@tinycloud/web-sdk 3.0.0-beta.8 → 3.0.0

package/dist/credentials/element.d.ts

@@ -1,23 +1,50 @@
 import { type CredentialFlowDescriptor } from "@tinycloud/sdk-core";
-import type { CredentialAcquisitionTheme, CredentialInteractionSurface, InlineCredentialProofRequest, PrimitiveStepResult } from "./types";
+import type { CredentialAcquisitionTheme, CredentialInputRequest, CredentialInteractionSurface, CredentialProofSubject, InlineCredentialProofRequest, PrimitiveStepResult } from "./types";
 export declare const TINYCLOUD_CREDENTIAL_ACQUISITION_TAG = "tinycloud-credential-acquisition";
+/** Length of the mailbox code OpenCredentials issues for the `mailbox_otp` step. */
+export declare const MAILBOX_OTP_LENGTH = 8;
 declare const ElementBase: typeof HTMLElement;
+/**
+ * Reduces typed, pasted, or autofilled text to the mailbox code digits.
+ * Full-width digits are folded to ASCII, and a pasted sentence contributes
+ * only its first eight-digit group (optionally split as `1234 5678`).
+ */
+export declare function normalizeMailboxCode(value: string): string;
 /** SDK-owned Shadow-DOM view. It is deliberately unaware of locators, verifiers, sessions, and transport. */
 export declare class TinyCloudCredentialAcquisitionElement extends ElementBase {
     private root?;
     private resolver?;
+    private inputResolver?;
     private rejecter?;
     private closed;
+    private subject?;
+    private mailboxDomain?;
+    private codeTtlSeconds?;
     connectedCallback(): void;
     disconnectedCallback(): void;
     configure(theme?: CredentialAcquisitionTheme): void;
+    /** Context known before the first proof request, used for the opening state. */
+    prepare(input: {
+        readonly subject?: CredentialProofSubject;
+        readonly mailboxDomain?: string;
+        readonly codeTtlSeconds?: number;
+    }): void;
     requestProof(request: InlineCredentialProofRequest): Promise<PrimitiveStepResult>;
+    /** Collects inputs the requirement does not carry, such as the recipient's own mailbox. */
+    requestInputs(request: CredentialInputRequest): Promise<Readonly<Record<string, string>>>;
     report(state: "signing" | "verifying" | "saving" | "success" | "recovery", message?: string): void;
     finish(): void;
     cancel(): void;
     isClosed(): boolean;
     private renderShell;
     private renderPrompt;
+    private settleInputs;
+    private mailboxEntryForm;
+    private collectForm;
+    private settle;
+    private actions;
+    private mailboxForm;
+    private inputForm;
 }
 /** Registers the element once in a browser document. */
 export declare function defineTinyCloudCredentialAcquisitionElement(): void;
@@ -29,6 +56,8 @@ export declare class CredentialAcquisitionController {
         readonly descriptor: CredentialFlowDescriptor;
         readonly mountTarget?: Element | string;
         readonly theme?: CredentialAcquisitionTheme;
+        readonly subject?: CredentialProofSubject;
+        readonly mailboxDomain?: string;
     });
     start(input: {
         readonly signal?: AbortSignal;

package/dist/credentials/interpreter.d.ts

@@ -1,5 +1,7 @@
 import { type CredentialFlowDescriptor, type CredentialProgressEvent, type CredentialRequirement } from "@tinycloud/sdk-core";
-import type { CredentialAcquisitionTransport, CredentialSigningAdapter, InlineCredentialProofHandler, PrimitiveStepHandler } from "./types";
+import type { CredentialAcquisitionTransport, CredentialProofSubject, CredentialSigningAdapter, InlineCredentialProofHandler, PrimitiveStepHandler } from "./types";
+/** The mailbox named by an email requirement, which the issuer delivers the code to. */
+export declare function mailboxSubject(requirement: CredentialRequirement): CredentialProofSubject | undefined;
 /** Finite step interpreter. Dispatch is exclusively by registered primitive and version. */
 export declare function interpretCredentialFlow(input: {
     readonly descriptor: CredentialFlowDescriptor;

package/dist/credentials/transport.d.ts

@@ -16,6 +16,7 @@ export declare class OpenCredentialsHttpTransport implements CredentialAcquisiti
         holderDid: string;
         openerOrigin: string;
         completionVerifierChallenge: string;
+        inputs?: Readonly<Record<string, string>>;
         signal?: AbortSignal;
     }): Promise<{
         requestId: string;

package/dist/credentials/types.d.ts

@@ -72,8 +72,22 @@ export interface InlineCredentialProofRequest {
         readonly label: string;
         readonly schema: CredentialFlowDescriptor["inputs"][number]["schema"];
     }[];
+    /** Present when this step's previous proof was rejected and may be retried. */
+    readonly feedback?: {
+        readonly kind: "rejected";
+        readonly attemptsRemaining: number;
+    };
     readonly signal?: AbortSignal;
 }
+/**
+ * The mailbox a `mailbox_otp` code is sent to, copied from the digest-bound
+ * credential requirement. Only the SDK-owned inline view receives it; host
+ * proof handlers never see requirement values.
+ */
+export interface CredentialProofSubject {
+    readonly kind: "email";
+    readonly value: string;
+}
 export type InlineCredentialProofHandler = (input: InlineCredentialProofRequest) => Promise<PrimitiveStepResult>;
 export type CredentialInteractionKind = "popup" | "redirect" | "headless" | "inline";
 export interface CredentialInteractionSurface {
@@ -86,6 +100,22 @@ export interface CredentialInteractionSurface {
      * acquisition locator, request verifier, or transport capability.
      */
     readonly requestProof?: InlineCredentialProofHandler;
+    /**
+     * Collects descriptor inputs the requirement does not already supply, such
+     * as the recipient's own mailbox for an email-domain requirement. It
+     * receives only the input schema and the public domain constraint.
+     */
+    readonly requestInputs?: (request: CredentialInputRequest) => Promise<Readonly<Record<string, string>>>;
+}
+export interface CredentialInputRequest {
+    readonly inputs: readonly {
+        readonly id: string;
+        readonly label: string;
+        readonly schema: CredentialFlowDescriptor["inputs"][number]["schema"];
+    }[];
+    /** The exact canonical domain the entered mailbox must belong to. */
+    readonly mailboxDomain?: string;
+    readonly signal?: AbortSignal;
 }
 /** A browser-owned interaction that navigates to the OpenCredentials locator. */
 export interface CredentialBrowserInteractionAdapter {
@@ -150,6 +180,7 @@ export interface CredentialAcquisitionTransport {
         readonly holderDid: string;
         readonly openerOrigin: string;
         readonly completionVerifierChallenge: string;
+        readonly inputs?: Readonly<Record<string, string>>;
         readonly signal?: AbortSignal;
     }): Promise<{
         readonly requestId: string;
@@ -193,6 +224,12 @@ export interface CredentialsAcquireOptions extends CredentialsOperationOptions {
     readonly openerOrigin?: string;
     /** Same-origin, request-scoped persistence used to resume a full-page redirect. */
     readonly redirectStore?: CredentialRedirectStore;
+    /**
+     * Acquisition inputs the requirement does not carry (for example a
+     * recipient-chosen mailbox for an email-domain requirement). When omitted,
+     * an inline surface collects them.
+     */
+    readonly inputs?: Readonly<Record<string, string>>;
 }
 export interface CredentialAcquisitionTheme {
     readonly accentColor?: string;
@@ -216,6 +253,8 @@ export interface CredentialsPolicyAdmissionOptions {
     readonly requirement: CredentialRequirement;
     readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
     readonly nodeOrigin: string;
+    /** How long the minted session should last; see `admitPolicyCredentialV3`. */
+    readonly requestedExpiresAt?: string | null;
     readonly fetch?: typeof fetch;
     readonly signal?: AbortSignal;
     readonly now?: Date;