@tinycloud/sdk-core 2.11.0-beta.9 → 2.11.1-beta.0

package/dist/policy/index.js

@@ -323,16 +323,16 @@ function policyCapabilityContains(authority, request) {
   return caveatsContain(auth.caveats, req.caveats);
 }
 function normalizePolicyCapabilityWithOptions(input, options) {
-  const object = expectObject(input, "$");
-  assertExactKeys(object, ["service", "space", "path", "actions", "caveats"], "$");
-  const service = requiredString(object, "service", "$", "policy-capability-malformed-service");
+  const object2 = expectObject(input, "$");
+  assertExactKeys(object2, ["service", "space", "path", "actions", "caveats"], "$");
+  const service = requiredString(object2, "service", "$", "policy-capability-malformed-service");
   if (!CEILING_SERVICES.has(service)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-service",
       "$.service is outside the frozen permissionsCeiling vocabulary"
     );
   }
-  const space = requiredString(object, "space", "$", "policy-capability-malformed-space");
+  const space = requiredString(object2, "space", "$", "policy-capability-malformed-space");
   validateConcreteSpace(space);
   const canonicalSpace = space.normalize("NFC");
   if (options.requireCanonical && canonicalSpace !== space) {
@@ -341,7 +341,7 @@ function normalizePolicyCapabilityWithOptions(input, options) {
       "$.space must already be canonical NFC"
     );
   }
-  const rawPath = requiredString(object, "path", "$", "policy-capability-malformed-path");
+  const rawPath = requiredString(object2, "path", "$", "policy-capability-malformed-path");
   validateRawPath(rawPath, options);
   const path = normalizePath(rawPath);
   if (options.requireCanonical && path !== rawPath) {
@@ -352,7 +352,7 @@ function normalizePolicyCapabilityWithOptions(input, options) {
   }
   validateRawPath(path, options);
   const actions = normalizeActions(
-    requiredArray(object, "actions", "$", "policy-capability-malformed-action"),
+    requiredArray(object2, "actions", "$", "policy-capability-malformed-action"),
     service,
     options
   );
@@ -361,9 +361,9 @@ function normalizePolicyCapabilityWithOptions(input, options) {
   output.space = canonicalSpace;
   output.path = path;
   output.actions = actions;
-  if (hasOwn(object, "caveats")) {
+  if (hasOwn(object2, "caveats")) {
     output.caveats = validateCaveats(
-      requiredValue(object, "caveats", "$", "policy-capability-malformed-caveats"),
+      requiredValue(object2, "caveats", "$", "policy-capability-malformed-caveats"),
       output.service
     );
   }
@@ -386,9 +386,9 @@ function expectObject(input, path) {
     );
   }
 }
-function assertExactKeys(object, allowed, path) {
+function assertExactKeys(object2, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object)) {
+  for (const key of Object.keys(object2)) {
     if (!allowedSet.has(key)) {
       throw new PolicyCapabilityError(
         key === "id" || key === "scope" ? "policy-capability-malformed" : "policy-capability-unknown-key",
@@ -397,21 +397,21 @@ function assertExactKeys(object, allowed, path) {
     }
   }
 }
-function requiredValue(object, key, path, code2) {
-  if (!hasOwn(object, key)) {
+function requiredValue(object2, key, path, code2) {
+  if (!hasOwn(object2, key)) {
     throw new PolicyCapabilityError(code2, `${path}.${key} is required`);
   }
-  return object[key];
+  return object2[key];
 }
-function requiredString(object, key, path, code2) {
-  const value = requiredValue(object, key, path, code2);
+function requiredString(object2, key, path, code2) {
+  const value = requiredValue(object2, key, path, code2);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyCapabilityError(code2, `${path}.${key} must be a non-empty string`);
   }
   return value;
 }
-function requiredArray(object, key, path, code2) {
-  const value = requiredValue(object, key, path, code2);
+function requiredArray(object2, key, path, code2) {
+  const value = requiredValue(object2, key, path, code2);
   if (!Array.isArray(value)) {
     throw new PolicyCapabilityError(code2, `${path}.${key} must be an array`);
   }
@@ -556,11 +556,11 @@ function validateSqlStatement(input, path) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new PolicyCapabilityError("policy-capability-malformed-caveats", `${path} must be an object`);
   }
-  const object = input;
-  assertCaveatKeys(object, ["name", "sql", "fixedParams"], path);
-  caveatString(object, "name", path);
-  caveatString(object, "sql", path);
-  const fixedParams = requiredCaveat(object, "fixedParams", path);
+  const object2 = input;
+  assertCaveatKeys(object2, ["name", "sql", "fixedParams"], path);
+  caveatString(object2, "name", path);
+  caveatString(object2, "sql", path);
+  const fixedParams = requiredCaveat(object2, "fixedParams", path);
   if (!Array.isArray(fixedParams)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
@@ -575,20 +575,20 @@ function validateFixedParam(input, path) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new PolicyCapabilityError("policy-capability-malformed-caveats", `${path} must be an object`);
   }
-  const object = input;
-  assertCaveatKeys(object, ["index", "value"], path);
-  const index = requiredCaveat(object, "index", path);
+  const object2 = input;
+  assertCaveatKeys(object2, ["index", "value"], path);
+  const index = requiredCaveat(object2, "index", path);
   if (typeof index !== "number" || !Number.isSafeInteger(index) || index < 0) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
       `${path}.index must be a non-negative integer`
     );
   }
-  requiredCaveat(object, "value", path);
+  requiredCaveat(object2, "value", path);
 }
-function assertCaveatKeys(object, allowed, path) {
+function assertCaveatKeys(object2, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object)) {
+  for (const key of Object.keys(object2)) {
     if (!allowedSet.has(key)) {
       throw new PolicyCapabilityError(
         "policy-capability-malformed-caveats",
@@ -597,17 +597,17 @@ function assertCaveatKeys(object, allowed, path) {
     }
   }
 }
-function requiredCaveat(object, key, path) {
-  if (!hasOwn(object, key)) {
+function requiredCaveat(object2, key, path) {
+  if (!hasOwn(object2, key)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
       `${path}.${key} is required`
     );
   }
-  return object[key];
+  return object2[key];
 }
-function caveatString(object, key, path) {
-  const value = requiredCaveat(object, key, path);
+function caveatString(object2, key, path) {
+  const value = requiredCaveat(object2, key, path);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
@@ -638,8 +638,8 @@ function caveatsContain(authority, request) {
     (statement) => authorityStatements.some((candidate) => jcsCanonicalize(candidate) === jcsCanonicalize(statement))
   );
 }
-function hasOwn(object, key) {
-  return objectHasOwn2(object, key);
+function hasOwn(object2, key) {
+  return objectHasOwn2(object2, key);
 }
 
 // src/policy/signed-object.ts
@@ -1798,7 +1798,7 @@ var hashes = { ...sha2_browser_exports, ...identity_exports2 };
 import { bytesToHex as bytesToHex2, sha256 as sha2563, verifyMessage } from "viem";
 
 // src/identity.ts
-import { getAddress, isAddress } from "viem";
+import { getAddress, isAddress, recoverMessageAddress } from "viem";
 var IdentityParseError = class extends Error {
   constructor(message) {
     super(message);
@@ -1909,17 +1909,17 @@ async function createAndSignSignedObject(input, signer) {
 }
 function createAndSignPolicy(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object) => validatePolicySignedShape(object)
+    (object2) => validatePolicySignedShape(object2)
   );
 }
 function createAndSignPolicyStatus(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object) => validatePolicyStatusSignedShape(object)
+    (object2) => validatePolicyStatusSignedShape(object2)
   );
 }
 function createAndSignPolicyEngineRecord(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object) => validatePolicyEngineRecordSignedShape(object)
+    (object2) => validatePolicyEngineRecordSignedShape(object2)
   );
 }
 async function verifySignedObject(input) {
@@ -2023,9 +2023,9 @@ function validateUnsignedForDescriptor(input, descriptor) {
   }
 }
 function validatePolicyShape(input, signed) {
-  const object = expectJsonObject(normalizeJson(input), "$");
+  const object2 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object,
+    object2,
     signed ? [
       "schema",
       "policyId",
@@ -2053,30 +2053,30 @@ function validatePolicyShape(input, signed) {
     ],
     "$"
   );
-  expectConst(requiredString2(object, "schema", "$"), POLICY_SCHEMA, "$.schema");
+  expectConst(requiredString2(object2, "schema", "$"), POLICY_SCHEMA, "$.schema");
   if (signed) {
-    requiredString2(object, "policyId", "$");
-    validateSignature(requiredValue2(object, "signature", "$"));
+    requiredString2(object2, "policyId", "$");
+    validateSignature(requiredValue2(object2, "signature", "$"));
   }
-  requiredString2(object, "ownerDid", "$");
-  requiredString2(object, "signingKeyDid", "$");
-  requiredDateString(object, "createdAt", "$");
-  optionalDateString(object, "expiresAt", "$");
-  validatePolicyResource(requiredValue2(object, "resource", "$"), "$.resource");
-  validateExpression(requiredValue2(object, "when", "$"), "$.when");
-  validateGrant(requiredValue2(object, "grant", "$"), "$.grant");
-  if (hasOwn2(object, "disclosure")) {
-    validateDisclosure(requiredValue2(object, "disclosure", "$"), "$.disclosure");
+  requiredString2(object2, "ownerDid", "$");
+  requiredString2(object2, "signingKeyDid", "$");
+  requiredDateString(object2, "createdAt", "$");
+  optionalDateString(object2, "expiresAt", "$");
+  validatePolicyResource(requiredValue2(object2, "resource", "$"), "$.resource");
+  validateExpression(requiredValue2(object2, "when", "$"), "$.when");
+  validateGrant(requiredValue2(object2, "grant", "$"), "$.grant");
+  if (hasOwn2(object2, "disclosure")) {
+    validateDisclosure(requiredValue2(object2, "disclosure", "$"), "$.disclosure");
   }
-  if (hasOwn2(object, "audit")) {
-    validateAudit(requiredValue2(object, "audit", "$"), "$.audit");
+  if (hasOwn2(object2, "audit")) {
+    validateAudit(requiredValue2(object2, "audit", "$"), "$.audit");
   }
-  return object;
+  return object2;
 }
 function validatePolicyStatusShape(input, signed) {
-  const object = expectJsonObject(normalizeJson(input), "$");
+  const object2 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object,
+    object2,
     signed ? [
       "schema",
       "statusId",
@@ -2100,28 +2100,28 @@ function validatePolicyStatusShape(input, signed) {
     ],
     "$"
   );
-  expectConst(requiredString2(object, "schema", "$"), POLICY_STATUS_SCHEMA, "$.schema");
+  expectConst(requiredString2(object2, "schema", "$"), POLICY_STATUS_SCHEMA, "$.schema");
   if (signed) {
-    requiredString2(object, "statusId", "$");
-    validateSignature(requiredValue2(object, "signature", "$"));
+    requiredString2(object2, "statusId", "$");
+    validateSignature(requiredValue2(object2, "signature", "$"));
   }
-  requiredString2(object, "policyId", "$");
-  requiredString2(object, "ownerDid", "$");
-  requiredInteger(object, "sequence", "$", 0);
-  expectOneOf(requiredString2(object, "disposition", "$"), [
+  requiredString2(object2, "policyId", "$");
+  requiredString2(object2, "ownerDid", "$");
+  requiredInteger(object2, "sequence", "$", 0);
+  expectOneOf(requiredString2(object2, "disposition", "$"), [
     "active",
     "suspended",
     "revoked"
   ], "$.disposition");
-  requiredDateString(object, "effectiveAt", "$");
-  optionalString(object, "reasonCode", "$");
-  requiredString2(object, "signingKeyDid", "$");
-  return object;
+  requiredDateString(object2, "effectiveAt", "$");
+  optionalString(object2, "reasonCode", "$");
+  requiredString2(object2, "signingKeyDid", "$");
+  return object2;
 }
 function validatePolicyEngineRecordShape(input, signed) {
-  const object = expectJsonObject(normalizeJson(input), "$");
+  const object2 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object,
+    object2,
     signed ? [
       "schema",
       "engineRecordId",
@@ -2146,44 +2146,44 @@ function validatePolicyEngineRecordShape(input, signed) {
     "$"
   );
   expectConst(
-    requiredString2(object, "schema", "$"),
+    requiredString2(object2, "schema", "$"),
     POLICY_ENGINE_RECORD_SCHEMA,
     "$.schema"
   );
   if (signed) {
-    requiredString2(object, "engineRecordId", "$");
-    validateSignature(requiredValue2(object, "signature", "$"));
+    requiredString2(object2, "engineRecordId", "$");
+    validateSignature(requiredValue2(object2, "signature", "$"));
   }
-  requiredString2(object, "ownerDid", "$");
-  requiredString2(object, "endpoint", "$");
-  requiredString2(object, "audience", "$");
+  requiredString2(object2, "ownerDid", "$");
+  requiredString2(object2, "endpoint", "$");
+  requiredString2(object2, "audience", "$");
   requiredStringArray(
-    object,
+    object2,
     "supportedPolicyVersions",
     "$",
     (value, path) => expectConst(value, "v0", path)
   );
-  requiredStringArray(object, "supportedEvidenceVerifiers", "$");
-  requiredString2(object, "grantIssuerDid", "$");
-  requiredDateString(object, "expiresAt", "$");
-  return object;
+  requiredStringArray(object2, "supportedEvidenceVerifiers", "$");
+  requiredString2(object2, "grantIssuerDid", "$");
+  requiredDateString(object2, "expiresAt", "$");
+  return object2;
 }
 function validateSignature(input) {
-  const object = expectJsonObject(input, "$.signature");
-  assertExactKeys2(object, ["suite", "signerDid", "value"], "$.signature");
-  const suite = requiredString2(object, "suite", "$.signature");
+  const object2 = expectJsonObject(input, "$.signature");
+  assertExactKeys2(object2, ["suite", "signerDid", "value"], "$.signature");
+  const suite = requiredString2(object2, "suite", "$.signature");
   assertSupportedSignatureSuite(suite);
-  const signerDid = requiredString2(object, "signerDid", "$.signature");
-  const value = requiredString2(object, "value", "$.signature");
+  const signerDid = requiredString2(object2, "signerDid", "$.signature");
+  const value = requiredString2(object2, "value", "$.signature");
   decodeSignatureValue(value, suite);
   return { suite, signerDid, value };
 }
 function validatePolicyResource(input, path) {
-  const object = expectJsonObject(input, path);
-  assertExactKeys2(object, ["resourceType", "resourceId", "permissionsCeiling"], path);
-  requiredString2(object, "resourceType", path);
-  requiredString2(object, "resourceId", path);
-  const ceiling = requiredArray2(object, "permissionsCeiling", path, 1);
+  const object2 = expectJsonObject(input, path);
+  assertExactKeys2(object2, ["resourceType", "resourceId", "permissionsCeiling"], path);
+  requiredString2(object2, "resourceType", path);
+  requiredString2(object2, "resourceId", path);
+  const ceiling = requiredArray2(object2, "permissionsCeiling", path, 1);
   for (let index = 0; index < ceiling.length; index++) {
     validatePolicyCapability(ceiling[index], `${path}.permissionsCeiling[${index}]`);
   }
@@ -2199,10 +2199,10 @@ function validatePolicyPermissionsCeilingForSigning(input) {
   }
 }
 function validatePolicyCapability(input, path) {
-  const object = expectJsonObject(input, path);
+  const object2 = expectJsonObject(input, path);
   try {
-    const canonical = canonicalizePolicyCapability(object);
-    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {
+    const canonical = canonicalizePolicyCapability(object2);
+    if (jcsCanonicalize(object2) !== jcsCanonicalize(canonical)) {
       throw new SignedObjectSchemaError(`${path} must be canonical PolicyCapability JSON`);
     }
   } catch (error) {
@@ -2215,10 +2215,10 @@ function validatePolicyCapability(input, path) {
   }
 }
 function validatePolicyCapabilityForSigning(input, path) {
-  const object = expectJsonObject(input, path);
+  const object2 = expectJsonObject(input, path);
   try {
-    const canonical = normalizePolicyCapability(object);
-    if (jcsCanonicalize(object) !== jcsCanonicalize(canonical)) {
+    const canonical = normalizePolicyCapability(object2);
+    if (jcsCanonicalize(object2) !== jcsCanonicalize(canonical)) {
       throw new SignedObjectSchemaError(`${path} must be strict canonical PolicyCapability JSON`);
     }
   } catch (error) {
@@ -2231,43 +2231,43 @@ function validatePolicyCapabilityForSigning(input, path) {
   }
 }
 function validateExpression(input, path) {
-  const object = expectJsonObject(input, path);
-  const keys = Object.keys(object);
+  const object2 = expectJsonObject(input, path);
+  const keys = Object.keys(object2);
   if (keys.length !== 1) {
     throw new SignedObjectSchemaError(`${path} must have exactly one expression key`);
   }
   const key = keys[0];
   if (key === "allOf" || key === "anyOf") {
-    const values = requiredArray2(object, key, path, 1);
+    const values = requiredArray2(object2, key, path, 1);
     for (let index = 0; index < values.length; index++) {
       validateExpression(values[index], `${path}.${key}[${index}]`);
     }
     return;
   }
   if (key === "subject") {
-    const subject = expectJsonObject(requiredValue2(object, "subject", path), `${path}.subject`);
+    const subject = expectJsonObject(requiredValue2(object2, "subject", path), `${path}.subject`);
     assertExactKeys2(subject, ["did"], `${path}.subject`);
     requiredString2(subject, "did", `${path}.subject`);
     return;
   }
   if (key === "evidence") {
-    validateEvidenceRequirement(requiredValue2(object, "evidence", path), `${path}.evidence`);
+    validateEvidenceRequirement(requiredValue2(object2, "evidence", path), `${path}.evidence`);
     return;
   }
   throw new SignedObjectSchemaError(`${path} has unknown expression key ${key}`);
 }
 function validateEvidenceRequirement(input, path) {
-  const object = expectJsonObject(input, path);
+  const object2 = expectJsonObject(input, path);
   assertExactKeys2(
-    object,
+    object2,
     ["requirementId", "verifier", "requirements", "authority", "freshness"],
     path
   );
-  requiredString2(object, "requirementId", path);
-  requiredString2(object, "verifier", path);
-  requiredValue2(object, "requirements", path);
-  if (hasOwn2(object, "authority")) {
-    const authority = expectJsonObject(requiredValue2(object, "authority", path), `${path}.authority`);
+  requiredString2(object2, "requirementId", path);
+  requiredString2(object2, "verifier", path);
+  requiredValue2(object2, "requirements", path);
+  if (hasOwn2(object2, "authority")) {
+    const authority = expectJsonObject(requiredValue2(object2, "authority", path), `${path}.authority`);
     assertExactKeys2(
       authority,
       ["profile", "acceptedIssuers", "allowOwnerAuthorizedIssuer"],
@@ -2279,35 +2279,35 @@ function validateEvidenceRequirement(input, path) {
     }
     optionalBoolean(authority, "allowOwnerAuthorizedIssuer", `${path}.authority`);
   }
-  if (hasOwn2(object, "freshness")) {
-    const freshness = expectJsonObject(requiredValue2(object, "freshness", path), `${path}.freshness`);
+  if (hasOwn2(object2, "freshness")) {
+    const freshness = expectJsonObject(requiredValue2(object2, "freshness", path), `${path}.freshness`);
     assertExactKeys2(freshness, ["maxStatusAgeSeconds"], `${path}.freshness`);
     requiredInteger(freshness, "maxStatusAgeSeconds", `${path}.freshness`, 0);
   }
 }
 function validateGrant(input, path) {
-  const object = expectJsonObject(input, path);
-  assertExactKeys2(object, ["output", "maxTtlSeconds", "delegationMode", "revocation"], path);
-  expectConst(requiredString2(object, "output", path), "portable-delegation", `${path}.output`);
-  requiredInteger(object, "maxTtlSeconds", path, 1);
-  expectOneOf(requiredString2(object, "delegationMode", path), [
+  const object2 = expectJsonObject(input, path);
+  assertExactKeys2(object2, ["output", "maxTtlSeconds", "delegationMode", "revocation"], path);
+  expectConst(requiredString2(object2, "output", path), "portable-delegation", `${path}.output`);
+  requiredInteger(object2, "maxTtlSeconds", path, 1);
+  expectOneOf(requiredString2(object2, "delegationMode", path), [
     "terminal",
     "attenuable"
   ], `${path}.delegationMode`);
-  expectOneOf(requiredString2(object, "revocation", path), [
+  expectOneOf(requiredString2(object2, "revocation", path), [
     "refresh_only",
     "active_cutoff"
   ], `${path}.revocation`);
 }
 function validateDisclosure(input, path) {
-  const object = expectJsonObject(input, path);
-  assertExactKeys2(object, ["denial"], path);
-  expectOneOf(requiredString2(object, "denial", path), ["none", "code", "debug"], `${path}.denial`);
+  const object2 = expectJsonObject(input, path);
+  assertExactKeys2(object2, ["denial"], path);
+  expectOneOf(requiredString2(object2, "denial", path), ["none", "code", "debug"], `${path}.denial`);
 }
 function validateAudit(input, path) {
-  const object = expectJsonObject(input, path);
-  assertExactKeys2(object, ["issuance"], path);
-  expectOneOf(requiredString2(object, "issuance", path), ["off", "security", "full"], `${path}.issuance`);
+  const object2 = expectJsonObject(input, path);
+  assertExactKeys2(object2, ["issuance"], path);
+  expectOneOf(requiredString2(object2, "issuance", path), ["off", "security", "full"], `${path}.issuance`);
 }
 function materialForUnsigned(unsigned, descriptor) {
   const jcs = jcsCanonicalize(unsigned);
@@ -2456,9 +2456,9 @@ function encodeSignatureValue(value, suite) {
   decodeSignatureValue(encoded, suite);
   return encoded;
 }
-function stripOwnIdAndSignature(object, descriptor) {
+function stripOwnIdAndSignature(object2, descriptor) {
   const output = /* @__PURE__ */ Object.create(null);
-  for (const [key, value] of Object.entries(object)) {
+  for (const [key, value] of Object.entries(object2)) {
     if (key === descriptor.idField || key === "signature") {
       continue;
     }
@@ -2467,8 +2467,8 @@ function stripOwnIdAndSignature(object, descriptor) {
   return output;
 }
 function descriptorForUnsigned(input) {
-  const object = expectJsonObject(normalizeJson(input), "$");
-  return descriptorForSchema(requiredString2(object, "schema", "$"));
+  const object2 = expectJsonObject(normalizeJson(input), "$");
+  return descriptorForSchema(requiredString2(object2, "schema", "$"));
 }
 function descriptorForSchema(schema) {
   if (schema === POLICY_SCHEMA) return DESCRIPTORS.Policy;
@@ -2482,28 +2482,28 @@ function expectJsonObject(input, path) {
   }
   return input;
 }
-function assertExactKeys2(object, allowed, path) {
+function assertExactKeys2(object2, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object)) {
+  for (const key of Object.keys(object2)) {
     if (!allowedSet.has(key)) {
       throw new SignedObjectSchemaError(`${path} has unknown field ${key}`);
     }
   }
 }
-function requiredValue2(object, key, path) {
-  if (!hasOwn2(object, key)) {
+function requiredValue2(object2, key, path) {
+  if (!hasOwn2(object2, key)) {
     throw new SignedObjectSchemaError(`${path}.${key} is required`);
   }
-  return object[key];
+  return object2[key];
 }
-function requiredString2(object, key, path) {
-  return requireStringType(requiredValue2(object, key, path), `${path}.${key}`);
+function requiredString2(object2, key, path) {
+  return requireStringType(requiredValue2(object2, key, path), `${path}.${key}`);
 }
-function optionalString(object, key, path) {
-  if (!hasOwn2(object, key)) {
+function optionalString(object2, key, path) {
+  if (!hasOwn2(object2, key)) {
     return;
   }
-  requireStringType(requiredValue2(object, key, path), `${path}.${key}`);
+  requireStringType(requiredValue2(object2, key, path), `${path}.${key}`);
 }
 function requireStringType(value, path) {
   if (typeof value !== "string" || value.length === 0) {
@@ -2511,16 +2511,16 @@ function requireStringType(value, path) {
   }
   return value;
 }
-function optionalBoolean(object, key, path) {
-  if (!hasOwn2(object, key)) {
+function optionalBoolean(object2, key, path) {
+  if (!hasOwn2(object2, key)) {
     return;
   }
-  if (typeof requiredValue2(object, key, path) !== "boolean") {
+  if (typeof requiredValue2(object2, key, path) !== "boolean") {
     throw new SignedObjectSchemaError(`${path}.${key} must be a boolean`);
   }
 }
-function requiredInteger(object, key, path, minimum) {
-  const value = requiredValue2(object, key, path);
+function requiredInteger(object2, key, path, minimum) {
+  const value = requiredValue2(object2, key, path);
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum) {
     throw new SignedObjectSchemaError(
       `${path}.${key} must be an integer >= ${minimum}`
@@ -2528,8 +2528,8 @@ function requiredInteger(object, key, path, minimum) {
   }
   return value;
 }
-function requiredArray2(object, key, path, minimum) {
-  const value = requiredValue2(object, key, path);
+function requiredArray2(object2, key, path, minimum) {
+  const value = requiredValue2(object2, key, path);
   if (!Array.isArray(value) || value.length < minimum) {
     throw new SignedObjectSchemaError(
       `${path}.${key} must be an array with at least ${minimum} item(s)`
@@ -2537,22 +2537,22 @@ function requiredArray2(object, key, path, minimum) {
   }
   return value;
 }
-function requiredStringArray(object, key, path, check) {
-  const values = requiredArray2(object, key, path, 0);
+function requiredStringArray(object2, key, path, check) {
+  const values = requiredArray2(object2, key, path, 0);
   for (let index = 0; index < values.length; index++) {
     const itemPath = `${path}.${key}[${index}]`;
     const value = requireStringType(values[index], itemPath);
     check?.(value, itemPath);
   }
 }
-function requiredDateString(object, key, path) {
-  assertRfc3339(requiredString2(object, key, path), `${path}.${key}`);
+function requiredDateString(object2, key, path) {
+  assertRfc3339(requiredString2(object2, key, path), `${path}.${key}`);
 }
-function optionalDateString(object, key, path) {
-  if (!hasOwn2(object, key)) {
+function optionalDateString(object2, key, path) {
+  if (!hasOwn2(object2, key)) {
     return;
   }
-  assertRfc3339(requiredString2(object, key, path), `${path}.${key}`);
+  assertRfc3339(requiredString2(object2, key, path), `${path}.${key}`);
 }
 function assertRfc3339(value, path) {
   const match = value.match(
@@ -2584,8 +2584,8 @@ function expectOneOf(actual, allowed, path) {
   }
   throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);
 }
-function hasOwn2(object, key) {
-  return objectHasOwn3(object, key);
+function hasOwn2(object2, key) {
+  return objectHasOwn3(object2, key);
 }
 function assertSupportedSignatureSuite(suite) {
   if (suite !== ED25519_JCS_SIGNATURE_SUITE && suite !== EIP191_JCS_SIGNATURE_SUITE) {
@@ -2664,13 +2664,13 @@ function base64UrlDecode(value) {
   return decoded;
 }
 function hexToBytes(value) {
-  const hex = value.slice(2);
-  if (hex.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex)) {
+  const hex3 = value.slice(2);
+  if (hex3.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex3)) {
     throw new SignatureMaterialError("hex signature must have even length");
   }
-  const output = new Uint8Array(hex.length / 2);
+  const output = new Uint8Array(hex3.length / 2);
   for (let index = 0; index < output.length; index++) {
-    output[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
+    output[index] = Number.parseInt(hex3.slice(index * 2, index * 2 + 2), 16);
   }
   return output;
 }
@@ -3021,9 +3021,9 @@ function expectPolicyEngineRecord(input) {
     );
   }
 }
-function assertExactKeys3(object, allowed, path) {
+function assertExactKeys3(object2, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object)) {
+  for (const key of Object.keys(object2)) {
     if (!allowedSet.has(key)) {
       throw new PolicyAuthoringError(
         "policy-authoring-unknown-key",
@@ -3032,17 +3032,17 @@ function assertExactKeys3(object, allowed, path) {
     }
   }
 }
-function requiredValue3(object, key, path) {
-  if (!hasOwn3(object, key)) {
+function requiredValue3(object2, key, path) {
+  if (!hasOwn3(object2, key)) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
       `${path}.${key} is required`
     );
   }
-  return object[key];
+  return object2[key];
 }
-function requiredString3(object, key, path) {
-  const value = requiredValue3(object, key, path);
+function requiredString3(object2, key, path) {
+  const value = requiredValue3(object2, key, path);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
@@ -3051,11 +3051,11 @@ function requiredString3(object, key, path) {
   }
   return value;
 }
-function fieldString(object, key, path, code2) {
-  if (!hasOwn3(object, key)) {
+function fieldString(object2, key, path, code2) {
+  if (!hasOwn3(object2, key)) {
     throw new PolicyAuthoringError(code2, `${path}.${key} is required`);
   }
-  const value = object[key];
+  const value = object2[key];
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyAuthoringError(
       code2,
@@ -3064,8 +3064,8 @@ function fieldString(object, key, path, code2) {
   }
   return value;
 }
-function requiredObject(object, key, path) {
-  const value = requiredValue3(object, key, path);
+function requiredObject(object2, key, path) {
+  const value = requiredValue3(object2, key, path);
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
@@ -3074,8 +3074,8 @@ function requiredObject(object, key, path) {
   }
   return value;
 }
-function requiredArray3(object, key, path) {
-  const value = requiredValue3(object, key, path);
+function requiredArray3(object2, key, path) {
+  const value = requiredValue3(object2, key, path);
   if (!Array.isArray(value)) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
@@ -3084,8 +3084,8 @@ function requiredArray3(object, key, path) {
   }
   return value;
 }
-function requiredStringArray2(object, key, path) {
-  const values = requiredArray3(object, key, path);
+function requiredStringArray2(object2, key, path) {
+  const values = requiredArray3(object2, key, path);
   return values.map((value, index) => {
     if (typeof value !== "string" || value.length === 0) {
       throw new PolicyAuthoringError(
@@ -3182,19 +3182,1086 @@ function parseStrictRfc3339(value, path) {
 var objectHasOwn4 = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
   Object.prototype.hasOwnProperty
 );
-function hasOwn3(object, key) {
-  return objectHasOwn4(object, key);
+function hasOwn3(object2, key) {
+  return objectHasOwn4(object2, key);
+}
+
+// src/policy/unified.ts
+import { sha256 as sha2564 } from "@noble/hashes/sha256";
+import { blake3 } from "@noble/hashes/blake3";
+import { ed25519 as ed255192 } from "@noble/curves/ed25519";
+import { z } from "zod";
+var POLICY_V1_SCHEMA = "xyz.tinycloud.policy/policy/v1";
+var POLICY_CAPABILITY_V1_SCHEMA = "xyz.tinycloud.policy/capability/v1";
+var POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA = "xyz.tinycloud.policy/enforcement-delegation/v2";
+var ATTESTED_ENFORCER_BINDING_V2_SCHEMA = "xyz.tinycloud.policy/attested-enforcer/v2";
+var ROOT_STATUS_CHECKPOINT_V1_SCHEMA = "xyz.tinycloud.policy/root-status/v1";
+var ROOT_REVOCATION_V1_SCHEMA = "xyz.tinycloud.policy/root-revocation/v1";
+var POLICY_SESSION_UCAN_V1_PROFILE = "policy-session-ucan/v1";
+var POLICY_V1_DOMAIN = "xyz.tinycloud.policy/policy/v1\0";
+var POLICY_CAPABILITY_V1_DOMAIN = "xyz.tinycloud.policy/PolicyCapability/v1\0";
+var CONTENT_SOURCE_V1_DOMAIN = "xyz.tinycloud.policy/ContentSource/v1\0";
+var NATIVE_PROJECTION_V1_DOMAIN = "xyz.tinycloud.policy/NativeProjection/v1\0";
+var ROOT_STATUS_V1_DOMAIN = "xyz.tinycloud.policy/RootStatusCheckpoint/v1\0";
+var ROOT_STATUS_RENEWAL_V1_DOMAIN = "xyz.tinycloud.policy/RootStatusRenewal/v1\0";
+var ROOT_REVOCATION_V1_DOMAIN = "xyz.tinycloud.policy/RootRevocation/v1\0";
+var LAST_V2_CREATE_AT = "2026-09-30T00:00:00Z";
+var MAX_LEGACY_ENVELOPE_EXPIRES_AT = "2026-12-29T00:00:00Z";
+var LAST_V2_READ_AT = "2027-01-05T00:00:00Z";
+async function requestPolicyChallengeV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const response = await fetchFn(new URL("/share/v3/policy/challenges", input.nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ policyCid: input.policyCid, recipientDid: input.recipientDid, requestedCapabilities: input.requestedCapabilities.map(normalizeUnifiedPolicyCapability) })
+  });
+  if (!response.ok) throw new Error(`policy challenge rejected (${response.status})`);
+  const value = object(await response.json(), "policy challenge");
+  if (typeof value.challengeId !== "string" || typeof value.nonce !== "string" || value.policyCid !== input.policyCid || value.recipientDid !== input.recipientDid)
+    throw new Error("policy challenge binding is invalid");
+  return value;
+}
+async function mintPolicySessionV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const challenge = input.challenge ?? await requestPolicyChallengeV3(input);
+  if (challenge.policyCid !== input.policyCid || challenge.recipientDid !== input.recipientDid)
+    throw new Error("policy challenge binding is invalid");
+  const response = await fetchFn(new URL("/share/v3/policy/delegations", input.nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ policyCid: input.policyCid, challengeId: challenge.challengeId, nonce: challenge.nonce, claim: input.claim, presentation: input.presentation })
+  });
+  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  const value = object(await response.json(), "policy delegation");
+  if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string")
+    throw new Error("policy delegation response is invalid");
+  const session = parsePolicySessionUcan(value.authorization, [input.policyRootCid, input.enforcementRootCid]);
+  const expectedAttenuation = compactAttenuationForPolicyCapabilities(input.requestedCapabilities);
+  if (session.cid !== value.sessionCid || session.aud !== input.recipientDid || session.fact.policyCid !== input.policyCid || session.fact.recipientDid !== input.recipientDid || session.fact.policyDelegationCid !== input.policyRootCid || session.fact.enforcementDelegationCid !== input.enforcementRootCid || jcsCanonicalize(session.att) !== jcsCanonicalize(expectedAttenuation) || Object.entries(input.expectedFacts ?? {}).some(([key, expected]) => session.fact[key] !== expected))
+    throw new Error("policy delegation signed binding is invalid");
+  return session;
+}
+function compactAttenuationForPolicyCapabilities(input) {
+  const attenuation = {};
+  for (const raw of input) {
+    const capability = normalizeUnifiedPolicyCapability(raw);
+    if (attenuation[capability.resource] !== void 0)
+      throw new Error("policy capabilities contain a duplicate resource");
+    attenuation[capability.resource] = capability.kind === "encryption" ? { [capability.action]: [{}] } : Object.fromEntries(capability.actions.map((action) => [action, [{
+      type: "xyz.tinycloud.resource/selector",
+      kind: capability.selector,
+      value: capability.resource
+    }]]));
+  }
+  return attenuation;
+}
+function verifyPolicyRootStatusCheckpointV3(input) {
+  const checkpoint = input.checkpoint;
+  const allowed = /* @__PURE__ */ new Set(["schema", "targetCid", "targetRole", "ownerDid", "nodeAudience", "state", "sequence", "checkedAt", "freshUntil", "revokedAt", "revocationCid", "previousCheckpointDigestHex", "issuerDid", "signature"]);
+  if (Object.keys(checkpoint).some((key) => !allowed.has(key)) || checkpoint.schema !== ROOT_STATUS_CHECKPOINT_V1_SCHEMA || checkpoint.targetCid !== input.rootCid || checkpoint.targetRole !== "policy-authority" && checkpoint.targetRole !== "policy-enforcement" || checkpoint.state !== "active" && checkpoint.state !== "revoked" || typeof checkpoint.ownerDid !== "string" || typeof checkpoint.nodeAudience !== "string" || checkpoint.issuerDid !== checkpoint.nodeAudience || input.expectedNodeAudience !== void 0 && checkpoint.nodeAudience !== input.expectedNodeAudience || !Number.isInteger(checkpoint.sequence) || checkpoint.sequence < 1 || typeof checkpoint.checkedAt !== "string" || typeof checkpoint.freshUntil !== "string") return false;
+  const checkedAt = Date.parse(checkpoint.checkedAt);
+  const freshUntil = Date.parse(checkpoint.freshUntil);
+  const now = (input.now ?? /* @__PURE__ */ new Date()).getTime();
+  if (!Number.isFinite(checkedAt) || !Number.isFinite(freshUntil) || freshUntil < now || freshUntil <= checkedAt || freshUntil - checkedAt > 3e5) return false;
+  if (checkpoint.sequence === 1 !== (checkpoint.previousCheckpointDigestHex === void 0)) return false;
+  if (checkpoint.sequence !== 1 && (typeof checkpoint.previousCheckpointDigestHex !== "string" || !/^[0-9a-f]{64}$/.test(checkpoint.previousCheckpointDigestHex))) return false;
+  if (checkpoint.state === "active" && (checkpoint.revokedAt !== void 0 || checkpoint.revocationCid !== void 0)) return false;
+  if (checkpoint.state === "revoked" && (typeof checkpoint.revokedAt !== "string" || typeof checkpoint.revocationCid !== "string")) return false;
+  const signature = checkpoint.signature;
+  if (!isRecordValue(signature) || Object.keys(signature).length !== 3 || signature.suite !== "Ed25519" || signature.signerDid !== checkpoint.issuerDid || typeof signature.value !== "string") return false;
+  try {
+    const principal = checkpoint.issuerDid.split("#", 1)[0];
+    const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+    if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1) return false;
+    const unsigned = { ...checkpoint };
+    delete unsigned.signature;
+    return ed255192.verify(
+      decodeBase64Url(signature.value),
+      sha2564(new TextEncoder().encode(ROOT_STATUS_V1_DOMAIN + jcsCanonicalize(unsigned))),
+      didMaterial.slice(2)
+    );
+  } catch {
+    return false;
+  }
+}
+async function getPolicyRootStatusV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const response = await fetchFn(new URL(`/share/v3/policy/status/${encodeURIComponent(input.rootCid)}`, input.nodeOrigin), {
+    method: "GET",
+    redirect: "error",
+    headers: { accept: "application/json" }
+  });
+  if (!response.ok) throw new Error(`policy root status rejected (${response.status})`);
+  const value = object(await response.json(), "policy root status");
+  const checkpoint = object(value.checkpoint, "policy root checkpoint");
+  if (value.rootCid !== input.rootCid || value.state !== "active" && value.state !== "revoked" || value.state !== checkpoint.state || !verifyPolicyRootStatusCheckpointV3({ rootCid: input.rootCid, checkpoint, expectedNodeAudience: input.expectedNodeAudience, now: input.now }))
+    throw new Error("policy root status binding is invalid");
+  const revocation = value.revocation === void 0 ? void 0 : object(value.revocation, "policy root revocation");
+  if (value.state === "revoked" !== (revocation !== void 0) || revocation !== void 0 && !verifyPolicyRootRevocationV3({
+    rootCid: input.rootCid,
+    checkpoint,
+    revocation,
+    expectedEnforcerDid: input.expectedEnforcerDid
+  })) throw new Error("policy root status revocation evidence is invalid");
+  return { rootCid: input.rootCid, state: value.state, checkpoint, ...revocation === void 0 ? {} : { revocation } };
+}
+function verifyPolicyRootRevocationV3(input) {
+  const value = input.revocation;
+  const allowed = ["schema", "targetCid", "targetRole", "ownerDid", "nodeAudience", "revokedAt", "reason", "issuerDid", "signature"];
+  if (Object.keys(value).length !== allowed.length || Object.keys(value).some((key) => !allowed.includes(key)) || value.schema !== ROOT_REVOCATION_V1_SCHEMA || value.targetCid !== input.rootCid || value.targetRole !== input.checkpoint.targetRole || value.ownerDid !== input.checkpoint.ownerDid || value.nodeAudience !== input.checkpoint.nodeAudience || value.revokedAt !== input.checkpoint.revokedAt || typeof value.reason !== "string" || value.reason.length === 0 || typeof value.issuerDid !== "string") return false;
+  const authorized = value.issuerDid === value.ownerDid || value.targetRole === "policy-enforcement" && value.issuerDid === input.expectedEnforcerDid;
+  if (!authorized) return false;
+  const signature = value.signature;
+  if (!isRecordValue(signature) || Object.keys(signature).length !== 3 || signature.suite !== "Ed25519" || signature.signerDid !== value.issuerDid || typeof signature.value !== "string") return false;
+  try {
+    const principal = value.issuerDid.split("#", 1)[0];
+    const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+    if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1) return false;
+    const unsigned = { ...value };
+    delete unsigned.signature;
+    const digest2 = sha2564(new TextEncoder().encode(ROOT_REVOCATION_V1_DOMAIN + jcsCanonicalize(unsigned)));
+    return input.checkpoint.revocationCid === hex(digest2) && ed255192.verify(decodeBase64Url(signature.value), digest2, didMaterial.slice(2));
+  } catch {
+    return false;
+  }
+}
+async function renewPolicyRootStatusV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const current = await getPolicyRootStatusV3({ nodeOrigin: input.nodeOrigin, rootCid: input.rootCid, expectedNodeAudience: input.nodeAudience, now: input.now, fetch: fetchFn });
+  if (current.state !== "active" || current.checkpoint.ownerDid !== input.ownerDid || current.checkpoint.nodeAudience !== input.nodeAudience || current.checkpoint.state !== "active" || !Number.isInteger(current.checkpoint.sequence))
+    throw new Error("policy root status cannot be renewed");
+  const currentUnsigned = { ...current.checkpoint };
+  delete currentUnsigned.signature;
+  const previousCheckpointDigestHex = hex(sha2564(new TextEncoder().encode(ROOT_STATUS_V1_DOMAIN + jcsCanonicalize(currentUnsigned))));
+  const unsigned = {
+    schema: "xyz.tinycloud.policy/root-status-renewal/v1",
+    targetCid: input.rootCid,
+    ownerDid: input.ownerDid,
+    nodeAudience: input.nodeAudience,
+    issuedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    nonce: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    sequence: current.checkpoint.sequence + 1,
+    previousCheckpointDigestHex
+  };
+  const signature = await input.sign(sha2564(new TextEncoder().encode(ROOT_STATUS_RENEWAL_V1_DOMAIN + jcsCanonicalize(unsigned))));
+  if (signature.length !== 64) throw new Error("policy root renewal signature must be Ed25519");
+  const response = await fetchFn(new URL("/share/v3/policy/status", input.nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ rootCid: input.rootCid, renewal: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.ownerDid, value: encodeBase64Url(signature) } } })
+  });
+  if (!response.ok) throw new Error(`policy root renewal rejected (${response.status})`);
+  return object(await response.json(), "policy root renewal");
+}
+async function revokePolicyRootV3(input) {
+  if (input.reason.length === 0) throw new Error("policy root revocation reason is required");
+  const unsigned = {
+    schema: ROOT_REVOCATION_V1_SCHEMA,
+    targetCid: input.rootCid,
+    targetRole: input.targetRole,
+    ownerDid: input.ownerDid,
+    nodeAudience: input.nodeAudience,
+    revokedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    reason: input.reason,
+    issuerDid: input.issuerDid
+  };
+  const signature = await input.sign(sha2564(new TextEncoder().encode(ROOT_REVOCATION_V1_DOMAIN + jcsCanonicalize(unsigned))));
+  if (signature.length !== 64) throw new Error("policy root revocation signature must be Ed25519");
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const response = await fetchFn(new URL("/revoke", input.nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ revocation: { ...unsigned, signature: { suite: "Ed25519", signerDid: input.issuerDid, value: encodeBase64Url(signature) } } })
+  });
+  if (!response.ok) throw new Error(`policy root revocation rejected (${response.status})`);
+  return object(await response.json(), "policy root revocation");
+}
+var POLICY_SESSION_FACT_KEYS = [
+  "profile",
+  "ownerDid",
+  "policyId",
+  "policyDigestHex",
+  "policyCid",
+  "policyDelegationCid",
+  "enforcementDelegationCid",
+  "contentSourceDigestHex",
+  "capabilityCeilingHashHex",
+  "nativeProjectionHashHex",
+  "enforcerDid",
+  "nodeAudience",
+  "recipientDid",
+  "challengeId",
+  "claimDigestHex",
+  "claimJti",
+  "vpDigestHex",
+  "credentialEvidenceDigestHex",
+  "decisionContextDigestHex",
+  "issuanceAuditDigestHex",
+  "remainingRedelegationDepth"
+];
+var KV_ACTIONS = /* @__PURE__ */ new Set([
+  "tinycloud.kv/get",
+  "tinycloud.kv/list",
+  "tinycloud.kv/metadata",
+  "tinycloud.kv/put"
+]);
+function object(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function exactKeys(value, allowed, label) {
+  const keys = new Set(allowed);
+  if (Object.keys(value).some((key) => !keys.has(key)))
+    throw new Error(`${label} contains an unknown field`);
+}
+function nonEmptyString(value, label) {
+  if (typeof value !== "string" || value.length === 0)
+    throw new Error(`${label} must be a non-empty string`);
+  return value;
+}
+function parseKvResource(resource) {
+  const marker = resource.indexOf("/kv/");
+  const encodedSpace = marker < 1 ? "" : resource.slice(0, marker);
+  const legacy = encodedSpace.startsWith("tinycloud://");
+  const space = legacy ? encodedSpace.slice("tinycloud://".length) : encodedSpace;
+  const path = marker < 1 ? "" : resource.slice(marker + 4);
+  if (marker < 1 || (legacy ? /[:/?#%]/.test(space) : !encodedSpace.startsWith("tinycloud:") || /[/?#%]/.test(encodedSpace)) || path.startsWith("/") || path.endsWith("/") || path.includes("//") || path.split("/").some((part) => part === "." || part === ".." || part.length === 0)) {
+    throw new Error("KV resource is not canonical");
+  }
+  return { space, path };
+}
+function parseEncryptionResource(resource) {
+  if (!resource.startsWith("urn:tinycloud:encryption:")) throw new Error("encryption capability is invalid");
+  const rest = resource.slice("urn:tinycloud:encryption:".length);
+  const separator = rest.lastIndexOf(":");
+  const ownerDid = separator < 0 ? "" : rest.slice(0, separator);
+  const network = separator < 0 ? "" : rest.slice(separator + 1);
+  if (!ownerDid.startsWith("did:") || network.length === 0 || network.includes(":") || network.includes("/") || network.includes("%") || network.includes("?") || network.includes("#")) {
+    throw new Error("encryption capability is invalid");
+  }
+}
+function normalizeUnifiedPolicyCapability(input) {
+  const value = object(input, "capability");
+  const kind = nonEmptyString(value.kind, "capability.kind");
+  if (kind === "kv") {
+    exactKeys(
+      value,
+      ["kind", "resource", "selector", "actions"],
+      "KV capability"
+    );
+    const resource = nonEmptyString(value.resource, "capability.resource");
+    parseKvResource(resource);
+    if (value.selector !== "exact" && value.selector !== "prefix")
+      throw new Error("capability.selector is invalid");
+    if (!Array.isArray(value.actions) || value.actions.length === 0)
+      throw new Error("capability.actions is invalid");
+    const actions = value.actions.map(
+      (action) => nonEmptyString(action, "capability.actions[]")
+    );
+    if (new Set(actions).size !== actions.length || actions.some((action) => !KV_ACTIONS.has(action)))
+      throw new Error("capability.actions is invalid");
+    return {
+      kind: "kv",
+      resource,
+      selector: value.selector,
+      actions: [...actions].sort()
+    };
+  }
+  if (kind === "encryption") {
+    exactKeys(value, ["kind", "resource", "action"], "encryption capability");
+    const resource = nonEmptyString(value.resource, "capability.resource");
+    if (value.action !== "tinycloud.encryption/decrypt")
+      throw new Error("encryption capability is invalid");
+    parseEncryptionResource(resource);
+    return {
+      kind: "encryption",
+      resource,
+      action: "tinycloud.encryption/decrypt"
+    };
+  }
+  throw new Error("capability.kind is invalid");
+}
+function canonicalizeUnifiedPolicyCapability(input) {
+  return normalizeUnifiedPolicyCapability(input);
+}
+function unifiedPolicyCapabilityDigestHex(input) {
+  return hex(
+    sha2564(
+      new TextEncoder().encode(
+        POLICY_CAPABILITY_V1_DOMAIN + jcsCanonicalize(normalizeUnifiedPolicyCapability(input))
+      )
+    )
+  );
+}
+function unifiedPolicyCapabilityContains(authorityInput, requestedInput) {
+  try {
+    const authority = normalizeUnifiedPolicyCapability(authorityInput);
+    const requested = normalizeUnifiedPolicyCapability(requestedInput);
+    if (authority.kind !== requested.kind) return false;
+    if (authority.kind === "encryption" && requested.kind === "encryption")
+      return authority.resource === requested.resource && authority.action === requested.action;
+    if (authority.kind !== "kv" || requested.kind !== "kv") return false;
+    const { resource: authorized } = authority;
+    const { resource: requestedResource } = requested;
+    const pathContained = authority.selector === "exact" ? authorized === requestedResource : authorized === requestedResource || requestedResource.startsWith(`${authorized}/`);
+    if (!pathContained || authority.selector === "exact" && requested.selector === "prefix")
+      return false;
+    return requested.actions.every(
+      (action) => authority.actions.includes(action)
+    );
+  } catch {
+    return false;
+  }
+}
+function projectUnifiedPolicyCapability(input) {
+  const capability = normalizeUnifiedPolicyCapability(input);
+  if (capability.kind === "encryption") {
+    return {
+      service: "tinycloud.encryption",
+      space: capability.resource,
+      path: capability.resource,
+      actions: [capability.action]
+    };
+  }
+  const { space, path } = parseKvResource(capability.resource);
+  return {
+    service: "tinycloud.kv",
+    space,
+    path,
+    actions: [...capability.actions],
+    caveat: {
+      type: "xyz.tinycloud.resource/selector",
+      kind: capability.selector,
+      value: capability.resource
+    }
+  };
+}
+function projectUnifiedPolicyCapabilities(input) {
+  return input.map(projectUnifiedPolicyCapability).sort((left, right) => {
+    const a = jcsCanonicalize(left);
+    const b = jcsCanonicalize(right);
+    return a < b ? -1 : a > b ? 1 : 0;
+  });
+}
+function unifiedNativeProjectionHashHex(input) {
+  return hex(
+    sha2564(
+      new TextEncoder().encode(
+        NATIVE_PROJECTION_V1_DOMAIN + jcsCanonicalize(projectUnifiedPolicyCapabilities(input))
+      )
+    )
+  );
+}
+function unifiedPolicyCapabilityFromNative(input) {
+  const value = object(input, "native capability");
+  exactKeys(
+    value,
+    ["service", "space", "path", "actions", "caveat"],
+    "native capability"
+  );
+  const service = nonEmptyString(value.service, "native.service");
+  const actions = value.actions;
+  if (!Array.isArray(actions)) throw new Error("native.actions is invalid");
+  if (service === "tinycloud.encryption" && value.caveat === void 0 && value.space === value.path && actions.length === 1 && actions[0] === "tinycloud.encryption/decrypt") {
+    return normalizeUnifiedPolicyCapability({
+      kind: "encryption",
+      resource: value.space,
+      action: actions[0]
+    });
+  }
+  if (service !== "tinycloud.kv" || typeof value.space !== "string" || typeof value.path !== "string")
+    throw new Error("native capability is not supported");
+  const caveat = object(value.caveat, "native.caveat");
+  exactKeys(caveat, ["type", "kind", "value"], "native selector caveat");
+  if (caveat.type !== "xyz.tinycloud.resource/selector" || caveat.kind !== "exact" && caveat.kind !== "prefix" || caveat.value !== `${value.space.startsWith("tinycloud:") ? value.space : `tinycloud://${value.space}`}/kv/${value.path}`)
+    throw new Error("native selector caveat does not match capability");
+  return normalizeUnifiedPolicyCapability({
+    kind: "kv",
+    resource: caveat.value,
+    selector: caveat.kind,
+    actions
+  });
+}
+function contentSourceDigestHex(input) {
+  return hex(
+    sha2564(
+      new TextEncoder().encode(
+        CONTENT_SOURCE_V1_DOMAIN + jcsCanonicalize(input)
+      )
+    )
+  );
+}
+function policyDigestHex(policy) {
+  const canonicalPolicy = {
+    ...policy,
+    capabilityCeiling: policy.capabilityCeiling.map(
+      normalizeUnifiedPolicyCapability
+    )
+  };
+  return hex(
+    sha2564(
+      new TextEncoder().encode(
+        POLICY_V1_DOMAIN + jcsCanonicalize(canonicalPolicy)
+      )
+    )
+  );
+}
+function policyIdForDigestHex(digestHex) {
+  const digest2 = Uint8Array.from(
+    (digestHex.match(/.{2}/g) ?? []).map((byte) => Number.parseInt(byte, 16))
+  );
+  if (digest2.length !== 32) throw new Error("policy digest must be 32 bytes");
+  return `pol_${base32Lower(digest2)}`;
+}
+function policyCidFromCanonicalBytes(bytes) {
+  return CID.createV1(85, create(18, sha2564(bytes))).toString();
+}
+var CompactHeaderSchema = z.object({
+  alg: z.literal("EdDSA"),
+  jwk: z.object({ alg: z.literal("EdDSA"), crv: z.literal("Ed25519"), kty: z.literal("OKP"), x: z.string().min(1) }).strict(),
+  typ: z.literal("JWT"),
+  ucv: z.literal("0.10.0")
+}).strict();
+var CompactPayloadSchema = z.object({
+  att: z.record(z.record(z.array(z.unknown()).min(1))),
+  aud: z.string().min(1),
+  exp: z.number().int(),
+  fct: z.array(z.record(z.unknown())).length(1),
+  iss: z.string().min(1),
+  nbf: z.number().int(),
+  nnc: z.string().min(1),
+  prf: z.array(z.string().min(1))
+}).strict();
+async function signCompactUcan(input) {
+  const principal = input.issuerDid.split("#", 1)[0];
+  const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+  if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1)
+    throw new Error("compact UCAN signer must be did:key Ed25519");
+  const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(didMaterial.slice(2)) }, typ: "JWT", ucv: "0.10.0" };
+  const payload = {
+    att: input.attenuation,
+    aud: input.audienceDid,
+    exp: input.expiresAt,
+    fct: input.facts,
+    iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
+    nbf: input.notBefore,
+    nnc: input.nonce,
+    prf: input.proofs
+  };
+  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
+  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
+  const signature = await input.sign(new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`));
+  if (signature.length !== 64) throw new Error("compact Authorization signature must be Ed25519");
+  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
+}
+async function signCompactUcanAuthorization(input) {
+  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 60)
+    throw new Error("compact invocation lifetime must be between one and 60 seconds");
+  return signCompactUcan(input);
+}
+async function signCompactUcanRootAuthorization(input) {
+  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 31 * 24 * 60 * 60)
+    throw new Error("compact policy root lifetime must be between one second and 31 days");
+  return signCompactUcan({ ...input, proofs: [] });
+}
+function createCompactPolicyInvocation(input) {
+  const session = parsePolicySessionUcan(input.sessionAuthorization);
+  if (session.cid !== input.sessionCid || session.aud !== input.recipientDid)
+    throw new Error("policy session does not bind the recipient signer");
+  const principal = input.recipientDid.split("#", 1)[0];
+  const didMaterial = base58btc.decode(principal.slice("did:key:".length));
+  if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1)
+    throw new Error("policy invocation signer must be did:key Ed25519");
+  const publicKey = ed255192.getPublicKey(input.privateKey);
+  if (!equalBytes(publicKey, didMaterial.slice(2)))
+    throw new Error("policy invocation private key does not bind recipient DID");
+  const now = input.now ?? Math.floor(Date.now() / 1e3);
+  const exp = Math.min(now + 60, session.exp);
+  if (exp <= now) throw new Error("policy session has expired");
+  const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(publicKey) }, typ: "JWT", ucv: "0.10.0" };
+  const payload = {
+    att: { [input.resource]: { [input.action]: [input.caveat ?? {}] } },
+    aud: input.audienceDid,
+    exp,
+    fct: [input.facts ?? { type: "tinycloud.policy.invocation/v1", policyCid: session.fact.policyCid, sessionCid: session.cid }],
+    iss: input.recipientDid.includes("#") ? input.recipientDid : `${principal}#${principal.slice("did:key:".length)}`,
+    nbf: now,
+    nnc: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    prf: [session.cid]
+  };
+  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
+  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
+  const signingInput = new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`);
+  const signature = ed255192.sign(signingInput, input.privateKey);
+  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
+}
+function createCompactPolicyDescendant(input) {
+  const parent = parseCompactUcanAuthorization(input.parentAuthorization, input.parentCid);
+  if (parent.payload.aud !== input.issuerDid) throw new Error("policy descendant issuer is not the parent audience");
+  const parentFact = parent.payload.fct[0];
+  const depth = parentFact.remainingRedelegationDepth;
+  if (!Number.isInteger(depth) || depth <= 0) throw new Error("policy descendant depth is exhausted");
+  if (!compactAttenuationContains(parent.payload.att, input.attenuation))
+    throw new Error("policy descendant exceeds the parent attenuation");
+  const principal = input.issuerDid.split("#", 1)[0];
+  const didMaterial = base58btc.decode(principal.slice("did:key:".length));
+  const publicKey = ed255192.getPublicKey(input.privateKey);
+  if (didMaterial.length !== 34 || !equalBytes(publicKey, didMaterial.slice(2))) throw new Error("policy descendant signer does not bind issuer DID");
+  const now = Math.max(input.now ?? Math.floor(Date.now() / 1e3), parent.payload.nbf + 1);
+  const exp = Math.min(input.expiresAt ?? now + 60, now + 60, parent.payload.exp - 1);
+  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
+  const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(publicKey) }, typ: "JWT", ucv: "0.10.0" };
+  const payload = {
+    att: input.attenuation,
+    aud: input.audienceDid,
+    exp,
+    fct: [{ ...parentFact, remainingRedelegationDepth: depth - 1 }],
+    iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
+    nbf: now,
+    nnc: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    prf: [parent.cid]
+  };
+  const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
+  const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
+  const signature = ed255192.sign(new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`), input.privateKey);
+  return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
+}
+function compactAttenuationContains(parent, child) {
+  const selector = (value) => {
+    if (value.length !== 1 || !isRecordValue(value[0])) return void 0;
+    const caveat = value[0];
+    if (Object.keys(caveat).length !== 3 || caveat.type !== "xyz.tinycloud.resource/selector" || caveat.kind !== "exact" && caveat.kind !== "prefix" || typeof caveat.value !== "string") return void 0;
+    return { kind: caveat.kind, value: caveat.value };
+  };
+  const equal = (left, right) => jcsCanonicalize(left) === jcsCanonicalize(right);
+  return Object.entries(child).every(
+    ([childResource, childActions]) => Object.entries(childActions).every(
+      ([action, childCaveats]) => Object.entries(parent).some(([parentResource, parentActions]) => {
+        const parentCaveats = parentActions[action];
+        if (parentCaveats === void 0) return false;
+        if (parentResource === childResource && equal(parentCaveats, childCaveats)) return true;
+        const parentSelector = selector(parentCaveats);
+        const childSelector = selector(childCaveats);
+        return parentSelector?.kind === "prefix" && childSelector !== void 0 && parentSelector.value === parentResource && childSelector.value === childResource && (childResource === parentResource || childResource.startsWith(`${parentResource}/`));
+      })
+    )
+  );
+}
+function isRecordValue(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parseCompactUcanAuthorization(input, expectedCid) {
+  if (typeof input !== "string" || /\s/.test(input))
+    throw new Error("Authorization must be compact UCAN bytes");
+  const segments = input.split(".");
+  if (segments.length !== 3 || segments.some((segment) => segment.length === 0))
+    throw new Error("Authorization must have three compact segments");
+  const [headerSegment, payloadSegment, signatureSegment] = segments;
+  const headerBytes = decodeBase64Url(headerSegment);
+  const payloadBytes = decodeBase64Url(payloadSegment);
+  const signature = decodeBase64Url(signatureSegment);
+  const headerValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(headerBytes));
+  const payloadValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(payloadBytes));
+  if (jcsCanonicalize(headerValue) !== new TextDecoder().decode(headerBytes) || jcsCanonicalize(payloadValue) !== new TextDecoder().decode(payloadBytes))
+    throw new Error("compact UCAN segments are not canonical JCS");
+  const header = CompactHeaderSchema.parse(headerValue);
+  const payload = CompactPayloadSchema.parse(payloadValue);
+  if (payload.nbf >= payload.exp) throw new Error("compact UCAN validity is empty");
+  const principal = payload.iss.split("#", 1)[0];
+  const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+  if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1)
+    throw new Error("compact UCAN issuer must be did:key Ed25519");
+  const publicKey = didMaterial.slice(2);
+  if (!equalBytes(publicKey, decodeBase64Url(header.jwk.x)))
+    throw new Error("compact UCAN JWK does not bind issuer");
+  if (!ed255192.verify(signature, new TextEncoder().encode(`${headerSegment}.${payloadSegment}`), publicKey))
+    throw new Error("compact UCAN signature is invalid");
+  const cid = CID.createV1(85, create(30, blake3(new TextEncoder().encode(input)))).toString();
+  if (expectedCid !== void 0 && cid !== expectedCid)
+    throw new Error("compact UCAN CID does not match exact Authorization bytes");
+  return { authorization: input, cid, header, payload };
+}
+function parsePolicySessionUcan(authorization, expectedProofs) {
+  const parsed = parseCompactUcanAuthorization(authorization);
+  const fact = parsed.payload.fct[0];
+  if (parsed.payload.prf.length !== 2 || parsed.payload.prf[0] === parsed.payload.prf[1])
+    throw new Error("policy session UCAN requires two distinct ordered proofs");
+  if (expectedProofs !== void 0 && (parsed.payload.prf[0] !== expectedProofs[0] || parsed.payload.prf[1] !== expectedProofs[1]))
+    throw new Error("policy session UCAN ordered proofs do not match");
+  const factKeys = Object.keys(fact);
+  if (factKeys.length !== POLICY_SESSION_FACT_KEYS.length || factKeys.some((key) => !POLICY_SESSION_FACT_KEYS.includes(key)) || POLICY_SESSION_FACT_KEYS.some((key) => !(key in fact)))
+    throw new Error("policy session UCAN fact is incomplete");
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.enforcerDid || parsed.payload.aud !== fact.recipientDid)
+    throw new Error("policy session UCAN fact is invalid");
+  return {
+    authorization,
+    cid: parsed.cid,
+    iss: parsed.payload.iss,
+    aud: parsed.payload.aud,
+    prf: parsed.payload.prf,
+    att: parsed.payload.att,
+    nbf: parsed.payload.nbf,
+    exp: parsed.payload.exp,
+    nnc: parsed.payload.nnc,
+    fact
+  };
+}
+function decodeBase64Url(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1)
+    throw new Error("value is not canonical base64url");
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = typeof atob === "function" ? atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=")) : Buffer.from(normalized, "base64").toString("binary");
+  const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  const encoded = typeof btoa === "function" ? btoa(String.fromCharCode(...bytes)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : Buffer.from(bytes).toString("base64url");
+  if (encoded !== value) throw new Error("value is not canonical base64url");
+  return bytes;
+}
+function encodeBase64Url(value) {
+  return typeof btoa === "function" ? btoa(String.fromCharCode(...value)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : Buffer.from(value).toString("base64url");
+}
+function equalBytes(left, right) {
+  return left.length === right.length && left.every((byte, index) => byte === right[index]);
+}
+function hex(bytes) {
+  return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function base32Lower(bytes) {
+  const alphabet2 = "abcdefghijklmnopqrstuvwxyz234567";
+  let output = "";
+  let buffer = 0;
+  let bits = 0;
+  for (const byte of bytes) {
+    buffer = buffer << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += alphabet2[buffer >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) output += alphabet2[buffer << 5 - bits & 31];
+  return output;
+}
+
+// src/policy/credential-admission.ts
+import { ed25519 as ed255193 } from "@noble/curves/ed25519";
+import { sha256 as sha2565 } from "@noble/hashes/sha256";
+
+// src/credentials/digest.ts
+function encodeBase64Url2(bytes) {
+  if (typeof btoa === "function") {
+    let binary = "";
+    for (const byte of bytes) binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+  }
+  return Buffer.from(bytes).toString("base64url");
+}
+async function sha256Base64Url(value) {
+  const bytes = typeof value === "string" ? new TextEncoder().encode(value) : value;
+  return encodeBase64Url2(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)));
+}
+async function canonicalDigest(value) {
+  return sha256Base64Url(jcsCanonicalize(value));
+}
+function isDigest(value) {
+  return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+
+// src/credentials/errors.ts
+var RECOVERABLE = /* @__PURE__ */ new Set([
+  "CANCELED",
+  "ISSUER_UNREADY",
+  "OFFLINE",
+  "POPUP_BLOCKED",
+  "REQUEST_EXPIRED",
+  "SIGNATURE_REJECTED",
+  "UNSUPPORTED_PROFILE",
+  "UNSUPPORTED_VERSION",
+  "VERIFIED_NOT_SAVED"
+]);
+var CredentialError = class extends Error {
+  constructor(code2, message, details = {}) {
+    super(message);
+    this.code = code2;
+    this.details = details;
+    this.name = "CredentialError";
+    this.recoverable = RECOVERABLE.has(code2);
+  }
+};
+
+// src/credentials/requirement.ts
+var ID = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
+function validateCredentialRequirement(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential requirement is invalid");
+  const raw = value;
+  if (Object.keys(raw).some((key) => !["type", "version", "profile", "credentialType", "claims", "maxAgeSeconds"].includes(key)) || raw.type !== "TinyCloudCredentialRequirement" || raw.version !== 1) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential requirement version is unsupported");
+  const pair = (candidate, label) => {
+    if (typeof candidate !== "object" || candidate === null || Array.isArray(candidate)) throw new CredentialError("UNSUPPORTED_PROFILE", `${label} is invalid`);
+    const item = candidate;
+    if (Object.keys(item).length !== 2 || typeof item.id !== "string" || !ID.test(item.id) || item.version !== 1) throw new CredentialError("UNSUPPORTED_PROFILE", `${label} version is unsupported`);
+    return { id: item.id, version: 1 };
+  };
+  if (typeof raw.claims !== "object" || raw.claims === null || Array.isArray(raw.claims)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claims are invalid");
+  const claims = {};
+  for (const [key, value2] of Object.entries(raw.claims).sort(([a], [b]) => a.localeCompare(b))) {
+    if (!ID.test(key) || typeof value2 !== "string" || value2.length === 0 || value2.length > 4096) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claim is invalid");
+    claims[key] = value2;
+  }
+  if (raw.maxAgeSeconds !== void 0 && (!Number.isSafeInteger(raw.maxAgeSeconds) || raw.maxAgeSeconds < 1)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential freshness is invalid");
+  return Object.freeze({ type: "TinyCloudCredentialRequirement", version: 1, profile: pair(raw.profile, "profile"), credentialType: pair(raw.credentialType, "credentialType"), claims: Object.freeze(claims), ...raw.maxAgeSeconds === void 0 ? {} : { maxAgeSeconds: raw.maxAgeSeconds } });
+}
+async function credentialRequirementDigest(requirement) {
+  return canonicalDigest(validateCredentialRequirement(requirement));
+}
+
+// src/policy/credential-admission.ts
+var POLICY_V2_SCHEMA = "xyz.tinycloud.policy/policy/v2";
+var POLICY_V2_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
+var POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE = "TinyCloudPolicyCredentialRequirement";
+var POLICY_PRESENTATION_V3_SCHEMA = "xyz.tinycloud.policy/presentation/v3";
+var POLICY_PRESENTATION_V3_DOMAIN = "xyz.tinycloud.policy/Presentation/v3\0";
+function record(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function exactKeys2(value, keys, label) {
+  const expected = [...keys].sort();
+  const actual = Object.keys(value).sort();
+  if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
+    throw new Error(`${label} contains an unknown or missing field`);
+  }
+}
+function nonEmpty(value, label) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`${label} must be a non-empty string`);
+  }
+  return value;
+}
+function policyNodeOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("policy node origin is invalid");
+  }
+  if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") {
+    throw new Error("policy node origin is invalid");
+  }
+  return url.origin;
+}
+function versionPair(value, label) {
+  const item = record(value, label);
+  exactKeys2(item, ["id", "version"], label);
+  if (item.version !== 1) throw new Error(`${label} version is unsupported`);
+  return Object.freeze({ id: nonEmpty(item.id, `${label}.id`), version: 1 });
+}
+function validatePolicyCredentialRequirementV1(value) {
+  const item = record(value, "policy credential requirement");
+  exactKeys2(
+    item,
+    [
+      "type",
+      "version",
+      "requirementDigest",
+      "descriptorDigest",
+      "issuerDid",
+      "issuerKid",
+      "profile",
+      "credentialType"
+    ],
+    "policy credential requirement"
+  );
+  if (item.type !== POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE || item.version !== 1 || !isDigest(item.requirementDigest) || !isDigest(item.descriptorDigest)) {
+    throw new Error("policy credential requirement is invalid");
+  }
+  return Object.freeze({
+    type: POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE,
+    version: 1,
+    requirementDigest: item.requirementDigest,
+    descriptorDigest: item.descriptorDigest,
+    issuerDid: nonEmpty(item.issuerDid, "policy credential issuer"),
+    issuerKid: nonEmpty(item.issuerKid, "policy credential issuer key"),
+    profile: versionPair(item.profile, "policy credential profile"),
+    credentialType: versionPair(
+      item.credentialType,
+      "policy credential type"
+    )
+  });
+}
+function hex2(bytes) {
+  return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function policyV2DigestHex(input) {
+  const canonicalPolicy = {
+    ...input,
+    credentialRequirement: validatePolicyCredentialRequirementV1(
+      input.credentialRequirement
+    ),
+    capabilityCeiling: input.capabilityCeiling.map(
+      normalizeUnifiedPolicyCapability
+    )
+  };
+  return hex2(
+    sha2565(
+      new TextEncoder().encode(
+        POLICY_V2_DOMAIN + jcsCanonicalize(canonicalPolicy)
+      )
+    )
+  );
+}
+function date(value, label) {
+  const text = nonEmpty(value, label);
+  if (!Number.isFinite(Date.parse(text))) throw new Error(`${label} is invalid`);
+  return text;
+}
+function rfc3339Seconds(value) {
+  return new Date(Math.floor(value.getTime() / 1e3) * 1e3).toISOString().replace(/\.000Z$/, "Z");
+}
+function validateUnifiedPolicyV2(value, expectedPolicyCid) {
+  const item = record(value, "Policy/v2");
+  const allowed = [
+    "schema",
+    "policyId",
+    "ownerDid",
+    "createdAt",
+    "contentSource",
+    "capabilityCeiling",
+    "credentialRequirement",
+    "signature",
+    ...item.expiresAt === void 0 ? [] : ["expiresAt"]
+  ];
+  exactKeys2(item, allowed, "Policy/v2");
+  if (item.schema !== POLICY_V2_SCHEMA || !Array.isArray(item.capabilityCeiling)) {
+    throw new Error("Policy/v2 is invalid");
+  }
+  const ownerDid = nonEmpty(item.ownerDid, "Policy/v2 ownerDid");
+  const signature = record(item.signature, "Policy/v2 signature");
+  exactKeys2(signature, ["suite", "signerDid", "value"], "Policy/v2 signature");
+  if (signature.suite !== "Ed25519" || signature.signerDid !== ownerDid || typeof signature.value !== "string" || signature.value.length === 0) {
+    throw new Error("Policy/v2 signature binding is invalid");
+  }
+  const policy = Object.freeze({
+    schema: POLICY_V2_SCHEMA,
+    policyId: nonEmpty(item.policyId, "Policy/v2 policyId"),
+    ownerDid,
+    createdAt: date(item.createdAt, "Policy/v2 createdAt"),
+    ...item.expiresAt === void 0 ? {} : { expiresAt: date(item.expiresAt, "Policy/v2 expiresAt") },
+    contentSource: item.contentSource,
+    capabilityCeiling: Object.freeze(
+      item.capabilityCeiling.map(normalizeUnifiedPolicyCapability)
+    ),
+    credentialRequirement: validatePolicyCredentialRequirementV1(
+      item.credentialRequirement
+    ),
+    signature: Object.freeze({
+      suite: "Ed25519",
+      signerDid: ownerDid,
+      value: signature.value
+    })
+  });
+  const unsigned = { ...policy };
+  delete unsigned.policyId;
+  delete unsigned.signature;
+  const digestHex = policyV2DigestHex(unsigned);
+  if (policy.policyId !== policyIdForDigestHex(digestHex)) {
+    throw new Error("Policy/v2 policyId binding is invalid");
+  }
+  if (expectedPolicyCid !== void 0) {
+    const cid = policyCidFromCanonicalBytes(
+      new TextEncoder().encode(jcsCanonicalize(policy))
+    );
+    if (cid !== expectedPolicyCid) throw new Error("Policy/v2 CID binding is invalid");
+  }
+  return policy;
+}
+function didKeyBytes(did) {
+  const principal = did.split("#", 1)[0];
+  if (!principal.startsWith("did:key:")) throw new Error("holder DID must be did:key");
+  const material = base58btc.decode(principal.slice("did:key:".length));
+  if (material.length !== 34 || material[0] !== 237 || material[1] !== 1) {
+    throw new Error("holder DID must contain an Ed25519 key");
+  }
+  return material.slice(2);
+}
+function envelopeFromVerified(verified) {
+  const {
+    verifiedAt: _verifiedAt,
+    credentialDigest: _credentialDigest,
+    statusCheckedAt: _statusCheckedAt,
+    ...envelope
+  } = verified;
+  return envelope;
+}
+async function buildPolicyCredentialPresentationV3(input) {
+  const policy = validateUnifiedPolicyV2(input.policy, input.policyCid);
+  const requirement = validateCredentialRequirement(input.requirement);
+  const commitment = policy.credentialRequirement;
+  const requirementDigest = await credentialRequirementDigest(requirement);
+  const credentialDigest = await sha256Base64Url(input.credential.credential);
+  if (requirementDigest !== commitment.requirementDigest || input.credential.descriptorDigest !== commitment.descriptorDigest || input.credential.credentialDigest !== credentialDigest || input.credential.issuerDid !== commitment.issuerDid || input.credential.issuerKid !== commitment.issuerKid || jcsCanonicalize(input.credential.profile) !== jcsCanonicalize(commitment.profile) || jcsCanonicalize(input.credential.credentialType) !== jcsCanonicalize(commitment.credentialType)) {
+    throw new Error("credential does not match the signed Policy/v2 requirement");
+  }
+  const requestedCapabilities = input.requestedCapabilities.map(
+    normalizeUnifiedPolicyCapability
+  );
+  if (requestedCapabilities.length === 0 || requestedCapabilities.some(
+    (requested) => !policy.capabilityCeiling.some(
+      (authority) => unifiedPolicyCapabilityContains(authority, requested)
+    )
+  )) {
+    throw new Error("requested capabilities exceed the signed Policy/v2 ceiling");
+  }
+  const challenge = input.challenge;
+  const holderDid = input.credential.holderDid;
+  if (challenge.policyCid !== input.policyCid || challenge.recipientDid !== holderDid || input.credential.subjectDid !== holderDid || typeof challenge.nodeAudience !== "string" || challenge.nodeAudience.length === 0 || typeof challenge.expiresAt !== "string" || !Number.isFinite(Date.parse(challenge.expiresAt))) {
+    throw new Error("policy challenge binding is invalid");
+  }
+  didKeyBytes(holderDid);
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const challengeExpiry = Date.parse(challenge.expiresAt);
+  const credentialExpiry = Date.parse(input.credential.expiresAt);
+  const expiresAtMs = Math.min(
+    now.getTime() + 6e4,
+    challengeExpiry,
+    credentialExpiry
+  );
+  if (expiresAtMs <= now.getTime()) throw new Error("policy challenge is expired");
+  const unsigned = Object.freeze({
+    schema: POLICY_PRESENTATION_V3_SCHEMA,
+    jti: input.jti ?? encodeBase64Url2(crypto.getRandomValues(new Uint8Array(16))),
+    challengeId: challenge.challengeId,
+    nonce: challenge.nonce,
+    policyCid: input.policyCid,
+    nodeAudience: challenge.nodeAudience,
+    holderDid,
+    subjectDid: input.credential.subjectDid,
+    credentialSpaceOwnerDid: nonEmpty(
+      input.credentialSpaceOwnerDid,
+      "credential space owner DID"
+    ),
+    credentialDigest,
+    requirementDigest,
+    descriptorDigest: input.credential.descriptorDigest,
+    requestedCapabilities: Object.freeze(requestedCapabilities),
+    issuedAt: rfc3339Seconds(now),
+    expiresAt: rfc3339Seconds(new Date(expiresAtMs))
+  });
+  const digest2 = sha2565(
+    new TextEncoder().encode(
+      POLICY_PRESENTATION_V3_DOMAIN + jcsCanonicalize(unsigned)
+    )
+  );
+  const signature = await input.sign(digest2);
+  if (signature.length !== 64 || !ed255193.verify(signature, digest2, didKeyBytes(holderDid))) {
+    throw new Error("policy presentation signature is invalid");
+  }
+  return Object.freeze({
+    ...unsigned,
+    signature: Object.freeze({
+      suite: "Ed25519",
+      signerDid: holderDid,
+      value: encodeBase64Url2(signature)
+    })
+  });
+}
+async function admitPolicyCredentialV3(input) {
+  const policy = validateUnifiedPolicyV2(input.policy, input.policyCid);
+  const nodeOrigin = policyNodeOrigin(input.nodeOrigin);
+  const accountAuthorizationCid = nonEmpty(
+    input.accountAuthorizationCid,
+    "account authorization CID"
+  );
+  const credentialSpaceId = nonEmpty(
+    input.credentialSpaceId,
+    "credential space ID"
+  );
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const challenge = await requestPolicyChallengeV3({
+    nodeOrigin,
+    policyCid: input.policyCid,
+    recipientDid: input.credential.holderDid,
+    requestedCapabilities: input.requestedCapabilities,
+    fetch: fetchFn
+  });
+  const presentation = await buildPolicyCredentialPresentationV3({
+    ...input,
+    policy,
+    challenge
+  });
+  const response = await fetchFn(
+    new URL("/share/v3/policy/delegations", nodeOrigin),
+    {
+      method: "POST",
+      redirect: "error",
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({
+        policyCid: input.policyCid,
+        challengeId: challenge.challengeId,
+        nonce: challenge.nonce,
+        requirement: validateCredentialRequirement(input.requirement),
+        credential: envelopeFromVerified(input.credential),
+        accountAuthorizationCid,
+        credentialSpaceId,
+        presentation
+      })
+    }
+  );
+  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  const value = record(await response.json(), "policy delegation");
+  if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") {
+    throw new Error("policy delegation response is invalid");
+  }
+  const session = parsePolicySessionUcan(value.authorization, [
+    input.policyRootCid,
+    input.enforcementRootCid
+  ]);
+  const expectedAttenuation = compactAttenuationForPolicyCapabilities(
+    input.requestedCapabilities
+  );
+  if (session.cid !== value.sessionCid || session.aud !== input.credential.holderDid || session.fact.policyCid !== input.policyCid || session.fact.recipientDid !== input.credential.holderDid || session.fact.policyDelegationCid !== input.policyRootCid || session.fact.enforcementDelegationCid !== input.enforcementRootCid || jcsCanonicalize(session.att) !== jcsCanonicalize(expectedAttenuation)) {
+    throw new Error("policy delegation signed binding is invalid");
+  }
+  return Object.freeze({ challenge, presentation, session });
 }
 export {
+  ATTESTED_ENFORCER_BINDING_V2_SCHEMA,
+  CONTENT_SOURCE_V1_DOMAIN,
   ED25519_JCS_SIGNATURE_SUITE,
   EIP191_JCS_SIGNATURE_SUITE,
+  LAST_V2_CREATE_AT,
+  LAST_V2_READ_AT,
+  MAX_LEGACY_ENVELOPE_EXPIRES_AT,
+  NATIVE_PROJECTION_V1_DOMAIN,
   OWNER_NODE_ENDPOINT_SCHEMA,
+  POLICY_CAPABILITY_V1_DOMAIN,
+  POLICY_CAPABILITY_V1_SCHEMA,
+  POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE,
+  POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA,
   POLICY_ENGINE_RECORD_SCHEMA,
+  POLICY_PRESENTATION_V3_DOMAIN,
+  POLICY_PRESENTATION_V3_SCHEMA,
   POLICY_SCHEMA,
+  POLICY_SESSION_UCAN_V1_PROFILE,
   POLICY_STATUS_SCHEMA,
+  POLICY_V1_DOMAIN,
+  POLICY_V1_SCHEMA,
+  POLICY_V2_DOMAIN,
+  POLICY_V2_SCHEMA,
   POLICY_VERSION_V0,
   PolicyAuthoringError,
   PolicyCapabilityError,
+  ROOT_REVOCATION_V1_DOMAIN,
+  ROOT_REVOCATION_V1_SCHEMA,
+  ROOT_STATUS_CHECKPOINT_V1_SCHEMA,
+  ROOT_STATUS_RENEWAL_V1_DOMAIN,
+  ROOT_STATUS_V1_DOMAIN,
   SignatureMaterialError,
   SignatureVerificationError,
   SignedObjectCanonicalizationError,
@@ -3206,25 +4273,53 @@ export {
   TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,
   UnsupportedSignatureSuiteError,
   W3C_VC_CREDENTIAL_VERIFIER,
+  admitPolicyCredentialV3,
+  buildPolicyCredentialPresentationV3,
   canonicalizePolicyCapability,
   canonicalizeSignedObjectUnsigned,
+  canonicalizeUnifiedPolicyCapability,
+  compactAttenuationContains,
   composeTranscriptShareBootstrap,
+  contentSourceDigestHex,
   createAndSignPolicy,
   createAndSignPolicyEngineRecord,
   createAndSignPolicyStatus,
   createAndSignRequesterPolicyEngineRecord,
   createAndSignSignedObject,
   createAndSignTranscriptSharePolicy,
+  createCompactPolicyDescendant,
+  createCompactPolicyInvocation,
   createUnsignedPolicyEngineRecord,
   deriveSignedObjectMaterial,
+  getPolicyRootStatusV3,
   jcsCanonicalize,
+  mintPolicySessionV3,
   normalizeJson,
   normalizePolicyCapability,
+  normalizeUnifiedPolicyCapability,
+  parseCompactUcanAuthorization,
+  parsePolicySessionUcan,
   policyCapabilityContains,
   policyCapabilityDigestHex,
+  policyCidFromCanonicalBytes,
+  policyDigestHex,
+  policyIdForDigestHex,
+  policyV2DigestHex,
+  projectUnifiedPolicyCapabilities,
+  projectUnifiedPolicyCapability,
+  renewPolicyRootStatusV3,
+  requestPolicyChallengeV3,
+  revokePolicyRootV3,
   serialize as serializeJcsJson,
+  signCompactUcanAuthorization,
+  signCompactUcanRootAuthorization,
   signedObjectIdFor,
   toSignedObjectError,
+  unifiedNativeProjectionHashHex,
+  unifiedPolicyCapabilityContains,
+  unifiedPolicyCapabilityDigestHex,
+  unifiedPolicyCapabilityFromNative,
+  validatePolicyCredentialRequirementV1,
   validatePolicyEngineRecordSigned,
   validatePolicyEngineRecordSignedShape,
   validatePolicyEngineRecordUnsigned,
@@ -3234,9 +4329,12 @@ export {
   validatePolicyStatusSignedShape,
   validatePolicyStatusUnsigned,
   validatePolicyUnsigned,
+  validateUnifiedPolicyV2,
   verifyPolicy,
   verifyPolicyEngineRecord,
   verifyPolicyEngineRecordForRequester,
+  verifyPolicyRootRevocationV3,
+  verifyPolicyRootStatusCheckpointV3,
   verifyPolicyStatus,
   verifySignedObject
 };