@tinycloud/sdk-core 2.11.0-beta.8 → 2.11.0

package/dist/policy/index.cjs

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __export = (target, all) => {
@@ -18,29 +16,38 @@ var __copyProps = (to, from3, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 
 // src/policy/index.ts
 var policy_exports = {};
 __export(policy_exports, {
+  ATTESTED_ENFORCER_BINDING_V2_SCHEMA: () => ATTESTED_ENFORCER_BINDING_V2_SCHEMA,
+  CONTENT_SOURCE_V1_DOMAIN: () => CONTENT_SOURCE_V1_DOMAIN,
   ED25519_JCS_SIGNATURE_SUITE: () => ED25519_JCS_SIGNATURE_SUITE,
   EIP191_JCS_SIGNATURE_SUITE: () => EIP191_JCS_SIGNATURE_SUITE,
+  LAST_V2_CREATE_AT: () => LAST_V2_CREATE_AT,
+  LAST_V2_READ_AT: () => LAST_V2_READ_AT,
+  MAX_LEGACY_ENVELOPE_EXPIRES_AT: () => MAX_LEGACY_ENVELOPE_EXPIRES_AT,
+  NATIVE_PROJECTION_V1_DOMAIN: () => NATIVE_PROJECTION_V1_DOMAIN,
   OWNER_NODE_ENDPOINT_SCHEMA: () => OWNER_NODE_ENDPOINT_SCHEMA,
+  POLICY_CAPABILITY_V1_DOMAIN: () => POLICY_CAPABILITY_V1_DOMAIN,
+  POLICY_CAPABILITY_V1_SCHEMA: () => POLICY_CAPABILITY_V1_SCHEMA,
+  POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA: () => POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA,
   POLICY_ENGINE_RECORD_SCHEMA: () => POLICY_ENGINE_RECORD_SCHEMA,
   POLICY_SCHEMA: () => POLICY_SCHEMA,
+  POLICY_SESSION_UCAN_V1_PROFILE: () => POLICY_SESSION_UCAN_V1_PROFILE,
   POLICY_STATUS_SCHEMA: () => POLICY_STATUS_SCHEMA,
+  POLICY_V1_DOMAIN: () => POLICY_V1_DOMAIN,
+  POLICY_V1_SCHEMA: () => POLICY_V1_SCHEMA,
   POLICY_VERSION_V0: () => POLICY_VERSION_V0,
   PolicyAuthoringError: () => PolicyAuthoringError,
   PolicyCapabilityError: () => PolicyCapabilityError,
+  ROOT_REVOCATION_V1_DOMAIN: () => ROOT_REVOCATION_V1_DOMAIN,
+  ROOT_REVOCATION_V1_SCHEMA: () => ROOT_REVOCATION_V1_SCHEMA,
+  ROOT_STATUS_CHECKPOINT_V1_SCHEMA: () => ROOT_STATUS_CHECKPOINT_V1_SCHEMA,
+  ROOT_STATUS_RENEWAL_V1_DOMAIN: () => ROOT_STATUS_RENEWAL_V1_DOMAIN,
+  ROOT_STATUS_V1_DOMAIN: () => ROOT_STATUS_V1_DOMAIN,
   SignatureMaterialError: () => SignatureMaterialError,
   SignatureVerificationError: () => SignatureVerificationError,
   SignedObjectCanonicalizationError: () => SignedObjectCanonicalizationError,
@@ -54,23 +61,46 @@ __export(policy_exports, {
   W3C_VC_CREDENTIAL_VERIFIER: () => W3C_VC_CREDENTIAL_VERIFIER,
   canonicalizePolicyCapability: () => canonicalizePolicyCapability,
   canonicalizeSignedObjectUnsigned: () => canonicalizeSignedObjectUnsigned,
+  canonicalizeUnifiedPolicyCapability: () => canonicalizeUnifiedPolicyCapability,
+  compactAttenuationContains: () => compactAttenuationContains,
   composeTranscriptShareBootstrap: () => composeTranscriptShareBootstrap,
+  contentSourceDigestHex: () => contentSourceDigestHex,
   createAndSignPolicy: () => createAndSignPolicy,
   createAndSignPolicyEngineRecord: () => createAndSignPolicyEngineRecord,
   createAndSignPolicyStatus: () => createAndSignPolicyStatus,
   createAndSignRequesterPolicyEngineRecord: () => createAndSignRequesterPolicyEngineRecord,
   createAndSignSignedObject: () => createAndSignSignedObject,
   createAndSignTranscriptSharePolicy: () => createAndSignTranscriptSharePolicy,
+  createCompactPolicyDescendant: () => createCompactPolicyDescendant,
+  createCompactPolicyInvocation: () => createCompactPolicyInvocation,
   createUnsignedPolicyEngineRecord: () => createUnsignedPolicyEngineRecord,
   deriveSignedObjectMaterial: () => deriveSignedObjectMaterial,
+  getPolicyRootStatusV3: () => getPolicyRootStatusV3,
   jcsCanonicalize: () => jcsCanonicalize,
+  mintPolicySessionV3: () => mintPolicySessionV3,
   normalizeJson: () => normalizeJson,
   normalizePolicyCapability: () => normalizePolicyCapability,
+  normalizeUnifiedPolicyCapability: () => normalizeUnifiedPolicyCapability,
+  parseCompactUcanAuthorization: () => parseCompactUcanAuthorization,
+  parsePolicySessionUcan: () => parsePolicySessionUcan,
   policyCapabilityContains: () => policyCapabilityContains,
   policyCapabilityDigestHex: () => policyCapabilityDigestHex,
+  policyCidFromCanonicalBytes: () => policyCidFromCanonicalBytes,
+  policyDigestHex: () => policyDigestHex,
+  policyIdForDigestHex: () => policyIdForDigestHex,
+  projectUnifiedPolicyCapabilities: () => projectUnifiedPolicyCapabilities,
+  projectUnifiedPolicyCapability: () => projectUnifiedPolicyCapability,
+  renewPolicyRootStatusV3: () => renewPolicyRootStatusV3,
+  requestPolicyChallengeV3: () => requestPolicyChallengeV3,
+  revokePolicyRootV3: () => revokePolicyRootV3,
   serializeJcsJson: () => serialize,
+  signCompactUcanAuthorization: () => signCompactUcanAuthorization,
   signedObjectIdFor: () => signedObjectIdFor,
   toSignedObjectError: () => toSignedObjectError,
+  unifiedNativeProjectionHashHex: () => unifiedNativeProjectionHashHex,
+  unifiedPolicyCapabilityContains: () => unifiedPolicyCapabilityContains,
+  unifiedPolicyCapabilityDigestHex: () => unifiedPolicyCapabilityDigestHex,
+  unifiedPolicyCapabilityFromNative: () => unifiedPolicyCapabilityFromNative,
   validatePolicyEngineRecordSigned: () => validatePolicyEngineRecordSigned,
   validatePolicyEngineRecordSignedShape: () => validatePolicyEngineRecordSignedShape,
   validatePolicyEngineRecordUnsigned: () => validatePolicyEngineRecordUnsigned,
@@ -83,6 +113,8 @@ __export(policy_exports, {
   verifyPolicy: () => verifyPolicy,
   verifyPolicyEngineRecord: () => verifyPolicyEngineRecord,
   verifyPolicyEngineRecordForRequester: () => verifyPolicyEngineRecordForRequester,
+  verifyPolicyRootRevocationV3: () => verifyPolicyRootRevocationV3,
+  verifyPolicyRootStatusCheckpointV3: () => verifyPolicyRootStatusCheckpointV3,
   verifyPolicyStatus: () => verifyPolicyStatus,
   verifySignedObject: () => verifySignedObject
 });
@@ -405,16 +437,16 @@ function policyCapabilityContains(authority, request) {
   return caveatsContain(auth.caveats, req.caveats);
 }
 function normalizePolicyCapabilityWithOptions(input, options) {
-  const object = expectObject(input, "$");
-  assertExactKeys(object, ["service", "space", "path", "actions", "caveats"], "$");
-  const service = requiredString(object, "service", "$", "policy-capability-malformed-service");
+  const object2 = expectObject(input, "$");
+  assertExactKeys(object2, ["service", "space", "path", "actions", "caveats"], "$");
+  const service = requiredString(object2, "service", "$", "policy-capability-malformed-service");
   if (!CEILING_SERVICES.has(service)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-service",
       "$.service is outside the frozen permissionsCeiling vocabulary"
     );
   }
-  const space = requiredString(object, "space", "$", "policy-capability-malformed-space");
+  const space = requiredString(object2, "space", "$", "policy-capability-malformed-space");
   validateConcreteSpace(space);
   const canonicalSpace = space.normalize("NFC");
   if (options.requireCanonical && canonicalSpace !== space) {
@@ -423,7 +455,7 @@ function normalizePolicyCapabilityWithOptions(input, options) {
       "$.space must already be canonical NFC"
     );
   }
-  const rawPath = requiredString(object, "path", "$", "policy-capability-malformed-path");
+  const rawPath = requiredString(object2, "path", "$", "policy-capability-malformed-path");
   validateRawPath(rawPath, options);
   const path = normalizePath(rawPath);
   if (options.requireCanonical && path !== rawPath) {
@@ -434,7 +466,7 @@ function normalizePolicyCapabilityWithOptions(input, options) {
   }
   validateRawPath(path, options);
   const actions = normalizeActions(
-    requiredArray(object, "actions", "$", "policy-capability-malformed-action"),
+    requiredArray(object2, "actions", "$", "policy-capability-malformed-action"),
     service,
     options
   );
@@ -443,9 +475,9 @@ function normalizePolicyCapabilityWithOptions(input, options) {
   output.space = canonicalSpace;
   output.path = path;
   output.actions = actions;
-  if (hasOwn(object, "caveats")) {
+  if (hasOwn(object2, "caveats")) {
     output.caveats = validateCaveats(
-      requiredValue(object, "caveats", "$", "policy-capability-malformed-caveats"),
+      requiredValue(object2, "caveats", "$", "policy-capability-malformed-caveats"),
       output.service
     );
   }
@@ -468,9 +500,9 @@ function expectObject(input, path) {
     );
   }
 }
-function assertExactKeys(object, allowed, path) {
+function assertExactKeys(object2, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object)) {
+  for (const key of Object.keys(object2)) {
     if (!allowedSet.has(key)) {
       throw new PolicyCapabilityError(
         key === "id" || key === "scope" ? "policy-capability-malformed" : "policy-capability-unknown-key",
@@ -479,21 +511,21 @@ function assertExactKeys(object, allowed, path) {
     }
   }
 }
-function requiredValue(object, key, path, code2) {
-  if (!hasOwn(object, key)) {
+function requiredValue(object2, key, path, code2) {
+  if (!hasOwn(object2, key)) {
     throw new PolicyCapabilityError(code2, `${path}.${key} is required`);
   }
-  return object[key];
+  return object2[key];
 }
-function requiredString(object, key, path, code2) {
-  const value = requiredValue(object, key, path, code2);
+function requiredString(object2, key, path, code2) {
+  const value = requiredValue(object2, key, path, code2);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyCapabilityError(code2, `${path}.${key} must be a non-empty string`);
   }
   return value;
 }
-function requiredArray(object, key, path, code2) {
-  const value = requiredValue(object, key, path, code2);
+function requiredArray(object2, key, path, code2) {
+  const value = requiredValue(object2, key, path, code2);
   if (!Array.isArray(value)) {
     throw new PolicyCapabilityError(code2, `${path}.${key} must be an array`);
   }
@@ -638,11 +670,11 @@ function validateSqlStatement(input, path) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new PolicyCapabilityError("policy-capability-malformed-caveats", `${path} must be an object`);
   }
-  const object = input;
-  assertCaveatKeys(object, ["name", "sql", "fixedParams"], path);
-  caveatString(object, "name", path);
-  caveatString(object, "sql", path);
-  const fixedParams = requiredCaveat(object, "fixedParams", path);
+  const object2 = input;
+  assertCaveatKeys(object2, ["name", "sql", "fixedParams"], path);
+  caveatString(object2, "name", path);
+  caveatString(object2, "sql", path);
+  const fixedParams = requiredCaveat(object2, "fixedParams", path);
   if (!Array.isArray(fixedParams)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
@@ -657,20 +689,20 @@ function validateFixedParam(input, path) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new PolicyCapabilityError("policy-capability-malformed-caveats", `${path} must be an object`);
   }
-  const object = input;
-  assertCaveatKeys(object, ["index", "value"], path);
-  const index = requiredCaveat(object, "index", path);
+  const object2 = input;
+  assertCaveatKeys(object2, ["index", "value"], path);
+  const index = requiredCaveat(object2, "index", path);
   if (typeof index !== "number" || !Number.isSafeInteger(index) || index < 0) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
       `${path}.index must be a non-negative integer`
     );
   }
-  requiredCaveat(object, "value", path);
+  requiredCaveat(object2, "value", path);
 }
-function assertCaveatKeys(object, allowed, path) {
+function assertCaveatKeys(object2, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object)) {
+  for (const key of Object.keys(object2)) {
     if (!allowedSet.has(key)) {
       throw new PolicyCapabilityError(
         "policy-capability-malformed-caveats",
@@ -679,17 +711,17 @@ function assertCaveatKeys(object, allowed, path) {
     }
   }
 }
-function requiredCaveat(object, key, path) {
-  if (!hasOwn(object, key)) {
+function requiredCaveat(object2, key, path) {
+  if (!hasOwn(object2, key)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
       `${path}.${key} is required`
     );
   }
-  return object[key];
+  return object2[key];
 }
-function caveatString(object, key, path) {
-  const value = requiredCaveat(object, key, path);
+function caveatString(object2, key, path) {
+  const value = requiredCaveat(object2, key, path);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
@@ -720,8 +752,8 @@ function caveatsContain(authority, request) {
     (statement) => authorityStatements.some((candidate) => jcsCanonicalize(candidate) === jcsCanonicalize(statement))
   );
 }
-function hasOwn(object, key) {
-  return objectHasOwn2(object, key);
+function hasOwn(object2, key) {
+  return objectHasOwn2(object2, key);
 }
 
 // src/policy/signed-object.ts
@@ -1465,13 +1497,12 @@ function digest(input, options) {
 }
 var identity2 = { code, name, encode: encode4, digest };
 
-// ../../node_modules/multiformats/dist/src/hashes/sha2.js
-var sha2_exports = {};
-__export(sha2_exports, {
+// ../../node_modules/multiformats/dist/src/hashes/sha2-browser.js
+var sha2_browser_exports = {};
+__export(sha2_browser_exports, {
   sha256: () => sha2562,
   sha512: () => sha512
 });
-var import_crypto = __toESM(require("crypto"), 1);
 
 // ../../node_modules/multiformats/dist/src/hashes/hasher.js
 var DEFAULT_MIN_DIGEST_LENGTH = 20;
@@ -1521,16 +1552,19 @@ function createDigest(digest2, code2, truncate) {
   return create(code2, digest2);
 }
 
-// ../../node_modules/multiformats/dist/src/hashes/sha2.js
+// ../../node_modules/multiformats/dist/src/hashes/sha2-browser.js
+function sha(name2) {
+  return async (data) => new Uint8Array(await crypto.subtle.digest(name2, data));
+}
 var sha2562 = from2({
   name: "sha2-256",
   code: 18,
-  encode: (input) => coerce(import_crypto.default.createHash("sha256").update(input).digest())
+  encode: sha("SHA-256")
 });
 var sha512 = from2({
   name: "sha2-512",
   code: 19,
-  encode: (input) => coerce(import_crypto.default.createHash("sha512").update(input).digest())
+  encode: sha("SHA-512")
 });
 
 // ../../node_modules/multiformats/dist/src/cid.js
@@ -1872,7 +1906,7 @@ var cidSymbol = /* @__PURE__ */ Symbol.for("@ipld/js-cid/CID");
 
 // ../../node_modules/multiformats/dist/src/basics.js
 var bases = { ...identity_exports, ...base2_exports, ...base8_exports, ...base10_exports, ...base16_exports, ...base32_exports, ...base36_exports, ...base58_exports, ...base64_exports, ...base256emoji_exports };
-var hashes = { ...sha2_exports, ...identity_exports2 };
+var hashes = { ...sha2_browser_exports, ...identity_exports2 };
 
 // src/policy/signed-object.ts
 var import_viem3 = require("viem");
@@ -1989,17 +2023,17 @@ async function createAndSignSignedObject(input, signer) {
 }
 function createAndSignPolicy(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object) => validatePolicySignedShape(object)
+    (object2) => validatePolicySignedShape(object2)
   );
 }
 function createAndSignPolicyStatus(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object) => validatePolicyStatusSignedShape(object)
+    (object2) => validatePolicyStatusSignedShape(object2)
   );
 }
 function createAndSignPolicyEngineRecord(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object) => validatePolicyEngineRecordSignedShape(object)
+    (object2) => validatePolicyEngineRecordSignedShape(object2)
   );
 }
 async function verifySignedObject(input) {
@@ -2103,9 +2137,9 @@ function validateUnsignedForDescriptor(input, descriptor) {
   }
 }
 function validatePolicyShape(input, signed) {
-  const object = expectJsonObject(normalizeJson(input), "$");
+  const object2 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object,
+    object2,
     signed ? [
       "schema",
       "policyId",
@@ -2133,30 +2167,30 @@ function validatePolicyShape(input, signed) {
     ],
     "$"
   );
-  expectConst(requiredString2(object, "schema", "$"), POLICY_SCHEMA, "$.schema");
+  expectConst(requiredString2(object2, "schema", "$"), POLICY_SCHEMA, "$.schema");
   if (signed) {
-    requiredString2(object, "policyId", "$");
-    validateSignature(requiredValue2(object, "signature", "$"));
+    requiredString2(object2, "policyId", "$");
+    validateSignature(requiredValue2(object2, "signature", "$"));
   }
-  requiredString2(object, "ownerDid", "$");
-  requiredString2(object, "signingKeyDid", "$");
-  requiredDateString(object, "createdAt", "$");
-  optionalDateString(object, "expiresAt", "$");
-  validatePolicyResource(requiredValue2(object, "resource", "$"), "$.resource");
-  validateExpression(requiredValue2(object, "when", "$"), "$.when");
-  validateGrant(requiredValue2(object, "grant", "$"), "$.grant");
-  if (hasOwn2(object, "disclosure")) {
-    validateDisclosure(requiredValue2(object, "disclosure", "$"), "$.disclosure");
+  requiredString2(object2, "ownerDid", "$");
+  requiredString2(object2, "signingKeyDid", "$");
+  requiredDateString(object2, "createdAt", "$");
+  optionalDateString(object2, "expiresAt", "$");
+  validatePolicyResource(requiredValue2(object2, "resource", "$"), "$.resource");
+  validateExpression(requiredValue2(object2, "when", "$"), "$.when");
+  validateGrant(requiredValue2(object2, "grant", "$"), "$.grant");
+  if (hasOwn2(object2, "disclosure")) {
+    validateDisclosure(requiredValue2(object2, "disclosure", "$"), "$.disclosure");
   }
-  if (hasOwn2(object, "audit")) {
-    validateAudit(requiredValue2(object, "audit", "$"), "$.audit");
+  if (hasOwn2(object2, "audit")) {
+    validateAudit(requiredValue2(object2, "audit", "$"), "$.audit");
   }
-  return object;
+  return object2;
 }
 function validatePolicyStatusShape(input, signed) {
-  const object = expectJsonObject(normalizeJson(input), "$");
+  const object2 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object,
+    object2,
     signed ? [
       "schema",
       "statusId",
@@ -2180,28 +2214,28 @@ function validatePolicyStatusShape(input, signed) {
     ],
     "$"
   );
-  expectConst(requiredString2(object, "schema", "$"), POLICY_STATUS_SCHEMA, "$.schema");
+  expectConst(requiredString2(object2, "schema", "$"), POLICY_STATUS_SCHEMA, "$.schema");
   if (signed) {
-    requiredString2(object, "statusId", "$");
-    validateSignature(requiredValue2(object, "signature", "$"));
+    requiredString2(object2, "statusId", "$");
+    validateSignature(requiredValue2(object2, "signature", "$"));
   }
-  requiredString2(object, "policyId", "$");
-  requiredString2(object, "ownerDid", "$");
-  requiredInteger(object, "sequence", "$", 0);
-  expectOneOf(requiredString2(object, "disposition", "$"), [
+  requiredString2(object2, "policyId", "$");
+  requiredString2(object2, "ownerDid", "$");
+  requiredInteger(object2, "sequence", "$", 0);
+  expectOneOf(requiredString2(object2, "disposition", "$"), [
     "active",
     "suspended",
     "revoked"
   ], "$.disposition");
-  requiredDateString(object, "effectiveAt", "$");
-  optionalString(object, "reasonCode", "$");
-  requiredString2(object, "signingKeyDid", "$");
-  return object;
+  requiredDateString(object2, "effectiveAt", "$");
+  optionalString(object2, "reasonCode", "$");
+  requiredString2(object2, "signingKeyDid", "$");
+  return object2;
 }
 function validatePolicyEngineRecordShape(input, signed) {
-  const object = expectJsonObject(normalizeJson(input), "$");
+  const object2 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object,
+    object2,
     signed ? [
       "schema",
       "engineRecordId",
@@ -2226,44 +2260,44 @@ function validatePolicyEngineRecordShape(input, signed) {
     "$"
   );
   expectConst(
-    requiredString2(object, "schema", "$"),
+    requiredString2(object2, "schema", "$"),
     POLICY_ENGINE_RECORD_SCHEMA,
     "$.schema"
   );
   if (signed) {
-    requiredString2(object, "engineRecordId", "$");
-    validateSignature(requiredValue2(object, "signature", "$"));
+    requiredString2(object2, "engineRecordId", "$");
+    validateSignature(requiredValue2(object2, "signature", "$"));
   }
-  requiredString2(object, "ownerDid", "$");
-  requiredString2(object, "endpoint", "$");
-  requiredString2(object, "audience", "$");
+  requiredString2(object2, "ownerDid", "$");
+  requiredString2(object2, "endpoint", "$");
+  requiredString2(object2, "audience", "$");
   requiredStringArray(
-    object,
+    object2,
     "supportedPolicyVersions",
     "$",
     (value, path) => expectConst(value, "v0", path)
   );
-  requiredStringArray(object, "supportedEvidenceVerifiers", "$");
-  requiredString2(object, "grantIssuerDid", "$");
-  requiredDateString(object, "expiresAt", "$");
-  return object;
+  requiredStringArray(object2, "supportedEvidenceVerifiers", "$");
+  requiredString2(object2, "grantIssuerDid", "$");
+  requiredDateString(object2, "expiresAt", "$");
+  return object2;
 }
 function validateSignature(input) {
-  const object = expectJsonObject(input, "$.signature");
-  assertExactKeys2(object, ["suite", "signerDid", "value"], "$.signature");
-  const suite = requiredString2(object, "suite", "$.signature");
+  const object2 = expectJsonObject(input, "$.signature");
+  assertExactKeys2(object2, ["suite", "signerDid", "value"], "$.signature");
+  const suite = requiredString2(object2, "suite", "$.signature");
   assertSupportedSignatureSuite(suite);
-  const signerDid = requiredString2(object, "signerDid", "$.signature");
-  const value = requiredString2(object, "value", "$.signature");
+  const signerDid = requiredString2(object2, "signerDid", "$.signature");
+  const value = requiredString2(object2, "value", "$.signature");
   decodeSignatureValue(value, suite);
   return { suite, signerDid, value };
 }
 function validatePolicyResource(input, path) {
-  const object = expectJsonObject(input, path);
-  assertExactKeys2(object, ["resourceType", "resourceId", "permissionsCeiling"], path);
-  requiredString2(object, "resourceType", path);
-  requiredString2(object, "resourceId", path);
-  const ceiling = requiredArray2(object, "permissionsCeiling", path, 1);
+  const object2 = expectJsonObject(input, path);
+  assertExactKeys2(object2, ["resourceType", "resourceId", "permissionsCeiling"], path);
+  requiredString2(object2, "resourceType", path);
+  requiredString2(object2, "resourceId", path);
+  const ceiling = requiredArray2(object2, "permissionsCeiling", path, 1);
   for (let index = 0; index < ceiling.length; index++) {
     validatePolicyCapability(ceiling[index], `${path}.permissionsCeiling[${index}]`);
   }
@@ -2279,10 +2313,10 @@ function validatePolicyPermissionsCeilingForSigning(input) {
   }
 }
 function validatePolicyCapability(input, path) {
-  const object = expectJsonObject(input, path);
+  const object2 = expectJsonObject(input, path);
   try {
-    const canonical = canonicalizePolicyCapability(object);
-    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {
+    const canonical = canonicalizePolicyCapability(object2);
+    if (jcsCanonicalize(object2) !== jcsCanonicalize(canonical)) {
       throw new SignedObjectSchemaError(`${path} must be canonical PolicyCapability JSON`);
     }
   } catch (error) {
@@ -2295,10 +2329,10 @@ function validatePolicyCapability(input, path) {
   }
 }
 function validatePolicyCapabilityForSigning(input, path) {
-  const object = expectJsonObject(input, path);
+  const object2 = expectJsonObject(input, path);
   try {
-    const canonical = normalizePolicyCapability(object);
-    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {
+    const canonical = normalizePolicyCapability(object2);
+    if (jcsCanonicalize(object2) !== jcsCanonicalize(canonical)) {
       throw new SignedObjectSchemaError(`${path} must be strict canonical PolicyCapability JSON`);
     }
   } catch (error) {
@@ -2311,43 +2345,43 @@ function validatePolicyCapabilityForSigning(input, path) {
   }
 }
 function validateExpression(input, path) {
-  const object = expectJsonObject(input, path);
-  const keys = Object.keys(object);
+  const object2 = expectJsonObject(input, path);
+  const keys = Object.keys(object2);
   if (keys.length !== 1) {
     throw new SignedObjectSchemaError(`${path} must have exactly one expression key`);
   }
   const key = keys[0];
   if (key === "allOf" || key === "anyOf") {
-    const values = requiredArray2(object, key, path, 1);
+    const values = requiredArray2(object2, key, path, 1);
     for (let index = 0; index < values.length; index++) {
       validateExpression(values[index], `${path}.${key}[${index}]`);
     }
     return;
   }
   if (key === "subject") {
-    const subject = expectJsonObject(requiredValue2(object, "subject", path), `${path}.subject`);
+    const subject = expectJsonObject(requiredValue2(object2, "subject", path), `${path}.subject`);
     assertExactKeys2(subject, ["did"], `${path}.subject`);
     requiredString2(subject, "did", `${path}.subject`);
     return;
   }
   if (key === "evidence") {
-    validateEvidenceRequirement(requiredValue2(object, "evidence", path), `${path}.evidence`);
+    validateEvidenceRequirement(requiredValue2(object2, "evidence", path), `${path}.evidence`);
     return;
   }
   throw new SignedObjectSchemaError(`${path} has unknown expression key ${key}`);
 }
 function validateEvidenceRequirement(input, path) {
-  const object = expectJsonObject(input, path);
+  const object2 = expectJsonObject(input, path);
   assertExactKeys2(
-    object,
+    object2,
     ["requirementId", "verifier", "requirements", "authority", "freshness"],
     path
   );
-  requiredString2(object, "requirementId", path);
-  requiredString2(object, "verifier", path);
-  requiredValue2(object, "requirements", path);
-  if (hasOwn2(object, "authority")) {
-    const authority = expectJsonObject(requiredValue2(object, "authority", path), `${path}.authority`);
+  requiredString2(object2, "requirementId", path);
+  requiredString2(object2, "verifier", path);
+  requiredValue2(object2, "requirements", path);
+  if (hasOwn2(object2, "authority")) {
+    const authority = expectJsonObject(requiredValue2(object2, "authority", path), `${path}.authority`);
     assertExactKeys2(
       authority,
       ["profile", "acceptedIssuers", "allowOwnerAuthorizedIssuer"],
@@ -2359,35 +2393,35 @@ function validateEvidenceRequirement(input, path) {
     }
     optionalBoolean(authority, "allowOwnerAuthorizedIssuer", `${path}.authority`);
   }
-  if (hasOwn2(object, "freshness")) {
-    const freshness = expectJsonObject(requiredValue2(object, "freshness", path), `${path}.freshness`);
+  if (hasOwn2(object2, "freshness")) {
+    const freshness = expectJsonObject(requiredValue2(object2, "freshness", path), `${path}.freshness`);
     assertExactKeys2(freshness, ["maxStatusAgeSeconds"], `${path}.freshness`);
     requiredInteger(freshness, "maxStatusAgeSeconds", `${path}.freshness`, 0);
   }
 }
 function validateGrant(input, path) {
-  const object = expectJsonObject(input, path);
-  assertExactKeys2(object, ["output", "maxTtlSeconds", "delegationMode", "revocation"], path);
-  expectConst(requiredString2(object, "output", path), "portable-delegation", `${path}.output`);
-  requiredInteger(object, "maxTtlSeconds", path, 1);
-  expectOneOf(requiredString2(object, "delegationMode", path), [
+  const object2 = expectJsonObject(input, path);
+  assertExactKeys2(object2, ["output", "maxTtlSeconds", "delegationMode", "revocation"], path);
+  expectConst(requiredString2(object2, "output", path), "portable-delegation", `${path}.output`);
+  requiredInteger(object2, "maxTtlSeconds", path, 1);
+  expectOneOf(requiredString2(object2, "delegationMode", path), [
     "terminal",
     "attenuable"
   ], `${path}.delegationMode`);
-  expectOneOf(requiredString2(object, "revocation", path), [
+  expectOneOf(requiredString2(object2, "revocation", path), [
     "refresh_only",
     "active_cutoff"
   ], `${path}.revocation`);
 }
 function validateDisclosure(input, path) {
-  const object = expectJsonObject(input, path);
-  assertExactKeys2(object, ["denial"], path);
-  expectOneOf(requiredString2(object, "denial", path), ["none", "code", "debug"], `${path}.denial`);
+  const object2 = expectJsonObject(input, path);
+  assertExactKeys2(object2, ["denial"], path);
+  expectOneOf(requiredString2(object2, "denial", path), ["none", "code", "debug"], `${path}.denial`);
 }
 function validateAudit(input, path) {
-  const object = expectJsonObject(input, path);
-  assertExactKeys2(object, ["issuance"], path);
-  expectOneOf(requiredString2(object, "issuance", path), ["off", "security", "full"], `${path}.issuance`);
+  const object2 = expectJsonObject(input, path);
+  assertExactKeys2(object2, ["issuance"], path);
+  expectOneOf(requiredString2(object2, "issuance", path), ["off", "security", "full"], `${path}.issuance`);
 }
 function materialForUnsigned(unsigned, descriptor) {
   const jcs = jcsCanonicalize(unsigned);
@@ -2536,9 +2570,9 @@ function encodeSignatureValue(value, suite) {
   decodeSignatureValue(encoded, suite);
   return encoded;
 }
-function stripOwnIdAndSignature(object, descriptor) {
+function stripOwnIdAndSignature(object2, descriptor) {
   const output = /* @__PURE__ */ Object.create(null);
-  for (const [key, value] of Object.entries(object)) {
+  for (const [key, value] of Object.entries(object2)) {
     if (key === descriptor.idField || key === "signature") {
       continue;
     }
@@ -2547,8 +2581,8 @@ function stripOwnIdAndSignature(object, descriptor) {
   return output;
 }
 function descriptorForUnsigned(input) {
-  const object = expectJsonObject(normalizeJson(input), "$");
-  return descriptorForSchema(requiredString2(object, "schema", "$"));
+  const object2 = expectJsonObject(normalizeJson(input), "$");
+  return descriptorForSchema(requiredString2(object2, "schema", "$"));
 }
 function descriptorForSchema(schema) {
   if (schema === POLICY_SCHEMA) return DESCRIPTORS.Policy;
@@ -2562,28 +2596,28 @@ function expectJsonObject(input, path) {
   }
   return input;
 }
-function assertExactKeys2(object, allowed, path) {
+function assertExactKeys2(object2, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object)) {
+  for (const key of Object.keys(object2)) {
     if (!allowedSet.has(key)) {
       throw new SignedObjectSchemaError(`${path} has unknown field ${key}`);
     }
   }
 }
-function requiredValue2(object, key, path) {
-  if (!hasOwn2(object, key)) {
+function requiredValue2(object2, key, path) {
+  if (!hasOwn2(object2, key)) {
     throw new SignedObjectSchemaError(`${path}.${key} is required`);
   }
-  return object[key];
+  return object2[key];
 }
-function requiredString2(object, key, path) {
-  return requireStringType(requiredValue2(object, key, path), `${path}.${key}`);
+function requiredString2(object2, key, path) {
+  return requireStringType(requiredValue2(object2, key, path), `${path}.${key}`);
 }
-function optionalString(object, key, path) {
-  if (!hasOwn2(object, key)) {
+function optionalString(object2, key, path) {
+  if (!hasOwn2(object2, key)) {
     return;
   }
-  requireStringType(requiredValue2(object, key, path), `${path}.${key}`);
+  requireStringType(requiredValue2(object2, key, path), `${path}.${key}`);
 }
 function requireStringType(value, path) {
   if (typeof value !== "string" || value.length === 0) {
@@ -2591,16 +2625,16 @@ function requireStringType(value, path) {
   }
   return value;
 }
-function optionalBoolean(object, key, path) {
-  if (!hasOwn2(object, key)) {
+function optionalBoolean(object2, key, path) {
+  if (!hasOwn2(object2, key)) {
     return;
   }
-  if (typeof requiredValue2(object, key, path) !== "boolean") {
+  if (typeof requiredValue2(object2, key, path) !== "boolean") {
     throw new SignedObjectSchemaError(`${path}.${key} must be a boolean`);
   }
 }
-function requiredInteger(object, key, path, minimum) {
-  const value = requiredValue2(object, key, path);
+function requiredInteger(object2, key, path, minimum) {
+  const value = requiredValue2(object2, key, path);
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum) {
     throw new SignedObjectSchemaError(
       `${path}.${key} must be an integer >= ${minimum}`
@@ -2608,8 +2642,8 @@ function requiredInteger(object, key, path, minimum) {
   }
   return value;
 }
-function requiredArray2(object, key, path, minimum) {
-  const value = requiredValue2(object, key, path);
+function requiredArray2(object2, key, path, minimum) {
+  const value = requiredValue2(object2, key, path);
   if (!Array.isArray(value) || value.length < minimum) {
     throw new SignedObjectSchemaError(
       `${path}.${key} must be an array with at least ${minimum} item(s)`
@@ -2617,22 +2651,22 @@ function requiredArray2(object, key, path, minimum) {
   }
   return value;
 }
-function requiredStringArray(object, key, path, check) {
-  const values = requiredArray2(object, key, path, 0);
+function requiredStringArray(object2, key, path, check) {
+  const values = requiredArray2(object2, key, path, 0);
   for (let index = 0; index < values.length; index++) {
     const itemPath = `${path}.${key}[${index}]`;
     const value = requireStringType(values[index], itemPath);
     check?.(value, itemPath);
   }
 }
-function requiredDateString(object, key, path) {
-  assertRfc3339(requiredString2(object, key, path), `${path}.${key}`);
+function requiredDateString(object2, key, path) {
+  assertRfc3339(requiredString2(object2, key, path), `${path}.${key}`);
 }
-function optionalDateString(object, key, path) {
-  if (!hasOwn2(object, key)) {
+function optionalDateString(object2, key, path) {
+  if (!hasOwn2(object2, key)) {
     return;
   }
-  assertRfc3339(requiredString2(object, key, path), `${path}.${key}`);
+  assertRfc3339(requiredString2(object2, key, path), `${path}.${key}`);
 }
 function assertRfc3339(value, path) {
   const match = value.match(
@@ -2664,8 +2698,8 @@ function expectOneOf(actual, allowed, path) {
   }
   throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);
 }
-function hasOwn2(object, key) {
-  return objectHasOwn3(object, key);
+function hasOwn2(object2, key) {
+  return objectHasOwn3(object2, key);
 }
 function assertSupportedSignatureSuite(suite) {
   if (suite !== ED25519_JCS_SIGNATURE_SUITE && suite !== EIP191_JCS_SIGNATURE_SUITE) {
@@ -2744,13 +2778,13 @@ function base64UrlDecode(value) {
   return decoded;
 }
 function hexToBytes(value) {
-  const hex = value.slice(2);
-  if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {
+  const hex2 = value.slice(2);
+  if (hex2.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex2)) {
     throw new SignatureMaterialError("hex signature must have even length");
   }
-  const output = new Uint8Array(hex.length / 2);
+  const output = new Uint8Array(hex2.length / 2);
   for (let index = 0; index < output.length; index++) {
-    output[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
+    output[index] = Number.parseInt(hex2.slice(index * 2, index * 2 + 2), 16);
   }
   return output;
 }
@@ -3101,9 +3135,9 @@ function expectPolicyEngineRecord(input) {
     );
   }
 }
-function assertExactKeys3(object, allowed, path) {
+function assertExactKeys3(object2, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object)) {
+  for (const key of Object.keys(object2)) {
     if (!allowedSet.has(key)) {
       throw new PolicyAuthoringError(
         "policy-authoring-unknown-key",
@@ -3112,17 +3146,17 @@ function assertExactKeys3(object, allowed, path) {
     }
   }
 }
-function requiredValue3(object, key, path) {
-  if (!hasOwn3(object, key)) {
+function requiredValue3(object2, key, path) {
+  if (!hasOwn3(object2, key)) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
       `${path}.${key} is required`
     );
   }
-  return object[key];
+  return object2[key];
 }
-function requiredString3(object, key, path) {
-  const value = requiredValue3(object, key, path);
+function requiredString3(object2, key, path) {
+  const value = requiredValue3(object2, key, path);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
@@ -3131,11 +3165,11 @@ function requiredString3(object, key, path) {
   }
   return value;
 }
-function fieldString(object, key, path, code2) {
-  if (!hasOwn3(object, key)) {
+function fieldString(object2, key, path, code2) {
+  if (!hasOwn3(object2, key)) {
     throw new PolicyAuthoringError(code2, `${path}.${key} is required`);
   }
-  const value = object[key];
+  const value = object2[key];
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyAuthoringError(
       code2,
@@ -3144,8 +3178,8 @@ function fieldString(object, key, path, code2) {
   }
   return value;
 }
-function requiredObject(object, key, path) {
-  const value = requiredValue3(object, key, path);
+function requiredObject(object2, key, path) {
+  const value = requiredValue3(object2, key, path);
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
@@ -3154,8 +3188,8 @@ function requiredObject(object, key, path) {
   }
   return value;
 }
-function requiredArray3(object, key, path) {
-  const value = requiredValue3(object, key, path);
+function requiredArray3(object2, key, path) {
+  const value = requiredValue3(object2, key, path);
   if (!Array.isArray(value)) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
@@ -3164,8 +3198,8 @@ function requiredArray3(object, key, path) {
   }
   return value;
 }
-function requiredStringArray2(object, key, path) {
-  const values = requiredArray3(object, key, path);
+function requiredStringArray2(object2, key, path) {
+  const values = requiredArray3(object2, key, path);
   return values.map((value, index) => {
     if (typeof value !== "string" || value.length === 0) {
       throw new PolicyAuthoringError(
@@ -3262,63 +3296,657 @@ function parseStrictRfc3339(value, path) {
 var objectHasOwn4 = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
   Object.prototype.hasOwnProperty
 );
-function hasOwn3(object, key) {
-  return objectHasOwn4(object, key);
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  ED25519_JCS_SIGNATURE_SUITE,
-  EIP191_JCS_SIGNATURE_SUITE,
-  OWNER_NODE_ENDPOINT_SCHEMA,
-  POLICY_ENGINE_RECORD_SCHEMA,
-  POLICY_SCHEMA,
-  POLICY_STATUS_SCHEMA,
-  POLICY_VERSION_V0,
-  PolicyAuthoringError,
-  PolicyCapabilityError,
-  SignatureMaterialError,
-  SignatureVerificationError,
-  SignedObjectCanonicalizationError,
-  SignedObjectDigestError,
-  SignedObjectIdError,
-  SignedObjectProfileError,
-  SignedObjectSchemaError,
-  SigningKeyBindingError,
-  TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,
-  UnsupportedSignatureSuiteError,
-  W3C_VC_CREDENTIAL_VERIFIER,
-  canonicalizePolicyCapability,
-  canonicalizeSignedObjectUnsigned,
-  composeTranscriptShareBootstrap,
-  createAndSignPolicy,
-  createAndSignPolicyEngineRecord,
-  createAndSignPolicyStatus,
-  createAndSignRequesterPolicyEngineRecord,
-  createAndSignSignedObject,
-  createAndSignTranscriptSharePolicy,
-  createUnsignedPolicyEngineRecord,
-  deriveSignedObjectMaterial,
-  jcsCanonicalize,
-  normalizeJson,
-  normalizePolicyCapability,
-  policyCapabilityContains,
-  policyCapabilityDigestHex,
-  serializeJcsJson,
-  signedObjectIdFor,
-  toSignedObjectError,
-  validatePolicyEngineRecordSigned,
-  validatePolicyEngineRecordSignedShape,
-  validatePolicyEngineRecordUnsigned,
-  validatePolicySigned,
-  validatePolicySignedShape,
-  validatePolicyStatusSigned,
-  validatePolicyStatusSignedShape,
-  validatePolicyStatusUnsigned,
-  validatePolicyUnsigned,
-  verifyPolicy,
-  verifyPolicyEngineRecord,
-  verifyPolicyEngineRecordForRequester,
-  verifyPolicyStatus,
-  verifySignedObject
-});
+function hasOwn3(object2, key) {
+  return objectHasOwn4(object2, key);
+}
+
+// src/policy/unified.ts
+var import_sha256 = require("@noble/hashes/sha256");
+var import_blake3 = require("@noble/hashes/blake3");
+var import_ed255192 = require("@noble/curves/ed25519");
+var import_zod = require("zod");
+var POLICY_V1_SCHEMA = "xyz.tinycloud.policy/policy/v1";
+var POLICY_CAPABILITY_V1_SCHEMA = "xyz.tinycloud.policy/capability/v1";
+var POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA = "xyz.tinycloud.policy/enforcement-delegation/v2";
+var ATTESTED_ENFORCER_BINDING_V2_SCHEMA = "xyz.tinycloud.policy/attested-enforcer/v2";
+var ROOT_STATUS_CHECKPOINT_V1_SCHEMA = "xyz.tinycloud.policy/root-status/v1";
+var ROOT_REVOCATION_V1_SCHEMA = "xyz.tinycloud.policy/root-revocation/v1";
+var POLICY_SESSION_UCAN_V1_PROFILE = "policy-session-ucan/v1";
+var POLICY_V1_DOMAIN = "xyz.tinycloud.policy/policy/v1\0";
+var POLICY_CAPABILITY_V1_DOMAIN = "xyz.tinycloud.policy/PolicyCapability/v1\0";
+var CONTENT_SOURCE_V1_DOMAIN = "xyz.tinycloud.policy/ContentSource/v1\0";
+var NATIVE_PROJECTION_V1_DOMAIN = "xyz.tinycloud.policy/NativeProjection/v1\0";
+var ROOT_STATUS_V1_DOMAIN = "xyz.tinycloud.policy/RootStatusCheckpoint/v1\0";
+var ROOT_STATUS_RENEWAL_V1_DOMAIN = "xyz.tinycloud.policy/RootStatusRenewal/v1\0";
+var ROOT_REVOCATION_V1_DOMAIN = "xyz.tinycloud.policy/RootRevocation/v1\0";
+var LAST_V2_CREATE_AT = "2026-09-30T00:00:00Z";
+var MAX_LEGACY_ENVELOPE_EXPIRES_AT = "2026-12-29T00:00:00Z";
+var LAST_V2_READ_AT = "2027-01-05T00:00:00Z";
+async function requestPolicyChallengeV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const response = await fetchFn(new URL("/share/v3/policy/challenges", input.nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ policyCid: input.policyCid, recipientDid: input.recipientDid, requestedCapabilities: input.requestedCapabilities.map(normalizeUnifiedPolicyCapability) })
+  });
+  if (!response.ok) throw new Error(`policy challenge rejected (${response.status})`);
+  const value = object(await response.json(), "policy challenge");
+  if (typeof value.challengeId !== "string" || typeof value.nonce !== "string" || value.policyCid !== input.policyCid || value.recipientDid !== input.recipientDid)
+    throw new Error("policy challenge binding is invalid");
+  return value;
+}
+async function mintPolicySessionV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const challenge = input.challenge ?? await requestPolicyChallengeV3(input);
+  if (challenge.policyCid !== input.policyCid || challenge.recipientDid !== input.recipientDid)
+    throw new Error("policy challenge binding is invalid");
+  const response = await fetchFn(new URL("/share/v3/policy/delegations", input.nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ policyCid: input.policyCid, challengeId: challenge.challengeId, nonce: challenge.nonce, claim: input.claim, presentation: input.presentation })
+  });
+  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  const value = object(await response.json(), "policy delegation");
+  if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string")
+    throw new Error("policy delegation response is invalid");
+  const session = parsePolicySessionUcan(value.authorization, [input.policyRootCid, input.enforcementRootCid]);
+  const expectedAttenuation = compactAttenuationForPolicyCapabilities(input.requestedCapabilities);
+  if (session.cid !== value.sessionCid || session.aud !== input.recipientDid || session.fact.policyCid !== input.policyCid || session.fact.recipientDid !== input.recipientDid || session.fact.policyDelegationCid !== input.policyRootCid || session.fact.enforcementDelegationCid !== input.enforcementRootCid || jcsCanonicalize(session.att) !== jcsCanonicalize(expectedAttenuation) || Object.entries(input.expectedFacts ?? {}).some(([key, expected]) => session.fact[key] !== expected))
+    throw new Error("policy delegation signed binding is invalid");
+  return session;
+}
+function compactAttenuationForPolicyCapabilities(input) {
+  const attenuation = {};
+  for (const raw of input) {
+    const capability = normalizeUnifiedPolicyCapability(raw);
+    if (attenuation[capability.resource] !== void 0)
+      throw new Error("policy capabilities contain a duplicate resource");
+    attenuation[capability.resource] = capability.kind === "encryption" ? { [capability.action]: [{}] } : Object.fromEntries(capability.actions.map((action) => [action, [{
+      type: "xyz.tinycloud.resource/selector",
+      kind: capability.selector,
+      value: capability.resource
+    }]]));
+  }
+  return attenuation;
+}
+function verifyPolicyRootStatusCheckpointV3(input) {
+  const checkpoint = input.checkpoint;
+  const allowed = /* @__PURE__ */ new Set(["schema", "targetCid", "targetRole", "ownerDid", "nodeAudience", "state", "sequence", "checkedAt", "freshUntil", "revokedAt", "revocationCid", "previousCheckpointDigestHex", "issuerDid", "signature"]);
+  if (Object.keys(checkpoint).some((key) => !allowed.has(key)) || checkpoint.schema !== ROOT_STATUS_CHECKPOINT_V1_SCHEMA || checkpoint.targetCid !== input.rootCid || checkpoint.targetRole !== "policy-authority" && checkpoint.targetRole !== "policy-enforcement" || checkpoint.state !== "active" && checkpoint.state !== "revoked" || typeof checkpoint.ownerDid !== "string" || typeof checkpoint.nodeAudience !== "string" || checkpoint.issuerDid !== checkpoint.nodeAudience || input.expectedNodeAudience !== void 0 && checkpoint.nodeAudience !== input.expectedNodeAudience || !Number.isInteger(checkpoint.sequence) || checkpoint.sequence < 1 || typeof checkpoint.checkedAt !== "string" || typeof checkpoint.freshUntil !== "string") return false;
+  const checkedAt = Date.parse(checkpoint.checkedAt);
+  const freshUntil = Date.parse(checkpoint.freshUntil);
+  const now = (input.now ?? /* @__PURE__ */ new Date()).getTime();
+  if (!Number.isFinite(checkedAt) || !Number.isFinite(freshUntil) || freshUntil < now || freshUntil <= checkedAt || freshUntil - checkedAt > 3e5) return false;
+  if (checkpoint.sequence === 1 !== (checkpoint.previousCheckpointDigestHex === void 0)) return false;
+  if (checkpoint.sequence !== 1 && (typeof checkpoint.previousCheckpointDigestHex !== "string" || !/^[0-9a-f]{64}$/.test(checkpoint.previousCheckpointDigestHex))) return false;
+  if (checkpoint.state === "active" && (checkpoint.revokedAt !== void 0 || checkpoint.revocationCid !== void 0)) return false;
+  if (checkpoint.state === "revoked" && (typeof checkpoint.revokedAt !== "string" || typeof checkpoint.revocationCid !== "string")) return false;
+  const signature = checkpoint.signature;
+  if (!isRecordValue(signature) || Object.keys(signature).length !== 3 || signature.suite !== "Ed25519" || signature.signerDid !== checkpoint.issuerDid || typeof signature.value !== "string") return false;
+  try {
+    const principal = checkpoint.issuerDid.split("#", 1)[0];
+    const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+    if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1) return false;
+    const unsigned = { ...checkpoint };
+    delete unsigned.signature;
+    return import_ed255192.ed25519.verify(
+      decodeBase64Url(signature.value),
+      (0, import_sha256.sha256)(new TextEncoder().encode(ROOT_STATUS_V1_DOMAIN + jcsCanonicalize(unsigned))),
+      didMaterial.slice(2)
+    );
+  } catch {
+    return false;
+  }
+}
+async function getPolicyRootStatusV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const response = await fetchFn(new URL(`/share/v3/policy/status/${encodeURIComponent(input.rootCid)}`, input.nodeOrigin), {
+    method: "GET",
+    redirect: "error",
+    headers: { accept: "application/json" }
+  });
+  if (!response.ok) throw new Error(`policy root status rejected (${response.status})`);
+  const value = object(await response.json(), "policy root status");
+  const checkpoint = object(value.checkpoint, "policy root checkpoint");
+  if (value.rootCid !== input.rootCid || value.state !== "active" && value.state !== "revoked" || value.state !== checkpoint.state || !verifyPolicyRootStatusCheckpointV3({ rootCid: input.rootCid, checkpoint, expectedNodeAudience: input.expectedNodeAudience, now: input.now }))
+    throw new Error("policy root status binding is invalid");
+  const revocation = value.revocation === void 0 ? void 0 : object(value.revocation, "policy root revocation");
+  if (value.state === "revoked" !== (revocation !== void 0) || revocation !== void 0 && !verifyPolicyRootRevocationV3({
+    rootCid: input.rootCid,
+    checkpoint,
+    revocation,
+    expectedEnforcerDid: input.expectedEnforcerDid
+  })) throw new Error("policy root status revocation evidence is invalid");
+  return { rootCid: input.rootCid, state: value.state, checkpoint, ...revocation === void 0 ? {} : { revocation } };
+}
+function verifyPolicyRootRevocationV3(input) {
+  const value = input.revocation;
+  const allowed = ["schema", "targetCid", "targetRole", "ownerDid", "nodeAudience", "revokedAt", "reason", "issuerDid", "signature"];
+  if (Object.keys(value).length !== allowed.length || Object.keys(value).some((key) => !allowed.includes(key)) || value.schema !== ROOT_REVOCATION_V1_SCHEMA || value.targetCid !== input.rootCid || value.targetRole !== input.checkpoint.targetRole || value.ownerDid !== input.checkpoint.ownerDid || value.nodeAudience !== input.checkpoint.nodeAudience || value.revokedAt !== input.checkpoint.revokedAt || typeof value.reason !== "string" || value.reason.length === 0 || typeof value.issuerDid !== "string") return false;
+  const authorized = value.issuerDid === value.ownerDid || value.targetRole === "policy-enforcement" && value.issuerDid === input.expectedEnforcerDid;
+  if (!authorized) return false;
+  const signature = value.signature;
+  if (!isRecordValue(signature) || Object.keys(signature).length !== 3 || signature.suite !== "Ed25519" || signature.signerDid !== value.issuerDid || typeof signature.value !== "string") return false;
+  try {
+    const principal = value.issuerDid.split("#", 1)[0];
+    const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+    if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1) return false;
+    const unsigned = { ...value };
+    delete unsigned.signature;
+    const digest2 = (0, import_sha256.sha256)(new TextEncoder().encode(ROOT_REVOCATION_V1_DOMAIN + jcsCanonicalize(unsigned)));
+    return input.checkpoint.revocationCid === hex(digest2) && import_ed255192.ed25519.verify(decodeBase64Url(signature.value), digest2, didMaterial.slice(2));
+  } catch {
+    return false;
+  }
+}
+async function renewPolicyRootStatusV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const current = await getPolicyRootStatusV3({ nodeOrigin: input.nodeOrigin, rootCid: input.rootCid, expectedNodeAudience: input.nodeAudience, now: input.now, fetch: fetchFn });
+  if (current.state !== "active" || current.checkpoint.ownerDid !== input.ownerDid || current.checkpoint.nodeAudience !== input.nodeAudience || current.checkpoint.state !== "active" || !Number.isInteger(current.checkpoint.sequence))
+    throw new Error("policy root status cannot be renewed");
+  const currentUnsigned = { ...current.checkpoint };
+  delete currentUnsigned.signature;
+  const previousCheckpointDigestHex = hex((0, import_sha256.sha256)(new TextEncoder().encode(ROOT_STATUS_V1_DOMAIN + jcsCanonicalize(currentUnsigned))));
+  const unsigned = {
+    schema: "xyz.tinycloud.policy/root-status-renewal/v1",
+    targetCid: input.rootCid,
+    ownerDid: input.ownerDid,
+    nodeAudience: input.nodeAudience,
+    issuedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    nonce: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    sequence: current.checkpoint.sequence + 1,
+    previousCheckpointDigestHex
+  };
+  const signature = await input.sign((0, import_sha256.sha256)(new TextEncoder().encode(ROOT_STATUS_RENEWAL_V1_DOMAIN + jcsCanonicalize(unsigned))));
+  if (signature.length !== 64) throw new Error("policy root renewal signature must be Ed25519");
+  const response = await fetchFn(new URL("/share/v3/policy/status", input.nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ rootCid: input.rootCid, renewal: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.ownerDid, value: encodeBase64Url(signature) } } })
+  });
+  if (!response.ok) throw new Error(`policy root renewal rejected (${response.status})`);
+  return object(await response.json(), "policy root renewal");
+}
+async function revokePolicyRootV3(input) {
+  if (input.reason.length === 0) throw new Error("policy root revocation reason is required");
+  const unsigned = {
+    schema: ROOT_REVOCATION_V1_SCHEMA,
+    targetCid: input.rootCid,
+    targetRole: input.targetRole,
+    ownerDid: input.ownerDid,
+    nodeAudience: input.nodeAudience,
+    revokedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    reason: input.reason,
+    issuerDid: input.issuerDid
+  };
+  const signature = await input.sign((0, import_sha256.sha256)(new TextEncoder().encode(ROOT_REVOCATION_V1_DOMAIN + jcsCanonicalize(unsigned))));
+  if (signature.length !== 64) throw new Error("policy root revocation signature must be Ed25519");
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const response = await fetchFn(new URL("/revoke", input.nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ revocation: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.issuerDid, value: encodeBase64Url(signature) } } })
+  });
+  if (!response.ok) throw new Error(`policy root revocation rejected (${response.status})`);
+  return object(await response.json(), "policy root revocation");
+}
+var POLICY_SESSION_FACT_KEYS = [
+  "profile",
+  "ownerDid",
+  "policyId",
+  "policyDigestHex",
+  "policyCid",
+  "policyDelegationCid",
+  "enforcementDelegationCid",
+  "contentSourceDigestHex",
+  "capabilityCeilingHashHex",
+  "nativeProjectionHashHex",
+  "enforcerDid",
+  "nodeAudience",
+  "recipientDid",
+  "challengeId",
+  "claimDigestHex",
+  "claimJti",
+  "vpDigestHex",
+  "credentialEvidenceDigestHex",
+  "decisionContextDigestHex",
+  "issuanceAuditDigestHex",
+  "remainingRedelegationDepth"
+];
+var KV_ACTIONS = /* @__PURE__ */ new Set([
+  "tinycloud.kv/get",
+  "tinycloud.kv/list",
+  "tinycloud.kv/metadata",
+  "tinycloud.kv/put"
+]);
+function object(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function exactKeys(value, allowed, label) {
+  const keys = new Set(allowed);
+  if (Object.keys(value).some((key) => !keys.has(key)))
+    throw new Error(`${label} contains an unknown field`);
+}
+function nonEmptyString(value, label) {
+  if (typeof value !== "string" || value.length === 0)
+    throw new Error(`${label} must be a non-empty string`);
+  return value;
+}
+function parseKvResource(resource) {
+  const match = /^tinycloud:\/\/([^/]+)\/kv\/(.+)$/.exec(resource);
+  if (!match || match[1].includes(":") || match[1].includes("?") || match[1].includes("#") || match[1].includes("%") || match[2].startsWith("/") || match[2].endsWith("/") || match[2].includes("//") || match[2].split("/").some((part) => part === "." || part === ".." || part.length === 0)) {
+    throw new Error("KV resource is not canonical");
+  }
+  return { space: match[1], path: match[2] };
+}
+function parseEncryptionResource(resource) {
+  if (!resource.startsWith("urn:tinycloud:encryption:")) throw new Error("encryption capability is invalid");
+  const rest = resource.slice("urn:tinycloud:encryption:".length);
+  const separator = rest.lastIndexOf(":");
+  const ownerDid = separator < 0 ? "" : rest.slice(0, separator);
+  const network = separator < 0 ? "" : rest.slice(separator + 1);
+  if (!ownerDid.startsWith("did:") || network.length === 0 || network.includes(":") || network.includes("/") || network.includes("%") || network.includes("?") || network.includes("#")) {
+    throw new Error("encryption capability is invalid");
+  }
+}
+function normalizeUnifiedPolicyCapability(input) {
+  const value = object(input, "capability");
+  const kind = nonEmptyString(value.kind, "capability.kind");
+  if (kind === "kv") {
+    exactKeys(
+      value,
+      ["kind", "resource", "selector", "actions"],
+      "KV capability"
+    );
+    const resource = nonEmptyString(value.resource, "capability.resource");
+    parseKvResource(resource);
+    if (value.selector !== "exact" && value.selector !== "prefix")
+      throw new Error("capability.selector is invalid");
+    if (!Array.isArray(value.actions) || value.actions.length === 0)
+      throw new Error("capability.actions is invalid");
+    const actions = value.actions.map(
+      (action) => nonEmptyString(action, "capability.actions[]")
+    );
+    if (new Set(actions).size !== actions.length || actions.some((action) => !KV_ACTIONS.has(action)))
+      throw new Error("capability.actions is invalid");
+    return {
+      kind: "kv",
+      resource,
+      selector: value.selector,
+      actions: [...actions].sort()
+    };
+  }
+  if (kind === "encryption") {
+    exactKeys(value, ["kind", "resource", "action"], "encryption capability");
+    const resource = nonEmptyString(value.resource, "capability.resource");
+    if (value.action !== "tinycloud.encryption/decrypt")
+      throw new Error("encryption capability is invalid");
+    parseEncryptionResource(resource);
+    return {
+      kind: "encryption",
+      resource,
+      action: "tinycloud.encryption/decrypt"
+    };
+  }
+  throw new Error("capability.kind is invalid");
+}
+function canonicalizeUnifiedPolicyCapability(input) {
+  return normalizeUnifiedPolicyCapability(input);
+}
+function unifiedPolicyCapabilityDigestHex(input) {
+  return hex(
+    (0, import_sha256.sha256)(
+      new TextEncoder().encode(
+        POLICY_CAPABILITY_V1_DOMAIN + jcsCanonicalize(normalizeUnifiedPolicyCapability(input))
+      )
+    )
+  );
+}
+function unifiedPolicyCapabilityContains(authorityInput, requestedInput) {
+  try {
+    const authority = normalizeUnifiedPolicyCapability(authorityInput);
+    const requested = normalizeUnifiedPolicyCapability(requestedInput);
+    if (authority.kind !== requested.kind) return false;
+    if (authority.kind === "encryption" && requested.kind === "encryption")
+      return authority.resource === requested.resource && authority.action === requested.action;
+    if (authority.kind !== "kv" || requested.kind !== "kv") return false;
+    const { resource: authorized } = authority;
+    const { resource: requestedResource } = requested;
+    const pathContained = authority.selector === "exact" ? authorized === requestedResource : authorized === requestedResource || requestedResource.startsWith(`${authorized}/`);
+    if (!pathContained || authority.selector === "exact" && requested.selector === "prefix")
+      return false;
+    return requested.actions.every(
+      (action) => authority.actions.includes(action)
+    );
+  } catch {
+    return false;
+  }
+}
+function projectUnifiedPolicyCapability(input) {
+  const capability = normalizeUnifiedPolicyCapability(input);
+  if (capability.kind === "encryption") {
+    return {
+      service: "tinycloud.encryption",
+      space: capability.resource,
+      path: capability.resource,
+      actions: [capability.action]
+    };
+  }
+  const { space, path } = parseKvResource(capability.resource);
+  return {
+    service: "tinycloud.kv",
+    space,
+    path,
+    actions: [...capability.actions],
+    caveat: {
+      type: "xyz.tinycloud.resource/selector",
+      kind: capability.selector,
+      value: capability.resource
+    }
+  };
+}
+function projectUnifiedPolicyCapabilities(input) {
+  return input.map(projectUnifiedPolicyCapability).sort((left, right) => {
+    const a = jcsCanonicalize(left);
+    const b = jcsCanonicalize(right);
+    return a < b ? -1 : a > b ? 1 : 0;
+  });
+}
+function unifiedNativeProjectionHashHex(input) {
+  return hex(
+    (0, import_sha256.sha256)(
+      new TextEncoder().encode(
+        NATIVE_PROJECTION_V1_DOMAIN + jcsCanonicalize(projectUnifiedPolicyCapabilities(input))
+      )
+    )
+  );
+}
+function unifiedPolicyCapabilityFromNative(input) {
+  const value = object(input, "native capability");
+  exactKeys(
+    value,
+    ["service", "space", "path", "actions", "caveat"],
+    "native capability"
+  );
+  const service = nonEmptyString(value.service, "native.service");
+  const actions = value.actions;
+  if (!Array.isArray(actions)) throw new Error("native.actions is invalid");
+  if (service === "tinycloud.encryption" && value.caveat === void 0 && value.space === value.path && actions.length === 1 && actions[0] === "tinycloud.encryption/decrypt") {
+    return normalizeUnifiedPolicyCapability({
+      kind: "encryption",
+      resource: value.space,
+      action: actions[0]
+    });
+  }
+  if (service !== "tinycloud.kv" || typeof value.space !== "string" || typeof value.path !== "string")
+    throw new Error("native capability is not supported");
+  const caveat = object(value.caveat, "native.caveat");
+  exactKeys(caveat, ["type", "kind", "value"], "native selector caveat");
+  if (caveat.type !== "xyz.tinycloud.resource/selector" || caveat.kind !== "exact" && caveat.kind !== "prefix" || caveat.value !== `tinycloud://${value.space}/kv/${value.path}`)
+    throw new Error("native selector caveat does not match capability");
+  return normalizeUnifiedPolicyCapability({
+    kind: "kv",
+    resource: caveat.value,
+    selector: caveat.kind,
+    actions
+  });
+}
+function contentSourceDigestHex(input) {
+  return hex(
+    (0, import_sha256.sha256)(
+      new TextEncoder().encode(
+        CONTENT_SOURCE_V1_DOMAIN + jcsCanonicalize(input)
+      )
+    )
+  );
+}
+function policyDigestHex(policy) {
+  const canonicalPolicy = {
+    ...policy,
+    capabilityCeiling: policy.capabilityCeiling.map(
+      normalizeUnifiedPolicyCapability
+    )
+  };
+  return hex(
+    (0, import_sha256.sha256)(
+      new TextEncoder().encode(
+        POLICY_V1_DOMAIN + jcsCanonicalize(canonicalPolicy)
+      )
+    )
+  );
+}
+function policyIdForDigestHex(digestHex) {
+  const digest2 = Uint8Array.from(
+    (digestHex.match(/.{2}/g) ?? []).map((byte) => Number.parseInt(byte, 16))
+  );
+  if (digest2.length !== 32) throw new Error("policy digest must be 32 bytes");
+  return `pol_${base32Lower(digest2)}`;
+}
+function policyCidFromCanonicalBytes(bytes) {
+  return CID.createV1(85, create(18, (0, import_sha256.sha256)(bytes))).toString();
+}
+var CompactHeaderSchema = import_zod.z.object({
+  alg: import_zod.z.literal("EdDSA"),
+  jwk: import_zod.z.object({ alg: import_zod.z.literal("EdDSA"), crv: import_zod.z.literal("Ed25519"), kty: import_zod.z.literal("OKP"), x: import_zod.z.string().min(1) }).strict(),
+  typ: import_zod.z.literal("JWT"),
+  ucv: import_zod.z.literal("0.10.0")
+}).strict();
+var CompactPayloadSchema = import_zod.z.object({
+  att: import_zod.z.record(import_zod.z.record(import_zod.z.array(import_zod.z.unknown()).min(1))),
+  aud: import_zod.z.string().min(1),
+  exp: import_zod.z.number().int(),
+  fct: import_zod.z.array(import_zod.z.record(import_zod.z.unknown())).length(1),
+  iss: import_zod.z.string().min(1),
+  nbf: import_zod.z.number().int(),
+  nnc: import_zod.z.string().min(1),
+  prf: import_zod.z.array(import_zod.z.string().min(1))
+}).strict();
+async function signCompactUcanAuthorization(input) {
+  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 60)
+    throw new Error("compact invocation lifetime must be between one and 60 seconds");
+  const principal = input.issuerDid.split("#", 1)[0];
+  const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+  if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1)
+    throw new Error("compact UCAN signer must be did:key Ed25519");
+  const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(didMaterial.slice(2)) }, typ: "JWT", ucv: "0.10.0" };
+  const payload = {
+    att: input.attenuation,
+    aud: input.audienceDid,
+    exp: input.expiresAt,
+    fct: input.facts,
+    iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
+    nbf: input.notBefore,
+    nnc: input.nonce,
+    prf: input.proofs
+  };
+  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
+  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
+  const signature = await input.sign(new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`));
+  if (signature.length !== 64) throw new Error("compact Authorization signature must be Ed25519");
+  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
+}
+function createCompactPolicyInvocation(input) {
+  const session = parsePolicySessionUcan(input.sessionAuthorization);
+  if (session.cid !== input.sessionCid || session.aud !== input.recipientDid)
+    throw new Error("policy session does not bind the recipient signer");
+  const principal = input.recipientDid.split("#", 1)[0];
+  const didMaterial = base58btc.decode(principal.slice("did:key:".length));
+  if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1)
+    throw new Error("policy invocation signer must be did:key Ed25519");
+  const publicKey = import_ed255192.ed25519.getPublicKey(input.privateKey);
+  if (!equalBytes(publicKey, didMaterial.slice(2)))
+    throw new Error("policy invocation private key does not bind recipient DID");
+  const now = input.now ?? Math.floor(Date.now() / 1e3);
+  const exp = Math.min(now + 60, session.exp);
+  if (exp <= now) throw new Error("policy session has expired");
+  const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(publicKey) }, typ: "JWT", ucv: "0.10.0" };
+  const payload = {
+    att: { [input.resource]: { [input.action]: [input.caveat ?? {}] } },
+    aud: input.audienceDid,
+    exp,
+    fct: [input.facts ?? { type: "tinycloud.policy.invocation/v1", policyCid: session.fact.policyCid, sessionCid: session.cid }],
+    iss: input.recipientDid.includes("#") ? input.recipientDid : `${principal}#${principal.slice("did:key:".length)}`,
+    nbf: now,
+    nnc: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    prf: [session.cid]
+  };
+  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
+  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
+  const signingInput = new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`);
+  const signature = import_ed255192.ed25519.sign(signingInput, input.privateKey);
+  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
+}
+function createCompactPolicyDescendant(input) {
+  const parent = parseCompactUcanAuthorization(input.parentAuthorization, input.parentCid);
+  if (parent.payload.aud !== input.issuerDid) throw new Error("policy descendant issuer is not the parent audience");
+  const parentFact = parent.payload.fct[0];
+  const depth = parentFact.remainingRedelegationDepth;
+  if (!Number.isInteger(depth) || depth <= 0) throw new Error("policy descendant depth is exhausted");
+  if (!compactAttenuationContains(parent.payload.att, input.attenuation))
+    throw new Error("policy descendant exceeds the parent attenuation");
+  const principal = input.issuerDid.split("#", 1)[0];
+  const didMaterial = base58btc.decode(principal.slice("did:key:".length));
+  const publicKey = import_ed255192.ed25519.getPublicKey(input.privateKey);
+  if (didMaterial.length !== 34 || !equalBytes(publicKey, didMaterial.slice(2))) throw new Error("policy descendant signer does not bind issuer DID");
+  const now = Math.max(input.now ?? Math.floor(Date.now() / 1e3), parent.payload.nbf + 1);
+  const exp = Math.min(input.expiresAt ?? now + 60, now + 60, parent.payload.exp - 1);
+  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
+  const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(publicKey) }, typ: "JWT", ucv: "0.10.0" };
+  const payload = {
+    att: input.attenuation,
+    aud: input.audienceDid,
+    exp,
+    fct: [{ ...parentFact, remainingRedelegationDepth: depth - 1 }],
+    iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
+    nbf: now,
+    nnc: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    prf: [parent.cid]
+  };
+  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
+  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
+  const signature = import_ed255192.ed25519.sign(new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`), input.privateKey);
+  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
+}
+function compactAttenuationContains(parent, child) {
+  const selector = (value) => {
+    if (value.length !== 1 || !isRecordValue(value[0])) return void 0;
+    const caveat = value[0];
+    if (Object.keys(caveat).length !== 3 || caveat.type !== "xyz.tinycloud.resource/selector" || caveat.kind !== "exact" && caveat.kind !== "prefix" || typeof caveat.value !== "string") return void 0;
+    return { kind: caveat.kind, value: caveat.value };
+  };
+  const equal = (left, right) => jcsCanonicalize(left) === jcsCanonicalize(right);
+  return Object.entries(child).every(
+    ([childResource, childActions]) => Object.entries(childActions).every(
+      ([action, childCaveats]) => Object.entries(parent).some(([parentResource, parentActions]) => {
+        const parentCaveats = parentActions[action];
+        if (parentCaveats === void 0) return false;
+        if (parentResource === childResource && equal(parentCaveats, childCaveats)) return true;
+        const parentSelector = selector(parentCaveats);
+        const childSelector = selector(childCaveats);
+        return parentSelector?.kind === "prefix" && childSelector !== void 0 && parentSelector.value === parentResource && childSelector.value === childResource && (childResource === parentResource || childResource.startsWith(`${parentResource}/`));
+      })
+    )
+  );
+}
+function isRecordValue(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseCompactUcanAuthorization(input, expectedCid) {
+  if (typeof input !== "string" || /\s/.test(input))
+    throw new Error("Authorization must be compact UCAN bytes");
+  const segments = input.split(".");
+  if (segments.length !== 3 || segments.some((segment) => segment.length === 0))
+    throw new Error("Authorization must have three compact segments");
+  const [headerSegment, payloadSegment, signatureSegment] = segments;
+  const headerBytes = decodeBase64Url(headerSegment);
+  const payloadBytes = decodeBase64Url(payloadSegment);
+  const signature = decodeBase64Url(signatureSegment);
+  const headerValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(headerBytes));
+  const payloadValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(payloadBytes));
+  if (jcsCanonicalize(headerValue) !== new TextDecoder().decode(headerBytes) || jcsCanonicalize(payloadValue) !== new TextDecoder().decode(payloadBytes))
+    throw new Error("compact UCAN segments are not canonical JCS");
+  const header = CompactHeaderSchema.parse(headerValue);
+  const payload = CompactPayloadSchema.parse(payloadValue);
+  if (payload.nbf >= payload.exp) throw new Error("compact UCAN validity is empty");
+  const principal = payload.iss.split("#", 1)[0];
+  const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+  if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1)
+    throw new Error("compact UCAN issuer must be did:key Ed25519");
+  const publicKey = didMaterial.slice(2);
+  if (!equalBytes(publicKey, decodeBase64Url(header.jwk.x)))
+    throw new Error("compact UCAN JWK does not bind issuer");
+  if (!import_ed255192.ed25519.verify(signature, new TextEncoder().encode(`${headerSegment}.${payloadSegment}`), publicKey))
+    throw new Error("compact UCAN signature is invalid");
+  const cid = CID.createV1(85, create(30, (0, import_blake3.blake3)(new TextEncoder().encode(input)))).toString();
+  if (expectedCid !== void 0 && cid !== expectedCid)
+    throw new Error("compact UCAN CID does not match exact Authorization bytes");
+  return { authorization: input, cid, header, payload };
+}
+function parsePolicySessionUcan(authorization, expectedProofs) {
+  const parsed = parseCompactUcanAuthorization(authorization);
+  const fact = parsed.payload.fct[0];
+  if (parsed.payload.prf.length !== 2 || parsed.payload.prf[0] === parsed.payload.prf[1])
+    throw new Error("policy session UCAN requires two distinct ordered proofs");
+  if (expectedProofs !== void 0 && (parsed.payload.prf[0] !== expectedProofs[0] || parsed.payload.prf[1] !== expectedProofs[1]))
+    throw new Error("policy session UCAN ordered proofs do not match");
+  const factKeys = Object.keys(fact);
+  if (factKeys.length !== POLICY_SESSION_FACT_KEYS.length || factKeys.some((key) => !POLICY_SESSION_FACT_KEYS.includes(key)) || POLICY_SESSION_FACT_KEYS.some((key) => !(key in fact)))
+    throw new Error("policy session UCAN fact is incomplete");
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.enforcerDid || parsed.payload.aud !== fact.recipientDid)
+    throw new Error("policy session UCAN fact is invalid");
+  return {
+    authorization,
+    cid: parsed.cid,
+    iss: parsed.payload.iss,
+    aud: parsed.payload.aud,
+    prf: parsed.payload.prf,
+    att: parsed.payload.att,
+    nbf: parsed.payload.nbf,
+    exp: parsed.payload.exp,
+    nnc: parsed.payload.nnc,
+    fact
+  };
+}
+function decodeBase64Url(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1)
+    throw new Error("value is not canonical base64url");
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = typeof Buffer !== "undefined" ? Buffer.from(normalized, "base64").toString("binary") : atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "="));
+  const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  const encoded = typeof Buffer !== "undefined" ? Buffer.from(bytes).toString("base64url") : btoa(String.fromCharCode(...bytes)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  if (encoded !== value) throw new Error("value is not canonical base64url");
+  return bytes;
+}
+function encodeBase64Url(value) {
+  return typeof Buffer !== "undefined" ? Buffer.from(value).toString("base64url") : btoa(String.fromCharCode(...value)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function equalBytes(left, right) {
+  return left.length === right.length && left.every((byte, index) => byte === right[index]);
+}
+function hex(bytes) {
+  return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function base32Lower(bytes) {
+  const alphabet2 = "abcdefghijklmnopqrstuvwxyz234567";
+  let output = "";
+  let buffer = 0;
+  let bits = 0;
+  for (const byte of bytes) {
+    buffer = buffer << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += alphabet2[buffer >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) output += alphabet2[buffer << 5 - bits & 31];
+  return output;
+}
 //# sourceMappingURL=index.cjs.map