@tinycloud/sdk-core 2.11.0-beta.10 → 2.11.0-beta.11

package/dist/index.cjs

@@ -39,23 +39,27 @@ var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  ACCOUNT_INDEX_SCHEMA: () => import_bootstrap3.ACCOUNT_INDEX_SCHEMA,
+  ACCOUNT_INDEX_SCHEMA: () => import_bootstrap4.ACCOUNT_INDEX_SCHEMA,
+  ACCOUNT_MANIFEST_PERMISSIONS: () => import_bootstrap4.ACCOUNT_MANIFEST_PERMISSIONS,
   ACCOUNT_REGISTRY_PATH: () => ACCOUNT_REGISTRY_PATH,
   ACCOUNT_REGISTRY_SPACE: () => ACCOUNT_REGISTRY_SPACE,
+  ATTESTED_ENFORCER_BINDING_V2_SCHEMA: () => ATTESTED_ENFORCER_BINDING_V2_SCHEMA,
   AccountService: () => AccountService,
   AutoApproveSpaceCreationHandler: () => AutoApproveSpaceCreationHandler,
-  BOOTSTRAP_ALLOWLIST: () => import_bootstrap3.BOOTSTRAP_ALLOWLIST,
-  BOOTSTRAP_DEFAULT_SPACE: () => import_bootstrap3.BOOTSTRAP_DEFAULT_SPACE,
-  BOOTSTRAP_ENCRYPTION_NETWORK_NAME: () => import_bootstrap3.BOOTSTRAP_ENCRYPTION_NETWORK_NAME,
-  BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE: () => import_bootstrap3.BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
-  BOOTSTRAP_MANIFEST: () => import_bootstrap3.BOOTSTRAP_MANIFEST,
-  BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS: () => import_bootstrap3.BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
-  BOOTSTRAP_PUBLIC_SPACE: () => import_bootstrap3.BOOTSTRAP_PUBLIC_SPACE,
-  BOOTSTRAP_SESSION_REQUESTS: () => import_bootstrap3.BOOTSTRAP_SESSION_REQUESTS,
-  BOOTSTRAP_SPACE_MANIFESTS: () => import_bootstrap3.BOOTSTRAP_SPACE_MANIFESTS,
-  BOOTSTRAP_SPACE_NAMES: () => import_bootstrap3.BOOTSTRAP_SPACE_NAMES,
-  CAPABILITIES: () => import_bootstrap3.CAPABILITIES,
-  CAPABILITY_REGISTRY: () => import_bootstrap3.CAPABILITY_REGISTRY,
+  BOOTSTRAP_ALLOWLIST: () => import_bootstrap4.BOOTSTRAP_ALLOWLIST,
+  BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST: () => import_bootstrap4.BOOTSTRAP_DEFAULT_ONLY_SESSION_REQUEST,
+  BOOTSTRAP_DEFAULT_SPACE: () => import_bootstrap4.BOOTSTRAP_DEFAULT_SPACE,
+  BOOTSTRAP_ENCRYPTION_NETWORK_NAME: () => import_bootstrap4.BOOTSTRAP_ENCRYPTION_NETWORK_NAME,
+  BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE: () => import_bootstrap4.BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE,
+  BOOTSTRAP_MANIFEST: () => import_bootstrap4.BOOTSTRAP_MANIFEST,
+  BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS: () => import_bootstrap4.BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS,
+  BOOTSTRAP_PUBLIC_SPACE: () => import_bootstrap4.BOOTSTRAP_PUBLIC_SPACE,
+  BOOTSTRAP_SESSION_REQUESTS: () => import_bootstrap4.BOOTSTRAP_SESSION_REQUESTS,
+  BOOTSTRAP_SPACE_MANIFESTS: () => import_bootstrap4.BOOTSTRAP_SPACE_MANIFESTS,
+  BOOTSTRAP_SPACE_NAMES: () => import_bootstrap4.BOOTSTRAP_SPACE_NAMES,
+  CAPABILITIES: () => import_bootstrap4.CAPABILITIES,
+  CAPABILITY_REGISTRY: () => import_bootstrap4.CAPABILITY_REGISTRY,
+  CONTENT_SOURCE_V1_DOMAIN: () => CONTENT_SOURCE_V1_DOMAIN,
   CapabilityKeyRegistry: () => CapabilityKeyRegistry,
   CapabilityKeyRegistryErrorCodes: () => CapabilityKeyRegistryErrorCodes,
   CaveatedDelegationUnsupportedError: () => CaveatedDelegationUnsupportedError,
@@ -76,7 +80,7 @@ __export(index_exports, {
   DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
   DEFAULT_TINYCLOUD_FALLBACK_HOST: () => DEFAULT_TINYCLOUD_FALLBACK_HOST,
   DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL: () => DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL,
-  DUCKDB: () => import_bootstrap3.DUCKDB,
+  DUCKDB: () => import_bootstrap4.DUCKDB,
   DataVaultService: () => import_sdk_services8.DataVaultService,
   DatabaseHandle: () => import_sdk_services8.DatabaseHandle,
   DecryptTransportResponseError: () => import_sdk_services8.DecryptTransportResponseError,
@@ -87,7 +91,7 @@ __export(index_exports, {
   DuckDbService: () => import_sdk_services8.DuckDbService,
   ED25519_JCS_SIGNATURE_SUITE: () => ED25519_JCS_SIGNATURE_SUITE,
   EIP191_JCS_SIGNATURE_SUITE: () => EIP191_JCS_SIGNATURE_SUITE,
-  ENCRYPTION: () => import_bootstrap3.ENCRYPTION,
+  ENCRYPTION: () => import_bootstrap4.ENCRYPTION,
   ENCRYPTION_MANIFEST_SPACE: () => ENCRYPTION_MANIFEST_SPACE,
   ENCRYPTION_NETWORK_URN_PREFIX: () => import_sdk_services8.ENCRYPTION_NETWORK_URN_PREFIX,
   ENCRYPTION_PERMISSION_SERVICE: () => ENCRYPTION_PERMISSION_SERVICE,
@@ -99,17 +103,20 @@ __export(index_exports, {
   EnsDataSchema: () => EnsDataSchema,
   ErrorCodes: () => import_sdk_services8.ErrorCodes,
   HOLDER_KEY_BINDING_PRESENTATION_SCHEMA: () => HOLDER_KEY_BINDING_PRESENTATION_SCHEMA,
-  HOOKS: () => import_bootstrap3.HOOKS,
+  HOOKS: () => import_bootstrap4.HOOKS,
   HooksService: () => import_sdk_services8.HooksService,
   IdentityParseError: () => IdentityParseError,
-  KV: () => import_bootstrap3.KV,
+  KV: () => import_bootstrap4.KV,
   KVService: () => import_sdk_services8.KVService,
+  LAST_V2_CREATE_AT: () => LAST_V2_CREATE_AT,
+  LAST_V2_READ_AT: () => LAST_V2_READ_AT,
   LISTEN_SQL_STATEMENT_CATALOG: () => LISTEN_SQL_STATEMENT_CATALOG,
   LOCAL_LINK_HOST_SUFFIX: () => LOCAL_LINK_HOST_SUFFIX,
   LOCAL_LINK_PROBE_TIMEOUT_MS: () => LOCAL_LINK_PROBE_TIMEOUT_MS,
   LOCAL_LOOPBACK_PROBE_TIMEOUT_MS: () => LOCAL_LOOPBACK_PROBE_TIMEOUT_MS,
   LocationRecordValidationError: () => LocationRecordValidationError,
   MAX_CONTENT_BYTES: () => MAX_CONTENT_BYTES,
+  MAX_LEGACY_ENVELOPE_EXPIRES_AT: () => MAX_LEGACY_ENVELOPE_EXPIRES_AT,
   MAX_SEALED_SHARE_CONTENT_BYTES: () => MAX_SEALED_SHARE_CONTENT_BYTES,
   MAX_SHARE_ARTIFACT_BYTES: () => MAX_SHARE_ARTIFACT_BYTES,
   MAX_SHARE_CONTENT_BYTES: () => MAX_SHARE_CONTENT_BYTES,
@@ -117,9 +124,13 @@ __export(index_exports, {
   MemorySenderShareKeyStorage: () => MemorySenderShareKeyStorage,
   MemorySenderShareRecordStorage: () => MemorySenderShareRecordStorage,
   MemoryShareCache: () => MemoryShareCache,
+  NATIVE_PROJECTION_V1_DOMAIN: () => NATIVE_PROJECTION_V1_DOMAIN,
   NETWORK_NAME_PATTERN: () => import_sdk_services8.NETWORK_NAME_PATTERN,
   NetworkIdError: () => import_sdk_services8.NetworkIdError,
   OPENKEY_ACTION_ID_SEPARATOR: () => OPENKEY_ACTION_ID_SEPARATOR,
+  POLICY_CAPABILITY_V1_DOMAIN: () => POLICY_CAPABILITY_V1_DOMAIN,
+  POLICY_CAPABILITY_V1_SCHEMA: () => POLICY_CAPABILITY_V1_SCHEMA,
+  POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA: () => POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA,
   POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA: () => POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA,
   POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA: () => POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA,
   POLICY_ENGINE_DENIAL_SCHEMA: () => POLICY_ENGINE_DENIAL_SCHEMA,
@@ -127,7 +138,10 @@ __export(index_exports, {
   POLICY_ENGINE_RECORD_SCHEMA: () => POLICY_ENGINE_RECORD_SCHEMA,
   POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA: () => POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA,
   POLICY_SCHEMA: () => POLICY_SCHEMA,
+  POLICY_SESSION_UCAN_V1_PROFILE: () => POLICY_SESSION_UCAN_V1_PROFILE,
   POLICY_STATUS_SCHEMA: () => POLICY_STATUS_SCHEMA,
+  POLICY_V1_DOMAIN: () => POLICY_V1_DOMAIN,
+  POLICY_V1_SCHEMA: () => POLICY_V1_SCHEMA,
   PORTABLE_DELEGATION_SCHEMA: () => PORTABLE_DELEGATION_SCHEMA,
   PermissionNotInManifestError: () => PermissionNotInManifestError,
   PrefixedKVService: () => import_sdk_services8.PrefixedKVService,
@@ -135,14 +149,19 @@ __export(index_exports, {
   REQUESTER_ENGINE_RETRY_ATTEMPTS: () => REQUESTER_ENGINE_RETRY_ATTEMPTS,
   REQUESTER_ENGINE_RETRY_MAX_DELAY_MS: () => REQUESTER_ENGINE_RETRY_MAX_DELAY_MS,
   REQUESTER_NEAR_EXPIRY_SECONDS: () => REQUESTER_NEAR_EXPIRY_SECONDS,
+  ROOT_REVOCATION_V1_DOMAIN: () => ROOT_REVOCATION_V1_DOMAIN,
+  ROOT_REVOCATION_V1_SCHEMA: () => ROOT_REVOCATION_V1_SCHEMA,
+  ROOT_STATUS_CHECKPOINT_V1_SCHEMA: () => ROOT_STATUS_CHECKPOINT_V1_SCHEMA,
+  ROOT_STATUS_RENEWAL_V1_DOMAIN: () => ROOT_STATUS_RENEWAL_V1_DOMAIN,
+  ROOT_STATUS_V1_DOMAIN: () => ROOT_STATUS_V1_DOMAIN,
   SECRETS_SPACE: () => SECRETS_SPACE,
   SECRET_NAME_RE: () => import_sdk_services8.SECRET_NAME_RE,
-  SECRET_RECORDS_SCHEMA: () => import_bootstrap3.SECRET_RECORDS_SCHEMA,
+  SECRET_RECORDS_SCHEMA: () => import_bootstrap4.SECRET_RECORDS_SCHEMA,
   SERVICE_LONG_TO_SHORT: () => SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG: () => SERVICE_SHORT_TO_LONG,
   SHARE_DELIVERY_AUTHORIZATION_DOMAIN: () => SHARE_DELIVERY_AUTHORIZATION_DOMAIN,
-  SPACE: () => import_bootstrap3.SPACE,
-  SQL: () => import_bootstrap3.SQL,
+  SPACE: () => import_bootstrap4.SPACE,
+  SQL: () => import_bootstrap4.SQL,
   SQLAction: () => import_sdk_services8.SQLAction,
   SQLService: () => import_sdk_services8.SQLService,
   SecretsService: () => import_sdk_services8.SecretsService,
@@ -172,11 +191,11 @@ __export(index_exports, {
   Space: () => Space,
   SpaceErrorCodes: () => SpaceErrorCodes,
   SpaceService: () => SpaceService,
-  TINYCLOUD_ACCOUNT_SPACE_MANIFEST: () => import_bootstrap3.TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
-  TINYCLOUD_APPLICATIONS_SPACE_MANIFEST: () => import_bootstrap3.TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
-  TINYCLOUD_DEFAULT_SPACE_MANIFEST: () => import_bootstrap3.TINYCLOUD_DEFAULT_SPACE_MANIFEST,
-  TINYCLOUD_PUBLIC_SPACE_MANIFEST: () => import_bootstrap3.TINYCLOUD_PUBLIC_SPACE_MANIFEST,
-  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST: () => import_bootstrap3.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
+  TINYCLOUD_ACCOUNT_SPACE_MANIFEST: () => import_bootstrap4.TINYCLOUD_ACCOUNT_SPACE_MANIFEST,
+  TINYCLOUD_APPLICATIONS_SPACE_MANIFEST: () => import_bootstrap4.TINYCLOUD_APPLICATIONS_SPACE_MANIFEST,
+  TINYCLOUD_DEFAULT_SPACE_MANIFEST: () => import_bootstrap4.TINYCLOUD_DEFAULT_SPACE_MANIFEST,
+  TINYCLOUD_PUBLIC_SPACE_MANIFEST: () => import_bootstrap4.TINYCLOUD_PUBLIC_SPACE_MANIFEST,
+  TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST: () => import_bootstrap4.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
   TinyCloud: () => TinyCloud,
   TinyCloudDebugLogger: () => import_sdk_services8.TinyCloudDebugLogger,
   TranscriptRequester: () => TranscriptRequester,
@@ -191,9 +210,9 @@ __export(index_exports, {
   activateSessionWithHost: () => activateSessionWithHost,
   addressStorageKey: () => addressStorageKey,
   applyPrefix: () => applyPrefix,
-  bootstrapEncryptionNetworkId: () => import_bootstrap3.bootstrapEncryptionNetworkId,
-  bootstrapSpaceId: () => import_bootstrap3.bootstrapSpaceId,
-  bootstrapSteps: () => import_bootstrap3.bootstrapSteps,
+  bootstrapEncryptionNetworkId: () => import_bootstrap4.bootstrapEncryptionNetworkId,
+  bootstrapSpaceId: () => import_bootstrap4.bootstrapSpaceId,
+  bootstrapSteps: () => import_bootstrap4.bootstrapSteps,
   buildCanonicalDecryptRequest: () => import_sdk_services8.buildCanonicalDecryptRequest,
   buildDecryptAttenuation: () => import_sdk_services8.buildDecryptAttenuation,
   buildDecryptFacts: () => import_sdk_services8.buildDecryptFacts,
@@ -212,13 +231,16 @@ __export(index_exports, {
   canonicalizeRecapCaveats: () => canonicalizeRecapCaveats,
   canonicalizeSecretScope: () => import_sdk_services8.canonicalizeSecretScope,
   canonicalizeSignedObjectUnsigned: () => canonicalizeSignedObjectUnsigned,
+  canonicalizeUnifiedPolicyCapability: () => canonicalizeUnifiedPolicyCapability,
   checkDecryptInvocationInput: () => import_sdk_services8.checkDecryptInvocationInput,
   checkNodeInfo: () => checkNodeInfo,
   clearTinyCloudDebugLogs: () => import_sdk_services8.clearTinyCloudDebugLogs,
-  composeBootstrapSpaceManifest: () => import_bootstrap3.composeBootstrapSpaceManifest,
+  compactAttenuationContains: () => compactAttenuationContains,
+  composeBootstrapSpaceManifest: () => import_bootstrap4.composeBootstrapSpaceManifest,
   composeManifestRequest: () => composeManifestRequest,
   computeOwnerShareRegistrationCid: () => computeOwnerShareRegistrationCid,
   computeShareCid: () => computeShareCid,
+  contentSourceDigestHex: () => contentSourceDigestHex,
   createAndSignPolicy: () => createAndSignPolicy,
   createAndSignPolicyEngineRecord: () => createAndSignPolicyEngineRecord,
   createAndSignPolicyStatus: () => createAndSignPolicyStatus,
@@ -241,6 +263,7 @@ __export(index_exports, {
   defaultRetryPolicy: () => import_sdk_services8.defaultRetryPolicy,
   defaultSignStrategy: () => defaultSignStrategy,
   defaultSpaceCreationHandler: () => defaultSpaceCreationHandler,
+  delegatePortablePolicySession: () => delegatePortablePolicySession,
   deriveDelegationCid: () => deriveDelegationCid,
   deriveSignedObjectMaterial: () => deriveSignedObjectMaterial,
   deriveSignedReceiverKey: () => import_sdk_services8.deriveSignedReceiverKey,
@@ -272,10 +295,12 @@ __export(index_exports, {
   fetchLocationRecord: () => fetchLocationRecord,
   fetchPeerId: () => fetchPeerId,
   generateRandomReceiverKey: () => import_sdk_services8.generateRandomReceiverKey,
+  getPolicyRootStatusV3: () => getPolicyRootStatusV3,
   getTinyCloudDebugLogs: () => import_sdk_services8.getTinyCloudDebugLogs,
   hexDecode: () => import_sdk_services8.hexDecode,
   hexEncode: () => import_sdk_services8.hexEncode,
   httpUrlToMultiaddr: () => httpUrlToMultiaddr,
+  importPortableDelegation: () => importPortableDelegation,
   installTinyCloudDebugGlobals: () => import_sdk_services8.installTinyCloudDebugGlobals,
   intersectShareCapabilities: () => intersectShareCapabilities,
   isCapabilitySubset: () => isCapabilitySubset,
@@ -296,22 +321,32 @@ __export(index_exports, {
   normalizeShareActions: () => normalizeShareActions,
   normalizeShareRecipientTarget: () => normalizeShareRecipientTarget,
   normalizeShareResource: () => normalizeShareResource,
+  normalizeUnifiedPolicyCapability: () => normalizeUnifiedPolicyCapability,
   ok: () => import_sdk_services8.ok,
   openWrappedKey: () => import_sdk_services8.openWrappedKey,
   parseCanonicalNetworkId: () => parseCanonicalNetworkId,
   parseCanonicalRecapResource: () => parseCanonicalRecapResource,
+  parseCompactUcanAuthorization: () => parseCompactUcanAuthorization,
   parseExpiry: () => parseExpiry,
   parseNetworkId: () => import_sdk_services8.parseNetworkId,
   parseNodeNativePortableDelegation: () => parseNodeNativePortableDelegation,
   parsePkhDid: () => parsePkhDid,
+  parsePolicySessionUcan: () => parsePolicySessionUcan,
+  parsePortableDelegation: () => parsePortableDelegation,
   parseRecapCapabilities: () => parseRecapCapabilities,
   parseShareArtifact: () => parseShareArtifact,
   parseShareUrl: () => parseShareUrl,
   parseSpaceUri: () => parseSpaceUri,
   pkhDid: () => pkhDid,
+  policyCidFromCanonicalBytes: () => policyCidFromCanonicalBytes,
+  policyDigestHex: () => policyDigestHex,
+  policyIdForDigestHex: () => policyIdForDigestHex,
   principalDid: () => principalDid,
   principalDidEquals: () => principalDidEquals,
+  projectUnifiedPolicyCapabilities: () => projectUnifiedPolicyCapabilities,
+  projectUnifiedPolicyCapability: () => projectUnifiedPolicyCapability,
   recapCaveatsEqual: () => recapCaveatsEqual,
+  renewPolicyRootStatusV3: () => renewPolicyRootStatusV3,
   resolveCloudLocation: () => resolveCloudLocation,
   resolveManifest: () => resolveManifest,
   resolveManifestKnowledgeRoot: () => resolveManifestKnowledgeRoot,
@@ -321,10 +356,13 @@ __export(index_exports, {
   resourceCapabilitiesToAbilitiesMap: () => resourceCapabilitiesToAbilitiesMap,
   resourceCapabilitiesToSpaceAbilitiesMap: () => resourceCapabilitiesToSpaceAbilitiesMap,
   restoreDelegatedShareKey: () => restoreDelegatedShareKey,
+  revokePolicyRootV3: () => revokePolicyRootV3,
   serializeJcsJson: () => serialize,
+  serializePortableDelegation: () => serializePortableDelegation,
   serviceError: () => import_sdk_services8.serviceError,
   shareCapabilityAllows: () => shareCapabilityAllows,
   shareDeliveryTrustedKid: () => shareDeliveryTrustedKid,
+  signCompactUcanAuthorization: () => signCompactUcanAuthorization,
   signLocationRecord: () => signLocationRecord,
   signShareEnvelope: () => signShareEnvelope,
   signedObjectIdFor: () => signedObjectIdFor,
@@ -332,6 +370,10 @@ __export(index_exports, {
   tinyCloudDebugLogger: () => import_sdk_services8.tinyCloudDebugLogger,
   toSignedObjectError: () => toSignedObjectError,
   unauthorizedRecapCapabilities: () => unauthorizedRecapCapabilities,
+  unifiedNativeProjectionHashHex: () => unifiedNativeProjectionHashHex,
+  unifiedPolicyCapabilityContains: () => unifiedPolicyCapabilityContains,
+  unifiedPolicyCapabilityDigestHex: () => unifiedPolicyCapabilityDigestHex,
+  unifiedPolicyCapabilityFromNative: () => unifiedPolicyCapabilityFromNative,
   validateAuthorizationResultV1: () => validateAuthorizationResultV1,
   validateClientSession: () => validateClientSession,
   validateEnvelope: () => import_sdk_services8.validateEnvelope,
@@ -356,6 +398,8 @@ __export(index_exports, {
   verifyLocationRecord: () => verifyLocationRecord,
   verifyPolicy: () => verifyPolicy,
   verifyPolicyEngineRecord: () => verifyPolicyEngineRecord,
+  verifyPolicyRootRevocationV3: () => verifyPolicyRootRevocationV3,
+  verifyPolicyRootStatusCheckpointV3: () => verifyPolicyRootStatusCheckpointV3,
   verifyPolicyStatus: () => verifyPolicyStatus,
   verifyShareCid: () => verifyShareCid,
   verifyShareEnvelope: () => verifyShareEnvelope,
@@ -498,7 +542,7 @@ function makePkhSpaceId(address, chainId, name2) {
 
 // src/requester/index.ts
 var import_viem4 = require("viem");
-var import_blake3 = require("@noble/hashes/blake3");
+var import_blake32 = require("@noble/hashes/blake3");
 
 // ../../node_modules/multiformats/dist/src/bases/base32.js
 var base32_exports = {};
@@ -1406,7 +1450,7 @@ function encodeCID(version, code3, multihash) {
 var cidSymbol = /* @__PURE__ */ Symbol.for("@ipld/js-cid/CID");
 
 // src/requester/index.ts
-var import_zod2 = require("zod");
+var import_zod3 = require("zod");
 
 // src/policy/errors.ts
 var SignedObjectProfileError = class extends Error {
@@ -1715,16 +1759,16 @@ function policyCapabilityContains(authority, request) {
   return caveatsContain(auth.caveats, req.caveats);
 }
 function normalizePolicyCapabilityWithOptions(input, options2) {
-  const object = expectObject(input, "$");
-  assertExactKeys(object, ["service", "space", "path", "actions", "caveats"], "$");
-  const service = requiredString(object, "service", "$", "policy-capability-malformed-service");
+  const object2 = expectObject(input, "$");
+  assertExactKeys(object2, ["service", "space", "path", "actions", "caveats"], "$");
+  const service = requiredString(object2, "service", "$", "policy-capability-malformed-service");
   if (!CEILING_SERVICES.has(service)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-service",
       "$.service is outside the frozen permissionsCeiling vocabulary"
     );
   }
-  const space = requiredString(object, "space", "$", "policy-capability-malformed-space");
+  const space = requiredString(object2, "space", "$", "policy-capability-malformed-space");
   validateConcreteSpace(space);
   const canonicalSpace = space.normalize("NFC");
   if (options2.requireCanonical && canonicalSpace !== space) {
@@ -1733,7 +1777,7 @@ function normalizePolicyCapabilityWithOptions(input, options2) {
       "$.space must already be canonical NFC"
     );
   }
-  const rawPath = requiredString(object, "path", "$", "policy-capability-malformed-path");
+  const rawPath = requiredString(object2, "path", "$", "policy-capability-malformed-path");
   validateRawPath(rawPath, options2);
   const path = normalizePath(rawPath);
   if (options2.requireCanonical && path !== rawPath) {
@@ -1744,7 +1788,7 @@ function normalizePolicyCapabilityWithOptions(input, options2) {
   }
   validateRawPath(path, options2);
   const actions = normalizeActions(
-    requiredArray(object, "actions", "$", "policy-capability-malformed-action"),
+    requiredArray(object2, "actions", "$", "policy-capability-malformed-action"),
     service,
     options2
   );
@@ -1753,9 +1797,9 @@ function normalizePolicyCapabilityWithOptions(input, options2) {
   output.space = canonicalSpace;
   output.path = path;
   output.actions = actions;
-  if (hasOwn(object, "caveats")) {
+  if (hasOwn(object2, "caveats")) {
     output.caveats = validateCaveats(
-      requiredValue(object, "caveats", "$", "policy-capability-malformed-caveats"),
+      requiredValue(object2, "caveats", "$", "policy-capability-malformed-caveats"),
       output.service
     );
   }
@@ -1778,9 +1822,9 @@ function expectObject(input, path) {
     );
   }
 }
-function assertExactKeys(object, allowed, path) {
+function assertExactKeys(object2, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object)) {
+  for (const key of Object.keys(object2)) {
     if (!allowedSet.has(key)) {
       throw new PolicyCapabilityError(
         key === "id" || key === "scope" ? "policy-capability-malformed" : "policy-capability-unknown-key",
@@ -1789,21 +1833,21 @@ function assertExactKeys(object, allowed, path) {
     }
   }
 }
-function requiredValue(object, key, path, code3) {
-  if (!hasOwn(object, key)) {
+function requiredValue(object2, key, path, code3) {
+  if (!hasOwn(object2, key)) {
     throw new PolicyCapabilityError(code3, `${path}.${key} is required`);
   }
-  return object[key];
+  return object2[key];
 }
-function requiredString(object, key, path, code3) {
-  const value = requiredValue(object, key, path, code3);
+function requiredString(object2, key, path, code3) {
+  const value = requiredValue(object2, key, path, code3);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyCapabilityError(code3, `${path}.${key} must be a non-empty string`);
   }
   return value;
 }
-function requiredArray(object, key, path, code3) {
-  const value = requiredValue(object, key, path, code3);
+function requiredArray(object2, key, path, code3) {
+  const value = requiredValue(object2, key, path, code3);
   if (!Array.isArray(value)) {
     throw new PolicyCapabilityError(code3, `${path}.${key} must be an array`);
   }
@@ -1948,11 +1992,11 @@ function validateSqlStatement(input, path) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new PolicyCapabilityError("policy-capability-malformed-caveats", `${path} must be an object`);
   }
-  const object = input;
-  assertCaveatKeys(object, ["name", "sql", "fixedParams"], path);
-  caveatString(object, "name", path);
-  caveatString(object, "sql", path);
-  const fixedParams = requiredCaveat(object, "fixedParams", path);
+  const object2 = input;
+  assertCaveatKeys(object2, ["name", "sql", "fixedParams"], path);
+  caveatString(object2, "name", path);
+  caveatString(object2, "sql", path);
+  const fixedParams = requiredCaveat(object2, "fixedParams", path);
   if (!Array.isArray(fixedParams)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
@@ -1967,20 +2011,20 @@ function validateFixedParam(input, path) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new PolicyCapabilityError("policy-capability-malformed-caveats", `${path} must be an object`);
   }
-  const object = input;
-  assertCaveatKeys(object, ["index", "value"], path);
-  const index = requiredCaveat(object, "index", path);
+  const object2 = input;
+  assertCaveatKeys(object2, ["index", "value"], path);
+  const index = requiredCaveat(object2, "index", path);
   if (typeof index !== "number" || !Number.isSafeInteger(index) || index < 0) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
       `${path}.index must be a non-negative integer`
     );
   }
-  requiredCaveat(object, "value", path);
+  requiredCaveat(object2, "value", path);
 }
-function assertCaveatKeys(object, allowed, path) {
+function assertCaveatKeys(object2, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object)) {
+  for (const key of Object.keys(object2)) {
     if (!allowedSet.has(key)) {
       throw new PolicyCapabilityError(
         "policy-capability-malformed-caveats",
@@ -1989,17 +2033,17 @@ function assertCaveatKeys(object, allowed, path) {
     }
   }
 }
-function requiredCaveat(object, key, path) {
-  if (!hasOwn(object, key)) {
+function requiredCaveat(object2, key, path) {
+  if (!hasOwn(object2, key)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
       `${path}.${key} is required`
     );
   }
-  return object[key];
+  return object2[key];
 }
-function caveatString(object, key, path) {
-  const value = requiredCaveat(object, key, path);
+function caveatString(object2, key, path) {
+  const value = requiredCaveat(object2, key, path);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
@@ -2030,8 +2074,8 @@ function caveatsContain(authority, request) {
     (statement) => authorityStatements.some((candidate) => jcsCanonicalize(candidate) === jcsCanonicalize(statement))
   );
 }
-function hasOwn(object, key) {
-  return objectHasOwn2(object, key);
+function hasOwn(object2, key) {
+  return objectHasOwn2(object2, key);
 }
 
 // src/policy/signed-object.ts
@@ -2359,17 +2403,17 @@ async function createAndSignSignedObject(input, signer) {
 }
 function createAndSignPolicy(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object) => validatePolicySignedShape(object)
+    (object2) => validatePolicySignedShape(object2)
   );
 }
 function createAndSignPolicyStatus(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object) => validatePolicyStatusSignedShape(object)
+    (object2) => validatePolicyStatusSignedShape(object2)
   );
 }
 function createAndSignPolicyEngineRecord(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object) => validatePolicyEngineRecordSignedShape(object)
+    (object2) => validatePolicyEngineRecordSignedShape(object2)
   );
 }
 async function verifySignedObject(input) {
@@ -2473,9 +2517,9 @@ function validateUnsignedForDescriptor(input, descriptor) {
   }
 }
 function validatePolicyShape(input, signed) {
-  const object = expectJsonObject(normalizeJson(input), "$");
+  const object2 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object,
+    object2,
     signed ? [
       "schema",
       "policyId",
@@ -2503,30 +2547,30 @@ function validatePolicyShape(input, signed) {
     ],
     "$"
   );
-  expectConst(requiredString2(object, "schema", "$"), POLICY_SCHEMA, "$.schema");
+  expectConst(requiredString2(object2, "schema", "$"), POLICY_SCHEMA, "$.schema");
   if (signed) {
-    requiredString2(object, "policyId", "$");
-    validateSignature(requiredValue2(object, "signature", "$"));
+    requiredString2(object2, "policyId", "$");
+    validateSignature(requiredValue2(object2, "signature", "$"));
   }
-  requiredString2(object, "ownerDid", "$");
-  requiredString2(object, "signingKeyDid", "$");
-  requiredDateString(object, "createdAt", "$");
-  optionalDateString(object, "expiresAt", "$");
-  validatePolicyResource(requiredValue2(object, "resource", "$"), "$.resource");
-  validateExpression(requiredValue2(object, "when", "$"), "$.when");
-  validateGrant(requiredValue2(object, "grant", "$"), "$.grant");
-  if (hasOwn2(object, "disclosure")) {
-    validateDisclosure(requiredValue2(object, "disclosure", "$"), "$.disclosure");
+  requiredString2(object2, "ownerDid", "$");
+  requiredString2(object2, "signingKeyDid", "$");
+  requiredDateString(object2, "createdAt", "$");
+  optionalDateString(object2, "expiresAt", "$");
+  validatePolicyResource(requiredValue2(object2, "resource", "$"), "$.resource");
+  validateExpression(requiredValue2(object2, "when", "$"), "$.when");
+  validateGrant(requiredValue2(object2, "grant", "$"), "$.grant");
+  if (hasOwn2(object2, "disclosure")) {
+    validateDisclosure(requiredValue2(object2, "disclosure", "$"), "$.disclosure");
   }
-  if (hasOwn2(object, "audit")) {
-    validateAudit(requiredValue2(object, "audit", "$"), "$.audit");
+  if (hasOwn2(object2, "audit")) {
+    validateAudit(requiredValue2(object2, "audit", "$"), "$.audit");
   }
-  return object;
+  return object2;
 }
 function validatePolicyStatusShape(input, signed) {
-  const object = expectJsonObject(normalizeJson(input), "$");
+  const object2 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object,
+    object2,
     signed ? [
       "schema",
       "statusId",
@@ -2550,28 +2594,28 @@ function validatePolicyStatusShape(input, signed) {
     ],
     "$"
   );
-  expectConst(requiredString2(object, "schema", "$"), POLICY_STATUS_SCHEMA, "$.schema");
+  expectConst(requiredString2(object2, "schema", "$"), POLICY_STATUS_SCHEMA, "$.schema");
   if (signed) {
-    requiredString2(object, "statusId", "$");
-    validateSignature(requiredValue2(object, "signature", "$"));
+    requiredString2(object2, "statusId", "$");
+    validateSignature(requiredValue2(object2, "signature", "$"));
   }
-  requiredString2(object, "policyId", "$");
-  requiredString2(object, "ownerDid", "$");
-  requiredInteger(object, "sequence", "$", 0);
-  expectOneOf(requiredString2(object, "disposition", "$"), [
+  requiredString2(object2, "policyId", "$");
+  requiredString2(object2, "ownerDid", "$");
+  requiredInteger(object2, "sequence", "$", 0);
+  expectOneOf(requiredString2(object2, "disposition", "$"), [
     "active",
     "suspended",
     "revoked"
   ], "$.disposition");
-  requiredDateString(object, "effectiveAt", "$");
-  optionalString(object, "reasonCode", "$");
-  requiredString2(object, "signingKeyDid", "$");
-  return object;
+  requiredDateString(object2, "effectiveAt", "$");
+  optionalString(object2, "reasonCode", "$");
+  requiredString2(object2, "signingKeyDid", "$");
+  return object2;
 }
 function validatePolicyEngineRecordShape(input, signed) {
-  const object = expectJsonObject(normalizeJson(input), "$");
+  const object2 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object,
+    object2,
     signed ? [
       "schema",
       "engineRecordId",
@@ -2596,44 +2640,44 @@ function validatePolicyEngineRecordShape(input, signed) {
     "$"
   );
   expectConst(
-    requiredString2(object, "schema", "$"),
+    requiredString2(object2, "schema", "$"),
     POLICY_ENGINE_RECORD_SCHEMA,
     "$.schema"
   );
   if (signed) {
-    requiredString2(object, "engineRecordId", "$");
-    validateSignature(requiredValue2(object, "signature", "$"));
+    requiredString2(object2, "engineRecordId", "$");
+    validateSignature(requiredValue2(object2, "signature", "$"));
   }
-  requiredString2(object, "ownerDid", "$");
-  requiredString2(object, "endpoint", "$");
-  requiredString2(object, "audience", "$");
+  requiredString2(object2, "ownerDid", "$");
+  requiredString2(object2, "endpoint", "$");
+  requiredString2(object2, "audience", "$");
   requiredStringArray(
-    object,
+    object2,
     "supportedPolicyVersions",
     "$",
     (value, path) => expectConst(value, "v0", path)
   );
-  requiredStringArray(object, "supportedEvidenceVerifiers", "$");
-  requiredString2(object, "grantIssuerDid", "$");
-  requiredDateString(object, "expiresAt", "$");
-  return object;
+  requiredStringArray(object2, "supportedEvidenceVerifiers", "$");
+  requiredString2(object2, "grantIssuerDid", "$");
+  requiredDateString(object2, "expiresAt", "$");
+  return object2;
 }
 function validateSignature(input) {
-  const object = expectJsonObject(input, "$.signature");
-  assertExactKeys2(object, ["suite", "signerDid", "value"], "$.signature");
-  const suite = requiredString2(object, "suite", "$.signature");
+  const object2 = expectJsonObject(input, "$.signature");
+  assertExactKeys2(object2, ["suite", "signerDid", "value"], "$.signature");
+  const suite = requiredString2(object2, "suite", "$.signature");
   assertSupportedSignatureSuite(suite);
-  const signerDid = requiredString2(object, "signerDid", "$.signature");
-  const value = requiredString2(object, "value", "$.signature");
+  const signerDid = requiredString2(object2, "signerDid", "$.signature");
+  const value = requiredString2(object2, "value", "$.signature");
   decodeSignatureValue(value, suite);
   return { suite, signerDid, value };
 }
 function validatePolicyResource(input, path) {
-  const object = expectJsonObject(input, path);
-  assertExactKeys2(object, ["resourceType", "resourceId", "permissionsCeiling"], path);
-  requiredString2(object, "resourceType", path);
-  requiredString2(object, "resourceId", path);
-  const ceiling = requiredArray2(object, "permissionsCeiling", path, 1);
+  const object2 = expectJsonObject(input, path);
+  assertExactKeys2(object2, ["resourceType", "resourceId", "permissionsCeiling"], path);
+  requiredString2(object2, "resourceType", path);
+  requiredString2(object2, "resourceId", path);
+  const ceiling = requiredArray2(object2, "permissionsCeiling", path, 1);
   for (let index = 0; index < ceiling.length; index++) {
     validatePolicyCapability(ceiling[index], `${path}.permissionsCeiling[${index}]`);
   }
@@ -2649,10 +2693,10 @@ function validatePolicyPermissionsCeilingForSigning(input) {
   }
 }
 function validatePolicyCapability(input, path) {
-  const object = expectJsonObject(input, path);
+  const object2 = expectJsonObject(input, path);
   try {
-    const canonical = canonicalizePolicyCapability(object);
-    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {
+    const canonical = canonicalizePolicyCapability(object2);
+    if (jcsCanonicalize(object2) !== jcsCanonicalize(canonical)) {
       throw new SignedObjectSchemaError(`${path} must be canonical PolicyCapability JSON`);
     }
   } catch (error) {
@@ -2665,10 +2709,10 @@ function validatePolicyCapability(input, path) {
   }
 }
 function validatePolicyCapabilityForSigning(input, path) {
-  const object = expectJsonObject(input, path);
+  const object2 = expectJsonObject(input, path);
   try {
-    const canonical = normalizePolicyCapability(object);
-    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {
+    const canonical = normalizePolicyCapability(object2);
+    if (jcsCanonicalize(object2) !== jcsCanonicalize(canonical)) {
       throw new SignedObjectSchemaError(`${path} must be strict canonical PolicyCapability JSON`);
     }
   } catch (error) {
@@ -2681,43 +2725,43 @@ function validatePolicyCapabilityForSigning(input, path) {
   }
 }
 function validateExpression(input, path) {
-  const object = expectJsonObject(input, path);
-  const keys = Object.keys(object);
+  const object2 = expectJsonObject(input, path);
+  const keys = Object.keys(object2);
   if (keys.length !== 1) {
     throw new SignedObjectSchemaError(`${path} must have exactly one expression key`);
   }
   const key = keys[0];
   if (key === "allOf" || key === "anyOf") {
-    const values = requiredArray2(object, key, path, 1);
+    const values = requiredArray2(object2, key, path, 1);
     for (let index = 0; index < values.length; index++) {
       validateExpression(values[index], `${path}.${key}[${index}]`);
     }
     return;
   }
   if (key === "subject") {
-    const subject = expectJsonObject(requiredValue2(object, "subject", path), `${path}.subject`);
+    const subject = expectJsonObject(requiredValue2(object2, "subject", path), `${path}.subject`);
     assertExactKeys2(subject, ["did"], `${path}.subject`);
     requiredString2(subject, "did", `${path}.subject`);
     return;
   }
   if (key === "evidence") {
-    validateEvidenceRequirement(requiredValue2(object, "evidence", path), `${path}.evidence`);
+    validateEvidenceRequirement(requiredValue2(object2, "evidence", path), `${path}.evidence`);
     return;
   }
   throw new SignedObjectSchemaError(`${path} has unknown expression key ${key}`);
 }
 function validateEvidenceRequirement(input, path) {
-  const object = expectJsonObject(input, path);
+  const object2 = expectJsonObject(input, path);
   assertExactKeys2(
-    object,
+    object2,
     ["requirementId", "verifier", "requirements", "authority", "freshness"],
     path
   );
-  requiredString2(object, "requirementId", path);
-  requiredString2(object, "verifier", path);
-  requiredValue2(object, "requirements", path);
-  if (hasOwn2(object, "authority")) {
-    const authority = expectJsonObject(requiredValue2(object, "authority", path), `${path}.authority`);
+  requiredString2(object2, "requirementId", path);
+  requiredString2(object2, "verifier", path);
+  requiredValue2(object2, "requirements", path);
+  if (hasOwn2(object2, "authority")) {
+    const authority = expectJsonObject(requiredValue2(object2, "authority", path), `${path}.authority`);
     assertExactKeys2(
       authority,
       ["profile", "acceptedIssuers", "allowOwnerAuthorizedIssuer"],
@@ -2729,35 +2773,35 @@ function validateEvidenceRequirement(input, path) {
     }
     optionalBoolean(authority, "allowOwnerAuthorizedIssuer", `${path}.authority`);
   }
-  if (hasOwn2(object, "freshness")) {
-    const freshness = expectJsonObject(requiredValue2(object, "freshness", path), `${path}.freshness`);
+  if (hasOwn2(object2, "freshness")) {
+    const freshness = expectJsonObject(requiredValue2(object2, "freshness", path), `${path}.freshness`);
     assertExactKeys2(freshness, ["maxStatusAgeSeconds"], `${path}.freshness`);
     requiredInteger(freshness, "maxStatusAgeSeconds", `${path}.freshness`, 0);
   }
 }
 function validateGrant(input, path) {
-  const object = expectJsonObject(input, path);
-  assertExactKeys2(object, ["output", "maxTtlSeconds", "delegationMode", "revocation"], path);
-  expectConst(requiredString2(object, "output", path), "portable-delegation", `${path}.output`);
-  requiredInteger(object, "maxTtlSeconds", path, 1);
-  expectOneOf(requiredString2(object, "delegationMode", path), [
+  const object2 = expectJsonObject(input, path);
+  assertExactKeys2(object2, ["output", "maxTtlSeconds", "delegationMode", "revocation"], path);
+  expectConst(requiredString2(object2, "output", path), "portable-delegation", `${path}.output`);
+  requiredInteger(object2, "maxTtlSeconds", path, 1);
+  expectOneOf(requiredString2(object2, "delegationMode", path), [
     "terminal",
     "attenuable"
   ], `${path}.delegationMode`);
-  expectOneOf(requiredString2(object, "revocation", path), [
+  expectOneOf(requiredString2(object2, "revocation", path), [
     "refresh_only",
     "active_cutoff"
   ], `${path}.revocation`);
 }
 function validateDisclosure(input, path) {
-  const object = expectJsonObject(input, path);
-  assertExactKeys2(object, ["denial"], path);
-  expectOneOf(requiredString2(object, "denial", path), ["none", "code", "debug"], `${path}.denial`);
+  const object2 = expectJsonObject(input, path);
+  assertExactKeys2(object2, ["denial"], path);
+  expectOneOf(requiredString2(object2, "denial", path), ["none", "code", "debug"], `${path}.denial`);
 }
 function validateAudit(input, path) {
-  const object = expectJsonObject(input, path);
-  assertExactKeys2(object, ["issuance"], path);
-  expectOneOf(requiredString2(object, "issuance", path), ["off", "security", "full"], `${path}.issuance`);
+  const object2 = expectJsonObject(input, path);
+  assertExactKeys2(object2, ["issuance"], path);
+  expectOneOf(requiredString2(object2, "issuance", path), ["off", "security", "full"], `${path}.issuance`);
 }
 function materialForUnsigned(unsigned, descriptor) {
   const jcs = jcsCanonicalize(unsigned);
@@ -2906,9 +2950,9 @@ function encodeSignatureValue(value, suite) {
   decodeSignatureValue(encoded, suite);
   return encoded;
 }
-function stripOwnIdAndSignature(object, descriptor) {
+function stripOwnIdAndSignature(object2, descriptor) {
   const output = /* @__PURE__ */ Object.create(null);
-  for (const [key, value] of Object.entries(object)) {
+  for (const [key, value] of Object.entries(object2)) {
     if (key === descriptor.idField || key === "signature") {
       continue;
     }
@@ -2917,8 +2961,8 @@ function stripOwnIdAndSignature(object, descriptor) {
   return output;
 }
 function descriptorForUnsigned(input) {
-  const object = expectJsonObject(normalizeJson(input), "$");
-  return descriptorForSchema(requiredString2(object, "schema", "$"));
+  const object2 = expectJsonObject(normalizeJson(input), "$");
+  return descriptorForSchema(requiredString2(object2, "schema", "$"));
 }
 function descriptorForSchema(schema) {
   if (schema === POLICY_SCHEMA) return DESCRIPTORS.Policy;
@@ -2932,28 +2976,28 @@ function expectJsonObject(input, path) {
   }
   return input;
 }
-function assertExactKeys2(object, allowed, path) {
+function assertExactKeys2(object2, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object)) {
+  for (const key of Object.keys(object2)) {
     if (!allowedSet.has(key)) {
       throw new SignedObjectSchemaError(`${path} has unknown field ${key}`);
     }
   }
 }
-function requiredValue2(object, key, path) {
-  if (!hasOwn2(object, key)) {
+function requiredValue2(object2, key, path) {
+  if (!hasOwn2(object2, key)) {
     throw new SignedObjectSchemaError(`${path}.${key} is required`);
   }
-  return object[key];
+  return object2[key];
 }
-function requiredString2(object, key, path) {
-  return requireStringType(requiredValue2(object, key, path), `${path}.${key}`);
+function requiredString2(object2, key, path) {
+  return requireStringType(requiredValue2(object2, key, path), `${path}.${key}`);
 }
-function optionalString(object, key, path) {
-  if (!hasOwn2(object, key)) {
+function optionalString(object2, key, path) {
+  if (!hasOwn2(object2, key)) {
     return;
   }
-  requireStringType(requiredValue2(object, key, path), `${path}.${key}`);
+  requireStringType(requiredValue2(object2, key, path), `${path}.${key}`);
 }
 function requireStringType(value, path) {
   if (typeof value !== "string" || value.length === 0) {
@@ -2961,16 +3005,16 @@ function requireStringType(value, path) {
   }
   return value;
 }
-function optionalBoolean(object, key, path) {
-  if (!hasOwn2(object, key)) {
+function optionalBoolean(object2, key, path) {
+  if (!hasOwn2(object2, key)) {
     return;
   }
-  if (typeof requiredValue2(object, key, path) !== "boolean") {
+  if (typeof requiredValue2(object2, key, path) !== "boolean") {
     throw new SignedObjectSchemaError(`${path}.${key} must be a boolean`);
   }
 }
-function requiredInteger(object, key, path, minimum) {
-  const value = requiredValue2(object, key, path);
+function requiredInteger(object2, key, path, minimum) {
+  const value = requiredValue2(object2, key, path);
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum) {
     throw new SignedObjectSchemaError(
       `${path}.${key} must be an integer >= ${minimum}`
@@ -2978,8 +3022,8 @@ function requiredInteger(object, key, path, minimum) {
   }
   return value;
 }
-function requiredArray2(object, key, path, minimum) {
-  const value = requiredValue2(object, key, path);
+function requiredArray2(object2, key, path, minimum) {
+  const value = requiredValue2(object2, key, path);
   if (!Array.isArray(value) || value.length < minimum) {
     throw new SignedObjectSchemaError(
       `${path}.${key} must be an array with at least ${minimum} item(s)`
@@ -2987,22 +3031,22 @@ function requiredArray2(object, key, path, minimum) {
   }
   return value;
 }
-function requiredStringArray(object, key, path, check) {
-  const values = requiredArray2(object, key, path, 0);
+function requiredStringArray(object2, key, path, check) {
+  const values = requiredArray2(object2, key, path, 0);
   for (let index = 0; index < values.length; index++) {
     const itemPath = `${path}.${key}[${index}]`;
     const value = requireStringType(values[index], itemPath);
     check?.(value, itemPath);
   }
 }
-function requiredDateString(object, key, path) {
-  assertRfc3339(requiredString2(object, key, path), `${path}.${key}`);
+function requiredDateString(object2, key, path) {
+  assertRfc3339(requiredString2(object2, key, path), `${path}.${key}`);
 }
-function optionalDateString(object, key, path) {
-  if (!hasOwn2(object, key)) {
+function optionalDateString(object2, key, path) {
+  if (!hasOwn2(object2, key)) {
     return;
   }
-  assertRfc3339(requiredString2(object, key, path), `${path}.${key}`);
+  assertRfc3339(requiredString2(object2, key, path), `${path}.${key}`);
 }
 function assertRfc3339(value, path) {
   const match = value.match(
@@ -3034,8 +3078,8 @@ function expectOneOf(actual, allowed, path) {
   }
   throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);
 }
-function hasOwn2(object, key) {
-  return objectHasOwn3(object, key);
+function hasOwn2(object2, key) {
+  return objectHasOwn3(object2, key);
 }
 function assertSupportedSignatureSuite(suite) {
   if (suite !== ED25519_JCS_SIGNATURE_SUITE && suite !== EIP191_JCS_SIGNATURE_SUITE) {
@@ -3114,13 +3158,13 @@ function base64UrlDecode(value) {
   return decoded;
 }
 function hexToBytes(value) {
-  const hex = value.slice(2);
-  if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {
+  const hex2 = value.slice(2);
+  if (hex2.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex2)) {
     throw new SignatureMaterialError("hex signature must have even length");
   }
-  const output = new Uint8Array(hex.length / 2);
+  const output = new Uint8Array(hex2.length / 2);
   for (let index = 0; index < output.length; index++) {
-    output[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
+    output[index] = Number.parseInt(hex2.slice(index * 2, index * 2 + 2), 16);
   }
   return output;
 }
@@ -3262,9 +3306,9 @@ function expectObject2(input, path, code3) {
     );
   }
 }
-function assertExactKeys3(object, allowed, path) {
+function assertExactKeys3(object2, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object)) {
+  for (const key of Object.keys(object2)) {
     if (!allowedSet.has(key)) {
       throw new PolicyAuthoringError(
         "policy-authoring-unknown-key",
@@ -3273,17 +3317,17 @@ function assertExactKeys3(object, allowed, path) {
     }
   }
 }
-function requiredValue3(object, key, path) {
-  if (!hasOwn3(object, key)) {
+function requiredValue3(object2, key, path) {
+  if (!hasOwn3(object2, key)) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
       `${path}.${key} is required`
     );
   }
-  return object[key];
+  return object2[key];
 }
-function requiredString3(object, key, path) {
-  const value = requiredValue3(object, key, path);
+function requiredString3(object2, key, path) {
+  const value = requiredValue3(object2, key, path);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
@@ -3292,11 +3336,11 @@ function requiredString3(object, key, path) {
   }
   return value;
 }
-function fieldString(object, key, path, code3) {
-  if (!hasOwn3(object, key)) {
+function fieldString(object2, key, path, code3) {
+  if (!hasOwn3(object2, key)) {
     throw new PolicyAuthoringError(code3, `${path}.${key} is required`);
   }
-  const value = object[key];
+  const value = object2[key];
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyAuthoringError(
       code3,
@@ -3334,8 +3378,609 @@ function parseStrictRfc3339(value, path) {
 var objectHasOwn4 = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
   Object.prototype.hasOwnProperty
 );
-function hasOwn3(object, key) {
-  return objectHasOwn4(object, key);
+function hasOwn3(object2, key) {
+  return objectHasOwn4(object2, key);
+}
+
+// src/policy/unified.ts
+var import_sha256 = require("@noble/hashes/sha256");
+var import_blake3 = require("@noble/hashes/blake3");
+var import_ed255192 = require("@noble/curves/ed25519");
+var import_zod2 = require("zod");
+var POLICY_V1_SCHEMA = "xyz.tinycloud.policy/policy/v1";
+var POLICY_CAPABILITY_V1_SCHEMA = "xyz.tinycloud.policy/capability/v1";
+var POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA = "xyz.tinycloud.policy/enforcement-delegation/v2";
+var ATTESTED_ENFORCER_BINDING_V2_SCHEMA = "xyz.tinycloud.policy/attested-enforcer/v2";
+var ROOT_STATUS_CHECKPOINT_V1_SCHEMA = "xyz.tinycloud.policy/root-status/v1";
+var ROOT_REVOCATION_V1_SCHEMA = "xyz.tinycloud.policy/root-revocation/v1";
+var POLICY_SESSION_UCAN_V1_PROFILE = "policy-session-ucan/v1";
+var POLICY_V1_DOMAIN = "xyz.tinycloud.policy/policy/v1\0";
+var POLICY_CAPABILITY_V1_DOMAIN = "xyz.tinycloud.policy/PolicyCapability/v1\0";
+var CONTENT_SOURCE_V1_DOMAIN = "xyz.tinycloud.policy/ContentSource/v1\0";
+var NATIVE_PROJECTION_V1_DOMAIN = "xyz.tinycloud.policy/NativeProjection/v1\0";
+var ROOT_STATUS_V1_DOMAIN = "xyz.tinycloud.policy/RootStatusCheckpoint/v1\0";
+var ROOT_STATUS_RENEWAL_V1_DOMAIN = "xyz.tinycloud.policy/RootStatusRenewal/v1\0";
+var ROOT_REVOCATION_V1_DOMAIN = "xyz.tinycloud.policy/RootRevocation/v1\0";
+var LAST_V2_CREATE_AT = "2026-09-30T00:00:00Z";
+var MAX_LEGACY_ENVELOPE_EXPIRES_AT = "2026-12-29T00:00:00Z";
+var LAST_V2_READ_AT = "2027-01-05T00:00:00Z";
+function verifyPolicyRootStatusCheckpointV3(input) {
+  const checkpoint = input.checkpoint;
+  const allowed = /* @__PURE__ */ new Set(["schema", "targetCid", "targetRole", "ownerDid", "nodeAudience", "state", "sequence", "checkedAt", "freshUntil", "revokedAt", "revocationCid", "previousCheckpointDigestHex", "issuerDid", "signature"]);
+  if (Object.keys(checkpoint).some((key) => !allowed.has(key)) || checkpoint.schema !== ROOT_STATUS_CHECKPOINT_V1_SCHEMA || checkpoint.targetCid !== input.rootCid || checkpoint.targetRole !== "policy-authority" && checkpoint.targetRole !== "policy-enforcement" || checkpoint.state !== "active" && checkpoint.state !== "revoked" || typeof checkpoint.ownerDid !== "string" || typeof checkpoint.nodeAudience !== "string" || checkpoint.issuerDid !== checkpoint.nodeAudience || input.expectedNodeAudience !== void 0 && checkpoint.nodeAudience !== input.expectedNodeAudience || !Number.isInteger(checkpoint.sequence) || checkpoint.sequence < 1 || typeof checkpoint.checkedAt !== "string" || typeof checkpoint.freshUntil !== "string") return false;
+  const checkedAt = Date.parse(checkpoint.checkedAt);
+  const freshUntil = Date.parse(checkpoint.freshUntil);
+  const now = (input.now ?? /* @__PURE__ */ new Date()).getTime();
+  if (!Number.isFinite(checkedAt) || !Number.isFinite(freshUntil) || freshUntil < now || freshUntil <= checkedAt || freshUntil - checkedAt > 3e5) return false;
+  if (checkpoint.sequence === 1 !== (checkpoint.previousCheckpointDigestHex === void 0)) return false;
+  if (checkpoint.sequence !== 1 && (typeof checkpoint.previousCheckpointDigestHex !== "string" || !/^[0-9a-f]{64}$/.test(checkpoint.previousCheckpointDigestHex))) return false;
+  if (checkpoint.state === "active" && (checkpoint.revokedAt !== void 0 || checkpoint.revocationCid !== void 0)) return false;
+  if (checkpoint.state === "revoked" && (typeof checkpoint.revokedAt !== "string" || typeof checkpoint.revocationCid !== "string")) return false;
+  const signature = checkpoint.signature;
+  if (!isRecordValue(signature) || Object.keys(signature).length !== 3 || signature.suite !== "Ed25519" || signature.signerDid !== checkpoint.issuerDid || typeof signature.value !== "string") return false;
+  try {
+    const principal = checkpoint.issuerDid.split("#", 1)[0];
+    const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+    if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1) return false;
+    const unsigned = { ...checkpoint };
+    delete unsigned.signature;
+    return import_ed255192.ed25519.verify(
+      decodeBase64Url(signature.value),
+      (0, import_sha256.sha256)(new TextEncoder().encode(ROOT_STATUS_V1_DOMAIN + jcsCanonicalize(unsigned))),
+      didMaterial.slice(2)
+    );
+  } catch {
+    return false;
+  }
+}
+async function getPolicyRootStatusV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const response = await fetchFn(new URL(`/share/v3/policy/status/${encodeURIComponent(input.rootCid)}`, input.nodeOrigin), {
+    method: "GET",
+    redirect: "error",
+    headers: { accept: "application/json" }
+  });
+  if (!response.ok) throw new Error(`policy root status rejected (${response.status})`);
+  const value = object(await response.json(), "policy root status");
+  const checkpoint = object(value.checkpoint, "policy root checkpoint");
+  if (value.rootCid !== input.rootCid || value.state !== "active" && value.state !== "revoked" || value.state !== checkpoint.state || !verifyPolicyRootStatusCheckpointV3({ rootCid: input.rootCid, checkpoint, expectedNodeAudience: input.expectedNodeAudience, now: input.now }))
+    throw new Error("policy root status binding is invalid");
+  const revocation = value.revocation === void 0 ? void 0 : object(value.revocation, "policy root revocation");
+  if (value.state === "revoked" !== (revocation !== void 0) || revocation !== void 0 && !verifyPolicyRootRevocationV3({
+    rootCid: input.rootCid,
+    checkpoint,
+    revocation,
+    expectedEnforcerDid: input.expectedEnforcerDid
+  })) throw new Error("policy root status revocation evidence is invalid");
+  return { rootCid: input.rootCid, state: value.state, checkpoint, ...revocation === void 0 ? {} : { revocation } };
+}
+function verifyPolicyRootRevocationV3(input) {
+  const value = input.revocation;
+  const allowed = ["schema", "targetCid", "targetRole", "ownerDid", "nodeAudience", "revokedAt", "reason", "issuerDid", "signature"];
+  if (Object.keys(value).length !== allowed.length || Object.keys(value).some((key) => !allowed.includes(key)) || value.schema !== ROOT_REVOCATION_V1_SCHEMA || value.targetCid !== input.rootCid || value.targetRole !== input.checkpoint.targetRole || value.ownerDid !== input.checkpoint.ownerDid || value.nodeAudience !== input.checkpoint.nodeAudience || value.revokedAt !== input.checkpoint.revokedAt || typeof value.reason !== "string" || value.reason.length === 0 || typeof value.issuerDid !== "string") return false;
+  const authorized = value.issuerDid === value.ownerDid || value.targetRole === "policy-enforcement" && value.issuerDid === input.expectedEnforcerDid;
+  if (!authorized) return false;
+  const signature = value.signature;
+  if (!isRecordValue(signature) || Object.keys(signature).length !== 3 || signature.suite !== "Ed25519" || signature.signerDid !== value.issuerDid || typeof signature.value !== "string") return false;
+  try {
+    const principal = value.issuerDid.split("#", 1)[0];
+    const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+    if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1) return false;
+    const unsigned = { ...value };
+    delete unsigned.signature;
+    const digest4 = (0, import_sha256.sha256)(new TextEncoder().encode(ROOT_REVOCATION_V1_DOMAIN + jcsCanonicalize(unsigned)));
+    return input.checkpoint.revocationCid === hex(digest4) && import_ed255192.ed25519.verify(decodeBase64Url(signature.value), digest4, didMaterial.slice(2));
+  } catch {
+    return false;
+  }
+}
+async function renewPolicyRootStatusV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const current = await getPolicyRootStatusV3({ nodeOrigin: input.nodeOrigin, rootCid: input.rootCid, expectedNodeAudience: input.nodeAudience, now: input.now, fetch: fetchFn });
+  if (current.state !== "active" || current.checkpoint.ownerDid !== input.ownerDid || current.checkpoint.nodeAudience !== input.nodeAudience || current.checkpoint.state !== "active" || !Number.isInteger(current.checkpoint.sequence))
+    throw new Error("policy root status cannot be renewed");
+  const currentUnsigned = { ...current.checkpoint };
+  delete currentUnsigned.signature;
+  const previousCheckpointDigestHex = hex((0, import_sha256.sha256)(new TextEncoder().encode(ROOT_STATUS_V1_DOMAIN + jcsCanonicalize(currentUnsigned))));
+  const unsigned = {
+    schema: "xyz.tinycloud.policy/root-status-renewal/v1",
+    targetCid: input.rootCid,
+    ownerDid: input.ownerDid,
+    nodeAudience: input.nodeAudience,
+    issuedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    nonce: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    sequence: current.checkpoint.sequence + 1,
+    previousCheckpointDigestHex
+  };
+  const signature = await input.sign((0, import_sha256.sha256)(new TextEncoder().encode(ROOT_STATUS_RENEWAL_V1_DOMAIN + jcsCanonicalize(unsigned))));
+  if (signature.length !== 64) throw new Error("policy root renewal signature must be Ed25519");
+  const response = await fetchFn(new URL("/share/v3/policy/status", input.nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ rootCid: input.rootCid, renewal: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.ownerDid, value: encodeBase64Url(signature) } } })
+  });
+  if (!response.ok) throw new Error(`policy root renewal rejected (${response.status})`);
+  return object(await response.json(), "policy root renewal");
+}
+async function revokePolicyRootV3(input) {
+  if (input.reason.length === 0) throw new Error("policy root revocation reason is required");
+  const unsigned = {
+    schema: ROOT_REVOCATION_V1_SCHEMA,
+    targetCid: input.rootCid,
+    targetRole: input.targetRole,
+    ownerDid: input.ownerDid,
+    nodeAudience: input.nodeAudience,
+    revokedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    reason: input.reason,
+    issuerDid: input.issuerDid
+  };
+  const signature = await input.sign((0, import_sha256.sha256)(new TextEncoder().encode(ROOT_REVOCATION_V1_DOMAIN + jcsCanonicalize(unsigned))));
+  if (signature.length !== 64) throw new Error("policy root revocation signature must be Ed25519");
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const response = await fetchFn(new URL("/revoke", input.nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ revocation: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.issuerDid, value: encodeBase64Url(signature) } } })
+  });
+  if (!response.ok) throw new Error(`policy root revocation rejected (${response.status})`);
+  return object(await response.json(), "policy root revocation");
+}
+var POLICY_SESSION_FACT_KEYS = [
+  "profile",
+  "ownerDid",
+  "policyId",
+  "policyDigestHex",
+  "policyCid",
+  "policyDelegationCid",
+  "enforcementDelegationCid",
+  "contentSourceDigestHex",
+  "capabilityCeilingHashHex",
+  "nativeProjectionHashHex",
+  "enforcerDid",
+  "nodeAudience",
+  "recipientDid",
+  "challengeId",
+  "claimDigestHex",
+  "claimJti",
+  "vpDigestHex",
+  "credentialEvidenceDigestHex",
+  "decisionContextDigestHex",
+  "issuanceAuditDigestHex",
+  "remainingRedelegationDepth"
+];
+var KV_ACTIONS = /* @__PURE__ */ new Set([
+  "tinycloud.kv/get",
+  "tinycloud.kv/list",
+  "tinycloud.kv/metadata",
+  "tinycloud.kv/put"
+]);
+function object(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function exactKeys(value, allowed, label) {
+  const keys = new Set(allowed);
+  if (Object.keys(value).some((key) => !keys.has(key)))
+    throw new Error(`${label} contains an unknown field`);
+}
+function nonEmptyString(value, label) {
+  if (typeof value !== "string" || value.length === 0)
+    throw new Error(`${label} must be a non-empty string`);
+  return value;
+}
+function parseKvResource(resource) {
+  const match = /^tinycloud:\/\/([^/]+)\/kv\/(.+)$/.exec(resource);
+  if (!match || match[1].includes(":") || match[1].includes("?") || match[1].includes("#") || match[1].includes("%") || match[2].startsWith("/") || match[2].endsWith("/") || match[2].includes("//") || match[2].split("/").some((part) => part === "." || part === ".." || part.length === 0)) {
+    throw new Error("KV resource is not canonical");
+  }
+  return { space: match[1], path: match[2] };
+}
+function parseEncryptionResource(resource) {
+  if (!resource.startsWith("urn:tinycloud:encryption:")) throw new Error("encryption capability is invalid");
+  const rest = resource.slice("urn:tinycloud:encryption:".length);
+  const separator = rest.lastIndexOf(":");
+  const ownerDid = separator < 0 ? "" : rest.slice(0, separator);
+  const network = separator < 0 ? "" : rest.slice(separator + 1);
+  if (!ownerDid.startsWith("did:") || network.length === 0 || network.includes(":") || network.includes("/") || network.includes("%") || network.includes("?") || network.includes("#")) {
+    throw new Error("encryption capability is invalid");
+  }
+}
+function normalizeUnifiedPolicyCapability(input) {
+  const value = object(input, "capability");
+  const kind = nonEmptyString(value.kind, "capability.kind");
+  if (kind === "kv") {
+    exactKeys(
+      value,
+      ["kind", "resource", "selector", "actions"],
+      "KV capability"
+    );
+    const resource = nonEmptyString(value.resource, "capability.resource");
+    parseKvResource(resource);
+    if (value.selector !== "exact" && value.selector !== "prefix")
+      throw new Error("capability.selector is invalid");
+    if (!Array.isArray(value.actions) || value.actions.length === 0)
+      throw new Error("capability.actions is invalid");
+    const actions = value.actions.map(
+      (action) => nonEmptyString(action, "capability.actions[]")
+    );
+    if (new Set(actions).size !== actions.length || actions.some((action) => !KV_ACTIONS.has(action)))
+      throw new Error("capability.actions is invalid");
+    return {
+      kind: "kv",
+      resource,
+      selector: value.selector,
+      actions: [...actions].sort()
+    };
+  }
+  if (kind === "encryption") {
+    exactKeys(value, ["kind", "resource", "action"], "encryption capability");
+    const resource = nonEmptyString(value.resource, "capability.resource");
+    if (value.action !== "tinycloud.encryption/decrypt")
+      throw new Error("encryption capability is invalid");
+    parseEncryptionResource(resource);
+    return {
+      kind: "encryption",
+      resource,
+      action: "tinycloud.encryption/decrypt"
+    };
+  }
+  throw new Error("capability.kind is invalid");
+}
+function canonicalizeUnifiedPolicyCapability(input) {
+  return normalizeUnifiedPolicyCapability(input);
+}
+function unifiedPolicyCapabilityDigestHex(input) {
+  return hex(
+    (0, import_sha256.sha256)(
+      new TextEncoder().encode(
+        POLICY_CAPABILITY_V1_DOMAIN + jcsCanonicalize(normalizeUnifiedPolicyCapability(input))
+      )
+    )
+  );
+}
+function unifiedPolicyCapabilityContains(authorityInput, requestedInput) {
+  try {
+    const authority = normalizeUnifiedPolicyCapability(authorityInput);
+    const requested = normalizeUnifiedPolicyCapability(requestedInput);
+    if (authority.kind !== requested.kind) return false;
+    if (authority.kind === "encryption" && requested.kind === "encryption")
+      return authority.resource === requested.resource && authority.action === requested.action;
+    if (authority.kind !== "kv" || requested.kind !== "kv") return false;
+    const { resource: authorized } = authority;
+    const { resource: requestedResource } = requested;
+    const pathContained = authority.selector === "exact" ? authorized === requestedResource : authorized === requestedResource || requestedResource.startsWith(`${authorized}/`);
+    if (!pathContained || authority.selector === "exact" && requested.selector === "prefix")
+      return false;
+    return requested.actions.every(
+      (action) => authority.actions.includes(action)
+    );
+  } catch {
+    return false;
+  }
+}
+function projectUnifiedPolicyCapability(input) {
+  const capability = normalizeUnifiedPolicyCapability(input);
+  if (capability.kind === "encryption") {
+    return {
+      service: "tinycloud.encryption",
+      space: capability.resource,
+      path: capability.resource,
+      actions: [capability.action]
+    };
+  }
+  const { space, path } = parseKvResource(capability.resource);
+  return {
+    service: "tinycloud.kv",
+    space,
+    path,
+    actions: [...capability.actions],
+    caveat: {
+      type: "xyz.tinycloud.resource/selector",
+      kind: capability.selector,
+      value: capability.resource
+    }
+  };
+}
+function projectUnifiedPolicyCapabilities(input) {
+  return input.map(projectUnifiedPolicyCapability).sort((left, right) => {
+    const a = jcsCanonicalize(left);
+    const b = jcsCanonicalize(right);
+    return a < b ? -1 : a > b ? 1 : 0;
+  });
+}
+function unifiedNativeProjectionHashHex(input) {
+  return hex(
+    (0, import_sha256.sha256)(
+      new TextEncoder().encode(
+        NATIVE_PROJECTION_V1_DOMAIN + jcsCanonicalize(projectUnifiedPolicyCapabilities(input))
+      )
+    )
+  );
+}
+function unifiedPolicyCapabilityFromNative(input) {
+  const value = object(input, "native capability");
+  exactKeys(
+    value,
+    ["service", "space", "path", "actions", "caveat"],
+    "native capability"
+  );
+  const service = nonEmptyString(value.service, "native.service");
+  const actions = value.actions;
+  if (!Array.isArray(actions)) throw new Error("native.actions is invalid");
+  if (service === "tinycloud.encryption" && value.caveat === void 0 && value.space === value.path && actions.length === 1 && actions[0] === "tinycloud.encryption/decrypt") {
+    return normalizeUnifiedPolicyCapability({
+      kind: "encryption",
+      resource: value.space,
+      action: actions[0]
+    });
+  }
+  if (service !== "tinycloud.kv" || typeof value.space !== "string" || typeof value.path !== "string")
+    throw new Error("native capability is not supported");
+  const caveat = object(value.caveat, "native.caveat");
+  exactKeys(caveat, ["type", "kind", "value"], "native selector caveat");
+  if (caveat.type !== "xyz.tinycloud.resource/selector" || caveat.kind !== "exact" && caveat.kind !== "prefix" || caveat.value !== `tinycloud://${value.space}/kv/${value.path}`)
+    throw new Error("native selector caveat does not match capability");
+  return normalizeUnifiedPolicyCapability({
+    kind: "kv",
+    resource: caveat.value,
+    selector: caveat.kind,
+    actions
+  });
+}
+function contentSourceDigestHex(input) {
+  return hex(
+    (0, import_sha256.sha256)(
+      new TextEncoder().encode(
+        CONTENT_SOURCE_V1_DOMAIN + jcsCanonicalize(input)
+      )
+    )
+  );
+}
+function policyDigestHex(policy) {
+  const canonicalPolicy = {
+    ...policy,
+    capabilityCeiling: policy.capabilityCeiling.map(
+      normalizeUnifiedPolicyCapability
+    )
+  };
+  return hex(
+    (0, import_sha256.sha256)(
+      new TextEncoder().encode(
+        POLICY_V1_DOMAIN + jcsCanonicalize(canonicalPolicy)
+      )
+    )
+  );
+}
+function policyIdForDigestHex(digestHex) {
+  const digest4 = Uint8Array.from(
+    (digestHex.match(/.{2}/g) ?? []).map((byte) => Number.parseInt(byte, 16))
+  );
+  if (digest4.length !== 32) throw new Error("policy digest must be 32 bytes");
+  return `pol_${base32Lower(digest4)}`;
+}
+function policyCidFromCanonicalBytes(bytes2) {
+  return CID.createV1(85, create(18, (0, import_sha256.sha256)(bytes2))).toString();
+}
+var CompactHeaderSchema = import_zod2.z.object({
+  alg: import_zod2.z.literal("EdDSA"),
+  jwk: import_zod2.z.object({ alg: import_zod2.z.literal("EdDSA"), crv: import_zod2.z.literal("Ed25519"), kty: import_zod2.z.literal("OKP"), x: import_zod2.z.string().min(1) }).strict(),
+  typ: import_zod2.z.literal("JWT"),
+  ucv: import_zod2.z.literal("0.10.0")
+}).strict();
+var CompactPayloadSchema = import_zod2.z.object({
+  att: import_zod2.z.record(import_zod2.z.record(import_zod2.z.array(import_zod2.z.unknown()).min(1))),
+  aud: import_zod2.z.string().min(1),
+  exp: import_zod2.z.number().int(),
+  fct: import_zod2.z.array(import_zod2.z.record(import_zod2.z.unknown())).length(1),
+  iss: import_zod2.z.string().min(1),
+  nbf: import_zod2.z.number().int(),
+  nnc: import_zod2.z.string().min(1),
+  prf: import_zod2.z.array(import_zod2.z.string().min(1))
+}).strict();
+async function signCompactUcanAuthorization(input) {
+  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 60)
+    throw new Error("compact invocation lifetime must be between one and 60 seconds");
+  const principal = input.issuerDid.split("#", 1)[0];
+  const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+  if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1)
+    throw new Error("compact UCAN signer must be did:key Ed25519");
+  const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(didMaterial.slice(2)) }, typ: "JWT", ucv: "0.10.0" };
+  const payload = {
+    att: input.attenuation,
+    aud: input.audienceDid,
+    exp: input.expiresAt,
+    fct: input.facts,
+    iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
+    nbf: input.notBefore,
+    nnc: input.nonce,
+    prf: input.proofs
+  };
+  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
+  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
+  const signature = await input.sign(new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`));
+  if (signature.length !== 64) throw new Error("compact Authorization signature must be Ed25519");
+  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
+}
+function createCompactPolicyInvocation(input) {
+  const session = parsePolicySessionUcan(input.sessionAuthorization);
+  if (session.cid !== input.sessionCid || session.aud !== input.recipientDid)
+    throw new Error("policy session does not bind the recipient signer");
+  const principal = input.recipientDid.split("#", 1)[0];
+  const didMaterial = base58btc.decode(principal.slice("did:key:".length));
+  if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1)
+    throw new Error("policy invocation signer must be did:key Ed25519");
+  const publicKey = import_ed255192.ed25519.getPublicKey(input.privateKey);
+  if (!equalBytes(publicKey, didMaterial.slice(2)))
+    throw new Error("policy invocation private key does not bind recipient DID");
+  const now = input.now ?? Math.floor(Date.now() / 1e3);
+  const exp = Math.min(now + 60, session.exp);
+  if (exp <= now) throw new Error("policy session has expired");
+  const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(publicKey) }, typ: "JWT", ucv: "0.10.0" };
+  const payload = {
+    att: { [input.resource]: { [input.action]: [input.caveat ?? {}] } },
+    aud: input.audienceDid,
+    exp,
+    fct: [input.facts ?? { type: "tinycloud.policy.invocation/v1", policyCid: session.fact.policyCid, sessionCid: session.cid }],
+    iss: input.recipientDid.includes("#") ? input.recipientDid : `${principal}#${principal.slice("did:key:".length)}`,
+    nbf: now,
+    nnc: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    prf: [session.cid]
+  };
+  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
+  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
+  const signingInput = new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`);
+  const signature = import_ed255192.ed25519.sign(signingInput, input.privateKey);
+  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
+}
+function createCompactPolicyDescendant(input) {
+  const parent = parseCompactUcanAuthorization(input.parentAuthorization, input.parentCid);
+  if (parent.payload.aud !== input.issuerDid) throw new Error("policy descendant issuer is not the parent audience");
+  const parentFact = parent.payload.fct[0];
+  const depth = parentFact.remainingRedelegationDepth;
+  if (!Number.isInteger(depth) || depth <= 0) throw new Error("policy descendant depth is exhausted");
+  if (!compactAttenuationContains(parent.payload.att, input.attenuation))
+    throw new Error("policy descendant exceeds the parent attenuation");
+  const principal = input.issuerDid.split("#", 1)[0];
+  const didMaterial = base58btc.decode(principal.slice("did:key:".length));
+  const publicKey = import_ed255192.ed25519.getPublicKey(input.privateKey);
+  if (didMaterial.length !== 34 || !equalBytes(publicKey, didMaterial.slice(2))) throw new Error("policy descendant signer does not bind issuer DID");
+  const now = Math.max(input.now ?? Math.floor(Date.now() / 1e3), parent.payload.nbf + 1);
+  const exp = Math.min(input.expiresAt ?? now + 60, now + 60, parent.payload.exp - 1);
+  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
+  const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(publicKey) }, typ: "JWT", ucv: "0.10.0" };
+  const payload = {
+    att: input.attenuation,
+    aud: input.audienceDid,
+    exp,
+    fct: [{ ...parentFact, remainingRedelegationDepth: depth - 1 }],
+    iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
+    nbf: now,
+    nnc: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    prf: [parent.cid]
+  };
+  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
+  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
+  const signature = import_ed255192.ed25519.sign(new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`), input.privateKey);
+  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
+}
+function compactAttenuationContains(parent, child) {
+  const selector = (value) => {
+    if (value.length !== 1 || !isRecordValue(value[0])) return void 0;
+    const caveat = value[0];
+    if (Object.keys(caveat).length !== 3 || caveat.type !== "xyz.tinycloud.resource/selector" || caveat.kind !== "exact" && caveat.kind !== "prefix" || typeof caveat.value !== "string") return void 0;
+    return { kind: caveat.kind, value: caveat.value };
+  };
+  const equal = (left, right) => jcsCanonicalize(left) === jcsCanonicalize(right);
+  return Object.entries(child).every(
+    ([childResource, childActions]) => Object.entries(childActions).every(
+      ([action, childCaveats]) => Object.entries(parent).some(([parentResource, parentActions]) => {
+        const parentCaveats = parentActions[action];
+        if (parentCaveats === void 0) return false;
+        if (parentResource === childResource && equal(parentCaveats, childCaveats)) return true;
+        const parentSelector = selector(parentCaveats);
+        const childSelector = selector(childCaveats);
+        return parentSelector?.kind === "prefix" && childSelector !== void 0 && parentSelector.value === parentResource && childSelector.value === childResource && (childResource === parentResource || childResource.startsWith(`${parentResource}/`));
+      })
+    )
+  );
+}
+function isRecordValue(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseCompactUcanAuthorization(input, expectedCid) {
+  if (typeof input !== "string" || /\s/.test(input))
+    throw new Error("Authorization must be compact UCAN bytes");
+  const segments = input.split(".");
+  if (segments.length !== 3 || segments.some((segment) => segment.length === 0))
+    throw new Error("Authorization must have three compact segments");
+  const [headerSegment, payloadSegment, signatureSegment] = segments;
+  const headerBytes = decodeBase64Url(headerSegment);
+  const payloadBytes = decodeBase64Url(payloadSegment);
+  const signature = decodeBase64Url(signatureSegment);
+  const headerValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(headerBytes));
+  const payloadValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(payloadBytes));
+  if (jcsCanonicalize(headerValue) !== new TextDecoder().decode(headerBytes) || jcsCanonicalize(payloadValue) !== new TextDecoder().decode(payloadBytes))
+    throw new Error("compact UCAN segments are not canonical JCS");
+  const header = CompactHeaderSchema.parse(headerValue);
+  const payload = CompactPayloadSchema.parse(payloadValue);
+  if (payload.nbf >= payload.exp) throw new Error("compact UCAN validity is empty");
+  const principal = payload.iss.split("#", 1)[0];
+  const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+  if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1)
+    throw new Error("compact UCAN issuer must be did:key Ed25519");
+  const publicKey = didMaterial.slice(2);
+  if (!equalBytes(publicKey, decodeBase64Url(header.jwk.x)))
+    throw new Error("compact UCAN JWK does not bind issuer");
+  if (!import_ed255192.ed25519.verify(signature, new TextEncoder().encode(`${headerSegment}.${payloadSegment}`), publicKey))
+    throw new Error("compact UCAN signature is invalid");
+  const cid2 = CID.createV1(85, create(30, (0, import_blake3.blake3)(new TextEncoder().encode(input)))).toString();
+  if (expectedCid !== void 0 && cid2 !== expectedCid)
+    throw new Error("compact UCAN CID does not match exact Authorization bytes");
+  return { authorization: input, cid: cid2, header, payload };
+}
+function parsePolicySessionUcan(authorization, expectedProofs) {
+  const parsed = parseCompactUcanAuthorization(authorization);
+  const fact = parsed.payload.fct[0];
+  if (parsed.payload.prf.length !== 2 || parsed.payload.prf[0] === parsed.payload.prf[1])
+    throw new Error("policy session UCAN requires two distinct ordered proofs");
+  if (expectedProofs !== void 0 && (parsed.payload.prf[0] !== expectedProofs[0] || parsed.payload.prf[1] !== expectedProofs[1]))
+    throw new Error("policy session UCAN ordered proofs do not match");
+  const factKeys = Object.keys(fact);
+  if (factKeys.length !== POLICY_SESSION_FACT_KEYS.length || factKeys.some((key) => !POLICY_SESSION_FACT_KEYS.includes(key)) || POLICY_SESSION_FACT_KEYS.some((key) => !(key in fact)))
+    throw new Error("policy session UCAN fact is incomplete");
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.enforcerDid || parsed.payload.aud !== fact.recipientDid)
+    throw new Error("policy session UCAN fact is invalid");
+  return {
+    authorization,
+    cid: parsed.cid,
+    iss: parsed.payload.iss,
+    aud: parsed.payload.aud,
+    prf: parsed.payload.prf,
+    att: parsed.payload.att,
+    nbf: parsed.payload.nbf,
+    exp: parsed.payload.exp,
+    nnc: parsed.payload.nnc,
+    fact
+  };
+}
+function decodeBase64Url(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1)
+    throw new Error("value is not canonical base64url");
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = typeof Buffer !== "undefined" ? Buffer.from(normalized, "base64").toString("binary") : atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "="));
+  const bytes2 = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  const encoded = typeof Buffer !== "undefined" ? Buffer.from(bytes2).toString("base64url") : btoa(String.fromCharCode(...bytes2)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  if (encoded !== value) throw new Error("value is not canonical base64url");
+  return bytes2;
+}
+function encodeBase64Url(value) {
+  return typeof Buffer !== "undefined" ? Buffer.from(value).toString("base64url") : btoa(String.fromCharCode(...value)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function equalBytes(left, right) {
+  return left.length === right.length && left.every((byte, index) => byte === right[index]);
+}
+function hex(bytes2) {
+  return [...bytes2].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function base32Lower(bytes2) {
+  const alphabet2 = "abcdefghijklmnopqrstuvwxyz234567";
+  let output = "";
+  let buffer = 0;
+  let bits = 0;
+  for (const byte of bytes2) {
+    buffer = buffer << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += alphabet2[buffer >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) output += alphabet2[buffer << 5 - bits & 31];
+  return output;
 }
 
 // src/requester/index.ts
@@ -3414,109 +4059,109 @@ var TranscriptRequesterError = class extends Error {
     this.status = status;
   }
 };
-var JsonValueSchema = import_zod2.z.lazy(
-  () => import_zod2.z.union([
-    import_zod2.z.string(),
-    import_zod2.z.number().finite(),
-    import_zod2.z.boolean(),
-    import_zod2.z.null(),
-    import_zod2.z.array(JsonValueSchema),
-    import_zod2.z.record(JsonValueSchema)
+var JsonValueSchema = import_zod3.z.lazy(
+  () => import_zod3.z.union([
+    import_zod3.z.string(),
+    import_zod3.z.number().finite(),
+    import_zod3.z.boolean(),
+    import_zod3.z.null(),
+    import_zod3.z.array(JsonValueSchema),
+    import_zod3.z.record(JsonValueSchema)
   ])
 );
-var Rfc3339Schema = import_zod2.z.string().refine((value) => parseStrictRfc33392(value) !== void 0, {
+var Rfc3339Schema = import_zod3.z.string().refine((value) => parseStrictRfc33392(value) !== void 0, {
   message: "must be strict RFC 3339 date-time with timezone"
 });
-var SignedRecordSchema = import_zod2.z.object({
-  schema: import_zod2.z.string(),
-  engineRecordId: import_zod2.z.string(),
-  ownerDid: import_zod2.z.string(),
-  endpoint: import_zod2.z.string(),
-  audience: import_zod2.z.string(),
-  supportedPolicyVersions: import_zod2.z.array(import_zod2.z.string()),
-  supportedEvidenceVerifiers: import_zod2.z.array(import_zod2.z.string()),
-  grantIssuerDid: import_zod2.z.string(),
+var SignedRecordSchema = import_zod3.z.object({
+  schema: import_zod3.z.string(),
+  engineRecordId: import_zod3.z.string(),
+  ownerDid: import_zod3.z.string(),
+  endpoint: import_zod3.z.string(),
+  audience: import_zod3.z.string(),
+  supportedPolicyVersions: import_zod3.z.array(import_zod3.z.string()),
+  supportedEvidenceVerifiers: import_zod3.z.array(import_zod3.z.string()),
+  grantIssuerDid: import_zod3.z.string(),
   expiresAt: Rfc3339Schema,
-  signature: import_zod2.z.object({
-    suite: import_zod2.z.string(),
-    signerDid: import_zod2.z.string(),
-    value: import_zod2.z.string()
+  signature: import_zod3.z.object({
+    suite: import_zod3.z.string(),
+    signerDid: import_zod3.z.string(),
+    value: import_zod3.z.string()
   }).strict()
 }).strict();
-var PolicyEngineSchema = import_zod2.z.object({
-  endpoint: import_zod2.z.string().url(),
-  audience: import_zod2.z.string(),
-  supportedEvidenceVerifiers: import_zod2.z.tuple([
-    import_zod2.z.literal(W3C_VC_CREDENTIAL_VERIFIER)
+var PolicyEngineSchema = import_zod3.z.object({
+  endpoint: import_zod3.z.string().url(),
+  audience: import_zod3.z.string(),
+  supportedEvidenceVerifiers: import_zod3.z.tuple([
+    import_zod3.z.literal(W3C_VC_CREDENTIAL_VERIFIER)
   ]),
   signedRecord: SignedRecordSchema
 }).strict();
-var OwnerNodeSchema = import_zod2.z.object({
-  schema: import_zod2.z.literal(OWNER_NODE_ENDPOINT_SCHEMA),
-  endpoint: import_zod2.z.string().url(),
-  spaceId: import_zod2.z.string().min(1)
+var OwnerNodeSchema = import_zod3.z.object({
+  schema: import_zod3.z.literal(OWNER_NODE_ENDPOINT_SCHEMA),
+  endpoint: import_zod3.z.string().url(),
+  spaceId: import_zod3.z.string().min(1)
 }).strict();
-var ResourceHintSchema = import_zod2.z.object({
-  resourceType: import_zod2.z.string(),
-  resourceId: import_zod2.z.string(),
-  requestedCapabilities: import_zod2.z.array(JsonValueSchema).min(1)
+var ResourceHintSchema = import_zod3.z.object({
+  resourceType: import_zod3.z.string(),
+  resourceId: import_zod3.z.string(),
+  requestedCapabilities: import_zod3.z.array(JsonValueSchema).min(1)
 }).strict();
-var BootstrapSchema = import_zod2.z.object({
-  schema: import_zod2.z.literal(TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA),
-  policyId: import_zod2.z.string(),
+var BootstrapSchema = import_zod3.z.object({
+  schema: import_zod3.z.literal(TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA),
+  policyId: import_zod3.z.string(),
   policyEngine: PolicyEngineSchema,
   ownerNode: OwnerNodeSchema,
   resourceHint: ResourceHintSchema
 }).strict();
-var SignatureSchema = import_zod2.z.object({
-  suite: import_zod2.z.string(),
-  signerDid: import_zod2.z.string(),
-  value: import_zod2.z.string()
+var SignatureSchema = import_zod3.z.object({
+  suite: import_zod3.z.string(),
+  signerDid: import_zod3.z.string(),
+  value: import_zod3.z.string()
 }).strict();
-var ChallengeSchema = import_zod2.z.object({
-  schema: import_zod2.z.literal(POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA),
-  challengeId: import_zod2.z.string(),
-  policyId: import_zod2.z.string(),
-  audience: import_zod2.z.string(),
-  nonce: import_zod2.z.string().min(16),
+var ChallengeSchema = import_zod3.z.object({
+  schema: import_zod3.z.literal(POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA),
+  challengeId: import_zod3.z.string(),
+  policyId: import_zod3.z.string(),
+  audience: import_zod3.z.string(),
+  nonce: import_zod3.z.string().min(16),
   challengeExpiresAt: Rfc3339Schema,
-  acceptedSuites: import_zod2.z.array(import_zod2.z.string()).min(1),
-  requestedCapabilitiesTemplate: import_zod2.z.array(JsonValueSchema).optional(),
+  acceptedSuites: import_zod3.z.array(import_zod3.z.string()).min(1),
+  requestedCapabilitiesTemplate: import_zod3.z.array(JsonValueSchema).optional(),
   signature: SignatureSchema
 }).strict();
-var ChallengeResponseSchema = import_zod2.z.object({ challenge: ChallengeSchema }).strict();
-var DenialSchema = import_zod2.z.object({
-  schema: import_zod2.z.literal(POLICY_ENGINE_DENIAL_SCHEMA),
-  code: import_zod2.z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),
-  message: import_zod2.z.string().optional()
+var ChallengeResponseSchema = import_zod3.z.object({ challenge: ChallengeSchema }).strict();
+var DenialSchema = import_zod3.z.object({
+  schema: import_zod3.z.literal(POLICY_ENGINE_DENIAL_SCHEMA),
+  code: import_zod3.z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),
+  message: import_zod3.z.string().optional()
 }).strict();
-var ErrorEnvelopeDenialSchema = import_zod2.z.object({
-  error: import_zod2.z.object({
-    code: import_zod2.z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),
-    message: import_zod2.z.string().optional()
+var ErrorEnvelopeDenialSchema = import_zod3.z.object({
+  error: import_zod3.z.object({
+    code: import_zod3.z.enum(POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES),
+    message: import_zod3.z.string().optional()
   }).strict()
 }).strict();
-var WireDelegationSchema = import_zod2.z.object({
-  delegationId: import_zod2.z.string(),
-  issuanceId: import_zod2.z.string().min(1),
-  issuerDid: import_zod2.z.string(),
-  holderDid: import_zod2.z.string(),
-  policyId: import_zod2.z.string(),
-  capabilityHashHex: import_zod2.z.string().regex(/^[0-9a-f]{64}$/),
-  revocationMode: import_zod2.z.literal("refresh_only"),
+var WireDelegationSchema = import_zod3.z.object({
+  delegationId: import_zod3.z.string(),
+  issuanceId: import_zod3.z.string().min(1),
+  issuerDid: import_zod3.z.string(),
+  holderDid: import_zod3.z.string(),
+  policyId: import_zod3.z.string(),
+  capabilityHashHex: import_zod3.z.string().regex(/^[0-9a-f]{64}$/),
+  revocationMode: import_zod3.z.literal("refresh_only"),
   issuedAt: Rfc3339Schema,
   expiresAt: Rfc3339Schema,
-  terminal: import_zod2.z.boolean(),
-  encoded: import_zod2.z.string()
+  terminal: import_zod3.z.boolean(),
+  encoded: import_zod3.z.string()
 }).strict();
-var ResolveResponseSchema = import_zod2.z.object({ delegation: WireDelegationSchema }).strict();
-var DelegateReceiptSchema = import_zod2.z.object({
-  cid: import_zod2.z.string().min(1),
-  activated: import_zod2.z.array(import_zod2.z.string()),
-  skipped: import_zod2.z.array(import_zod2.z.string())
+var ResolveResponseSchema = import_zod3.z.object({ delegation: WireDelegationSchema }).strict();
+var DelegateReceiptSchema = import_zod3.z.object({
+  cid: import_zod3.z.string().min(1),
+  activated: import_zod3.z.array(import_zod3.z.string()),
+  skipped: import_zod3.z.array(import_zod3.z.string())
 }).strict();
-var SqlReadResponseSchema = import_zod2.z.object({ rows: import_zod2.z.array(JsonValueSchema) }).strict();
-var KvReadResponseSchema = import_zod2.z.object({ value: JsonValueSchema }).strict();
+var SqlReadResponseSchema = import_zod3.z.object({ rows: import_zod3.z.array(JsonValueSchema) }).strict();
+var KvReadResponseSchema = import_zod3.z.object({ value: JsonValueSchema }).strict();
 var LISTEN_SQL_STATEMENT_CATALOG = [
   {
     name: "listen.getConversation",
@@ -4506,7 +5151,7 @@ function nodeErrorMessage(body) {
   return "native node refusal";
 }
 function deriveDelegationCid(encoded) {
-  const digest4 = create(30, (0, import_blake3.blake3)(new TextEncoder().encode(encoded)));
+  const digest4 = create(30, (0, import_blake32.blake3)(new TextEncoder().encode(encoded)));
   return CID.createV1(85, digest4).toString();
 }
 function headersRecord(headers) {
@@ -4653,55 +5298,55 @@ function parseStrictRfc33392(value) {
 }
 
 // src/delegations/types.schema.ts
-var import_zod3 = require("zod");
-var JWKSchema = import_zod3.z.object({
+var import_zod4 = require("zod");
+var JWKSchema = import_zod4.z.object({
   /** Key type (e.g., "EC", "RSA", "OKP") */
-  kty: import_zod3.z.string(),
+  kty: import_zod4.z.string(),
   /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
-  crv: import_zod3.z.string().optional(),
+  crv: import_zod4.z.string().optional(),
   /** X coordinate for EC keys, public key for OKP */
-  x: import_zod3.z.string().optional(),
+  x: import_zod4.z.string().optional(),
   /** Y coordinate for EC keys */
-  y: import_zod3.z.string().optional(),
+  y: import_zod4.z.string().optional(),
   /** Private key value (d parameter) */
-  d: import_zod3.z.string().optional(),
+  d: import_zod4.z.string().optional(),
   /** Public exponent for RSA keys */
-  e: import_zod3.z.string().optional(),
+  e: import_zod4.z.string().optional(),
   /** Modulus for RSA keys */
-  n: import_zod3.z.string().optional(),
+  n: import_zod4.z.string().optional(),
   /** Key ID */
-  kid: import_zod3.z.string().optional(),
+  kid: import_zod4.z.string().optional(),
   /** Algorithm */
-  alg: import_zod3.z.string().optional(),
+  alg: import_zod4.z.string().optional(),
   /** Key use (e.g., "sig", "enc") */
-  use: import_zod3.z.string().optional(),
+  use: import_zod4.z.string().optional(),
   /** Key operations (e.g., ["sign", "verify"]) */
-  key_ops: import_zod3.z.array(import_zod3.z.string()).optional()
+  key_ops: import_zod4.z.array(import_zod4.z.string()).optional()
 });
-var KeyTypeSchema = import_zod3.z.enum(["main", "session", "ingested"]);
-var KeyInfoSchema = import_zod3.z.object({
+var KeyTypeSchema = import_zod4.z.enum(["main", "session", "ingested"]);
+var KeyInfoSchema = import_zod4.z.object({
   /** Unique identifier for this key */
-  id: import_zod3.z.string(),
+  id: import_zod4.z.string(),
   /** DID associated with this key */
-  did: import_zod3.z.string(),
+  did: import_zod4.z.string(),
   /** Type of key determining its authority level */
   type: KeyTypeSchema,
   /** Private key in JWK format */
   jwk: JWKSchema.optional(),
   /** Priority for key selection (lower = higher priority) */
-  priority: import_zod3.z.number()
+  priority: import_zod4.z.number()
 });
-var DelegationErrorSchema = import_zod3.z.object({
+var DelegationErrorSchema = import_zod4.z.object({
   /** Error code for programmatic handling */
-  code: import_zod3.z.string(),
+  code: import_zod4.z.string(),
   /** Human-readable error message */
-  message: import_zod3.z.string(),
+  message: import_zod4.z.string(),
   /** The service that produced the error */
-  service: import_zod3.z.literal("delegation"),
+  service: import_zod4.z.literal("delegation"),
   /** Original error if wrapping another error */
-  cause: import_zod3.z.instanceof(Error).optional(),
+  cause: import_zod4.z.instanceof(Error).optional(),
   /** Additional metadata about the error */
-  meta: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()).optional()
+  meta: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()).optional()
 });
 var DelegationErrorCodes = {
   AUTH_REQUIRED: "AUTH_REQUIRED",
@@ -4721,313 +5366,313 @@ var DelegationErrorCodes = {
   DATA_FETCH_FAILED: "DATA_FETCH_FAILED",
   VALIDATION_ERROR: "VALIDATION_ERROR"
 };
-var DelegationSchema = import_zod3.z.object({
+var DelegationSchema = import_zod4.z.object({
   /** Content identifier (CID) of the delegation */
-  cid: import_zod3.z.string(),
+  cid: import_zod4.z.string(),
   /** DID of the delegate (the party receiving the delegation) */
-  delegateDID: import_zod3.z.string(),
+  delegateDID: import_zod4.z.string(),
   /** Space ID this delegation applies to */
-  spaceId: import_zod3.z.string(),
+  spaceId: import_zod4.z.string(),
   /** Resource path this delegation grants access to */
-  path: import_zod3.z.string(),
+  path: import_zod4.z.string(),
   /** Actions this delegation authorizes */
-  actions: import_zod3.z.array(import_zod3.z.string()),
+  actions: import_zod4.z.array(import_zod4.z.string()),
   /** Exact ReCap caveats that constrain every action in this scope. */
-  caveats: import_zod3.z.array(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown())).optional(),
+  caveats: import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown())).optional(),
   /** When this delegation expires (accepts Date or ISO string from JSON) */
-  expiry: import_zod3.z.coerce.date(),
+  expiry: import_zod4.z.coerce.date(),
   /** Whether this delegation has been revoked */
-  isRevoked: import_zod3.z.boolean(),
+  isRevoked: import_zod4.z.boolean(),
   /** DID of the delegator (the party granting the delegation) */
-  delegatorDID: import_zod3.z.string().optional(),
+  delegatorDID: import_zod4.z.string().optional(),
   /** When this delegation was created (accepts Date or ISO string from JSON) */
-  createdAt: import_zod3.z.coerce.date().optional(),
+  createdAt: import_zod4.z.coerce.date().optional(),
   /** Parent delegation CID if this is a sub-delegation */
-  parentCid: import_zod3.z.string().optional(),
+  parentCid: import_zod4.z.string().optional(),
   /** Whether sub-delegation is allowed */
-  allowSubDelegation: import_zod3.z.boolean().optional(),
+  allowSubDelegation: import_zod4.z.boolean().optional(),
   /** Authorization header (UCAN bearer token) */
-  authHeader: import_zod3.z.string().optional()
+  authHeader: import_zod4.z.string().optional()
 });
-var DelegationStatusSchema = import_zod3.z.object({
-  cid: import_zod3.z.string().min(1),
-  status: import_zod3.z.enum(["active", "revoked", "expired", "unavailable", "not_found"]),
-  exists: import_zod3.z.boolean(),
-  active: import_zod3.z.boolean(),
-  revoked: import_zod3.z.boolean(),
-  expired: import_zod3.z.boolean()
+var DelegationStatusSchema = import_zod4.z.object({
+  cid: import_zod4.z.string().min(1),
+  status: import_zod4.z.enum(["active", "revoked", "expired", "unavailable", "not_found"]),
+  exists: import_zod4.z.boolean(),
+  active: import_zod4.z.boolean(),
+  revoked: import_zod4.z.boolean(),
+  expired: import_zod4.z.boolean()
 }).strict().superRefine((value, context) => {
   const valid = value.status === "active" ? value.exists && value.active && !value.revoked && !value.expired : value.status === "revoked" ? value.exists && !value.active && value.revoked && !value.expired : value.status === "expired" ? value.exists && !value.active && !value.revoked && value.expired : value.status === "unavailable" ? value.exists && !value.active && !value.revoked && !value.expired : !value.exists && !value.active && !value.revoked && !value.expired;
   if (!valid) {
     context.addIssue({
-      code: import_zod3.z.ZodIssueCode.custom,
+      code: import_zod4.z.ZodIssueCode.custom,
       message: "delegation status flags do not match status"
     });
   }
 });
-var DelegationRevocationReceiptSchema = import_zod3.z.object({
-  revoked: import_zod3.z.literal(true),
-  cid: import_zod3.z.string().min(1)
+var DelegationRevocationReceiptSchema = import_zod4.z.object({
+  revoked: import_zod4.z.literal(true),
+  cid: import_zod4.z.string().min(1)
 }).strict();
-var AccountDelegationResourceSchema = import_zod3.z.object({
-  resource: import_zod3.z.string().min(1),
-  actions: import_zod3.z.array(import_zod3.z.string()),
-  caveats: import_zod3.z.array(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown()))
+var AccountDelegationResourceSchema = import_zod4.z.object({
+  resource: import_zod4.z.string().min(1),
+  actions: import_zod4.z.array(import_zod4.z.string()),
+  caveats: import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()))
 }).strict();
-var AccountDelegationDateSchema = import_zod3.z.string().datetime({ offset: true }).transform((value) => new Date(value));
-var AccountDelegationRecordSchema = import_zod3.z.object({
-  cid: import_zod3.z.string().min(1),
-  direction: import_zod3.z.enum(["granted", "received"]),
-  delegatorDid: import_zod3.z.string().min(1),
-  delegateDid: import_zod3.z.string().min(1),
-  resources: import_zod3.z.array(AccountDelegationResourceSchema),
-  parents: import_zod3.z.array(import_zod3.z.string()),
+var AccountDelegationDateSchema = import_zod4.z.string().datetime({ offset: true }).transform((value) => new Date(value));
+var AccountDelegationRecordSchema = import_zod4.z.object({
+  cid: import_zod4.z.string().min(1),
+  direction: import_zod4.z.enum(["granted", "received"]),
+  delegatorDid: import_zod4.z.string().min(1),
+  delegateDid: import_zod4.z.string().min(1),
+  resources: import_zod4.z.array(AccountDelegationResourceSchema),
+  parents: import_zod4.z.array(import_zod4.z.string()),
   issuedAt: AccountDelegationDateSchema.nullable(),
   notBefore: AccountDelegationDateSchema.nullable(),
   expiresAt: AccountDelegationDateSchema.nullable(),
-  status: import_zod3.z.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]),
+  status: import_zod4.z.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]),
   revokedAt: AccountDelegationDateSchema.nullable().optional(),
-  revokedBy: import_zod3.z.string().optional(),
-  revokedAncestorCid: import_zod3.z.string().optional()
+  revokedBy: import_zod4.z.string().optional(),
+  revokedAncestorCid: import_zod4.z.string().optional()
 }).strict();
-var AccountDelegationPageSchema = import_zod3.z.object({
-  schemaVersion: import_zod3.z.literal(2),
-  items: import_zod3.z.array(AccountDelegationRecordSchema),
-  nextCursor: import_zod3.z.string().optional()
+var AccountDelegationPageSchema = import_zod4.z.object({
+  schemaVersion: import_zod4.z.literal(2),
+  items: import_zod4.z.array(AccountDelegationRecordSchema),
+  nextCursor: import_zod4.z.string().optional()
 }).strict();
-var AccountDelegationQueryOptionsSchema = import_zod3.z.object({
-  direction: import_zod3.z.enum(["granted", "received", "all"]).optional(),
-  status: import_zod3.z.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]).optional(),
-  space: import_zod3.z.string().trim().min(1).optional(),
-  limit: import_zod3.z.number().int().min(1).max(100).optional(),
-  cursor: import_zod3.z.string().min(1).optional()
+var AccountDelegationQueryOptionsSchema = import_zod4.z.object({
+  direction: import_zod4.z.enum(["granted", "received", "all"]).optional(),
+  status: import_zod4.z.enum(["active", "pending", "expired", "revoked", "ancestor_revoked"]).optional(),
+  space: import_zod4.z.string().trim().min(1).optional(),
+  limit: import_zod4.z.number().int().min(1).max(100).optional(),
+  cursor: import_zod4.z.string().min(1).optional()
 }).strict();
-var CapabilityEntrySchema = import_zod3.z.object({
+var CapabilityEntrySchema = import_zod4.z.object({
   /** Resource URI this capability applies to */
-  resource: import_zod3.z.string(),
+  resource: import_zod4.z.string(),
   /** Action this capability authorizes */
-  action: import_zod3.z.string(),
+  action: import_zod4.z.string(),
   /** Keys that can exercise this capability, ordered by priority */
-  keys: import_zod3.z.array(KeyInfoSchema),
+  keys: import_zod4.z.array(KeyInfoSchema),
   /** The delegation that grants this capability */
   delegation: DelegationSchema,
   /** When this capability expires (accepts Date or ISO string from JSON) */
-  expiresAt: import_zod3.z.coerce.date().optional()
+  expiresAt: import_zod4.z.coerce.date().optional()
 });
-var DelegationRecordSchema = import_zod3.z.object({
+var DelegationRecordSchema = import_zod4.z.object({
   /** Content identifier (CID) of the delegation */
-  cid: import_zod3.z.string(),
+  cid: import_zod4.z.string(),
   /** Space ID this delegation applies to */
-  spaceId: import_zod3.z.string(),
+  spaceId: import_zod4.z.string(),
   /** DID of the delegator (grantor) */
-  delegator: import_zod3.z.string(),
+  delegator: import_zod4.z.string(),
   /** DID of the delegatee (recipient) */
-  delegatee: import_zod3.z.string(),
+  delegatee: import_zod4.z.string(),
   /** Key ID used to sign/exercise this delegation */
-  keyId: import_zod3.z.string().optional(),
+  keyId: import_zod4.z.string().optional(),
   /** Resource path pattern this delegation grants access to */
-  path: import_zod3.z.string(),
+  path: import_zod4.z.string(),
   /** Actions this delegation authorizes */
-  actions: import_zod3.z.array(import_zod3.z.string()),
+  actions: import_zod4.z.array(import_zod4.z.string()),
   /** When this delegation expires (accepts Date or ISO string from JSON) */
-  expiry: import_zod3.z.coerce.date().optional(),
+  expiry: import_zod4.z.coerce.date().optional(),
   /** When this delegation becomes valid (not before) (accepts Date or ISO string) */
-  notBefore: import_zod3.z.coerce.date().optional(),
+  notBefore: import_zod4.z.coerce.date().optional(),
   /** Whether this delegation has been revoked */
-  isRevoked: import_zod3.z.boolean(),
+  isRevoked: import_zod4.z.boolean(),
   /** When this delegation was created (accepts Date or ISO string from JSON) */
-  createdAt: import_zod3.z.coerce.date(),
+  createdAt: import_zod4.z.coerce.date(),
   /** Parent delegation CID if this is a sub-delegation */
-  parentCid: import_zod3.z.string().optional()
+  parentCid: import_zod4.z.string().optional()
 });
-var CreateDelegationParamsSchema = import_zod3.z.object({
+var CreateDelegationParamsSchema = import_zod4.z.object({
   /** DID of the delegate (the party receiving the delegation) */
-  delegateDID: import_zod3.z.string(),
+  delegateDID: import_zod4.z.string(),
   /** Resource path this delegation grants access to */
-  path: import_zod3.z.string(),
+  path: import_zod4.z.string(),
   /** Actions to authorize */
-  actions: import_zod3.z.array(import_zod3.z.string()),
+  actions: import_zod4.z.array(import_zod4.z.string()),
   /** When this delegation expires (accepts Date or ISO string) */
-  expiry: import_zod3.z.coerce.date().optional(),
+  expiry: import_zod4.z.coerce.date().optional(),
   /** Whether to disable sub-delegation */
-  disableSubDelegation: import_zod3.z.boolean().optional(),
+  disableSubDelegation: import_zod4.z.boolean().optional(),
   /** Optional statement for the SIWE message */
-  statement: import_zod3.z.string().optional()
+  statement: import_zod4.z.string().optional()
 });
-var DelegationChainSchema = import_zod3.z.array(DelegationSchema);
-var DelegationChainV2Schema = import_zod3.z.object({
+var DelegationChainSchema = import_zod4.z.array(DelegationSchema);
+var DelegationChainV2Schema = import_zod4.z.object({
   /** The root delegation from the original authority */
   root: DelegationSchema,
   /** Intermediate delegations in the chain (may be empty) */
-  chain: import_zod3.z.array(DelegationSchema),
+  chain: import_zod4.z.array(DelegationSchema),
   /** The final delegation to the current user */
   leaf: DelegationSchema
 });
-var DelegationDirectionSchema = import_zod3.z.enum(["granted", "received", "all"]);
-var DelegationFiltersSchema = import_zod3.z.object({
+var DelegationDirectionSchema = import_zod4.z.enum(["granted", "received", "all"]);
+var DelegationFiltersSchema = import_zod4.z.object({
   /** Filter by delegation direction */
   direction: DelegationDirectionSchema.optional(),
   /** Filter by resource path pattern */
-  path: import_zod3.z.string().optional(),
+  path: import_zod4.z.string().optional(),
   /** Filter by required actions */
-  actions: import_zod3.z.array(import_zod3.z.string()).optional(),
+  actions: import_zod4.z.array(import_zod4.z.string()).optional(),
   /** Include revoked delegations */
-  includeRevoked: import_zod3.z.boolean().optional(),
+  includeRevoked: import_zod4.z.boolean().optional(),
   /** Filter by delegator DID */
-  delegator: import_zod3.z.string().optional(),
+  delegator: import_zod4.z.string().optional(),
   /** Filter by delegatee DID */
-  delegatee: import_zod3.z.string().optional(),
+  delegatee: import_zod4.z.string().optional(),
   /** Only include delegations valid at this time */
-  validAt: import_zod3.z.coerce.date().optional(),
+  validAt: import_zod4.z.coerce.date().optional(),
   /** Maximum number of results to return */
-  limit: import_zod3.z.number().optional(),
+  limit: import_zod4.z.number().optional(),
   /** Cursor for pagination */
-  cursor: import_zod3.z.string().optional()
+  cursor: import_zod4.z.string().optional()
 });
-var SpaceOwnershipSchema = import_zod3.z.enum(["owned", "delegated"]);
-var SpaceInfoSchema = import_zod3.z.object({
+var SpaceOwnershipSchema = import_zod4.z.enum(["owned", "delegated"]);
+var SpaceInfoSchema = import_zod4.z.object({
   /** Space identifier */
-  id: import_zod3.z.string(),
+  id: import_zod4.z.string(),
   /** Human-readable name for the space */
-  name: import_zod3.z.string().optional(),
+  name: import_zod4.z.string().optional(),
   /** DID of the space owner */
-  owner: import_zod3.z.string(),
+  owner: import_zod4.z.string(),
   /** Whether user owns or has delegated access */
   type: SpaceOwnershipSchema,
   /** Permissions the user has in this space */
-  permissions: import_zod3.z.array(import_zod3.z.string()).optional(),
+  permissions: import_zod4.z.array(import_zod4.z.string()).optional(),
   /** When the access expires (for delegated spaces) */
-  expiresAt: import_zod3.z.coerce.date().optional()
+  expiresAt: import_zod4.z.coerce.date().optional()
 });
-var ShareSchemaSchema = import_zod3.z.enum(["base64", "compact", "ipfs"]);
-var ShareLinkSchema = import_zod3.z.object({
+var ShareSchemaSchema = import_zod4.z.enum(["base64", "compact", "ipfs"]);
+var ShareLinkSchema = import_zod4.z.object({
   /** Unique token identifying this share link */
-  token: import_zod3.z.string(),
+  token: import_zod4.z.string(),
   /** Full URL for sharing */
-  url: import_zod3.z.string(),
+  url: import_zod4.z.string(),
   /** The delegation this link grants access to */
   delegation: DelegationSchema,
   /** Encoding schema used for the link */
   schema: ShareSchemaSchema,
   /** When this share link expires */
-  expiresAt: import_zod3.z.coerce.date().optional(),
+  expiresAt: import_zod4.z.coerce.date().optional(),
   /** Human-readable description of what is being shared */
-  description: import_zod3.z.string().optional()
+  description: import_zod4.z.string().optional()
 });
 function createShareLinkDataSchema(dataSchema) {
-  return import_zod3.z.object({
+  return import_zod4.z.object({
     /** The retrieved data */
     data: dataSchema,
     /** The delegation that authorized this access */
     delegation: DelegationSchema,
     /** The space the data belongs to */
-    spaceId: import_zod3.z.string(),
+    spaceId: import_zod4.z.string(),
     /** The resource path that was accessed */
-    path: import_zod3.z.string()
+    path: import_zod4.z.string()
   });
 }
-var ShareLinkDataSchema = createShareLinkDataSchema(import_zod3.z.unknown());
-var IngestOptionsSchema = import_zod3.z.object({
+var ShareLinkDataSchema = createShareLinkDataSchema(import_zod4.z.unknown());
+var IngestOptionsSchema = import_zod4.z.object({
   /** Whether to persist the delegation to storage */
-  persist: import_zod3.z.boolean().optional(),
+  persist: import_zod4.z.boolean().optional(),
   /** Whether to validate the full delegation chain */
-  validateChain: import_zod3.z.boolean().optional(),
+  validateChain: import_zod4.z.boolean().optional(),
   /** Name for the ingested key */
-  keyName: import_zod3.z.string().optional(),
+  keyName: import_zod4.z.string().optional(),
   /** Whether to create a session key for this delegation */
-  createSessionKey: import_zod3.z.boolean().optional(),
+  createSessionKey: import_zod4.z.boolean().optional(),
   /** Override the priority for the ingested key */
-  priority: import_zod3.z.number().optional()
+  priority: import_zod4.z.number().optional()
 });
-var GenerateShareParamsSchema = import_zod3.z.object({
+var GenerateShareParamsSchema = import_zod4.z.object({
   /** Resource path to share */
-  path: import_zod3.z.string(),
+  path: import_zod4.z.string(),
   /** Actions to authorize */
-  actions: import_zod3.z.array(import_zod3.z.string()).optional(),
+  actions: import_zod4.z.array(import_zod4.z.string()).optional(),
   /** When the share link expires */
-  expiry: import_zod3.z.coerce.date().optional(),
+  expiry: import_zod4.z.coerce.date().optional(),
   /** Encoding schema for the link */
   schema: ShareSchemaSchema.optional(),
   /** Human-readable description */
-  description: import_zod3.z.string().optional(),
+  description: import_zod4.z.string().optional(),
   /** Base URL for the share link */
-  baseUrl: import_zod3.z.string().optional()
+  baseUrl: import_zod4.z.string().optional()
 });
-var DelegationManagerConfigSchema = import_zod3.z.object({
+var DelegationManagerConfigSchema = import_zod4.z.object({
   /** TinyCloud host URLs */
-  hosts: import_zod3.z.array(import_zod3.z.string()),
+  hosts: import_zod4.z.array(import_zod4.z.string()),
   /** Account space used by account-wide delegation history queries */
-  accountSpaceId: import_zod3.z.string().min(1).optional(),
+  accountSpaceId: import_zod4.z.string().min(1).optional(),
   /** Active session for authentication */
-  session: import_zod3.z.unknown().refine(
+  session: import_zod4.z.unknown().refine(
     (val) => val !== null && typeof val === "object",
     { message: "Expected a ServiceSession object" }
   ),
   /** Platform-specific invoke function */
-  invoke: import_zod3.z.unknown().refine(
+  invoke: import_zod4.z.unknown().refine(
     (val) => typeof val === "function",
     { message: "Expected an invoke function" }
   ),
   /** Platform-specific invoke function for raw resource URIs */
-  invokeAny: import_zod3.z.unknown().refine(
+  invokeAny: import_zod4.z.unknown().refine(
     (val) => val === void 0 || typeof val === "function",
     { message: "Expected an invokeAny function or undefined" }
   ).optional(),
   /** Optional custom fetch implementation */
-  fetch: import_zod3.z.unknown().refine(
+  fetch: import_zod4.z.unknown().refine(
     (val) => val === void 0 || typeof val === "function",
     { message: "Expected a fetch function or undefined" }
   ).optional()
 });
-var KeyProviderSchema = import_zod3.z.object({
+var KeyProviderSchema = import_zod4.z.object({
   /** Generate a new session key, returns key ID */
-  createSessionKey: import_zod3.z.unknown().refine(
+  createSessionKey: import_zod4.z.unknown().refine(
     (val) => typeof val === "function",
     { message: "Expected a function" }
   ),
   /** Get JWK for a key */
-  getJWK: import_zod3.z.unknown().refine(
+  getJWK: import_zod4.z.unknown().refine(
     (val) => typeof val === "function",
     { message: "Expected a function" }
   ),
   /** Get DID for a key */
-  getDID: import_zod3.z.unknown().refine(
+  getDID: import_zod4.z.unknown().refine(
     (val) => typeof val === "function",
     { message: "Expected a function" }
   )
 });
-var DelegationApiResponseSchema = import_zod3.z.object({
+var DelegationApiResponseSchema = import_zod4.z.object({
   /** SIWE message content */
-  siwe: import_zod3.z.string(),
+  siwe: import_zod4.z.string(),
   /** Signature of the SIWE message */
-  signature: import_zod3.z.string(),
+  signature: import_zod4.z.string(),
   /** Delegation version */
-  version: import_zod3.z.number(),
+  version: import_zod4.z.number(),
   /** CID of the created delegation */
-  cid: import_zod3.z.string().optional()
+  cid: import_zod4.z.string().optional()
 });
-var DelegatedResourceSchema = import_zod3.z.object({
+var DelegatedResourceSchema = import_zod4.z.object({
   /** Short-form service name, e.g. "kv", "sql", "duckdb", "capabilities", "hooks". */
-  service: import_zod3.z.string(),
+  service: import_zod4.z.string(),
   /** Full space id string, e.g. "tinycloud:pkh:eip155:1:0x....:default". */
-  space: import_zod3.z.string(),
+  space: import_zod4.z.string(),
   /** Resource path; empty string when the resource URI had no path segment. */
-  path: import_zod3.z.string(),
+  path: import_zod4.z.string(),
   /** Full-URN ability strings, e.g. ["tinycloud.kv/get", "tinycloud.kv/put"]. */
-  actions: import_zod3.z.array(import_zod3.z.string()),
+  actions: import_zod4.z.array(import_zod4.z.string()),
   /** Exact ReCap caveats that constrain every action in this scope. */
-  caveats: import_zod3.z.array(import_zod3.z.record(import_zod3.z.string(), import_zod3.z.unknown())).optional()
+  caveats: import_zod4.z.array(import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown())).optional()
 });
-var CreateDelegationWasmParamsSchema = import_zod3.z.object({
+var CreateDelegationWasmParamsSchema = import_zod4.z.object({
   /** The session containing delegation credentials */
-  session: import_zod3.z.unknown().refine(
+  session: import_zod4.z.unknown().refine(
     (val) => val !== null && typeof val === "object",
     { message: "Expected a ServiceSession object" }
   ),
   /** DID of the delegate */
-  delegateDID: import_zod3.z.string(),
+  delegateDID: import_zod4.z.string(),
   /** Space ID this delegation applies to */
-  spaceId: import_zod3.z.string(),
+  spaceId: import_zod4.z.string(),
   /**
    * Multi-resource abilities map: short-service → path → full-URN actions.
    * Matches the shape accepted by `prepareSession`.
@@ -5044,26 +5689,26 @@ var CreateDelegationWasmParamsSchema = import_zod3.z.object({
    * }
    * ```
    */
-  abilities: import_zod3.z.record(import_zod3.z.string(), import_zod3.z.record(import_zod3.z.string(), import_zod3.z.array(import_zod3.z.string()))),
+  abilities: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.record(import_zod4.z.string(), import_zod4.z.array(import_zod4.z.string()))),
   /** Expiration time in seconds since Unix epoch */
-  expirationSecs: import_zod3.z.number(),
+  expirationSecs: import_zod4.z.number(),
   /** Optional not-before time in seconds since Unix epoch */
-  notBeforeSecs: import_zod3.z.number().optional()
+  notBeforeSecs: import_zod4.z.number().optional()
 });
-var CreateDelegationWasmResultSchema = import_zod3.z.object({
+var CreateDelegationWasmResultSchema = import_zod4.z.object({
   /** Base64url-encoded UCAN delegation */
-  delegation: import_zod3.z.string(),
+  delegation: import_zod4.z.string(),
   /** CID of the delegation */
-  cid: import_zod3.z.string(),
+  cid: import_zod4.z.string(),
   /** DID of the delegate */
-  delegateDID: import_zod3.z.string(),
+  delegateDID: import_zod4.z.string(),
   /** Expiration time */
-  expiry: import_zod3.z.coerce.date(),
+  expiry: import_zod4.z.coerce.date(),
   /**
    * All (service, space, path, actions) entries granted by this delegation.
    * Always non-empty on success.
    */
-  resources: import_zod3.z.array(DelegatedResourceSchema)
+  resources: import_zod4.z.array(DelegatedResourceSchema)
 });
 
 // src/expiry.ts
@@ -5758,66 +6403,66 @@ var DelegationManager = class {
 };
 
 // src/delegations/SharingService.schema.ts
-var import_zod4 = require("zod");
-var EncodedShareDataSchema = import_zod4.z.object({
+var import_zod5 = require("zod");
+var EncodedShareDataSchema = import_zod5.z.object({
   /** Private key in JWK format (must include d parameter) */
   key: JWKSchema.refine(
     (jwk) => typeof jwk.d === "string" && jwk.d.length > 0,
     { message: "JWK must include private key (d parameter)" }
   ),
   /** DID of the key */
-  keyDid: import_zod4.z.string().min(1, "keyDid is required"),
+  keyDid: import_zod5.z.string().min(1, "keyDid is required"),
   /** The delegation granting access */
   delegation: DelegationSchema,
   /** Resource path this link grants access to */
-  path: import_zod4.z.string().min(1, "path is required"),
+  path: import_zod5.z.string().min(1, "path is required"),
   /** TinyCloud host URL */
-  host: import_zod4.z.string().url("host must be a valid URL"),
+  host: import_zod5.z.string().url("host must be a valid URL"),
   /** Space ID */
-  spaceId: import_zod4.z.string().min(1, "spaceId is required"),
+  spaceId: import_zod5.z.string().min(1, "spaceId is required"),
   /** Schema version (must be 1) */
-  version: import_zod4.z.literal(1)
+  version: import_zod5.z.literal(1)
 });
-var ReceiveOptionsSchema = import_zod4.z.object({
+var ReceiveOptionsSchema = import_zod5.z.object({
   /**
    * Whether to automatically create a sub-delegation to the current session key.
    * Default: true
    */
-  autoSubdelegate: import_zod4.z.boolean().optional(),
+  autoSubdelegate: import_zod5.z.boolean().optional(),
   /**
    * Whether to use the current session key for operations (requires autoSubdelegate).
    * Default: true
    */
-  useSessionKey: import_zod4.z.boolean().optional(),
+  useSessionKey: import_zod5.z.boolean().optional(),
   /**
    * Ingestion options passed to CapabilityKeyRegistry.
    */
   ingestOptions: IngestOptionsSchema.optional()
 });
-var SharingServiceConfigSchema = import_zod4.z.object({
+var SharingServiceConfigSchema = import_zod5.z.object({
   /** TinyCloud host URLs */
-  hosts: import_zod4.z.array(import_zod4.z.string().url()).min(1, "At least one host URL is required"),
+  hosts: import_zod5.z.array(import_zod5.z.string().url()).min(1, "At least one host URL is required"),
   /**
    * Active session for authentication.
    * Required for generate(), optional for receive().
    */
-  session: import_zod4.z.unknown().refine(
+  session: import_zod5.z.unknown().refine(
     (val) => val === void 0 || val !== null && typeof val === "object",
     { message: "Expected a ServiceSession object or undefined" }
   ).optional(),
   /** Platform-specific invoke function */
-  invoke: import_zod4.z.unknown().refine((val) => typeof val === "function", {
+  invoke: import_zod5.z.unknown().refine((val) => typeof val === "function", {
     message: "Expected an invoke function"
   }),
   /** Optional custom fetch implementation */
-  fetch: import_zod4.z.unknown().refine(
+  fetch: import_zod5.z.unknown().refine(
     (val) => val === void 0 || typeof val === "function",
     { message: "Expected a fetch function or undefined" }
   ).optional(),
   /** Key provider for cryptographic operations */
   keyProvider: KeyProviderSchema,
   /** Capability key registry for key/delegation management */
-  registry: import_zod4.z.unknown().refine(
+  registry: import_zod5.z.unknown().refine(
     (val) => val !== null && typeof val === "object",
     { message: "Expected an ICapabilityKeyRegistry object" }
   ),
@@ -5825,47 +6470,47 @@ var SharingServiceConfigSchema = import_zod4.z.object({
    * Delegation manager for creating delegations.
    * Required for generate(), optional for receive().
    */
-  delegationManager: import_zod4.z.unknown().refine(
+  delegationManager: import_zod5.z.unknown().refine(
     (val) => val === void 0 || val !== null && typeof val === "object",
     { message: "Expected a DelegationManager object or undefined" }
   ).optional(),
   /** Factory for creating KV service instances */
-  createKVService: import_zod4.z.unknown().refine(
+  createKVService: import_zod5.z.unknown().refine(
     (val) => typeof val === "function",
     { message: "Expected a createKVService factory function" }
   ),
   /** Base URL for sharing links (e.g., "https://share.myapp.com") */
-  baseUrl: import_zod4.z.string().optional(),
+  baseUrl: import_zod5.z.string().optional(),
   /**
    * Custom delegation creation function.
    */
-  createDelegation: import_zod4.z.unknown().refine((val) => val === void 0 || typeof val === "function", {
+  createDelegation: import_zod5.z.unknown().refine((val) => val === void 0 || typeof val === "function", {
     message: "Expected a createDelegation function or undefined"
   }).optional(),
   /**
    * WASM function for client-side delegation creation.
    */
-  createDelegationWasm: import_zod4.z.unknown().refine((val) => val === void 0 || typeof val === "function", {
+  createDelegationWasm: import_zod5.z.unknown().refine((val) => val === void 0 || typeof val === "function", {
     message: "Expected a createDelegationWasm function or undefined"
   }).optional(),
   /** CID computation used to verify transportable child delegations. */
-  computeCid: import_zod4.z.unknown().refine((val) => val === void 0 || typeof val === "function", {
+  computeCid: import_zod5.z.unknown().refine((val) => val === void 0 || typeof val === "function", {
     message: "Expected a computeCid function or undefined"
   }).optional(),
   /**
    * Path prefix for KV operations.
    */
-  pathPrefix: import_zod4.z.string().optional(),
+  pathPrefix: import_zod5.z.string().optional(),
   /**
    * Session expiry time.
    */
-  sessionExpiry: import_zod4.z.date().optional(),
+  sessionExpiry: import_zod5.z.date().optional(),
   /**
    * Callback to create a DIRECT delegation from wallet to share key.
    * This is the preferred method for long-lived share links because it
    * bypasses the session delegation chain entirely.
    */
-  onRootDelegationNeeded: import_zod4.z.unknown().refine((val) => val === void 0 || typeof val === "function", {
+  onRootDelegationNeeded: import_zod5.z.unknown().refine((val) => val === void 0 || typeof val === "function", {
     message: "Expected an onRootDelegationNeeded function or undefined"
   }).optional()
 });
@@ -5887,6 +6532,7 @@ function validateEncodedShareData(data) {
 
 // src/manifest.ts
 var import_ms = __toESM(require("ms"), 1);
+var import_bootstrap2 = require("@tinycloud/bootstrap");
 var import_sdk_services = require("@tinycloud/sdk-services");
 var DEFAULT_KNOWLEDGE_ROOT = "knowledge/index.md";
 var ManifestValidationError = class extends Error {
@@ -6545,30 +7191,6 @@ function withCapabilitiesReadForSpaces(resources) {
     ...[...spaces].map(capabilitiesReadPermission)
   ]);
 }
-function accountRegistryPermissions() {
-  return [
-    ...[ACCOUNT_REGISTRY_PATH, "spaces/"].map((path) => ({
-      service: "tinycloud.kv",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path,
-      actions: ["tinycloud.kv/get", "tinycloud.kv/put", "tinycloud.kv/list"]
-    })),
-    {
-      service: "tinycloud.delegation",
-      space: ACCOUNT_REGISTRY_SPACE,
-      path: "",
-      actions: ["tinycloud.delegation/list"]
-    }
-  ];
-}
-function accountRegistryIndexPermission() {
-  return {
-    service: "tinycloud.sql",
-    space: ACCOUNT_REGISTRY_SPACE,
-    path: "account",
-    actions: ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/schema"]
-  };
-}
 function composeManifestRequest(inputs, options2 = {}) {
   if (!Array.isArray(inputs) || inputs.length === 0) {
     throw new ManifestValidationError(
@@ -6586,8 +7208,12 @@ function composeManifestRequest(inputs, options2 = {}) {
     }))
   );
   if (includeAccountRegistryPermissions) {
-    resources.push(...accountRegistryPermissions());
-    resources.push(accountRegistryIndexPermission());
+    resources.push(
+      ...import_bootstrap2.ACCOUNT_MANIFEST_PERMISSIONS.map((resource) => ({
+        ...resource,
+        actions: [...resource.actions]
+      }))
+    );
   }
   const resourcesWithImplicitCapabilities = withCapabilitiesReadForSpaces(resources);
   const manifestsByAppId = /* @__PURE__ */ new Map();
@@ -6762,13 +7388,13 @@ function canonicalizeRecapCaveats(caveats) {
     }
     if (Array.isArray(value)) return `[${value.map(canonicalize).join(",")}]`;
     if (typeof value === "object") {
-      const object = value;
-      const prototype = Object.getPrototypeOf(object);
+      const object2 = value;
+      const prototype = Object.getPrototypeOf(object2);
       if (prototype !== Object.prototype && prototype !== null) {
         throw new Error("ReCap caveats must contain only JSON values.");
       }
-      return `{${Object.keys(object).sort().map(
-        (key) => `${JSON.stringify(key)}:${canonicalize(object[key])}`
+      return `{${Object.keys(object2).sort().map(
+        (key) => `${JSON.stringify(key)}:${canonicalize(object2[key])}`
       ).join(",")}}`;
     }
     throw new Error("ReCap caveats must contain only JSON values.");
@@ -6840,17 +7466,17 @@ function parseRecapCapabilities(parseWasm, siwe) {
 }
 
 // src/delegations/SharingService.ts
-var import_ed255194 = require("@noble/curves/ed25519");
+var import_ed255195 = require("@noble/curves/ed25519");
 
 // src/delegations/ShareRecipientClient.ts
 var import_sdk_services2 = require("@tinycloud/sdk-services");
-var import_ed255193 = require("@noble/curves/ed25519");
-var import_sha2563 = require("@noble/hashes/sha256");
+var import_ed255194 = require("@noble/curves/ed25519");
+var import_sha2564 = require("@noble/hashes/sha256");
 
 // src/delegations/share-envelope.ts
-var import_ed255192 = require("@noble/curves/ed25519");
-var import_blake32 = require("@noble/hashes/blake3");
-var import_sha256 = require("@noble/hashes/sha256");
+var import_ed255193 = require("@noble/curves/ed25519");
+var import_blake33 = require("@noble/hashes/blake3");
+var import_sha2562 = require("@noble/hashes/sha256");
 var ENVELOPE_SCHEMA = "xyz.tinycloud.share/envelope";
 var INLINE_PREFIX = "tc2:";
 var RAW_CID_CODEC = 85;
@@ -6899,8 +7525,8 @@ function canonicalJson(value) {
   }
   if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
   if (typeof value === "object") {
-    const object = value;
-    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(",")}}`;
+    const object2 = value;
+    return `{${Object.keys(object2).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object2[key])}`).join(",")}}`;
   }
   throw new ShareEnvelopeError("invalid-envelope", "unsupported JSON value");
 }
@@ -7069,17 +7695,17 @@ function createSharePolicy(input) {
   };
 }
 function contentDigest(bytes2) {
-  return bytesToBase64Url((0, import_sha256.sha256)(bytes2));
+  return bytesToBase64Url((0, import_sha2562.sha256)(bytes2));
 }
 function computeShareCid(bytes2) {
-  const digest4 = create(BLAKE3_256_CODE, (0, import_blake32.blake3)(bytes2));
+  const digest4 = create(BLAKE3_256_CODE, (0, import_blake33.blake3)(bytes2));
   return CID.createV1(RAW_CID_CODEC, digest4).toString();
 }
 function verifyShareCid(cid2, bytes2) {
   try {
     const parsed = CID.parse(cid2);
     if (parsed.toString() !== cid2 || parsed.multihash.code !== BLAKE3_256_CODE) return false;
-    return parsed.equals(CID.createV1(parsed.code, create(parsed.multihash.code, (0, import_blake32.blake3)(bytes2))));
+    return parsed.equals(CID.createV1(parsed.code, create(parsed.multihash.code, (0, import_blake33.blake3)(bytes2))));
   } catch {
     return false;
   }
@@ -7089,7 +7715,7 @@ function envelopeSigningBytes(envelope) {
 }
 function signShareEnvelope(input) {
   if (input.signerPrivateKey.length !== 32) throw new ShareEnvelopeError("invalid-envelope", "Ed25519 private key must be 32 bytes");
-  const publicKey = import_ed255192.ed25519.getPublicKey(input.signerPrivateKey);
+  const publicKey = import_ed255193.ed25519.getPublicKey(input.signerPrivateKey);
   const unsigned = {
     schema: ENVELOPE_SCHEMA,
     version: 2,
@@ -7104,7 +7730,7 @@ function signShareEnvelope(input) {
     expiresAt: new Date(input.expiresAt).toISOString(),
     signer: { did: input.signerDid, publicKey: bytesToBase64Url(publicKey) }
   };
-  return { ...unsigned, signature: bytesToBase64Url(import_ed255192.ed25519.sign(envelopeSigningBytes(unsigned), input.signerPrivateKey)) };
+  return { ...unsigned, signature: bytesToBase64Url(import_ed255193.ed25519.sign(envelopeSigningBytes(unsigned), input.signerPrivateKey)) };
 }
 function verifyShareEnvelope(envelope, options2 = {}) {
   try {
@@ -7136,7 +7762,7 @@ function verifyShareEnvelope(envelope, options2 = {}) {
     const signature = base64UrlToBytes(envelope.signature);
     const unsigned = { ...envelope };
     delete unsigned.signature;
-    if (publicKey.length !== 32 || signature.length !== 64 || !import_ed255192.ed25519.verify(signature, envelopeSigningBytes(unsigned), publicKey)) throw new ShareEnvelopeError("signature-invalid", "share envelope signature is invalid");
+    if (publicKey.length !== 32 || signature.length !== 64 || !import_ed255193.ed25519.verify(signature, envelopeSigningBytes(unsigned), publicKey)) throw new ShareEnvelopeError("signature-invalid", "share envelope signature is invalid");
     if (options2.trustedSignerDids !== void 0 && envelope.recipientKind !== void 0 && !options2.trustedSignerDids.includes(envelope.signer.did)) throw new ShareEnvelopeError("signature-invalid", "share signer is not trusted");
     return envelope;
   } catch (error) {
@@ -7184,7 +7810,7 @@ function encodeInlineShareUrl(input) {
 }
 var PUBLISHED_AAD = new TextEncoder().encode("tinycloud-share-envelope-v1");
 function publishedCid(bytes2) {
-  return CID.create(1, code, create(sha2562.code, (0, import_sha256.sha256)(bytes2))).toString();
+  return CID.create(1, code, create(sha2562.code, (0, import_sha2562.sha256)(bytes2))).toString();
 }
 function isPublishedCid(value) {
   try {
@@ -7224,7 +7850,7 @@ function publishedArtifact(envelope, plaintext, policy) {
       content: {
         mimeType: "application/octet-stream",
         size: plaintext.byteLength,
-        digest: bytesToBase64Url((0, import_sha256.sha256)(plaintext))
+        digest: bytesToBase64Url((0, import_sha2562.sha256)(plaintext))
       },
       // Addressed policy metadata is confidential even though this function
       // is called after the outer envelope has been opened. Keep the
@@ -7328,9 +7954,9 @@ function parsePolicyMetadata(policyBytes, target, expectedExpiry) {
     assertKeys(source, ["kind", "space", "database", "path", "statement", "arguments", "argumentsDigest", "action"], "published SQL content source");
     if (typeof source.space !== "string" || typeof source.database !== "string" || typeof source.path !== "string" || typeof source.statement !== "string" || !source.arguments || typeof source.arguments !== "object" || Array.isArray(source.arguments) || typeof source.argumentsDigest !== "string" || source.action !== "tinycloud.sql/read") throw new ShareEnvelopeError("invalid-envelope", "published SQL content source is invalid");
     for (const argument of Object.values(source.arguments)) if (!Number.isSafeInteger(argument)) throw new ShareEnvelopeError("invalid-envelope", "published SQL arguments are invalid");
-    if (bytesToBase64Url((0, import_sha256.sha256)(new TextEncoder().encode(canonicalJson(source.arguments)))) !== source.argumentsDigest) throw new ShareEnvelopeError("invalid-envelope", "published SQL argument digest is invalid");
+    if (bytesToBase64Url((0, import_sha2562.sha256)(new TextEncoder().encode(canonicalJson(source.arguments)))) !== source.argumentsDigest) throw new ShareEnvelopeError("invalid-envelope", "published SQL argument digest is invalid");
   } else throw new ShareEnvelopeError("invalid-envelope", "policy content source kind is invalid");
-  if (typeof policy.contentSourceDigest !== "string" || bytesToBase64Url((0, import_sha256.sha256)(new TextEncoder().encode(canonicalJson(source)))) !== policy.contentSourceDigest) throw new ShareEnvelopeError("invalid-envelope", "policy content source digest is invalid");
+  if (typeof policy.contentSourceDigest !== "string" || bytesToBase64Url((0, import_sha2562.sha256)(new TextEncoder().encode(canonicalJson(source)))) !== policy.contentSourceDigest) throw new ShareEnvelopeError("invalid-envelope", "policy content source digest is invalid");
   return { recipientKind, actions, resource };
 }
 function parseCanonicalPublishedV2(value, options2) {
@@ -7378,7 +8004,7 @@ function parseCanonicalPublishedV2(value, options2) {
   const signingBytes = new Uint8Array(domain.length + body.length);
   signingBytes.set(domain);
   signingBytes.set(body, domain.length);
-  if (signatureBytes.length !== 64 || !import_ed255192.ed25519.verify(signatureBytes, signingBytes, signerKey)) throw new ShareEnvelopeError("signature-invalid", "published v2 envelope signature is invalid");
+  if (signatureBytes.length !== 64 || !import_ed255193.ed25519.verify(signatureBytes, signingBytes, signerKey)) throw new ShareEnvelopeError("signature-invalid", "published v2 envelope signature is invalid");
   const content = options2.plaintext ?? new Uint8Array();
   const normalized = {
     schema: ENVELOPE_SCHEMA,
@@ -7388,7 +8014,7 @@ function parseCanonicalPublishedV2(value, options2) {
     recipientKind: normalizedMatcher.kind,
     resource,
     actions,
-    content: { mimeType: typeof contentSource.mimeType === "string" ? contentSource.mimeType : "application/octet-stream", size: content.byteLength, digest: bytesToBase64Url((0, import_sha256.sha256)(content)) },
+    content: { mimeType: typeof contentSource.mimeType === "string" ? contentSource.mimeType : "application/octet-stream", size: content.byteLength, digest: bytesToBase64Url((0, import_sha2562.sha256)(content)) },
     encrypted: true,
     expiresAt: value.expiry,
     signer: { did: signature.signerDid, publicKey: bytesToBase64Url(signerKey) },
@@ -7487,7 +8113,7 @@ function parsePublishedShareEnvelope(bytes2, options2 = {}) {
   if (envelope.authorizationTarget.kind !== "bearerKey" && (options2.trustedSignerDids === void 0 || !options2.trustedSignerDids.includes(envelope.signature.signerDid))) throw new ShareEnvelopeError("signature-invalid", "a trusted authority is required for addressed shares");
   const signature = base64UrlToBytes(envelope.signature.value);
   const publicKey = publishedPublicKey(envelope.signature.signerDid);
-  if (signature.length !== 64 || !import_ed255192.ed25519.verify(signature, publishedEnvelopeSigningBytes(envelope), publicKey)) throw new ShareEnvelopeError("signature-invalid", "published envelope signature is invalid");
+  if (signature.length !== 64 || !import_ed255193.ed25519.verify(signature, publishedEnvelopeSigningBytes(envelope), publicKey)) throw new ShareEnvelopeError("signature-invalid", "published envelope signature is invalid");
   return { envelope, artifact: publishedArtifact(envelope, options2.plaintext ?? new Uint8Array(), policy) };
 }
 function parseLegacyPublishedShareEnvelope(bytes2, options2 = {}) {
@@ -7526,7 +8152,7 @@ function parseLegacyPublishedShareEnvelope(bytes2, options2 = {}) {
   const signingBytes = new Uint8Array(domain.length + body.length);
   signingBytes.set(domain);
   signingBytes.set(body, domain.length);
-  if (signatureBytes.length !== 64 || !import_ed255192.ed25519.verify(signatureBytes, signingBytes, signerKey)) throw new ShareEnvelopeError("signature-invalid", "published v1 envelope signature is invalid");
+  if (signatureBytes.length !== 64 || !import_ed255193.ed25519.verify(signatureBytes, signingBytes, signerKey)) throw new ShareEnvelopeError("signature-invalid", "published v1 envelope signature is invalid");
   const content = options2.plaintext ?? new Uint8Array();
   const artifact = {
     envelope: {
@@ -7537,7 +8163,7 @@ function parseLegacyPublishedShareEnvelope(bytes2, options2 = {}) {
       resource: { kind: resource.kind, path: resource.path },
       recipientKind: authorizationTarget.kind === "bearer" ? "bearer" : authorizationTarget.kind === "exact-email" ? "exactEmail" : authorizationTarget.kind === "email-domain" ? "emailDomain" : void 0,
       actions: ["read"],
-      content: { mimeType: "application/octet-stream", size: content.byteLength, digest: bytesToBase64Url((0, import_sha256.sha256)(content)) },
+      content: { mimeType: "application/octet-stream", size: content.byteLength, digest: bytesToBase64Url((0, import_sha2562.sha256)(content)) },
       encrypted: true,
       expiresAt: envelope.expiry,
       signer: { did: signature.signerDid, publicKey: bytesToBase64Url(signerKey) },
@@ -7724,15 +8350,15 @@ function shareCapabilityAllows(capability, action, path) {
 }
 
 // src/delegations/ShareCache.ts
-var import_sha2562 = require("@noble/hashes/sha256");
+var import_sha2563 = require("@noble/hashes/sha256");
 function cacheKey(key) {
   if (!key.cid || !key.expiresAt) throw new Error("share cache keys require CID and expiry");
   return `${key.cid}\0${key.expiresAt}`;
 }
 function digest2(bytes2) {
-  return (0, import_sha2562.sha256)(bytes2);
+  return (0, import_sha2563.sha256)(bytes2);
 }
-function equalBytes(left, right) {
+function equalBytes2(left, right) {
   if (left.byteLength !== right.byteLength) return false;
   return left.every((byte, index) => byte === right[index]);
 }
@@ -7745,7 +8371,7 @@ var MemoryShareCache = class {
     const mapKey = cacheKey(key);
     const entry = this.entries.get(mapKey);
     if (entry === void 0) return void 0;
-    if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest2(entry.bytes))) {
+    if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes2(entry.digest, digest2(entry.bytes))) {
       this.entries.delete(mapKey);
       return void 0;
     }
@@ -7754,7 +8380,7 @@ var MemoryShareCache = class {
   async getByCid(cid2, now = /* @__PURE__ */ new Date()) {
     const entries = [...this.entries.values()].filter((entry) => entry.key.cid === cid2);
     for (const entry of entries) {
-      if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes(entry.digest, digest2(entry.bytes))) {
+      if (Date.parse(entry.key.expiresAt) <= now.getTime() || !equalBytes2(entry.digest, digest2(entry.bytes))) {
         this.entries.delete(cacheKey(entry.key));
         continue;
       }
@@ -7804,138 +8430,234 @@ var ShareAccessError = class extends Error {
 };
 
 // src/delegations/recipient-types.schema.ts
-var import_zod5 = require("zod");
-var ShareRecipientTargetSchema = import_zod5.z.discriminatedUnion("kind", [
-  import_zod5.z.object({ kind: import_zod5.z.literal("exactEmail"), value: import_zod5.z.string().min(1) }).strict(),
-  import_zod5.z.object({ kind: import_zod5.z.literal("emailDomain"), value: import_zod5.z.string().min(1) }).strict(),
-  import_zod5.z.object({ kind: import_zod5.z.literal("recipientDid"), value: import_zod5.z.string().regex(/^did:[a-z0-9]+:.+$/) }).strict(),
-  import_zod5.z.object({ kind: import_zod5.z.literal("bearer") }).strict()
+var import_zod6 = require("zod");
+var ShareRecipientTargetSchema = import_zod6.z.discriminatedUnion("kind", [
+  import_zod6.z.object({ kind: import_zod6.z.literal("exactEmail"), value: import_zod6.z.string().min(1) }).strict(),
+  import_zod6.z.object({ kind: import_zod6.z.literal("emailDomain"), value: import_zod6.z.string().min(1) }).strict(),
+  import_zod6.z.object({ kind: import_zod6.z.literal("recipientDid"), value: import_zod6.z.string().regex(/^did:[a-z0-9]+:.+$/) }).strict(),
+  import_zod6.z.object({ kind: import_zod6.z.literal("bearer") }).strict()
 ]);
-var ShareResourceSchema = import_zod5.z.discriminatedUnion("kind", [
-  import_zod5.z.object({ kind: import_zod5.z.literal("exact"), path: import_zod5.z.string().min(1) }).strict(),
-  import_zod5.z.object({ kind: import_zod5.z.literal("prefix"), path: import_zod5.z.string().min(1) }).strict()
+var ShareResourceSchema = import_zod6.z.discriminatedUnion("kind", [
+  import_zod6.z.object({ kind: import_zod6.z.literal("exact"), path: import_zod6.z.string().min(1) }).strict(),
+  import_zod6.z.object({ kind: import_zod6.z.literal("prefix"), path: import_zod6.z.string().min(1) }).strict()
 ]);
-var ShareActionSchema = import_zod5.z.enum(["read", "list", "edit"]);
-var ShareRecipientPolicySchema = import_zod5.z.object({
+var ShareActionSchema = import_zod6.z.enum(["read", "list", "edit"]);
+var ShareRecipientPolicySchema = import_zod6.z.object({
   recipientMatcher: ShareRecipientTargetSchema,
-  spaceId: import_zod5.z.string().min(1),
+  spaceId: import_zod6.z.string().min(1),
   resource: ShareResourceSchema,
-  actions: import_zod5.z.array(ShareActionSchema).min(1),
-  expiresAt: import_zod5.z.date()
+  actions: import_zod6.z.array(ShareActionSchema).min(1),
+  expiresAt: import_zod6.z.date()
 }).strict();
-var ShareRecipientClientOptionsSchema = import_zod5.z.object({
-  trustedOrigins: import_zod5.z.array(import_zod5.z.string().url()).min(1),
-  maxInlineBytes: import_zod5.z.number().int().positive().optional(),
-  maxArtifactBytes: import_zod5.z.number().int().positive().optional(),
-  maxContentBytes: import_zod5.z.number().int().positive().optional(),
-  maxSealedContentBytes: import_zod5.z.number().int().positive().optional()
+var ShareRecipientClientOptionsSchema = import_zod6.z.object({
+  trustedOrigins: import_zod6.z.array(import_zod6.z.string().url()).min(1),
+  maxInlineBytes: import_zod6.z.number().int().positive().optional(),
+  maxArtifactBytes: import_zod6.z.number().int().positive().optional(),
+  maxContentBytes: import_zod6.z.number().int().positive().optional(),
+  maxSealedContentBytes: import_zod6.z.number().int().positive().optional()
 }).strict();
-var ShareNativeActionSchema = import_zod5.z.enum(["tinycloud.kv/get", "tinycloud.kv/metadata", "tinycloud.kv/list", "tinycloud.kv/put"]);
-var ShareWireActionSchema = import_zod5.z.enum(["tinycloud.kv/get", "tinycloud.kv/metadata", "tinycloud.kv/list", "tinycloud.kv/put", "tinycloud.sql/read"]);
-var ShareContentSourceSchema = import_zod5.z.discriminatedUnion("kind", [
-  import_zod5.z.object({
-    kind: import_zod5.z.literal("kv"),
+var ShareNativeActionSchema = import_zod6.z.enum(["tinycloud.kv/get", "tinycloud.kv/metadata", "tinycloud.kv/list", "tinycloud.kv/put"]);
+var ShareWireActionSchema = import_zod6.z.enum(["tinycloud.kv/get", "tinycloud.kv/metadata", "tinycloud.kv/list", "tinycloud.kv/put", "tinycloud.sql/read"]);
+var ShareContentSourceSchema = import_zod6.z.discriminatedUnion("kind", [
+  import_zod6.z.object({
+    kind: import_zod6.z.literal("kv"),
     action: ShareNativeActionSchema,
-    space: import_zod5.z.string().min(1),
-    path: import_zod5.z.string().min(1)
+    space: import_zod6.z.string().min(1),
+    path: import_zod6.z.string().min(1)
   }).strict(),
-  import_zod5.z.object({
-    kind: import_zod5.z.literal("sql"),
-    action: import_zod5.z.literal("tinycloud.sql/read"),
-    space: import_zod5.z.string().min(1),
-    database: import_zod5.z.string().min(1),
-    path: import_zod5.z.string().min(1),
-    statement: import_zod5.z.string().min(1),
-    arguments: import_zod5.z.record(import_zod5.z.number().int().safe()),
-    argumentsDigest: import_zod5.z.string().min(1)
+  import_zod6.z.object({
+    kind: import_zod6.z.literal("sql"),
+    action: import_zod6.z.literal("tinycloud.sql/read"),
+    space: import_zod6.z.string().min(1),
+    database: import_zod6.z.string().min(1),
+    path: import_zod6.z.string().min(1),
+    statement: import_zod6.z.string().min(1),
+    arguments: import_zod6.z.record(import_zod6.z.number().int().safe()),
+    argumentsDigest: import_zod6.z.string().min(1)
   }).strict()
 ]);
-var ShareAddressedRecipientSchema = import_zod5.z.discriminatedUnion("kind", [
-  import_zod5.z.object({ kind: import_zod5.z.literal("exactEmail"), value: import_zod5.z.string().min(1) }).strict(),
-  import_zod5.z.object({ kind: import_zod5.z.literal("emailDomain"), value: import_zod5.z.string().min(1) }).strict(),
-  import_zod5.z.object({ kind: import_zod5.z.literal("recipientDid"), value: import_zod5.z.string().regex(/^did:[a-z0-9]+:.+$/) }).strict()
+var ShareAddressedRecipientSchema = import_zod6.z.discriminatedUnion("kind", [
+  import_zod6.z.object({ kind: import_zod6.z.literal("exactEmail"), value: import_zod6.z.string().min(1) }).strict(),
+  import_zod6.z.object({ kind: import_zod6.z.literal("emailDomain"), value: import_zod6.z.string().min(1) }).strict(),
+  import_zod6.z.object({ kind: import_zod6.z.literal("recipientDid"), value: import_zod6.z.string().regex(/^did:[a-z0-9]+:.+$/) }).strict()
 ]);
-var ShareAddressedDelegationRequestV2Schema = import_zod5.z.object({
-  version: import_zod5.z.literal(2),
-  nonce: import_zod5.z.string().min(1),
-  jti: import_zod5.z.string().min(1),
-  senderDid: import_zod5.z.string().min(1),
+var ShareAddressedDelegationRequestV2Schema = import_zod6.z.object({
+  version: import_zod6.z.literal(2),
+  nonce: import_zod6.z.string().min(1),
+  jti: import_zod6.z.string().min(1),
+  senderDid: import_zod6.z.string().min(1),
   recipientMatcher: ShareAddressedRecipientSchema,
-  targetOrigin: import_zod5.z.string().url(),
-  nodeAudience: import_zod5.z.string().min(1),
-  shareCid: import_zod5.z.string().min(1),
-  shareId: import_zod5.z.string().min(1),
-  delegationCid: import_zod5.z.string().min(1),
-  authorityMaterialHandle: import_zod5.z.string().min(1),
-  authorityMaterialDigest: import_zod5.z.string().min(1),
+  targetOrigin: import_zod6.z.string().url(),
+  nodeAudience: import_zod6.z.string().min(1),
+  shareCid: import_zod6.z.string().min(1),
+  shareId: import_zod6.z.string().min(1),
+  delegationCid: import_zod6.z.string().min(1),
+  authorityMaterialHandle: import_zod6.z.string().min(1),
+  authorityMaterialDigest: import_zod6.z.string().min(1),
   contentSource: ShareContentSourceSchema,
-  contentSourceDigest: import_zod5.z.string().min(1),
-  actions: import_zod5.z.array(ShareWireActionSchema).min(1).refine((actions) => new Set(actions).size === actions.length),
-  resource: import_zod5.z.object({ kind: import_zod5.z.enum(["exact", "prefix"]), value: import_zod5.z.string().min(1) }).strict(),
-  expiresAt: import_zod5.z.string().datetime({ offset: true }),
-  requestBodyDigest: import_zod5.z.string().min(1)
+  contentSourceDigest: import_zod6.z.string().min(1),
+  actions: import_zod6.z.array(ShareWireActionSchema).min(1).refine((actions) => new Set(actions).size === actions.length),
+  resource: import_zod6.z.object({ kind: import_zod6.z.enum(["exact", "prefix"]), value: import_zod6.z.string().min(1) }).strict(),
+  expiresAt: import_zod6.z.string().datetime({ offset: true }),
+  requestBodyDigest: import_zod6.z.string().min(1)
 }).strict();
-var ShareAddressedDelegationEnvelopeV2Schema = import_zod5.z.object({
+var ShareAddressedDelegationEnvelopeV2Schema = import_zod6.z.object({
   request: ShareAddressedDelegationRequestV2Schema,
-  proof: import_zod5.z.object({ alg: import_zod5.z.literal("EdDSA"), kid: import_zod5.z.string().min(1), signature: import_zod5.z.string().min(1) }).strict()
+  proof: import_zod6.z.object({ alg: import_zod6.z.literal("EdDSA"), kid: import_zod6.z.string().min(1), signature: import_zod6.z.string().min(1) }).strict()
 }).strict();
-var ShareAddressedDelegationResponseV2Schema = import_zod5.z.object({
-  type: import_zod5.z.literal("TinyCloudShareAddressedDelegation"),
-  version: import_zod5.z.literal(2),
-  nonce: import_zod5.z.string().min(1),
-  jti: import_zod5.z.string().min(1),
-  policyCid: import_zod5.z.string().min(1),
-  policyBytes: import_zod5.z.string().min(1),
-  policyDigest: import_zod5.z.string().min(1),
-  delegationCid: import_zod5.z.string().min(1),
-  delegationBytes: import_zod5.z.string().min(1),
-  delegationDigest: import_zod5.z.string().min(1),
-  authorityMaterialHandle: import_zod5.z.string().min(1),
-  authorityMaterialDigest: import_zod5.z.string().min(1),
-  actions: import_zod5.z.array(ShareWireActionSchema).min(1).refine((actions) => new Set(actions).size === actions.length),
-  resource: import_zod5.z.object({ kind: import_zod5.z.enum(["exact", "prefix"]), value: import_zod5.z.string().min(1) }).strict(),
-  expiresAt: import_zod5.z.string().datetime({ offset: true }),
-  proof: import_zod5.z.object({ alg: import_zod5.z.literal("EdDSA"), kid: import_zod5.z.string().min(1), signature: import_zod5.z.string().min(1) }).strict()
+var ShareAddressedDelegationResponseV2Schema = import_zod6.z.object({
+  type: import_zod6.z.literal("TinyCloudShareAddressedDelegation"),
+  version: import_zod6.z.literal(2),
+  nonce: import_zod6.z.string().min(1),
+  jti: import_zod6.z.string().min(1),
+  policyCid: import_zod6.z.string().min(1),
+  policyBytes: import_zod6.z.string().min(1),
+  policyDigest: import_zod6.z.string().min(1),
+  delegationCid: import_zod6.z.string().min(1),
+  delegationBytes: import_zod6.z.string().min(1),
+  delegationDigest: import_zod6.z.string().min(1),
+  authorityMaterialHandle: import_zod6.z.string().min(1),
+  authorityMaterialDigest: import_zod6.z.string().min(1),
+  actions: import_zod6.z.array(ShareWireActionSchema).min(1).refine((actions) => new Set(actions).size === actions.length),
+  resource: import_zod6.z.object({ kind: import_zod6.z.enum(["exact", "prefix"]), value: import_zod6.z.string().min(1) }).strict(),
+  expiresAt: import_zod6.z.string().datetime({ offset: true }),
+  proof: import_zod6.z.object({ alg: import_zod6.z.literal("EdDSA"), kid: import_zod6.z.string().min(1), signature: import_zod6.z.string().min(1) }).strict()
 }).strict();
-var ShareNativeResponseEntrySchema = import_zod5.z.object({
-  path: import_zod5.z.string().min(1),
-  kind: import_zod5.z.enum(["file", "folder"])
+var ShareNativeResponseEntrySchema = import_zod6.z.object({
+  path: import_zod6.z.string().min(1),
+  kind: import_zod6.z.enum(["file", "folder"])
 }).strict();
 var ShareNativeResponseBase = {
-  type: import_zod5.z.literal("TinyCloudShareInvokeResponse"),
-  version: import_zod5.z.literal(2),
-  resource: import_zod5.z.string().min(1)
+  type: import_zod6.z.literal("TinyCloudShareInvokeResponse"),
+  version: import_zod6.z.literal(2),
+  resource: import_zod6.z.string().min(1)
 };
-var ShareNativeResponseSchema = import_zod5.z.discriminatedUnion("action", [
-  import_zod5.z.object({
+var ShareNativeResponseSchema = import_zod6.z.discriminatedUnion("action", [
+  import_zod6.z.object({
     ...ShareNativeResponseBase,
-    action: import_zod5.z.literal("tinycloud.kv/metadata"),
-    metadata: import_zod5.z.record(import_zod5.z.string()),
-    etag: import_zod5.z.string().min(1).nullable()
+    action: import_zod6.z.literal("tinycloud.kv/metadata"),
+    metadata: import_zod6.z.record(import_zod6.z.string()),
+    etag: import_zod6.z.string().min(1).nullable()
   }).strict(),
-  import_zod5.z.object({
+  import_zod6.z.object({
     ...ShareNativeResponseBase,
-    action: import_zod5.z.literal("tinycloud.kv/get"),
-    mediaType: import_zod5.z.string().min(1),
-    content: import_zod5.z.string(),
-    bodyDigest: import_zod5.z.string().min(1),
-    etag: import_zod5.z.string().min(1).nullable()
+    action: import_zod6.z.literal("tinycloud.kv/get"),
+    mediaType: import_zod6.z.string().min(1),
+    content: import_zod6.z.string(),
+    bodyDigest: import_zod6.z.string().min(1),
+    etag: import_zod6.z.string().min(1).nullable()
   }).strict(),
-  import_zod5.z.object({
+  import_zod6.z.object({
     ...ShareNativeResponseBase,
-    action: import_zod5.z.literal("tinycloud.kv/list"),
-    entries: import_zod5.z.array(ShareNativeResponseEntrySchema),
-    nextCursor: import_zod5.z.string().min(1).nullable()
+    action: import_zod6.z.literal("tinycloud.kv/list"),
+    entries: import_zod6.z.array(ShareNativeResponseEntrySchema),
+    nextCursor: import_zod6.z.string().min(1).nullable()
   }).strict(),
-  import_zod5.z.object({
+  import_zod6.z.object({
     ...ShareNativeResponseBase,
-    action: import_zod5.z.literal("tinycloud.kv/put"),
-    etag: import_zod5.z.string().min(1),
-    bodyDigest: import_zod5.z.string().min(1),
-    contentType: import_zod5.z.string().min(1)
+    action: import_zod6.z.literal("tinycloud.kv/put"),
+    etag: import_zod6.z.string().min(1),
+    bodyDigest: import_zod6.z.string().min(1),
+    contentType: import_zod6.z.string().min(1)
   }).strict()
 ]);
 
+// src/delegations/portable.ts
+var import_zod7 = require("zod");
+var ResourceSchema = import_zod7.z.object({
+  service: import_zod7.z.string().min(1),
+  space: import_zod7.z.string().min(1),
+  path: import_zod7.z.string(),
+  actions: import_zod7.z.array(import_zod7.z.string().min(1)).min(1),
+  caveats: import_zod7.z.array(import_zod7.z.record(import_zod7.z.unknown())).optional()
+}).strict();
+var PortableDelegationSchema = import_zod7.z.object({
+  cid: import_zod7.z.string().min(1),
+  delegationHeader: import_zod7.z.object({ Authorization: import_zod7.z.string().min(1) }).strict(),
+  ownerAddress: import_zod7.z.string().min(1),
+  chainId: import_zod7.z.number().int().nonnegative(),
+  host: import_zod7.z.string().url().optional(),
+  spaceId: import_zod7.z.string().min(1),
+  path: import_zod7.z.string(),
+  actions: import_zod7.z.array(import_zod7.z.string().min(1)).min(1),
+  caveats: import_zod7.z.array(import_zod7.z.record(import_zod7.z.unknown())).optional(),
+  expiry: import_zod7.z.coerce.date(),
+  delegateDID: import_zod7.z.string().min(1),
+  delegatorDID: import_zod7.z.string().min(1).optional(),
+  parentCid: import_zod7.z.string().min(1).optional(),
+  disableSubDelegation: import_zod7.z.boolean().optional(),
+  resources: import_zod7.z.array(ResourceSchema).min(1).optional()
+}).strict();
+function parsePortableDelegation(input) {
+  const parsed = PortableDelegationSchema.parse(input);
+  if (parsed.resources !== void 0 && parsed.resources.length === 0)
+    throw new Error("portable delegation resources must not be empty");
+  return parsed;
+}
+function serializePortableDelegation(delegation) {
+  return JSON.stringify({
+    ...delegation,
+    expiry: delegation.expiry.toISOString()
+  });
+}
+async function importPortableDelegation(fetchFn, host, delegation) {
+  const parsed = parsePortableDelegation(delegation);
+  const response = await fetchFn(`${host.replace(/\/+$/, "")}/delegate`, {
+    method: "POST",
+    headers: { Authorization: parsed.delegationHeader.Authorization }
+  });
+  if (!response.ok)
+    throw new Error(`node rejected delegation import (${response.status})`);
+  const body = await response.json().catch(() => ({}));
+  if (body === null || typeof body !== "object" || Array.isArray(body))
+    return {};
+  return body;
+}
+async function delegatePortablePolicySession(input) {
+  const parent = parsePortableDelegation(input.parent);
+  const descendant = createCompactPolicyDescendant({
+    parentAuthorization: parent.delegationHeader.Authorization.replace(/^Bearer\s+/i, ""),
+    parentCid: parent.cid,
+    issuerDid: parent.delegateDID,
+    audienceDid: input.delegateDID,
+    attenuation: input.attenuation,
+    privateKey: input.issuerPrivateKey,
+    ...input.now === void 0 ? {} : { now: input.now },
+    ...input.expiresAt === void 0 ? {} : { expiresAt: input.expiresAt },
+    ...input.nonce === void 0 ? {} : { nonce: input.nonce }
+  });
+  const resources = Object.entries(descendant.payload.att).map(([resource, abilities]) => {
+    const actions = Object.keys(abilities);
+    if (resource.startsWith("urn:tinycloud:encryption:")) {
+      return { service: "encryption", space: "encryption", path: resource, actions };
+    }
+    const match = /^tinycloud:\/\/([^/]+)\/kv\/(.+)$/.exec(resource);
+    if (match === null) throw new Error("policy descendant resource is invalid");
+    const caveats = Object.values(abilities).flat().filter((value) => value !== null && typeof value === "object" && !Array.isArray(value));
+    return { service: "kv", space: match[1], path: match[2], actions, ...caveats.length === 0 ? {} : { caveats } };
+  });
+  const primary = resources.find((resource) => resource.service === "kv") ?? resources[0];
+  if (primary === void 0) throw new Error("policy descendant attenuation is empty");
+  const portable = {
+    cid: descendant.cid,
+    delegationHeader: { Authorization: descendant.authorization },
+    ownerAddress: parent.ownerAddress,
+    chainId: parent.chainId,
+    host: input.host,
+    spaceId: primary.space,
+    path: primary.path,
+    actions: primary.actions,
+    expiry: new Date(descendant.payload.exp * 1e3),
+    delegateDID: input.delegateDID,
+    delegatorDID: parent.delegateDID,
+    parentCid: parent.cid,
+    disableSubDelegation: descendant.payload.fct[0]?.remainingRedelegationDepth === 0,
+    resources
+  };
+  await importPortableDelegation(input.fetch, input.host, portable);
+  return portable;
+}
+
 // src/delegations/ShareRecipientClient.ts
 var DEFAULT_MAX_ARTIFACT_BYTES2 = MAX_SHARE_ARTIFACT_BYTES;
 var DEFAULT_MAX_CONTENT_BYTES = MAX_SHARE_CONTENT_BYTES;
@@ -7986,8 +8708,8 @@ function canonicalJsonForProof(value) {
   }
   if (Array.isArray(value)) return `[${value.map(canonicalJsonForProof).join(",")}]`;
   if (typeof value === "object") {
-    const object = value;
-    return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonForProof(object[key])}`).join(",")}}`;
+    const object2 = value;
+    return `{${Object.keys(object2).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonForProof(object2[key])}`).join(",")}}`;
   }
   throw new ShareAccessError("SHARE_SESSION_INVALID");
 }
@@ -8011,7 +8733,7 @@ function randomJti() {
   return bytesToBase64Url2(bytes2);
 }
 function digestCanonical(value) {
-  return bytesToBase64Url2((0, import_sha2563.sha256)(new TextEncoder().encode(canonicalJsonForProof(value))));
+  return bytesToBase64Url2((0, import_sha2564.sha256)(new TextEncoder().encode(canonicalJsonForProof(value))));
 }
 function actionWire(action) {
   return action === "get" ? "tinycloud.kv/get" : action === "metadata" ? "tinycloud.kv/metadata" : action === "list" ? "tinycloud.kv/list" : "tinycloud.kv/put";
@@ -8123,9 +8845,31 @@ var ShareRecipientClient = class {
       if (policy && this.options.bearerSession !== void 0) throw new ShareAccessError("SHARE_POLICY_BEARER_MISMATCH");
       if (bearer && this.options.presentation !== void 0) throw new ShareAccessError("SHARE_BEARER_PRESENTATION_MISMATCH");
       const session = bearer || legacyBearer ? this.options.bearerSession : recipientDidSession ? recipientDidSession : policy && this.options.establishPolicySession !== void 0 ? await this.options.establishPolicySession({ envelope, presentation: this.options.presentation }) : policy ? await this.establishPolicySession(envelope) : void 0;
-      const kv = bearer || legacyBearer ? session === void 0 ? void 0 : this.createKV(envelope.origin, session) : void 0;
       const policySession = policy ? session : void 0;
       if (policySession !== void 0) this.assertProvidedPolicySession(policySession, envelope);
+      const portableDelegation = policySession === void 0 ? void 0 : this.policySessionDelegation(policySession, envelope.origin);
+      const portableInvoke = portableDelegation === void 0 ? void 0 : this.policyInvocationSigner(portableDelegation);
+      if (portableDelegation !== void 0) {
+        if (this.options.importDelegation === void 0) {
+          await importPortableDelegation(this.fetchFn, envelope.origin, portableDelegation);
+        } else {
+          const imported = await this.options.importDelegation(portableDelegation);
+          if (imported !== void 0) {
+            const normalized = parsePortableDelegation(imported);
+            if (normalized.delegationHeader.Authorization !== portableDelegation.delegationHeader.Authorization) {
+              throw new ShareAccessError("SHARE_SESSION_INVALID", "delegation importer changed authorization bytes");
+            }
+          }
+        }
+      }
+      const ordinarySession = portableDelegation === void 0 ? void 0 : {
+        delegationHeader: portableDelegation.delegationHeader,
+        delegationCid: portableDelegation.cid,
+        spaceId: this.policySessionProjection(portableDelegation).spaceId,
+        verificationMethod: portableDelegation.delegateDID,
+        jwk: this.options.bearerSession?.jwk ?? {}
+      };
+      const kv = bearer || legacyBearer || ordinarySession !== void 0 ? session === void 0 && ordinarySession === void 0 ? void 0 : this.createKV(envelope.origin, ordinarySession ?? session, portableInvoke) : void 0;
       const advertisedCapability = { spaceId: envelope.spaceId, resource: envelope.resource, actions: envelope.actions };
       const capability = policySession?.capability === void 0 ? advertisedCapability : intersectShareCapabilities(advertisedCapability, policySession.capability);
       if (capability === void 0) throw new ShareAccessError("SHARE_CAPABILITY_EMPTY");
@@ -8150,6 +8894,11 @@ var ShareRecipientClient = class {
           const scope = normalizePath2(input.path ?? envelope.resource.path);
           this.assertAllowed(capability, "list", scope);
           if (kv === void 0 && policySession === void 0) throw new ShareAccessError("SHARE_SESSION_REQUIRED");
+          if (portableDelegation !== void 0 && kv !== void 0) {
+            const result2 = await kv.list({ path: scope, limit: input.limit, cursor: input.cursor });
+            if (!result2.ok) throw result2.error;
+            return { keys: result2.data.keys, truncated: result2.data.truncated, nextCursor: result2.data.nextCursor };
+          }
           if (policySession !== void 0) return this.nativeList(envelope, policySession, scope, input.limit, input.cursor);
           const result = await kv.list({ path: scope, limit: input.limit, cursor: input.cursor });
           if (!result.ok) throw result.error;
@@ -8163,6 +8912,14 @@ var ShareRecipientClient = class {
           const resolvedPath = normalizePath2(path);
           this.assertAllowed(capability, "save", resolvedPath);
           if (kv === void 0 && policySession === void 0) throw new ShareAccessError("SHARE_SESSION_REQUIRED");
+          if (portableDelegation !== void 0 && kv !== void 0) {
+            const result2 = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
+            if (!result2.ok) {
+              if (result2.error.code === import_sdk_services2.ErrorCodes.KV_PRECONDITION_FAILED || result2.error.code === import_sdk_services2.ErrorCodes.KV_CONFLICT) throw new ShareConflict(resolvedPath, result2.error.meta?.etag);
+              throw result2.error;
+            }
+            return { etag: result2.data.headers.etag };
+          }
           if (policySession !== void 0) return this.nativeSave(envelope, policySession, resolvedPath, bytes2, input);
           const result = await kv.put(resolvedPath, bytes2, { contentType: input.contentType ?? envelope.content.mimeType, ifMatch: input.etag });
           if (!result.ok) {
@@ -8178,22 +8935,79 @@ var ShareRecipientClient = class {
       const metadata = async (path = envelope.resource.kind === "exact" ? envelope.resource.path : "") => {
         const resolvedPath = normalizePath2(path);
         this.assertAllowed(capability, "metadata", resolvedPath);
+        if (portableDelegation !== void 0 && kv !== void 0) {
+          const result2 = await kv.head(resolvedPath);
+          if (!result2.ok) throw result2.error;
+          return { metadata: { "content-type": result2.data.headers.contentType ?? "application/octet-stream", "content-length": String(result2.data.headers.contentLength ?? ""), ...result2.data.headers.lastModified === void 0 ? {} : { "last-modified": result2.data.headers.lastModified } }, etag: result2.data.headers.etag, contentType: result2.data.headers.contentType, size: result2.data.headers.contentLength };
+        }
         if (policySession !== void 0) return this.nativeMetadata(envelope, policySession, resolvedPath);
         if (kv === void 0) throw new ShareAccessError("SHARE_SESSION_REQUIRED");
         const result = await kv.head(resolvedPath);
         if (!result.ok) throw result.error;
         return { metadata: { "content-type": result.data.headers.contentType ?? "application/octet-stream", "content-length": String(result.data.headers.contentLength ?? ""), ...result.data.headers.lastModified === void 0 ? {} : { "last-modified": result.data.headers.lastModified } }, etag: result.data.headers.etag, contentType: result.data.headers.contentType, size: result.data.headers.contentLength };
       };
-      return { kind: "share-v2", envelope, location: { ...location, key: void 0 }, resource: envelope.resource, actions: envelope.actions, expiresAt: new Date(envelope.expiresAt), kv, get, listChildren, save, metadata };
+      return { kind: "share-v2", envelope, location: { ...location, key: void 0 }, resource: envelope.resource, actions: envelope.actions, expiresAt: new Date(envelope.expiresAt), kv, portableDelegation, get, listChildren, save, metadata };
     } catch (error) {
       throw asError(error);
     }
   }
-  createKV(origin, session) {
+  policySessionDelegation(session, origin) {
+    if (session.runtimeDelegation === void 0) return void 0;
+    const delegation = parsePortableDelegation(session.runtimeDelegation);
+    if (delegation.host !== void 0 && delegation.host.replace(/\/+$/, "") !== origin.replace(/\/+$/, "")) throw new ShareAccessError("SHARE_ORIGIN_MISMATCH", "delegation host does not match the trusted share origin");
+    return delegation;
+  }
+  policyInvocationSigner(delegation) {
+    const privateKey = this.options.policySessionPrivateKey;
+    if (privateKey === void 0) throw new ShareAccessError("SHARE_SESSION_SIGNER_REQUIRED");
+    const session = parsePolicySessionUcan(delegation.delegationHeader.Authorization);
+    if (session.cid !== delegation.cid || session.aud !== delegation.delegateDID)
+      throw new ShareAccessError("SHARE_SESSION_INVALID");
+    return (_serviceSession, service, path, action, facts) => {
+      const serviceName = service.replace(/^tinycloud\./, "");
+      const cleanPath = path.replace(/^\//, "").replace(/\/$/, "");
+      const authority = Object.entries(session.att).find(([parentResource, abilities]) => {
+        if (!(action in abilities)) return false;
+        if (serviceName === "encryption") return parentResource.startsWith("urn:tinycloud:encryption:") && parentResource === cleanPath;
+        const match = /^tinycloud:\/\/[^/]+\/kv\/(.+)$/.exec(parentResource);
+        if (match === null) return false;
+        const parentPath = match[1];
+        const caveats = abilities[action] ?? [];
+        const prefix = caveats.some((value) => isRecord(value) && value.kind === "prefix");
+        return cleanPath === parentPath || prefix && cleanPath.startsWith(`${parentPath}/`);
+      });
+      if (authority === void 0) throw new ShareAccessError("SHARE_OUT_OF_SCOPE");
+      const resource = serviceName === "encryption" ? authority[0] : `${authority[0].slice(0, authority[0].indexOf("/kv/") + 4)}${cleanPath}`;
+      const caveat = serviceName === "encryption" ? {} : { type: "xyz.tinycloud.resource/selector", kind: "exact", value: resource };
+      const invocation = createCompactPolicyInvocation({
+        sessionAuthorization: delegation.delegationHeader.Authorization,
+        sessionCid: delegation.cid,
+        recipientDid: delegation.delegateDID,
+        audienceDid: String(session.fact.nodeAudience),
+        resource,
+        action,
+        caveat,
+        ...facts?.length === 1 ? { facts: facts[0] } : {},
+        privateKey,
+        now: Math.floor(this.now().getTime() / 1e3)
+      });
+      return { Authorization: invocation.authorization };
+    };
+  }
+  policySessionProjection(delegation) {
+    const session = parsePolicySessionUcan(delegation.delegationHeader.Authorization);
+    if (session.cid !== delegation.cid || session.aud !== delegation.delegateDID) throw new ShareAccessError("SHARE_SESSION_INVALID");
+    const kvResource = Object.keys(session.att).find((resource) => /^tinycloud:\/\/[^/]+\/kv\/.+$/.test(resource));
+    const match = kvResource === void 0 ? void 0 : /^tinycloud:\/\/([^/]+)\/kv\/(.+)$/.exec(kvResource);
+    if (match === void 0 || match === null) throw new ShareAccessError("SHARE_SESSION_INVALID");
+    return { spaceId: match[1] };
+  }
+  createKV(origin, session, invokeOverride) {
+    const invoke = invokeOverride ?? this.options.invoke ?? nativeInvoke;
     if (this.options.createKVService !== void 0) {
-      return this.options.createKVService({ hosts: [origin], session, invoke: this.options.invoke ?? nativeInvoke, fetch: this.fetchFn });
+      return this.options.createKVService({ hosts: [origin], session, invoke, fetch: this.fetchFn });
     }
-    const context = new import_sdk_services2.ServiceContext({ hosts: [origin], session, invoke: this.options.invoke ?? nativeInvoke, fetch: this.fetchFn });
+    const context = new import_sdk_services2.ServiceContext({ hosts: [origin], session, invoke, fetch: this.fetchFn });
     const service = new import_sdk_services2.KVService({ prefix: "" });
     context.registerService("kv", service);
     service.initialize(context);
@@ -8236,7 +9050,7 @@ var ShareRecipientClient = class {
     if (bytes2.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES)) throw new ShareAccessError("SHARE_TOO_LARGE");
     const contentType = input.contentType ?? envelope.content.mimeType;
     if (contentType !== envelope.content.mimeType && !/^text\/(?:plain|markdown)(?:;|$)/i.test(contentType)) throw new ShareAccessError("SHARE_CONTENT_TYPE_INVALID");
-    const result = await this.invokeNative({ envelope, session, action: "put", resource: path, body: bytes2, bodyDigest: bytesToBase64Url2((0, import_sha2563.sha256)(bytes2)), contentType, ifMatch: input.etag, mediaType: "application/vnd.tinycloud.share+json" });
+    const result = await this.invokeNative({ envelope, session, action: "put", resource: path, body: bytes2, bodyDigest: bytesToBase64Url2((0, import_sha2564.sha256)(bytes2)), contentType, ifMatch: input.etag, mediaType: "application/vnd.tinycloud.share+json" });
     if (result.status === 412 || result.status === 409) throw new ShareConflict(path, result.headers?.etag);
     if (result.status === 401 || result.status === 403) throw new ShareAccessError("SHARE_DENIED");
     if (result.status < 200 || result.status >= 300) throw new ShareAccessError("SHARE_WRITE_FAILED");
@@ -8358,7 +9172,7 @@ var ShareRecipientClient = class {
     };
     const signed = this.options.signNativeInvoke === void 0 ? void 0 : await this.options.signNativeInvoke({ envelope: input.envelope, session: input.session, request: body });
     const transport = this.options.invoke !== void 0 || session.authorization !== void 0 || session.delegationHeader !== void 0 ? this.defaultNativeHeaders(session, input.action, input.resource, body) : void 0;
-    const response = await this.fetchFn(v2 ? `${base3}/share/v2/invoke` : `${base3}/invoke`, {
+    const response = await this.fetchFn(`${base3}/invoke`, {
       method: "POST",
       headers: { ...headersRecord2(transport), ...headersRecord2(signed), "content-type": input.mediaType, accept: input.mediaType },
       body: JSON.stringify(body),
@@ -8482,7 +9296,7 @@ var ShareRecipientClient = class {
     }]);
   }
   digestMatches(value, bytes2) {
-    const digest4 = bytesToBase64Url2((0, import_sha2563.sha256)(bytes2));
+    const digest4 = bytesToBase64Url2((0, import_sha2564.sha256)(bytes2));
     return value === digest4 || value === `sha-256=:${digest4}:`;
   }
   assertNativeRequestBounds(envelope, session, operation, path, limit, cursor) {
@@ -8604,12 +9418,12 @@ var ShareRecipientClient = class {
     this.assertDetachedProof(request.proof);
   }
   parseSessionCapability(value) {
-    const object = this.requireObject(value, "session capability");
-    if (typeof object.spaceId !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability space is invalid");
-    if (!Array.isArray(object.actions) || object.actions.some((action) => !["read", "list", "edit"].includes(action))) throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability actions are invalid");
-    const resource = this.requireObject(object.resource, "session capability resource");
+    const object2 = this.requireObject(value, "session capability");
+    if (typeof object2.spaceId !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability space is invalid");
+    if (!Array.isArray(object2.actions) || object2.actions.some((action) => !["read", "list", "edit"].includes(action))) throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability actions are invalid");
+    const resource = this.requireObject(object2.resource, "session capability resource");
     if (resource.kind !== "exact" && resource.kind !== "prefix" || typeof resource.path !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability resource is invalid");
-    return { spaceId: object.spaceId, actions: [...new Set(object.actions)], resource: { kind: resource.kind, path: resource.path } };
+    return { spaceId: object2.spaceId, actions: [...new Set(object2.actions)], resource: { kind: resource.kind, path: resource.path } };
   }
   assertProvidedPolicySession(session, envelope) {
     const sessionExpiry = dateValue(session.expiresAt);
@@ -8700,7 +9514,7 @@ var ShareRecipientClient = class {
         nodeAudience: binding.nodeAudience,
         ...isV2 ? {
           enforcerDid: challenge.enforcerDid,
-          credentialDigest: typeof presentation.credentialDigest === "string" ? presentation.credentialDigest : bytesToBase64Url2((0, import_sha2563.sha256)(new TextEncoder().encode(credential)))
+          credentialDigest: typeof presentation.credentialDigest === "string" ? presentation.credentialDigest : bytesToBase64Url2((0, import_sha2564.sha256)(new TextEncoder().encode(credential)))
         } : {},
         action,
         ...binding.actions === void 0 ? {} : { actions: [...binding.actions] },
@@ -8766,7 +9580,7 @@ var ShareRecipientClient = class {
     }
     if (isJwsProof && detached.kid !== `${signerDid}#${encoded}` || isEd25519Proof && detached.signerDid !== signerDid || signature.length !== 64) throw new ShareAccessError("SHARE_SESSION_INVALID", "Node proof binding is invalid");
     const bytes2 = new TextEncoder().encode(`${domain}${canonicalJsonForProof(message)}`);
-    if (!import_ed255193.ed25519.verify(signature, bytes2, key)) throw new ShareAccessError("SHARE_SESSION_INVALID", "Node proof signature is invalid");
+    if (!import_ed255194.ed25519.verify(signature, bytes2, key)) throw new ShareAccessError("SHARE_SESSION_INVALID", "Node proof signature is invalid");
   }
   assertChallengeRequestBinding(request, challenge) {
     const source = isRecord(request.body) ? request.body : request;
@@ -9970,7 +10784,7 @@ function shareKeyMatchesDid(key, didUrl) {
     if (!publicKey) return false;
     const jwkBytes = decodeBase64UrlBytes(key.x);
     const privateKey = decodeBase64UrlBytes(key.d);
-    const derivedPublicKey = import_ed255194.ed25519.getPublicKey(privateKey);
+    const derivedPublicKey = import_ed255195.ed25519.getPublicKey(privateKey);
     return privateKey.length === 32 && publicKey.length === jwkBytes.length && publicKey.every((byte, index) => byte === jwkBytes[index]) && derivedPublicKey.length === jwkBytes.length && derivedPublicKey.every((byte, index) => byte === jwkBytes[index]);
   } catch {
     return false;
@@ -10020,8 +10834,8 @@ function verifySignedChild(result, expected, computeCid) {
 }
 
 // src/delegations/owner-policy.ts
-var import_ed255195 = require("@noble/curves/ed25519");
-var import_sha2564 = require("@noble/hashes/sha256");
+var import_ed255196 = require("@noble/curves/ed25519");
+var import_sha2565 = require("@noble/hashes/sha256");
 var MAX_CONTENT_BYTES = 100 * 1024 * 1024;
 var ENFORCEMENT_DOMAIN = "xyz.tinycloud.share/policy-enforcement/v2\0";
 var POLICY_DOMAIN = "xyz.tinycloud.share/policy/v2\0";
@@ -10048,10 +10862,10 @@ function fromB64(value) {
   throw new Error("base64url decoding is unavailable");
 }
 function cid(bytesValue) {
-  return CID.createV1(code, create(sha2562.code, (0, import_sha2564.sha256)(bytesValue))).toString(base32.encoder);
+  return CID.createV1(code, create(sha2562.code, (0, import_sha2565.sha256)(bytesValue))).toString(base32.encoder);
 }
 function digest3(bytesValue) {
-  return b64((0, import_sha2564.sha256)(bytesValue));
+  return b64((0, import_sha2565.sha256)(bytesValue));
 }
 function didKeyFromEd25519PublicKey(publicKey) {
   if (publicKey.length !== 32) throw new Error("share key public key must be 32 bytes");
@@ -10236,7 +11050,7 @@ function validateOwnerSharePolicyRegistration(value, expected) {
   const publicKey = encodedKid.length === 34 ? encodedKid.slice(2) : encodedKid;
   const signatureBytes = fromB64(proof.signature);
   const signedBytes = new TextEncoder().encode(`${OWNER_SHARE_REGISTRATION_DOMAIN}${canonicalizeSignedObjectUnsigned(registrationCore)}`);
-  if (signatureBytes.length !== 64 || !import_ed255195.ed25519.verify(signatureBytes, signedBytes, publicKey)) throw new Error("owner-share registration proof signature is invalid");
+  if (signatureBytes.length !== 64 || !import_ed255196.ed25519.verify(signatureBytes, signedBytes, publicKey)) throw new Error("owner-share registration proof signature is invalid");
   return { registration, proof };
 }
 function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
@@ -10250,7 +11064,7 @@ function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
 }
 
 // src/delegations/share-delivery.ts
-var import_ed255196 = require("@noble/curves/ed25519");
+var import_ed255197 = require("@noble/curves/ed25519");
 var SHARE_DELIVERY_AUTHORIZATION_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v2\0";
 function isCanonicalHttpsOrigin(value) {
   let url;
@@ -10338,7 +11152,7 @@ function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
   if (publicKey.length !== 32) throw new Error("share delivery authorization proof key is invalid");
   const signatureBytes = fromB642(proof.signature);
   const signedBytes = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_DOMAIN}${canonicalizeSignedObjectUnsigned(authorization)}`);
-  if (signatureBytes.length !== 64 || !import_ed255196.ed25519.verify(signatureBytes, signedBytes, publicKey)) throw new Error("share delivery authorization proof signature is invalid");
+  if (signatureBytes.length !== 64 || !import_ed255197.ed25519.verify(signatureBytes, signedBytes, publicKey)) throw new Error("share delivery authorization proof signature is invalid");
   return { authorization, proof };
 }
 function shareDeliveryTrustedKid(publicKey) {
@@ -10474,47 +11288,47 @@ function parseCanonicalNetworkId(networkId) {
 }
 
 // src/storage.schema.ts
-var import_zod6 = require("zod");
+var import_zod8 = require("zod");
 var ethereumAddressPattern = /^0x[a-fA-F0-9]{40}$/;
-var EnsDataSchema2 = import_zod6.z.object({
+var EnsDataSchema2 = import_zod8.z.object({
   /** ENS name/domain. */
-  domain: import_zod6.z.string().nullable().optional(),
+  domain: import_zod8.z.string().nullable().optional(),
   /** ENS avatar URL. */
-  avatarUrl: import_zod6.z.string().nullable().optional()
+  avatarUrl: import_zod8.z.string().nullable().optional()
 });
-var PersistedTinyCloudSessionSchema = import_zod6.z.object({
+var PersistedTinyCloudSessionSchema = import_zod8.z.object({
   /** The delegation header containing the UCAN */
-  delegationHeader: import_zod6.z.object({
-    Authorization: import_zod6.z.string()
+  delegationHeader: import_zod8.z.object({
+    Authorization: import_zod8.z.string()
   }),
   /** The delegation CID */
-  delegationCid: import_zod6.z.string(),
+  delegationCid: import_zod8.z.string(),
   /** The space ID for this session */
-  spaceId: import_zod6.z.string(),
+  spaceId: import_zod8.z.string(),
   /** Additional spaces included in this session's capabilities. Key is logical name, value is full spaceId URI */
-  spaces: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.string()).optional(),
+  spaces: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.string()).optional(),
   /** The verification method DID */
-  verificationMethod: import_zod6.z.string()
+  verificationMethod: import_zod8.z.string()
 });
-var PersistedSessionDataSchema = import_zod6.z.object({
+var PersistedSessionDataSchema = import_zod8.z.object({
   /** User's Ethereum address */
-  address: import_zod6.z.string().regex(ethereumAddressPattern, "Invalid Ethereum address"),
+  address: import_zod8.z.string().regex(ethereumAddressPattern, "Invalid Ethereum address"),
   /** EIP-155 Chain ID */
-  chainId: import_zod6.z.number().int().positive(),
+  chainId: import_zod8.z.number().int().positive(),
   /** Session key in JWK format (stringified) */
-  sessionKey: import_zod6.z.string(),
+  sessionKey: import_zod8.z.string(),
   /** The signed SIWE message */
-  siwe: import_zod6.z.string(),
+  siwe: import_zod8.z.string(),
   /** User's signature of the SIWE message */
-  signature: import_zod6.z.string(),
+  signature: import_zod8.z.string(),
   /** TinyCloud delegation data if available */
   tinycloudSession: PersistedTinyCloudSessionSchema.optional(),
   /** Session expiration timestamp (ISO 8601 with timezone offset) */
-  expiresAt: import_zod6.z.string().datetime({ offset: true }),
+  expiresAt: import_zod8.z.string().datetime({ offset: true }),
   /** Session creation timestamp (ISO 8601 with timezone offset) */
-  createdAt: import_zod6.z.string().datetime({ offset: true }),
+  createdAt: import_zod8.z.string().datetime({ offset: true }),
   /** Schema version for migrations */
-  version: import_zod6.z.string(),
+  version: import_zod8.z.string(),
   /** Optional ENS data */
   ens: EnsDataSchema2.optional(),
   /**
@@ -10524,33 +11338,33 @@ var PersistedSessionDataSchema = import_zod6.z.object({
    * for backward compatibility with sessions persisted before this field
    * existed — those restore and lazily re-resolve their hosts.
    */
-  tinycloudHosts: import_zod6.z.array(import_zod6.z.string()).optional()
+  tinycloudHosts: import_zod8.z.array(import_zod8.z.string()).optional()
 });
-var TinyCloudSessionSchema = import_zod6.z.object({
+var TinyCloudSessionSchema = import_zod8.z.object({
   /** User's Ethereum address */
-  address: import_zod6.z.string().regex(ethereumAddressPattern, "Invalid Ethereum address"),
+  address: import_zod8.z.string().regex(ethereumAddressPattern, "Invalid Ethereum address"),
   /** EIP-155 Chain ID */
-  chainId: import_zod6.z.number().int().positive(),
+  chainId: import_zod8.z.number().int().positive(),
   /** Session key ID */
-  sessionKey: import_zod6.z.string(),
+  sessionKey: import_zod8.z.string(),
   /** The space ID for this session */
-  spaceId: import_zod6.z.string(),
+  spaceId: import_zod8.z.string(),
   /** Additional spaces included in this session's capabilities. Key is logical name, value is full spaceId URI */
-  spaces: import_zod6.z.record(import_zod6.z.string(), import_zod6.z.string()).optional(),
+  spaces: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.string()).optional(),
   /** The delegation CID */
-  delegationCid: import_zod6.z.string(),
+  delegationCid: import_zod8.z.string(),
   /** The delegation header for API calls */
-  delegationHeader: import_zod6.z.object({
-    Authorization: import_zod6.z.string()
+  delegationHeader: import_zod8.z.object({
+    Authorization: import_zod8.z.string()
   }),
   /** The verification method DID */
-  verificationMethod: import_zod6.z.string(),
+  verificationMethod: import_zod8.z.string(),
   /** The session key JWK (required for invoke operations) */
-  jwk: import_zod6.z.object({}).passthrough(),
+  jwk: import_zod8.z.object({}).passthrough(),
   /** The signed SIWE message */
-  siwe: import_zod6.z.string(),
+  siwe: import_zod8.z.string(),
   /** User's signature of the SIWE message */
-  signature: import_zod6.z.string()
+  signature: import_zod8.z.string()
 });
 function validatePersistedSessionData(data) {
   const result = PersistedSessionDataSchema.safeParse(data);
@@ -10653,112 +11467,112 @@ var Space = class {
 };
 
 // src/spaces/spaces.schema.ts
-var import_zod7 = require("zod");
-var SpaceConfigSchema = import_zod7.z.object({
+var import_zod9 = require("zod");
+var SpaceConfigSchema = import_zod9.z.object({
   /** The space identifier (full URI) */
-  id: import_zod7.z.string(),
+  id: import_zod9.z.string(),
   /** The short name of the space */
-  name: import_zod7.z.string(),
+  name: import_zod9.z.string(),
   /** Factory function to create a space-scoped KV service */
-  createKV: import_zod7.z.function(),
+  createKV: import_zod9.z.function(),
   /** Factory function to create a space-scoped Data Vault service */
-  createVault: import_zod7.z.function(),
+  createVault: import_zod9.z.function(),
   /** Optional factory function to create a space-scoped secrets service */
-  createSecrets: import_zod7.z.function().optional(),
+  createSecrets: import_zod9.z.function().optional(),
   /** Factory function to create space-scoped delegations */
-  createDelegations: import_zod7.z.function(),
+  createDelegations: import_zod9.z.function(),
   /** Factory function to create space-scoped sharing */
-  createSharing: import_zod7.z.function(),
+  createSharing: import_zod9.z.function(),
   /** Function to get space info */
-  getInfo: import_zod7.z.function()
+  getInfo: import_zod9.z.function()
 });
-var SpaceServiceConfigSchema = import_zod7.z.object({
+var SpaceServiceConfigSchema = import_zod9.z.object({
   /** TinyCloud host URLs */
-  hosts: import_zod7.z.array(import_zod7.z.string()),
+  hosts: import_zod9.z.array(import_zod9.z.string()),
   /** Active session for authentication */
-  session: import_zod7.z.unknown(),
+  session: import_zod9.z.unknown(),
   /** Platform-specific invoke function */
-  invoke: import_zod7.z.function(),
+  invoke: import_zod9.z.function(),
   /** Optional custom fetch implementation */
-  fetch: import_zod7.z.function().optional(),
+  fetch: import_zod9.z.function().optional(),
   /** Optional capability key registry for delegated space discovery */
-  capabilityRegistry: import_zod7.z.unknown().optional(),
+  capabilityRegistry: import_zod9.z.unknown().optional(),
   /** Factory function to create a space-scoped KV service */
-  createKVService: import_zod7.z.function().optional(),
+  createKVService: import_zod9.z.function().optional(),
   /** Factory function to create a space-scoped Data Vault service */
-  createVaultService: import_zod7.z.function().optional(),
+  createVaultService: import_zod9.z.function().optional(),
   /** Factory function to create a space-scoped secrets service */
-  createSecretsService: import_zod7.z.function().optional(),
+  createSecretsService: import_zod9.z.function().optional(),
   /** User's PKH DID (derived from address or provided explicitly) */
-  userDid: import_zod7.z.string().optional(),
+  userDid: import_zod9.z.string().optional(),
   /** Optional SharingService for v2 sharing links (client-side) */
-  sharingService: import_zod7.z.unknown().optional(),
+  sharingService: import_zod9.z.unknown().optional(),
   /** Factory function to create delegations using SIWE-based flow */
-  createDelegation: import_zod7.z.function().optional()
+  createDelegation: import_zod9.z.function().optional()
 });
 var SpaceDelegationParamsSchema = CreateDelegationParamsSchema.extend({
   /** The space ID to create the delegation for */
-  spaceId: import_zod7.z.string()
+  spaceId: import_zod9.z.string()
 });
-var ServerDelegationInfoSchema = import_zod7.z.object({
+var ServerDelegationInfoSchema = import_zod9.z.object({
   /** DID of the delegator */
-  delegator: import_zod7.z.string(),
+  delegator: import_zod9.z.string(),
   /** DID of the delegate */
-  delegate: import_zod7.z.string(),
+  delegate: import_zod9.z.string(),
   /** Parent delegation CIDs - accepts string or byte array format from server */
-  parents: import_zod7.z.array(import_zod7.z.union([import_zod7.z.string(), import_zod7.z.array(import_zod7.z.number())])),
+  parents: import_zod9.z.array(import_zod9.z.union([import_zod9.z.string(), import_zod9.z.array(import_zod9.z.number())])),
   /** Expiration time (ISO8601 string) */
-  expiry: import_zod7.z.string().optional(),
+  expiry: import_zod9.z.string().optional(),
   /** Not-before time (ISO8601 string) */
-  not_before: import_zod7.z.string().optional(),
+  not_before: import_zod9.z.string().optional(),
   /** Issued-at time (ISO8601 string) */
-  issued_at: import_zod7.z.string().optional(),
+  issued_at: import_zod9.z.string().optional(),
   /** Capabilities granted by this delegation */
-  capabilities: import_zod7.z.array(
-    import_zod7.z.object({
-      resource: import_zod7.z.string(),
-      ability: import_zod7.z.string()
+  capabilities: import_zod9.z.array(
+    import_zod9.z.object({
+      resource: import_zod9.z.string(),
+      ability: import_zod9.z.string()
     })
   )
 });
-var ServerDelegationsResponseSchema = import_zod7.z.record(
-  import_zod7.z.string(),
+var ServerDelegationsResponseSchema = import_zod9.z.record(
+  import_zod9.z.string(),
   ServerDelegationInfoSchema
 );
-var ServerOwnedSpaceSchema = import_zod7.z.object({
+var ServerOwnedSpaceSchema = import_zod9.z.object({
   /** Space identifier */
-  id: import_zod7.z.string(),
+  id: import_zod9.z.string(),
   /** Space name (optional, can be derived from id) */
-  name: import_zod7.z.string().optional(),
+  name: import_zod9.z.string().optional(),
   /** Owner DID */
-  owner: import_zod7.z.string(),
+  owner: import_zod9.z.string(),
   /** Creation timestamp */
-  createdAt: import_zod7.z.string().optional()
+  createdAt: import_zod9.z.string().optional()
 });
-var ServerOwnedSpacesResponseSchema = import_zod7.z.array(ServerOwnedSpaceSchema);
-var ServerCreateSpaceResponseSchema = import_zod7.z.object({
+var ServerOwnedSpacesResponseSchema = import_zod9.z.array(ServerOwnedSpaceSchema);
+var ServerCreateSpaceResponseSchema = import_zod9.z.object({
   /** Space identifier */
-  id: import_zod7.z.string(),
+  id: import_zod9.z.string(),
   /** Space name */
-  name: import_zod7.z.string(),
+  name: import_zod9.z.string(),
   /** Owner DID */
-  owner: import_zod7.z.string(),
+  owner: import_zod9.z.string(),
   /** Creation timestamp */
-  createdAt: import_zod7.z.string().optional()
+  createdAt: import_zod9.z.string().optional()
 });
-var ServerSpaceInfoResponseSchema = import_zod7.z.object({
+var ServerSpaceInfoResponseSchema = import_zod9.z.object({
   /** Space identifier */
-  id: import_zod7.z.string(),
+  id: import_zod9.z.string(),
   /** Space name (optional) */
-  name: import_zod7.z.string().optional(),
+  name: import_zod9.z.string().optional(),
   /** Owner DID */
-  owner: import_zod7.z.string(),
+  owner: import_zod9.z.string(),
   /** Ownership type */
-  type: import_zod7.z.enum(["owned", "delegated"]).optional(),
+  type: import_zod9.z.enum(["owned", "delegated"]).optional(),
   /** Permissions the user has in this space */
-  permissions: import_zod7.z.array(import_zod7.z.string()).optional(),
+  permissions: import_zod9.z.array(import_zod9.z.string()).optional(),
   /** Expiration for delegated access */
-  expiresAt: import_zod7.z.string().optional()
+  expiresAt: import_zod9.z.string().optional()
 });
 function validateServerDelegationsResponse(data) {
   if (data === null || data === void 0) {
@@ -12168,7 +12982,7 @@ var TinyCloud = class _TinyCloud {
 
 // src/account/AccountService.ts
 var import_sdk_services6 = require("@tinycloud/sdk-services");
-var import_bootstrap2 = require("@tinycloud/bootstrap");
+var import_bootstrap3 = require("@tinycloud/bootstrap");
 var SERVICE_NAME2 = "account";
 var ACCOUNT_INDEX_DB = "account";
 var ACCOUNT_INDEX_NAMESPACE = "tinycloud.account.index";
@@ -12959,7 +13773,7 @@ var AccountService = class {
       migrations: [
         {
           id: "001_initial",
-          sql: [...import_bootstrap2.ACCOUNT_INDEX_SCHEMA]
+          sql: [...import_bootstrap3.ACCOUNT_INDEX_SCHEMA]
         }
       ]
     });
@@ -13070,8 +13884,8 @@ function stableJson(value) {
   if (Array.isArray(value)) {
     return `[${value.map(stableJson).join(",")}]`;
   }
-  const object = value;
-  return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableJson(object[key])}`).join(",")}}`;
+  const object2 = value;
+  return `{${Object.keys(object2).sort().map((key) => `${JSON.stringify(key)}:${stableJson(object2[key])}`).join(",")}}`;
 }
 function indexedDelegationFromRow(row) {
   const [
@@ -14088,7 +14902,7 @@ async function checkNodeInfo(host, sdkProtocol, fetchFn = globalThis.fetch.bind(
 }
 
 // src/index.ts
-var import_bootstrap3 = require("@tinycloud/bootstrap");
+var import_bootstrap4 = require("@tinycloud/bootstrap");
 
 // ../../node_modules/uint8arrays/dist/src/equals.js
 function equals3(a, b) {
@@ -15739,7 +16553,7 @@ function portForProtocol(protocol) {
 }
 
 // src/location.ts
-var import_ed255197 = require("@noble/curves/ed25519");
+var import_ed255198 = require("@noble/curves/ed25519");
 var import_viem5 = require("viem");
 var DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL = "https://registry.tinycloud.xyz";
 var DEFAULT_TINYCLOUD_FALLBACK_HOST = "https://node.tinycloud.xyz";
@@ -16305,13 +17119,13 @@ async function verifyPkhSignature(did, payload, signature) {
 }
 function verifyDidKeySignature(did, payload, signature) {
   const publicKey = ed25519PublicKeyFromDidKey2(did);
-  const signatureBytes = decodeBase64Url(signature);
+  const signatureBytes = decodeBase64Url2(signature);
   if (signatureBytes.length !== 64) {
     throw new LocationRecordValidationError(
       "did:key signature must be a base64url Ed25519 signature"
     );
   }
-  return import_ed255197.ed25519.verify(
+  return import_ed255198.ed25519.verify(
     signatureBytes,
     new TextEncoder().encode(payload),
     publicKey
@@ -16319,7 +17133,7 @@ function verifyDidKeySignature(did, payload, signature) {
 }
 function verifyDidKeyEd25519Signature(did, payload, signature) {
   const publicKey = ed25519PublicKeyFromDidKey2(did);
-  return import_ed255197.ed25519.verify(signature, payload, publicKey);
+  return import_ed255198.ed25519.verify(signature, payload, publicKey);
 }
 function ed25519PublicKeyFromDidKey2(did) {
   const identifier = did.slice("did:key:".length);
@@ -16358,7 +17172,7 @@ function base64UrlEncode3(bytes2) {
   }
   return output;
 }
-function decodeBase64Url(value) {
+function decodeBase64Url2(value) {
   const alphabet2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   const bytes2 = [];
   let buffer = 0;