diff --git a/index.html b/index.html index bcc9dc4..fe658e1 100644 --- a/index.html +++ b/index.html @@ -1058,9 +1058,10 @@ comprising the first items of each top-level section. */ margin-top: 1.1rem; } - #toc .secno { + #toc#toc .secno { /* Ugh, need more specificity to override base.css */ grid-column: 1; width: auto; + margin-left: 0; } #toc .content { grid-column: 2; @@ -1211,9 +1212,8 @@ } } - + -

Credential Management Level 1

-

Editor’s Draft,

+

Editor’s Draft,

This version: @@ -1483,7 +1483,7 @@

https://github.com/w3c/webappsec-credential-management/commits/master/index.src.html
Feedback: -
public-webappsec@w3.org with subject line “[credential-management] … message topic …” (archives) +
public-webappsec@w3.org with subject line “[credential-management] … message topic …” (archives)
Editor:
(Google Inc.)
Participate: @@ -1539,7 +1539,14 @@

Table of Contents

  • 2.2 The Credential Interface
      -
    1. 2.2.1 Credential Internal Methods +
    2. + 2.2.1 Credential Internal Methods +
        +
      1. 2.2.1.1 [[CollectFromCredentialStore]] internal method +
      2. 2.2.1.2 [[DiscoverFromExternalSource]] internal method +
      3. 2.2.1.3 [[Store]] internal method +
      4. 2.2.1.4 [[Create]] internal method +
    3. 2.2.2 CredentialUserData Mixin
  • @@ -1577,8 +1584,8 @@

    Table of Contents

  • 3.3 Algorithms
      -
    1. 3.3.1 PasswordCredential's [[CollectFromCredentialStore]](options, sameOriginWithAncestors) -
    2. 3.3.2 PasswordCredential's [[Create]](options, sameOriginWithAncestors) +
    3. 3.3.1 PasswordCredential's [[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors) +
    4. 3.3.2 PasswordCredential's [[Create]](origin, options, sameOriginWithAncestors)
    5. 3.3.3 PasswordCredential's [[Store]](credential, sameOriginWithAncestors)
    6. 3.3.4 Create a PasswordCredential from an HTMLFormElement
    7. 3.3.5 Create a PasswordCredential from PasswordCredentialData @@ -1596,8 +1603,8 @@

      Table of Contents

    8. 4.2 Algorithms
        -
      1. 4.2.1 FederatedCredential's [[CollectFromCredentialStore]](options, sameOriginWithAncestors) -
      2. 4.2.2 FederatedCredential's [[Create]](options, sameOriginWithAncestors) +
      3. 4.2.1 FederatedCredential's [[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors) +
      4. 4.2.2 FederatedCredential's [[Create]](origin, options, sameOriginWithAncestors)
      5. 4.2.3 FederatedCredential's [[Store]](credential, sameOriginWithAncestors)
      6. 4.2.4 Create a FederatedCredential from FederatedCredentialInit
      @@ -1691,14 +1698,14 @@

      hodgepodge of heuristics meant to detect and fill sign-in forms, password change forms, etc.

      A few problems with the status quo stand out as being particularly noteworthy:

      +
    9. credential type, in §2.2
    10. CredentialUserData, in §2.2.2 -
    11. [[DiscoverFromExternalSource]](options, sameOriginWithAncestors), in §2.2.1 +
    12. [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors), in §2.2.1.2
    13. [[discovery]], in §2.2
    14. effective, in §2
    15. @@ -3454,6 +3500,12 @@

      dict-member for PasswordCredentialData, in §3.2
    16. optional, in §2.3.2 +
    17. + origin +
    18. [[origin]], in §2.2
    19. origin bound, in §2.2
    20. @@ -3470,8 +3522,8 @@

      PasswordCredentialData, in §3.2
    21. PasswordCredential(form), in §3.2
    22. PasswordCredentialInit, in §3.2 -
    23. Prevent Silent Access, in §2.5.5
    24. preventSilentAccess(), in §2.3 +
    25. Prevent Silent Access, in §2.5.5
    26. prevent silent access flag, in §2.1
    27. protocol @@ -3508,7 +3560,7 @@

      method for Credential, in §2.2.1 +
    28. method for Credential, in §2.2.1.3
    29. method for FederatedCredential, in §4.2.3
    30. method for PasswordCredential, in §3.3.3 @@ -3574,6 +3626,12 @@

      + https://tc39.github.io/ecma262/#sec-ordinary-object-internal-methods-and-internal-slotsReferenced in: + + @@ -3723,16 +3783,21 @@

      https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-globalReferenced in: + + - + + -

    • IDL Index

    -
    [Exposed=Window, SecureContext]
-interface Credential {
-  readonly attribute USVString id;
-  readonly attribute DOMString type;
+
    [Exposed=Window, SecureContext]
+interface Credential {
+  readonly attribute USVString id;
+  readonly attribute DOMString type;
 };
 
-[SecureContext]
-interface mixin CredentialUserData {
-  readonly attribute USVString name;
-  readonly attribute USVString iconURL;
+[SecureContext]
+interface mixin CredentialUserData {
+  readonly attribute USVString name;
+  readonly attribute USVString iconURL;
 };
 
-partial interface Navigator {
-  [SecureContext, SameObject] readonly attribute CredentialsContainer credentials;
+partial interface Navigator {
+  [SecureContext, SameObject] readonly attribute CredentialsContainer credentials;
 };
 
-[Exposed=Window, SecureContext]
-interface CredentialsContainer {
-  Promise<Credential?> get(optional CredentialRequestOptions options);
-  Promise<Credential> store(Credential credential);
-  Promise<Credential?> create(optional CredentialCreationOptions options);
-  Promise<void> preventSilentAccess();
+[Exposed=Window, SecureContext]
+interface CredentialsContainer {
+  Promise<Credential?> get(optional CredentialRequestOptions options);
+  Promise<Credential> store(Credential credential);
+  Promise<Credential?> create(optional CredentialCreationOptions options);
+  Promise<void> preventSilentAccess();
 };
 
-dictionary CredentialData {
-  required USVString id;
+dictionary CredentialData {
+  required USVString id;
 };
 
-dictionary CredentialRequestOptions {
-  CredentialMediationRequirement mediation = "optional";
-  AbortSignal signal;
+dictionary CredentialRequestOptions {
+  CredentialMediationRequirement mediation = "optional";
+  AbortSignal signal;
 };
 
-enum CredentialMediationRequirement {
-  "silent",
-  "optional",
-  "required"
+enum CredentialMediationRequirement {
+  "silent",
+  "optional",
+  "required"
 };
 
-dictionary CredentialCreationOptions {
-  AbortSignal signal;
+dictionary CredentialCreationOptions {
+  AbortSignal signal;
 };
 
-typedef (FormData or URLSearchParams) CredentialBodyType;
-
-[Constructor(HTMLFormElement form),
- Constructor(PasswordCredentialData data),
- Exposed=Window,
- SecureContext]
-interface PasswordCredential : Credential {
-  readonly attribute USVString password;
+[Constructor(HTMLFormElement form),
+ Constructor(PasswordCredentialData data),
+ Exposed=Window,
+ SecureContext]
+interface PasswordCredential : Credential {
+  readonly attribute USVString password;
 };
-PasswordCredential includes CredentialUserData;
+PasswordCredential includes CredentialUserData;
 
-partial dictionary CredentialRequestOptions {
-  boolean password = false;
+partial dictionary CredentialRequestOptions {
+  boolean password = false;
 };
 
-dictionary PasswordCredentialData : CredentialData {
-  USVString name;
-  USVString iconURL;
-  required USVString password;
+dictionary PasswordCredentialData : CredentialData {
+  USVString name;
+  USVString iconURL;
+  required USVString origin;
+  required USVString password;
 };
 
-typedef (PasswordCredentialData or HTMLFormElement) PasswordCredentialInit;
+typedef (PasswordCredentialData or HTMLFormElement) PasswordCredentialInit;
 
-partial dictionary CredentialCreationOptions {
-  PasswordCredentialInit password;
+partial dictionary CredentialCreationOptions {
+  PasswordCredentialInit password;
 };
 
-[Constructor(FederatedCredentialInit data),
- Exposed=Window,
- SecureContext]
-interface FederatedCredential : Credential {
-  readonly attribute USVString provider;
-  readonly attribute DOMString? protocol;
+[Constructor(FederatedCredentialInit data),
+ Exposed=Window,
+ SecureContext]
+interface FederatedCredential : Credential {
+  readonly attribute USVString provider;
+  readonly attribute DOMString? protocol;
 };
-FederatedCredential includes CredentialUserData;
+FederatedCredential includes CredentialUserData;
 
-dictionary FederatedCredentialRequestOptions {
-  sequence<USVString> providers;
-  sequence<DOMString> protocols;
+dictionary FederatedCredentialRequestOptions {
+  sequence<USVString> providers;
+  sequence<DOMString> protocols;
 };
 
-partial dictionary CredentialRequestOptions {
-  FederatedCredentialRequestOptions federated;
+partial dictionary CredentialRequestOptions {
+  FederatedCredentialRequestOptions federated;
 };
 
-dictionary FederatedCredentialInit : CredentialData {
-  USVString name;
-  USVString iconURL;
-  required USVString provider;
-  DOMString protocol;
+dictionary FederatedCredentialInit : CredentialData {
+  USVString name;
+  USVString iconURL;
+  required USVString origin;
+  required USVString provider;
+  DOMString protocol;
 };
 
-partial dictionary CredentialCreationOptions {
-  FederatedCredentialInit federated;
+partial dictionary CredentialCreationOptions {
+  FederatedCredentialInit federated;
 };
 
 
    
@@ -4475,8 +4568,9 @@ 
    2.1. Infrastructure (2) (3) (4) (5) (6) (7)
     
  • 2.2. The Credential Interface
     
  • 2.2.1. Credential Internal Methods
-    
  • 3. Password Credentials
-    
  • 7.2. Extension Points (2) (3)
+    
  • 2.2.1.2. [[DiscoverFromExternalSource]] internal method
+    
  • 3. Password Credentials
+    
  • 7.2. Extension Points (2) (3)
    
   
   
   
@@ -4500,17 +4594,18 @@ 
    2.1. Infrastructure (2) (3) (4)
     
  • 2.2. The Credential Interface (2)
-    
  • 2.2.1. Credential Internal Methods (2)
+    
  • 2.2.1.1. [[CollectFromCredentialStore]] internal method
+    
  • 2.2.1.3. [[Store]] internal method
     
  • 2.3. navigator.credentials
     
  • 2.5.3. Store a Credential
     
  • 2.5.5. Prevent Silent Access (2)
     
  • 3.1.1. Password-based Sign-in
     
  • 3.3.1. 
-    PasswordCredential's [[CollectFromCredentialStore]](options, sameOriginWithAncestors)  (2)
+    PasswordCredential's [[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)  (2)
     
  • 3.3.3. 
     PasswordCredential's [[Store]](credential, sameOriginWithAncestors)  (2) (3) (4)
     
  • 4.2.1. 
-    FederatedCredential's [[CollectFromCredentialStore]](options, sameOriginWithAncestors)  (2)
+    FederatedCredential's [[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)  (2)
     
  • 4.2.3. 
     FederatedCredential's [[Store]](credential, sameOriginWithAncestors)  (2) (3) (4)
     
  • 5.2. Requiring User Mediation
@@ -4523,9 +4618,9 @@ 
    #abstract-opdef-credential-store-retrieve-a-list-of-credentialsReferenced in:
    
   
   
   
+  
   
   
   
   
   
@@ -4989,9 +5103,9 @@ 
    3.1.3. Change Password (2)
     
  • 3.2. The PasswordCredential Interface (2) (3) (4) (5) (6)
     
  • 3.3.1. 
-    PasswordCredential's [[CollectFromCredentialStore]](options, sameOriginWithAncestors) 
+    PasswordCredential's [[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors) 
     
  • 3.3.2. 
-    PasswordCredential's [[Create]](options, sameOriginWithAncestors)  (2)
+    PasswordCredential's [[Create]](origin, options, sameOriginWithAncestors)  (2)
     
  • 3.3.3. 
     PasswordCredential's [[Store]](credential, sameOriginWithAncestors)  (2) (3)
     
  • 3.3.4. 
@@ -5008,7 +5122,7 @@ 
    3.1.1. Password-based Sign-in (2)
     
  • 3.3.1. 
-    PasswordCredential's [[CollectFromCredentialStore]](options, sameOriginWithAncestors)  (2)
+    PasswordCredential's [[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)  (2)
     
  • 3.3.6. 
     CredentialRequestOptions Matching for PasswordCredential 
    
@@ -5048,7 +5162,7 @@ 
    3.2. The PasswordCredential Interface (2) (3) (4)
     
  • 3.3.2. 
-    PasswordCredential's [[Create]](options, sameOriginWithAncestors)  (2)
+    PasswordCredential's [[Create]](origin, options, sameOriginWithAncestors)  (2)
     
  • 3.3.4. 
     Create a PasswordCredential from an HTMLFormElement 
     
  • 3.3.5. 
@@ -5069,6 +5183,15 @@ 
    
+   #dom-passwordcredentialdata-originReferenced in:
+   
+
    • + 
     spec: ECMA262; urlPrefix: https://tc39.github.io/ecma262/
   type: dfn
     text: JavaScript realm; url: sec-code-realms
+    text: internal method; url: sec-ordinary-object-internal-methods-and-internal-slots
 spec: HTML; urlPrefix: https://html.spec.whatwg.org/multipage/
   urlPrefix: forms.html
     type: element-attr
@@ -51,12 +53,17 @@ 
    Credential Management Level 1
    
     text: public suffix; url: #
 spec: FETCH; urlPrefix: https://fetch.spec.whatwg.org/
   type: dfn
-    text: http-network-or-cache fetch; url: http-network-or-cache-fetch 
+    text: http-network-or-cache fetch; url: http-network-or-cache-fetch
    + 
     spec:html; type:dfn; for:/; text:origin
+spec:html; type:dfn; for:environment settings object; text:global object
 spec:fetch; type:dfn; for:/; text:request
 spec:fetch; type:dictionary; for:/; text:RequestInit
+spec:infra; type:dfn; for:/; text:set
+spec:infra; type:dfn; for:struct; text:item
+spec:webidl; type:idl; for:/; text:Function
 spec:webidl; type:interface; text:Promise
 spec:promises-guide-1; type:dfn; text:resolve
 
@@ -66,6 +73,9 @@ 
    Credential Management Level 1
    
 spec:html; type:dfn; text:autofill detail tokens
 spec:url; type:dfn; text:urlencoded byte serializer
    +
    +spec:css-syntax-3;
+
     {
   "WEB-LOGIN": {
@@ -268,11 +278,11 @@ 
    Credential Management Level 1
    
 
     :   type
     ::  This attribute's getter returns the value of the object's [=interface object=]'s
-        {{[[type]]}} slot, which specifies the kind of credential represented by this object.
+        {{[[type]]}} slot, which specifies the [=credential type=] represented by this object.
 
     :   \[[type]]
     ::  The {{Credential}} [=interface object=] has an internal slot named `[[type]]`, which
-        unsurprisingly contains a string representing the type of the credential. The slot's value
+        unsurprisingly contains a string representing the credential type. The slot's value
         is the empty string unless otherwise specified.
 
         Note: The {{[[type]]}} slot's value will be the same for all credentials implementing a
@@ -300,64 +310,86 @@ 
    Credential Management Level 1
    
   for which the {{Credential}} may be [=effective=].
 
   ### `Credential` Internal Methods ### {#credential-internal-methods}
-
-  Each [=interface object=] created for interfaces which [=interface/inherit=] from {{Credential}}
-  defines several internal methods that allow retrieval and storage of {{Credential}} objects:
-
-  
    
-    \[[CollectFromCredentialStore]](options, sameOriginWithAncestors)
-    is called with a {{CredentialRequestOptions}} and a boolean which is true iff the caller's
-    [=environment settings object=] is [=same-origin with its ancestors=]. The algorithm returns a
-    set of {{Credential}} objects from the user agent's [=credential store=] that match the options
-    provided. If no matching {{Credential}} objects are available, the returned set will be empty.
+  
+  The {{Credential}} [=interface object=] features several [=internal methods=] facilitating 
+  retrieval and storage of {{Credential}} objects, with default "no-op" implementations
+  as specified in this section, below.
+
+  Unless otherwise specified, each [=interface object=] created for interfaces which [=interface/inherit=] 
+  from {{Credential}} MUST provide implementations for at least one of these internal methods, overriding
+  {{Credential}}'s default implementations, as appropriate for the [=credential=] type. E.g.,
+  [[#passwordcredential-interface]], [[#federatedcredential-interface]], and [[WEBAUTHN]].
+
+  
    `[[CollectFromCredentialStore]]` internal method
    
+    \[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)
+    is called with an [=environment settings object/origin=], a {{CredentialRequestOptions}}, and a boolean which
+    is true iff the caller's [=environment settings object=] is [=same-origin with its ancestors=].
+    The algorithm returns a set of {{Credential}} objects from the user agent's [=credential store=] that
+    match the options provided. If no matching {{Credential}} objects are available, the
+    returned set will be empty.
+
+    {{Credential}}'s default implementation of
+    {{Credential/[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)}}:
 
     
      
       1.  Return an empty set.
     
    
-  
    
 
-  
    
-    \[[DiscoverFromExternalSource]](options, sameOriginWithAncestors)
-    is called with a {{CredentialRequestOptions}} object, and a boolean which is true iff the
-    caller's [=environment settings object=] is [=same-origin with its ancestors=]. It returns a
-    {{Credential}} if one can be returned given the options provided, `null` if no credential is
-    available, or an error if discovery fails (for example, incorrect options could produce a
-    {{TypeError}}). If this kind of {{Credential}} is only [=effective=] for a single use or a
-    limited time, this method is responsible for generating new [=credentials=] using a
-    [=credential source=].
+
+  
    `[[DiscoverFromExternalSource]]` internal method
    
+    \[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)
+    is called [=in parallel=] with an [=environment settings object/origin=], a {{CredentialRequestOptions}} object,
+    and a boolean which is true iff the caller's [=environment settings object=] is
+    [=same-origin with its ancestors=].
+    It returns a {{Credential}} if one can be
+    returned given the options provided, `null` if no credential is available, or an error if
+    discovery fails (for example, incorrect options could produce a {{TypeError}}). If this
+    kind of {{Credential}} is only [=effective=] for a single use or a limited time, this
+    method is responsible for generating new [=credentials=] using a [=credential source=].
+
+    {{Credential}}'s default implementation of
+    {{Credential/[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)}}:
 
     
      
       1.  Return `null`.
     
    
-  
    
-  
-  
    
-    \[[Store]](credential, sameOriginWithAncestors) is
-    called with a {{Credential}}, and a boolean which is true iff the caller's [=environment
-    settings object=] is [=same-origin with its ancestors=]. The algorithm returns once
-    {{Credential}} is persisted to the [=credential store=]:
+
+  
    `[[Store]]` internal method
    
+    \[[Store]](credential, sameOriginWithAncestors)
+    is called [=in parallel=] with a {{Credential}}, and a boolean which is true iff the caller's
+    [=environment settings object=] is [=same-origin with its ancestors=].
+    The algorithm returns once {{Credential}} is persisted to the [=credential store=].
+
+    {{Credential}}'s default implementation of {{Credential/[[Store]](credential, sameOriginWithAncestors)}}:
 
     
      
       1.  Return `undefined`.
     
    
-  
    
 
-  
    
-    \[[Create]](options, sameOriginWithAncestors) is
-    called with a {{CredentialCreationOptions}}, and a boolean which is true iff the caller's
-    [=environment settings object=] is [=same-origin with its ancestors=]. The algorithm returns
-    either a {{Credential}}, if one can be created, `null` if no credential was created, or an
-    error if creation fails due to exceptional situations (for example, incorrect options could
-    produce a {{TypeError}}):
+  
    `[[Create]]` internal method
    
+    \[[Create]](origin, options, sameOriginWithAncestors)
+    is called [=in parallel=] with an [=environment settings object/origin=], a {{CredentialCreationOptions}},
+    and a boolean which is true iff the caller's
+    [=environment settings object=] is [=same-origin with its ancestors=].
+    The algorithm either:
 
-    
      
+    * creates a {{Credential}}, or
+    * does not create a credential and returns `null`, or
+    * returns an error if creation fails due to exceptional situations
+        (for example, incorrect options could produce a {{TypeError}}).
+
+    When creating a {{Credential}}, it will return an algorithm that takes a [=global object=]
+        and returns an [=interface object=]
+        inheriting from {{Credential}}. This algorithm MUST be invoked from a [=task=].
+
+    Note: This algorithm's steps are defined on a per-[=credential type=] basis.
+
+    {{Credential}}'s default implementation of {{Credential/[[Create]](origin, options, sameOriginWithAncestors)}}:
+
+     
        
       1.  Return `null`.
     
      
-  
    
 
-  Unless otherwise specified, the [=interface objects=] for [=interfaces=] which [=interface/inherit=] from
-  {{Credential}} will alias {{Credential}}'s implementation of these three internal methods. Since that
-  implementation isn't particularly useful, derived interfaces MUST override one or the other.
 
   ### `CredentialUserData` Mixin ### {#credentialuserdata-mixin}
 
@@ -426,7 +458,7 @@ 
    Credential Management Level 1
    
 
     :   store(credential)
     ::  When {{CredentialsContainer/store()}} is called, the user agent MUST return the result of
-        executing Store a `Credential` on 
+        executing Store a `Credential` on
         {{CredentialsContainer/store(credential)/credential}}.
 
         
    @@ -441,7 +473,7 @@ 
    Credential Management Level 1
    
         
               options: The options used to create a `Credential`.
         
    
-    
+
     :   preventSilentAccess()
     ::  When {{CredentialsContainer/preventSilentAccess()}} is called, the user agent MUST return
         the result of executing Prevent Silent Access on the current settings
@@ -727,13 +759,15 @@ 
    Request a `Credential`
    
 
     4.  Let |p| be [=a new promise=].
 
-    5.  Let |sameOriginWithAncestors| be `true` if |settings| is [=same-origin with its
+    5.  Let |origin| be the [=current settings object=]'s [=environment settings object/origin=].
+
+    6.  Let |sameOriginWithAncestors| be `true` if |settings| is [=same-origin with its
         ancestors=], and `false` otherwise.
-   
-    6.  Run the following steps [=in parallel=]: 
+
+    7.  Run the following steps [=in parallel=]:
 
         1.  Let |credentials| be the result of     collecting
-            `Credential`s from the credential store, given |options| and
+            `Credential`s from the credential store, given |origin|, |options|, and
             |sameOriginWithAncestors|.
 
         2.  If |credentials| is an [=exception=], [=reject=] |p| with |credentials|.
@@ -743,8 +777,7 @@ 
    Request a `Credential`
    
 
             1.  |credentials|' [=set/size=] is 1
 
-            2.  |settings|' [=environment settings object/origin=] does not
-                [=origin/requires user mediation|require user mediation=]
+            2.  |origin| does not [=origin/requires user mediation|require user mediation=]
 
             3.  |options| is matchable a priori.
 
@@ -768,8 +801,8 @@ 
    Request a `Credential`
    
         7.  Assert: |choice| is an [=interface object=].
 
         8.  Let |result| be the result of executing |choice|'s
-            {{[[DiscoverFromExternalSource]](options, sameOriginWithAncestors)}}, given |options|
-            and |sameOriginWithAncestors|.
+            {{[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)}},
+            given |origin|, |options|, and |sameOriginWithAncestors|.
 
         9.  If |result| is a {{Credential}} or `null`, resolve |p| with |result|.
 
@@ -780,7 +813,8 @@ 
    Request a `Credential`
    
 
   
    Collect `Credential`s from the credential store
    
 
-  Given a {{CredentialRequestOptions}} (|options|) and a boolean which is `true` iff the calling
+  Given an [=environment settings object/origin=] (|origin|),
+  a {{CredentialRequestOptions}} (|options|), and a boolean which is `true` iff the calling
   context is [=same-origin with its ancestors=] (|sameOriginWithAncestors|), the user agent may
   collect `Credential`s from the credential store,
   returning a set of {{Credential}} objects stored by the user agent locally that match |options|'
@@ -792,15 +826,15 @@ 
    Collect `Credential`s from the creden
     2.  For each |interface| in |options|' relevant credential interface objects:
 
         1.  Let |r| be the result of executing |interface|'s
-            {{Credential/[[CollectFromCredentialStore]](options, sameOriginWithAncestors)}} internal
-            method on |options| and |sameOriginWithAncestors|.
+            {{Credential/[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)}} internal method on
+            |origin|, |options|, and |sameOriginWithAncestors|.
 
         2.  If |r| is an [=exception=], return |r|.
 
         3.  Assert: |r| is a list of [=interface objects=].
 
         4.  For each |c| in |r|:
-       
+
             1.  Append |c| to |possible matches|.
 
     3.  Return |possible matches|.
@@ -844,16 +878,18 @@ 
    Create a `Credential`
    
   circumstances, the {{Promise}} may reject with an appropriate exception:
 
   
      
-    1.  Let |settings| be the current settings object
+    1.  Let |settings| be the current settings object.
 
     2.  Assert: |settings| is a [=secure context=].
 
-    3.  Let |sameOriginWithAncestors| be `true` if the [=current settings object=] is [=same-origin
+    3.  Let |global| be |settings|' [=environment settings object/global object=].
+
+    4.  Let |sameOriginWithAncestors| be `true` if the [=current settings object=] is [=same-origin
         with its ancestors=], and `false` otherwise.
 
-    4.  Let |interfaces| be the set of |options|' relevant credential interface objects.
+    5.  Let |interfaces| be the [=set=] of |options|' relevant credential interface objects.
 
-    5.  Return [=a promise rejected with=] `NotSupportedError` if any of the following statements
+    6.  Return [=a promise rejected with=] `NotSupportedError` if any of the following statements
         are true:
 
         1.  |settings| does not have a [=environment settings object/responsible document=].
@@ -865,22 +901,30 @@ 
      Create a `Credential`
      
             types in order to support a "sign-up" use case. For the moment, though, we're punting
             on that by restricting the dictionary to a single entry.
 
-    6.  If |options|.{{CredentialCreationOptions/signal}}'s [=AbortSignal/aborted
+    7.  If |options|.{{CredentialCreationOptions/signal}}'s [=AbortSignal/aborted
         flag=] is set, then return [=a promise rejected with=] an "{{AbortError}}" {{DOMException}}.
 
-    7.  Let |p| be [=a new promise=].
+    8.  Let |p| be [=a new promise=].
 
-    8.  Run the following steps [=in parallel=]:
+    9.  Let |origin| be |settings|'s [=environment settings object/origin=].
 
-        1.  Let |r| be the result of executing |interfaces|[0]
-            {{Credential/[[Create]](options, sameOriginWithAncestors)}} internal method on |options|
-            and |sameOriginWithAncestors|.
+    10.  Run the following steps [=in parallel=]:
 
-        2.  If |r| is an [=exception=], [=reject=] |p| with |r|.
+        1.  Let |r| be the result of executing |interfaces|[0]'s
+            {{Credential/[[Create]](origin, options, sameOriginWithAncestors)}} internal method on
+            |origin|, |options|, and |sameOriginWithAncestors|.
 
-            Otherwise, [=resolve=] |p| with |r|.
+        2.  If |r| is an [=exception=], [=reject=] |p| with |r|, and terminate these substeps.
+
+        3.  If |r| is a {{Credential}} or `null`, [=resolve=] |p| with |r|, and terminate these substeps.
+
+        4.  Assert: |r| is a algorithm (as defined in [[#algorithm-create-cred]]).
+
+        5.  [=Queue a task=] on |global|'s [=DOM manipulation task source=] to run the following substeps:
 
-    9.  Return |p|.
+            1. [=Resolve=] |p| with the result of [=promise-calling=] |r| given |global|.
+
+    11.  Return |p|.
   
    
 
   
    Prevent Silent Access
    
@@ -902,6 +946,8 @@ 
    Prevent Silent Access
    
 
     4.  Retun |p|.
   
+
+