) => void;
+    readonly now?: () => Date;
+}
+export interface CredentialsAcquireOptions extends CredentialsOperationOptions {
+    /**
+     * `inline` mounts the first-party TinyCloud element unless a bounded local
+     * proof adapter is explicitly supplied.
+     */
+    readonly interaction?: CredentialInteractionKind;
+    readonly browser?: CredentialInteractionAdapter;
+    /** An element or selector inside the current document for the SDK-owned UI. */
+    readonly mountTarget?: Element | string;
+    /** Presentation-only tokens. Security-critical copy and proof order are fixed by the descriptor. */
+    readonly theme?: CredentialAcquisitionTheme;
+    readonly transport?: CredentialAcquisitionTransport;
+    readonly signing?: CredentialSigningAdapter;
+    readonly stepHandlers?: Partial<Record<"collect_input" | "mailbox_otp", PrimitiveStepHandler>>;
+    readonly openerOrigin?: string;
+    /** Same-origin, request-scoped persistence used to resume a full-page redirect. */
+    readonly redirectStore?: CredentialRedirectStore;
+}
+export interface CredentialAcquisitionTheme {
+    readonly accentColor?: string;
+    readonly backgroundColor?: string;
+    readonly textColor?: string;
+}
+export interface CredentialsEnsureOptions extends CredentialsAcquireOptions {
+}
+export interface CredentialsEnsureResult {
+    readonly status: "reused" | "acquired";
+    readonly credential: VerifiedCredential;
+    readonly record: StoredCredentialRecord;
+    readonly receipt?: CredentialStorageReceipt;
+}
+export interface CredentialsPolicyAdmissionOptions {
+    readonly ensured: CredentialsEnsureResult;
+    readonly policy: UnifiedPolicyV2;
+    readonly policyCid: string;
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+    readonly requirement: CredentialRequirement;
+    readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
+    readonly nodeOrigin: string;
+    readonly fetch?: typeof fetch;
+    readonly now?: Date;
+    readonly jti?: string;
+}
+export interface CredentialsPolicyAdmissionResult extends PolicyCredentialAdmissionV3 {
+    readonly installed: ValidatedRuntimeDelegation;
+}
+//# sourceMappingURL=types.d.ts.map