@tinycloud/sdk-core 2.11.0 → 3.0.0-beta.0

package/dist/index.js

@@ -315,6 +315,7 @@ var CREDENTIAL_ERROR_CODES = [
   "REQUEST_SUBSTITUTED",
   "SIGNATURE_REJECTED",
   "UNSUPPORTED_PROFILE",
+  "UNSUPPORTED_VERSION",
   "VERIFICATION_FAILED",
   "VERIFIED_NOT_SAVED"
 ];
@@ -326,6 +327,7 @@ var RECOVERABLE = /* @__PURE__ */ new Set([
   "REQUEST_EXPIRED",
   "SIGNATURE_REJECTED",
   "UNSUPPORTED_PROFILE",
+  "UNSUPPORTED_VERSION",
   "VERIFIED_NOT_SAVED"
 ]);
 var CredentialError = class extends Error {
@@ -613,11 +615,11 @@ async function createStoredCredentialRecord(input) {
   const recordId = await canonicalDigest({ credentialDigest: input.verified.credentialDigest, holderDid: input.ownerDid });
   return Object.freeze({ type: "TinyCloudStoredCredential", version: 1, ownerDid: input.ownerDid, recordId, requirementDigest: input.requirementDigest, descriptorDigest: input.verified.descriptorDigest, profile: input.verified.profile, credentialType: input.verified.credentialType, issuerDid: input.verified.issuerDid, issuerKid: input.verified.issuerKid, holderDid: input.verified.holderDid, claims: input.verified.claims, claimsDigest: input.verified.claimsDigest, credentialDigest: input.verified.credentialDigest, credential: input.verified.credential, schema: input.verified.schema, credentialId: input.verified.credentialId, issuedAt: input.verified.issuedAt, notBefore: input.verified.notBefore, expiresAt: input.verified.expiresAt, status: input.verified.status, verifiedAt: input.verified.verifiedAt, storedAt });
 }
-async function createStorageReceipt(record, etag) {
-  return Object.freeze({ type: "TinyCloudCredentialStorageReceipt", version: 1, ownerDid: record.ownerDid, recordId: record.recordId, recordDigest: await canonicalDigest(record), storedAt: record.storedAt, ...etag === void 0 ? {} : { etag } });
+async function createStorageReceipt(record2, etag) {
+  return Object.freeze({ type: "TinyCloudCredentialStorageReceipt", version: 1, ownerDid: record2.ownerDid, recordId: record2.recordId, recordDigest: await canonicalDigest(record2), storedAt: record2.storedAt, ...etag === void 0 ? {} : { etag } });
 }
-async function verifyStorageReceipt(record, receipt, activeOwnerDid, activeHolderDid) {
-  return receipt.type === "TinyCloudCredentialStorageReceipt" && receipt.version === 1 && receipt.ownerDid === activeOwnerDid && record.ownerDid === activeOwnerDid && record.holderDid === activeHolderDid && receipt.recordId === record.recordId && receipt.storedAt === record.storedAt && receipt.recordDigest === await canonicalDigest(record);
+async function verifyStorageReceipt(record2, receipt, activeOwnerDid, activeHolderDid) {
+  return receipt.type === "TinyCloudCredentialStorageReceipt" && receipt.version === 1 && receipt.ownerDid === activeOwnerDid && record2.ownerDid === activeOwnerDid && record2.holderDid === activeHolderDid && receipt.recordId === record2.recordId && receipt.storedAt === record2.storedAt && receipt.recordDigest === await canonicalDigest(record2);
 }
 
 // src/credentials/verification.ts
@@ -806,7 +808,7 @@ function makePkhSpaceId(address, chainId, name2) {
 }
 
 // src/requester/index.ts
-import { bytesToHex as bytesToHex3, sha256 as sha2565 } from "viem";
+import { bytesToHex as bytesToHex3, sha256 as sha2566 } from "viem";
 import { blake3 as blake32 } from "@noble/hashes/blake3";
 
 // ../../node_modules/multiformats/dist/src/bases/base32.js
@@ -3176,13 +3178,13 @@ function base64UrlDecode(value) {
   return decoded;
 }
 function hexToBytes(value) {
-  const hex2 = value.slice(2);
-  if (hex2.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex2)) {
+  const hex3 = value.slice(2);
+  if (hex3.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex3)) {
     throw new SignatureMaterialError("hex signature must have even length");
   }
-  const output = new Uint8Array(hex2.length / 2);
+  const output = new Uint8Array(hex3.length / 2);
   for (let index = 0; index < output.length; index++) {
-    output[index] = Number.parseInt(hex2.slice(index * 2, index * 2 + 2), 16);
+    output[index] = Number.parseInt(hex3.slice(index * 2, index * 2 + 2), 16);
   }
   return output;
 }
@@ -3422,6 +3424,34 @@ var ROOT_REVOCATION_V1_DOMAIN = "xyz.tinycloud.policy/RootRevocation/v1\0";
 var LAST_V2_CREATE_AT = "2026-09-30T00:00:00Z";
 var MAX_LEGACY_ENVELOPE_EXPIRES_AT = "2026-12-29T00:00:00Z";
 var LAST_V2_READ_AT = "2027-01-05T00:00:00Z";
+async function requestPolicyChallengeV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const response = await fetchFn(new URL("/share/v3/policy/challenges", input.nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({ policyCid: input.policyCid, recipientDid: input.recipientDid, requestedCapabilities: input.requestedCapabilities.map(normalizeUnifiedPolicyCapability) })
+  });
+  if (!response.ok) throw new Error(`policy challenge rejected (${response.status})`);
+  const value = object2(await response.json(), "policy challenge");
+  if (typeof value.challengeId !== "string" || typeof value.nonce !== "string" || value.policyCid !== input.policyCid || value.recipientDid !== input.recipientDid)
+    throw new Error("policy challenge binding is invalid");
+  return value;
+}
+function compactAttenuationForPolicyCapabilities(input) {
+  const attenuation = {};
+  for (const raw of input) {
+    const capability = normalizeUnifiedPolicyCapability(raw);
+    if (attenuation[capability.resource] !== void 0)
+      throw new Error("policy capabilities contain a duplicate resource");
+    attenuation[capability.resource] = capability.kind === "encryption" ? { [capability.action]: [{}] } : Object.fromEntries(capability.actions.map((action) => [action, [{
+      type: "xyz.tinycloud.resource/selector",
+      kind: capability.selector,
+      value: capability.resource
+    }]]));
+  }
+  return attenuation;
+}
 function verifyPolicyRootStatusCheckpointV3(input) {
   const checkpoint = input.checkpoint;
   const allowed = /* @__PURE__ */ new Set(["schema", "targetCid", "targetRole", "ownerDid", "nodeAudience", "state", "sequence", "checkedAt", "freshUntil", "revokedAt", "revocationCid", "previousCheckpointDigestHex", "issuerDid", "signature"]);
@@ -3591,11 +3621,15 @@ function nonEmptyString(value, label) {
   return value;
 }
 function parseKvResource(resource) {
-  const match = /^tinycloud:\/\/([^/]+)\/kv\/(.+)$/.exec(resource);
-  if (!match || match[1].includes(":") || match[1].includes("?") || match[1].includes("#") || match[1].includes("%") || match[2].startsWith("/") || match[2].endsWith("/") || match[2].includes("//") || match[2].split("/").some((part) => part === "." || part === ".." || part.length === 0)) {
+  const marker = resource.indexOf("/kv/");
+  const encodedSpace = marker < 1 ? "" : resource.slice(0, marker);
+  const legacy = encodedSpace.startsWith("tinycloud://");
+  const space = legacy ? encodedSpace.slice("tinycloud://".length) : encodedSpace;
+  const path = marker < 1 ? "" : resource.slice(marker + 4);
+  if (marker < 1 || (legacy ? /[:/?#%]/.test(space) : !encodedSpace.startsWith("tinycloud:") || /[/?#%]/.test(encodedSpace)) || path.startsWith("/") || path.endsWith("/") || path.includes("//") || path.split("/").some((part) => part === "." || part === ".." || part.length === 0)) {
     throw new Error("KV resource is not canonical");
   }
-  return { space: match[1], path: match[2] };
+  return { space, path };
 }
 function parseEncryptionResource(resource) {
   if (!resource.startsWith("urn:tinycloud:encryption:")) throw new Error("encryption capability is invalid");
@@ -3740,7 +3774,7 @@ function unifiedPolicyCapabilityFromNative(input) {
     throw new Error("native capability is not supported");
   const caveat = object2(value.caveat, "native.caveat");
   exactKeys(caveat, ["type", "kind", "value"], "native selector caveat");
-  if (caveat.type !== "xyz.tinycloud.resource/selector" || caveat.kind !== "exact" && caveat.kind !== "prefix" || caveat.value !== `tinycloud://${value.space}/kv/${value.path}`)
+  if (caveat.type !== "xyz.tinycloud.resource/selector" || caveat.kind !== "exact" && caveat.kind !== "prefix" || caveat.value !== `${value.space.startsWith("tinycloud:") ? value.space : `tinycloud://${value.space}`}/kv/${value.path}`)
     throw new Error("native selector caveat does not match capability");
   return normalizeUnifiedPolicyCapability({
     kind: "kv",
@@ -3799,9 +3833,7 @@ var CompactPayloadSchema = z2.object({
   nnc: z2.string().min(1),
   prf: z2.array(z2.string().min(1))
 }).strict();
-async function signCompactUcanAuthorization(input) {
-  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 60)
-    throw new Error("compact invocation lifetime must be between one and 60 seconds");
+async function signCompactUcan(input) {
   const principal = input.issuerDid.split("#", 1)[0];
   const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
   if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1)
@@ -3823,6 +3855,16 @@ async function signCompactUcanAuthorization(input) {
   if (signature.length !== 64) throw new Error("compact Authorization signature must be Ed25519");
   return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url2(signature)}`);
 }
+async function signCompactUcanAuthorization(input) {
+  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 60)
+    throw new Error("compact invocation lifetime must be between one and 60 seconds");
+  return signCompactUcan(input);
+}
+async function signCompactUcanRootAuthorization(input) {
+  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 31 * 24 * 60 * 60)
+    throw new Error("compact policy root lifetime must be between one second and 31 days");
+  return signCompactUcan({ ...input, proofs: [] });
+}
 function createCompactPolicyInvocation(input) {
   const session = parsePolicySessionUcan(input.sessionAuthorization);
   if (session.cid !== input.sessionCid || session.aud !== input.recipientDid)
@@ -3969,14 +4011,14 @@ function decodeBase64Url2(value) {
   if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1)
     throw new Error("value is not canonical base64url");
   const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
-  const binary = typeof Buffer !== "undefined" ? Buffer.from(normalized, "base64").toString("binary") : atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "="));
+  const binary = typeof atob === "function" ? atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=")) : Buffer.from(normalized, "base64").toString("binary");
   const bytes2 = Uint8Array.from(binary, (character) => character.charCodeAt(0));
-  const encoded = typeof Buffer !== "undefined" ? Buffer.from(bytes2).toString("base64url") : btoa(String.fromCharCode(...bytes2)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  const encoded = typeof btoa === "function" ? btoa(String.fromCharCode(...bytes2)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : Buffer.from(bytes2).toString("base64url");
   if (encoded !== value) throw new Error("value is not canonical base64url");
   return bytes2;
 }
 function encodeBase64Url2(value) {
-  return typeof Buffer !== "undefined" ? Buffer.from(value).toString("base64url") : btoa(String.fromCharCode(...value)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  return typeof btoa === "function" ? btoa(String.fromCharCode(...value)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : Buffer.from(value).toString("base64url");
 }
 function equalBytes(left, right) {
   return left.length === right.length && left.every((byte, index) => byte === right[index]);
@@ -4001,6 +4043,320 @@ function base32Lower(bytes2) {
   return output;
 }
 
+// src/policy/credential-admission.ts
+import { ed25519 as ed255194 } from "@noble/curves/ed25519";
+import { sha256 as sha2565 } from "@noble/hashes/sha256";
+var POLICY_V2_SCHEMA = "xyz.tinycloud.policy/policy/v2";
+var POLICY_V2_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
+var POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE = "TinyCloudPolicyCredentialRequirement";
+var POLICY_PRESENTATION_V3_SCHEMA = "xyz.tinycloud.policy/presentation/v3";
+var POLICY_PRESENTATION_V3_DOMAIN = "xyz.tinycloud.policy/Presentation/v3\0";
+function record(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function exactKeys2(value, keys, label) {
+  const expected = [...keys].sort();
+  const actual = Object.keys(value).sort();
+  if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
+    throw new Error(`${label} contains an unknown or missing field`);
+  }
+}
+function nonEmpty(value, label) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`${label} must be a non-empty string`);
+  }
+  return value;
+}
+function policyNodeOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("policy node origin is invalid");
+  }
+  if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") {
+    throw new Error("policy node origin is invalid");
+  }
+  return url.origin;
+}
+function versionPair(value, label) {
+  const item = record(value, label);
+  exactKeys2(item, ["id", "version"], label);
+  if (item.version !== 1) throw new Error(`${label} version is unsupported`);
+  return Object.freeze({ id: nonEmpty(item.id, `${label}.id`), version: 1 });
+}
+function validatePolicyCredentialRequirementV1(value) {
+  const item = record(value, "policy credential requirement");
+  exactKeys2(
+    item,
+    [
+      "type",
+      "version",
+      "requirementDigest",
+      "descriptorDigest",
+      "issuerDid",
+      "issuerKid",
+      "profile",
+      "credentialType"
+    ],
+    "policy credential requirement"
+  );
+  if (item.type !== POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE || item.version !== 1 || !isDigest(item.requirementDigest) || !isDigest(item.descriptorDigest)) {
+    throw new Error("policy credential requirement is invalid");
+  }
+  return Object.freeze({
+    type: POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE,
+    version: 1,
+    requirementDigest: item.requirementDigest,
+    descriptorDigest: item.descriptorDigest,
+    issuerDid: nonEmpty(item.issuerDid, "policy credential issuer"),
+    issuerKid: nonEmpty(item.issuerKid, "policy credential issuer key"),
+    profile: versionPair(item.profile, "policy credential profile"),
+    credentialType: versionPair(
+      item.credentialType,
+      "policy credential type"
+    )
+  });
+}
+function hex2(bytes2) {
+  return [...bytes2].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function policyV2DigestHex(input) {
+  const canonicalPolicy = {
+    ...input,
+    credentialRequirement: validatePolicyCredentialRequirementV1(
+      input.credentialRequirement
+    ),
+    capabilityCeiling: input.capabilityCeiling.map(
+      normalizeUnifiedPolicyCapability
+    )
+  };
+  return hex2(
+    sha2565(
+      new TextEncoder().encode(
+        POLICY_V2_DOMAIN + jcsCanonicalize(canonicalPolicy)
+      )
+    )
+  );
+}
+function date(value, label) {
+  const text2 = nonEmpty(value, label);
+  if (!Number.isFinite(Date.parse(text2))) throw new Error(`${label} is invalid`);
+  return text2;
+}
+function rfc3339Seconds(value) {
+  return new Date(Math.floor(value.getTime() / 1e3) * 1e3).toISOString().replace(/\.000Z$/, "Z");
+}
+function validateUnifiedPolicyV2(value, expectedPolicyCid) {
+  const item = record(value, "Policy/v2");
+  const allowed = [
+    "schema",
+    "policyId",
+    "ownerDid",
+    "createdAt",
+    "contentSource",
+    "capabilityCeiling",
+    "credentialRequirement",
+    "signature",
+    ...item.expiresAt === void 0 ? [] : ["expiresAt"]
+  ];
+  exactKeys2(item, allowed, "Policy/v2");
+  if (item.schema !== POLICY_V2_SCHEMA || !Array.isArray(item.capabilityCeiling)) {
+    throw new Error("Policy/v2 is invalid");
+  }
+  const ownerDid = nonEmpty(item.ownerDid, "Policy/v2 ownerDid");
+  const signature = record(item.signature, "Policy/v2 signature");
+  exactKeys2(signature, ["suite", "signerDid", "value"], "Policy/v2 signature");
+  if (signature.suite !== "Ed25519" || signature.signerDid !== ownerDid || typeof signature.value !== "string" || signature.value.length === 0) {
+    throw new Error("Policy/v2 signature binding is invalid");
+  }
+  const policy = Object.freeze({
+    schema: POLICY_V2_SCHEMA,
+    policyId: nonEmpty(item.policyId, "Policy/v2 policyId"),
+    ownerDid,
+    createdAt: date(item.createdAt, "Policy/v2 createdAt"),
+    ...item.expiresAt === void 0 ? {} : { expiresAt: date(item.expiresAt, "Policy/v2 expiresAt") },
+    contentSource: item.contentSource,
+    capabilityCeiling: Object.freeze(
+      item.capabilityCeiling.map(normalizeUnifiedPolicyCapability)
+    ),
+    credentialRequirement: validatePolicyCredentialRequirementV1(
+      item.credentialRequirement
+    ),
+    signature: Object.freeze({
+      suite: "Ed25519",
+      signerDid: ownerDid,
+      value: signature.value
+    })
+  });
+  const unsigned = { ...policy };
+  delete unsigned.policyId;
+  delete unsigned.signature;
+  const digestHex = policyV2DigestHex(unsigned);
+  if (policy.policyId !== policyIdForDigestHex(digestHex)) {
+    throw new Error("Policy/v2 policyId binding is invalid");
+  }
+  if (expectedPolicyCid !== void 0) {
+    const cid2 = policyCidFromCanonicalBytes(
+      new TextEncoder().encode(jcsCanonicalize(policy))
+    );
+    if (cid2 !== expectedPolicyCid) throw new Error("Policy/v2 CID binding is invalid");
+  }
+  return policy;
+}
+function didKeyBytes(did) {
+  const principal = did.split("#", 1)[0];
+  if (!principal.startsWith("did:key:")) throw new Error("holder DID must be did:key");
+  const material = base58btc.decode(principal.slice("did:key:".length));
+  if (material.length !== 34 || material[0] !== 237 || material[1] !== 1) {
+    throw new Error("holder DID must contain an Ed25519 key");
+  }
+  return material.slice(2);
+}
+function envelopeFromVerified(verified) {
+  const {
+    verifiedAt: _verifiedAt,
+    credentialDigest: _credentialDigest,
+    statusCheckedAt: _statusCheckedAt,
+    ...envelope
+  } = verified;
+  return envelope;
+}
+async function buildPolicyCredentialPresentationV3(input) {
+  const policy = validateUnifiedPolicyV2(input.policy, input.policyCid);
+  const requirement = validateCredentialRequirement(input.requirement);
+  const commitment = policy.credentialRequirement;
+  const requirementDigest = await credentialRequirementDigest(requirement);
+  const credentialDigest = await sha256Base64Url(input.credential.credential);
+  if (requirementDigest !== commitment.requirementDigest || input.credential.descriptorDigest !== commitment.descriptorDigest || input.credential.credentialDigest !== credentialDigest || input.credential.issuerDid !== commitment.issuerDid || input.credential.issuerKid !== commitment.issuerKid || jcsCanonicalize(input.credential.profile) !== jcsCanonicalize(commitment.profile) || jcsCanonicalize(input.credential.credentialType) !== jcsCanonicalize(commitment.credentialType)) {
+    throw new Error("credential does not match the signed Policy/v2 requirement");
+  }
+  const requestedCapabilities = input.requestedCapabilities.map(
+    normalizeUnifiedPolicyCapability
+  );
+  if (requestedCapabilities.length === 0 || requestedCapabilities.some(
+    (requested) => !policy.capabilityCeiling.some(
+      (authority) => unifiedPolicyCapabilityContains(authority, requested)
+    )
+  )) {
+    throw new Error("requested capabilities exceed the signed Policy/v2 ceiling");
+  }
+  const challenge = input.challenge;
+  const holderDid = input.credential.holderDid;
+  if (challenge.policyCid !== input.policyCid || challenge.recipientDid !== holderDid || input.credential.subjectDid !== holderDid || typeof challenge.nodeAudience !== "string" || challenge.nodeAudience.length === 0 || typeof challenge.expiresAt !== "string" || !Number.isFinite(Date.parse(challenge.expiresAt))) {
+    throw new Error("policy challenge binding is invalid");
+  }
+  didKeyBytes(holderDid);
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const challengeExpiry = Date.parse(challenge.expiresAt);
+  const credentialExpiry = Date.parse(input.credential.expiresAt);
+  const expiresAtMs = Math.min(
+    now.getTime() + 6e4,
+    challengeExpiry,
+    credentialExpiry
+  );
+  if (expiresAtMs <= now.getTime()) throw new Error("policy challenge is expired");
+  const unsigned = Object.freeze({
+    schema: POLICY_PRESENTATION_V3_SCHEMA,
+    jti: input.jti ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
+    challengeId: challenge.challengeId,
+    nonce: challenge.nonce,
+    policyCid: input.policyCid,
+    nodeAudience: challenge.nodeAudience,
+    holderDid,
+    subjectDid: input.credential.subjectDid,
+    credentialSpaceOwnerDid: nonEmpty(
+      input.credentialSpaceOwnerDid,
+      "credential space owner DID"
+    ),
+    credentialDigest,
+    requirementDigest,
+    descriptorDigest: input.credential.descriptorDigest,
+    requestedCapabilities: Object.freeze(requestedCapabilities),
+    issuedAt: rfc3339Seconds(now),
+    expiresAt: rfc3339Seconds(new Date(expiresAtMs))
+  });
+  const digest4 = sha2565(
+    new TextEncoder().encode(
+      POLICY_PRESENTATION_V3_DOMAIN + jcsCanonicalize(unsigned)
+    )
+  );
+  const signature = await input.sign(digest4);
+  if (signature.length !== 64 || !ed255194.verify(signature, digest4, didKeyBytes(holderDid))) {
+    throw new Error("policy presentation signature is invalid");
+  }
+  return Object.freeze({
+    ...unsigned,
+    signature: Object.freeze({
+      suite: "Ed25519",
+      signerDid: holderDid,
+      value: encodeBase64Url(signature)
+    })
+  });
+}
+async function admitPolicyCredentialV3(input) {
+  const policy = validateUnifiedPolicyV2(input.policy, input.policyCid);
+  const nodeOrigin = policyNodeOrigin(input.nodeOrigin);
+  const accountAuthorizationCid = nonEmpty(
+    input.accountAuthorizationCid,
+    "account authorization CID"
+  );
+  const credentialSpaceId = nonEmpty(
+    input.credentialSpaceId,
+    "credential space ID"
+  );
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const challenge = await requestPolicyChallengeV3({
+    nodeOrigin,
+    policyCid: input.policyCid,
+    recipientDid: input.credential.holderDid,
+    requestedCapabilities: input.requestedCapabilities,
+    fetch: fetchFn
+  });
+  const presentation = await buildPolicyCredentialPresentationV3({
+    ...input,
+    policy,
+    challenge
+  });
+  const response = await fetchFn(
+    new URL("/share/v3/policy/delegations", nodeOrigin),
+    {
+      method: "POST",
+      redirect: "error",
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({
+        policyCid: input.policyCid,
+        challengeId: challenge.challengeId,
+        nonce: challenge.nonce,
+        requirement: validateCredentialRequirement(input.requirement),
+        credential: envelopeFromVerified(input.credential),
+        accountAuthorizationCid,
+        credentialSpaceId,
+        presentation
+      })
+    }
+  );
+  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  const value = record(await response.json(), "policy delegation");
+  if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") {
+    throw new Error("policy delegation response is invalid");
+  }
+  const session = parsePolicySessionUcan(value.authorization, [
+    input.policyRootCid,
+    input.enforcementRootCid
+  ]);
+  const expectedAttenuation = compactAttenuationForPolicyCapabilities(
+    input.requestedCapabilities
+  );
+  if (session.cid !== value.sessionCid || session.aud !== input.credential.holderDid || session.fact.policyCid !== input.policyCid || session.fact.recipientDid !== input.credential.holderDid || session.fact.policyDelegationCid !== input.policyRootCid || session.fact.enforcementDelegationCid !== input.enforcementRootCid || jcsCanonicalize(session.att) !== jcsCanonicalize(expectedAttenuation)) {
+    throw new Error("policy delegation signed binding is invalid");
+  }
+  return Object.freeze({ challenge, presentation, session });
+}
+
 // src/requester/index.ts
 var REQUESTER_NEAR_EXPIRY_SECONDS = 30;
 var REQUESTER_ENGINE_RETRY_ATTEMPTS = 3;
@@ -4252,15 +4608,15 @@ var TranscriptRequester = class _TranscriptRequester {
         "bootstrap owner-node binding does not match trusted discovery/config"
       );
     }
-    const record = await verifyRecordBeforeEgress(bootstrap, options2);
-    if (record.endpoint !== bootstrap.policyEngine.endpoint) {
+    const record2 = await verifyRecordBeforeEgress(bootstrap, options2);
+    if (record2.endpoint !== bootstrap.policyEngine.endpoint) {
       throw new TranscriptRequesterError(
         "requester-engine-record-endpoint-mismatch",
         "policy engine record endpoint does not match bootstrap endpoint",
         "bootstrap-invalid"
       );
     }
-    if (record.audience !== bootstrap.policyEngine.audience) {
+    if (record2.audience !== bootstrap.policyEngine.audience) {
       throw new TranscriptRequesterError(
         "requester-engine-record-audience-mismatch",
         "policy engine record audience does not match bootstrap audience",
@@ -4291,7 +4647,7 @@ var TranscriptRequester = class _TranscriptRequester {
       requestedCapabilities,
       nativeAuthorityCeiling,
       requestedCapabilitiesHash(requestedCapabilities),
-      parseStrictRfc33392(record.expiresAt),
+      parseStrictRfc33392(record2.expiresAt),
       policyEngineAddresses,
       ownerNodeAddresses,
       options2
@@ -4914,7 +5270,7 @@ function requestedCapabilitiesHash(capabilities) {
   const bytes2 = new Uint8Array(domain.length + body.length);
   bytes2.set(domain, 0);
   bytes2.set(body, domain.length);
-  return bytesToHex3(sha2565(bytes2, "bytes")).slice(2);
+  return bytesToHex3(sha2566(bytes2, "bytes")).slice(2);
 }
 function normalizeWireDelegation(delegation) {
   const signed = delegationAuthorityFromCompactJws(delegation.encoded);
@@ -5160,9 +5516,9 @@ function parseNodeDataResponse(response, schema, label) {
 function nodeErrorMessage(body) {
   if (typeof body === "string") return body;
   if (body !== null && typeof body === "object") {
-    const record = body;
-    const code3 = typeof record.code === "string" ? record.code : void 0;
-    const message = typeof record.message === "string" ? record.message : void 0;
+    const record2 = body;
+    const code3 = typeof record2.code === "string" ? record2.code : void 0;
+    const message = typeof record2.message === "string" ? record2.message : void 0;
     if (code3 !== void 0)
       return message === void 0 ? code3 : `${code3}: ${message}`;
   }
@@ -7484,7 +7840,7 @@ function parseRecapCapabilities(parseWasm, siwe) {
 }
 
 // src/delegations/SharingService.ts
-import { ed25519 as ed255196 } from "@noble/curves/ed25519";
+import { ed25519 as ed255197 } from "@noble/curves/ed25519";
 
 // src/delegations/ShareRecipientClient.ts
 import {
@@ -7492,13 +7848,13 @@ import {
   KVService,
   ServiceContext
 } from "@tinycloud/sdk-services";
-import { ed25519 as ed255195 } from "@noble/curves/ed25519";
-import { sha256 as sha2568 } from "@noble/hashes/sha256";
+import { ed25519 as ed255196 } from "@noble/curves/ed25519";
+import { sha256 as sha2569 } from "@noble/hashes/sha256";
 
 // src/delegations/share-envelope.ts
-import { ed25519 as ed255194 } from "@noble/curves/ed25519";
+import { ed25519 as ed255195 } from "@noble/curves/ed25519";
 import { blake3 as blake33 } from "@noble/hashes/blake3";
-import { sha256 as sha2566 } from "@noble/hashes/sha256";
+import { sha256 as sha2567 } from "@noble/hashes/sha256";
 var ENVELOPE_SCHEMA = "xyz.tinycloud.share/envelope";
 var INLINE_PREFIX = "tc2:";
 var RAW_CID_CODEC = 85;
@@ -7717,7 +8073,7 @@ function createSharePolicy(input) {
   };
 }
 function contentDigest(bytes2) {
-  return bytesToBase64Url(sha2566(bytes2));
+  return bytesToBase64Url(sha2567(bytes2));
 }
 function computeShareCid(bytes2) {
   const digest4 = create(BLAKE3_256_CODE, blake33(bytes2));
@@ -7737,7 +8093,7 @@ function envelopeSigningBytes(envelope) {
 }
 function signShareEnvelope(input) {
   if (input.signerPrivateKey.length !== 32) throw new ShareEnvelopeError("invalid-envelope", "Ed25519 private key must be 32 bytes");
-  const publicKey = ed255194.getPublicKey(input.signerPrivateKey);
+  const publicKey = ed255195.getPublicKey(input.signerPrivateKey);
   const unsigned = {
     schema: ENVELOPE_SCHEMA,
     version: 2,
@@ -7752,7 +8108,7 @@ function signShareEnvelope(input) {
     expiresAt: new Date(input.expiresAt).toISOString(),
     signer: { did: input.signerDid, publicKey: bytesToBase64Url(publicKey) }
   };
-  return { ...unsigned, signature: bytesToBase64Url(ed255194.sign(envelopeSigningBytes(unsigned), input.signerPrivateKey)) };
+  return { ...unsigned, signature: bytesToBase64Url(ed255195.sign(envelopeSigningBytes(unsigned), input.signerPrivateKey)) };
 }
 function verifyShareEnvelope(envelope, options2 = {}) {
   try {
@@ -7784,7 +8140,7 @@ function verifyShareEnvelope(envelope, options2 = {}) {
     const signature = base64UrlToBytes(envelope.signature);
     const unsigned = { ...envelope };
     delete unsigned.signature;
-    if (publicKey.length !== 32 || signature.length !== 64 || !ed255194.verify(signature, envelopeSigningBytes(unsigned), publicKey)) throw new ShareEnvelopeError("signature-invalid", "share envelope signature is invalid");
+    if (publicKey.length !== 32 || signature.length !== 64 || !ed255195.verify(signature, envelopeSigningBytes(unsigned), publicKey)) throw new ShareEnvelopeError("signature-invalid", "share envelope signature is invalid");
     if (options2.trustedSignerDids !== void 0 && envelope.recipientKind !== void 0 && !options2.trustedSignerDids.includes(envelope.signer.did)) throw new ShareEnvelopeError("signature-invalid", "share signer is not trusted");
     return envelope;
   } catch (error) {
@@ -7832,7 +8188,7 @@ function encodeInlineShareUrl(input) {
 }
 var PUBLISHED_AAD = new TextEncoder().encode("tinycloud-share-envelope-v1");
 function publishedCid(bytes2) {
-  return CID.create(1, code, create(sha2562.code, sha2566(bytes2))).toString();
+  return CID.create(1, code, create(sha2562.code, sha2567(bytes2))).toString();
 }
 function isPublishedCid(value) {
   try {
@@ -7872,7 +8228,7 @@ function publishedArtifact(envelope, plaintext, policy) {
       content: {
         mimeType: "application/octet-stream",
         size: plaintext.byteLength,
-        digest: bytesToBase64Url(sha2566(plaintext))
+        digest: bytesToBase64Url(sha2567(plaintext))
       },
       // Addressed policy metadata is confidential even though this function
       // is called after the outer envelope has been opened. Keep the
@@ -7976,9 +8332,9 @@ function parsePolicyMetadata(policyBytes, target, expectedExpiry) {
     assertKeys(source, ["kind", "space", "database", "path", "statement", "arguments", "argumentsDigest", "action"], "published SQL content source");
     if (typeof source.space !== "string" || typeof source.database !== "string" || typeof source.path !== "string" || typeof source.statement !== "string" || !source.arguments || typeof source.arguments !== "object" || Array.isArray(source.arguments) || typeof source.argumentsDigest !== "string" || source.action !== "tinycloud.sql/read") throw new ShareEnvelopeError("invalid-envelope", "published SQL content source is invalid");
     for (const argument of Object.values(source.arguments)) if (!Number.isSafeInteger(argument)) throw new ShareEnvelopeError("invalid-envelope", "published SQL arguments are invalid");
-    if (bytesToBase64Url(sha2566(new TextEncoder().encode(canonicalJson(source.arguments)))) !== source.argumentsDigest) throw new ShareEnvelopeError("invalid-envelope", "published SQL argument digest is invalid");
+    if (bytesToBase64Url(sha2567(new TextEncoder().encode(canonicalJson(source.arguments)))) !== source.argumentsDigest) throw new ShareEnvelopeError("invalid-envelope", "published SQL argument digest is invalid");
   } else throw new ShareEnvelopeError("invalid-envelope", "policy content source kind is invalid");
-  if (typeof policy.contentSourceDigest !== "string" || bytesToBase64Url(sha2566(new TextEncoder().encode(canonicalJson(source)))) !== policy.contentSourceDigest) throw new ShareEnvelopeError("invalid-envelope", "policy content source digest is invalid");
+  if (typeof policy.contentSourceDigest !== "string" || bytesToBase64Url(sha2567(new TextEncoder().encode(canonicalJson(source)))) !== policy.contentSourceDigest) throw new ShareEnvelopeError("invalid-envelope", "policy content source digest is invalid");
   return { recipientKind, actions, resource };
 }
 function parseCanonicalPublishedV2(value, options2) {
@@ -8026,7 +8382,7 @@ function parseCanonicalPublishedV2(value, options2) {
   const signingBytes = new Uint8Array(domain.length + body.length);
   signingBytes.set(domain);
   signingBytes.set(body, domain.length);
-  if (signatureBytes.length !== 64 || !ed255194.verify(signatureBytes, signingBytes, signerKey)) throw new ShareEnvelopeError("signature-invalid", "published v2 envelope signature is invalid");
+  if (signatureBytes.length !== 64 || !ed255195.verify(signatureBytes, signingBytes, signerKey)) throw new ShareEnvelopeError("signature-invalid", "published v2 envelope signature is invalid");
   const content = options2.plaintext ?? new Uint8Array();
   const normalized = {
     schema: ENVELOPE_SCHEMA,
@@ -8036,7 +8392,7 @@ function parseCanonicalPublishedV2(value, options2) {
     recipientKind: normalizedMatcher.kind,
     resource,
     actions,
-    content: { mimeType: typeof contentSource.mimeType === "string" ? contentSource.mimeType : "application/octet-stream", size: content.byteLength, digest: bytesToBase64Url(sha2566(content)) },
+    content: { mimeType: typeof contentSource.mimeType === "string" ? contentSource.mimeType : "application/octet-stream", size: content.byteLength, digest: bytesToBase64Url(sha2567(content)) },
     encrypted: true,
     expiresAt: value.expiry,
     signer: { did: signature.signerDid, publicKey: bytesToBase64Url(signerKey) },
@@ -8135,7 +8491,7 @@ function parsePublishedShareEnvelope(bytes2, options2 = {}) {
   if (envelope.authorizationTarget.kind !== "bearerKey" && (options2.trustedSignerDids === void 0 || !options2.trustedSignerDids.includes(envelope.signature.signerDid))) throw new ShareEnvelopeError("signature-invalid", "a trusted authority is required for addressed shares");
   const signature = base64UrlToBytes(envelope.signature.value);
   const publicKey = publishedPublicKey(envelope.signature.signerDid);
-  if (signature.length !== 64 || !ed255194.verify(signature, publishedEnvelopeSigningBytes(envelope), publicKey)) throw new ShareEnvelopeError("signature-invalid", "published envelope signature is invalid");
+  if (signature.length !== 64 || !ed255195.verify(signature, publishedEnvelopeSigningBytes(envelope), publicKey)) throw new ShareEnvelopeError("signature-invalid", "published envelope signature is invalid");
   return { envelope, artifact: publishedArtifact(envelope, options2.plaintext ?? new Uint8Array(), policy) };
 }
 function parseLegacyPublishedShareEnvelope(bytes2, options2 = {}) {
@@ -8174,7 +8530,7 @@ function parseLegacyPublishedShareEnvelope(bytes2, options2 = {}) {
   const signingBytes = new Uint8Array(domain.length + body.length);
   signingBytes.set(domain);
   signingBytes.set(body, domain.length);
-  if (signatureBytes.length !== 64 || !ed255194.verify(signatureBytes, signingBytes, signerKey)) throw new ShareEnvelopeError("signature-invalid", "published v1 envelope signature is invalid");
+  if (signatureBytes.length !== 64 || !ed255195.verify(signatureBytes, signingBytes, signerKey)) throw new ShareEnvelopeError("signature-invalid", "published v1 envelope signature is invalid");
   const content = options2.plaintext ?? new Uint8Array();
   const artifact = {
     envelope: {
@@ -8185,7 +8541,7 @@ function parseLegacyPublishedShareEnvelope(bytes2, options2 = {}) {
       resource: { kind: resource.kind, path: resource.path },
       recipientKind: authorizationTarget.kind === "bearer" ? "bearer" : authorizationTarget.kind === "exact-email" ? "exactEmail" : authorizationTarget.kind === "email-domain" ? "emailDomain" : void 0,
       actions: ["read"],
-      content: { mimeType: "application/octet-stream", size: content.byteLength, digest: bytesToBase64Url(sha2566(content)) },
+      content: { mimeType: "application/octet-stream", size: content.byteLength, digest: bytesToBase64Url(sha2567(content)) },
       encrypted: true,
       expiresAt: envelope.expiry,
       signer: { did: signature.signerDid, publicKey: bytesToBase64Url(signerKey) },
@@ -8372,13 +8728,13 @@ function shareCapabilityAllows(capability, action, path) {
 }
 
 // src/delegations/ShareCache.ts
-import { sha256 as sha2567 } from "@noble/hashes/sha256";
+import { sha256 as sha2568 } from "@noble/hashes/sha256";
 function cacheKey(key) {
   if (!key.cid || !key.expiresAt) throw new Error("share cache keys require CID and expiry");
   return `${key.cid}\0${key.expiresAt}`;
 }
 function digest2(bytes2) {
-  return sha2567(bytes2);
+  return sha2568(bytes2);
 }
 function equalBytes2(left, right) {
   if (left.byteLength !== right.byteLength) return false;
@@ -8755,7 +9111,7 @@ function randomJti() {
   return bytesToBase64Url2(bytes2);
 }
 function digestCanonical(value) {
-  return bytesToBase64Url2(sha2568(new TextEncoder().encode(canonicalJsonForProof(value))));
+  return bytesToBase64Url2(sha2569(new TextEncoder().encode(canonicalJsonForProof(value))));
 }
 function actionWire(action) {
   return action === "get" ? "tinycloud.kv/get" : action === "metadata" ? "tinycloud.kv/metadata" : action === "list" ? "tinycloud.kv/list" : "tinycloud.kv/put";
@@ -8991,9 +9347,9 @@ var ShareRecipientClient = class {
       const authority = Object.entries(session.att).find(([parentResource, abilities]) => {
         if (!(action in abilities)) return false;
         if (serviceName === "encryption") return parentResource.startsWith("urn:tinycloud:encryption:") && parentResource === cleanPath;
-        const match = /^tinycloud:\/\/[^/]+\/kv\/(.+)$/.exec(parentResource);
-        if (match === null) return false;
-        const parentPath = match[1];
+        const marker = parentResource.indexOf("/kv/");
+        if (marker < 1) return false;
+        const parentPath = parentResource.slice(marker + 4);
         const caveats = abilities[action] ?? [];
         const prefix = caveats.some((value) => isRecord(value) && value.kind === "prefix");
         return cleanPath === parentPath || prefix && cleanPath.startsWith(`${parentPath}/`);
@@ -9019,10 +9375,10 @@ var ShareRecipientClient = class {
   policySessionProjection(delegation) {
     const session = parsePolicySessionUcan(delegation.delegationHeader.Authorization);
     if (session.cid !== delegation.cid || session.aud !== delegation.delegateDID) throw new ShareAccessError("SHARE_SESSION_INVALID");
-    const kvResource = Object.keys(session.att).find((resource) => /^tinycloud:\/\/[^/]+\/kv\/.+$/.test(resource));
-    const match = kvResource === void 0 ? void 0 : /^tinycloud:\/\/([^/]+)\/kv\/(.+)$/.exec(kvResource);
-    if (match === void 0 || match === null) throw new ShareAccessError("SHARE_SESSION_INVALID");
-    return { spaceId: match[1] };
+    const kvResource = Object.keys(session.att).find((resource) => resource.indexOf("/kv/") > 0);
+    const marker = kvResource?.indexOf("/kv/") ?? -1;
+    if (kvResource === void 0 || marker < 1) throw new ShareAccessError("SHARE_SESSION_INVALID");
+    return { spaceId: kvResource.slice(0, marker) };
   }
   createKV(origin2, session, invokeOverride) {
     const invoke = invokeOverride ?? this.options.invoke ?? nativeInvoke;
@@ -9072,7 +9428,7 @@ var ShareRecipientClient = class {
     if (bytes2.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES)) throw new ShareAccessError("SHARE_TOO_LARGE");
     const contentType = input.contentType ?? envelope.content.mimeType;
     if (contentType !== envelope.content.mimeType && !/^text\/(?:plain|markdown)(?:;|$)/i.test(contentType)) throw new ShareAccessError("SHARE_CONTENT_TYPE_INVALID");
-    const result = await this.invokeNative({ envelope, session, action: "put", resource: path, body: bytes2, bodyDigest: bytesToBase64Url2(sha2568(bytes2)), contentType, ifMatch: input.etag, mediaType: "application/vnd.tinycloud.share+json" });
+    const result = await this.invokeNative({ envelope, session, action: "put", resource: path, body: bytes2, bodyDigest: bytesToBase64Url2(sha2569(bytes2)), contentType, ifMatch: input.etag, mediaType: "application/vnd.tinycloud.share+json" });
     if (result.status === 412 || result.status === 409) throw new ShareConflict(path, result.headers?.etag);
     if (result.status === 401 || result.status === 403) throw new ShareAccessError("SHARE_DENIED");
     if (result.status < 200 || result.status >= 300) throw new ShareAccessError("SHARE_WRITE_FAILED");
@@ -9224,44 +9580,44 @@ var ShareRecipientClient = class {
     }
     const parsed = ShareNativeResponseSchema.safeParse(value);
     if (!parsed.success) throw new ShareAccessError("SHARE_RESPONSE_INVALID");
-    const record = parsed.data;
+    const record2 = parsed.data;
     const expectedAction = actionWire(input.action);
-    if (record.action !== expectedAction || record.version !== 2 || record.resource !== input.resource) {
+    if (record2.action !== expectedAction || record2.version !== 2 || record2.resource !== input.resource) {
       throw new ShareAccessError("SHARE_RESPONSE_MISMATCH");
     }
-    if (record.etag !== void 0 && record.etag !== null && headers.etag !== void 0 && record.etag !== headers.etag) throw new ShareAccessError("SHARE_RESPONSE_INTEGRITY");
-    if (record.etag !== void 0 && record.etag !== null) headers.etag = record.etag;
+    if (record2.etag !== void 0 && record2.etag !== null && headers.etag !== void 0 && record2.etag !== headers.etag) throw new ShareAccessError("SHARE_RESPONSE_INTEGRITY");
+    if (record2.etag !== void 0 && record2.etag !== null) headers.etag = record2.etag;
     if (input.action === "list") {
-      if (record.entries === void 0) throw new ShareAccessError("SHARE_RESPONSE_INVALID");
-      const rawEntries = record.entries;
+      if (record2.entries === void 0) throw new ShareAccessError("SHARE_RESPONSE_INVALID");
+      const rawEntries = record2.entries;
       if (rawEntries.length > MAX_NATIVE_ENTRIES) throw new ShareAccessError("SHARE_TOO_LARGE");
       const entries = [...rawEntries];
       const headerCursor = response.headers.get("x-tinycloud-next-cursor");
-      if (record.nextCursor !== void 0 && record.nextCursor !== null && headerCursor !== null && record.nextCursor !== headerCursor) throw new ShareAccessError("SHARE_RESPONSE_INTEGRITY");
-      const nextCursor = record.nextCursor ?? headerCursor ?? void 0;
+      if (record2.nextCursor !== void 0 && record2.nextCursor !== null && headerCursor !== null && record2.nextCursor !== headerCursor) throw new ShareAccessError("SHARE_RESPONSE_INTEGRITY");
+      const nextCursor = record2.nextCursor ?? headerCursor ?? void 0;
       if (nextCursor !== void 0 && new TextEncoder().encode(nextCursor).byteLength > MAX_NATIVE_CURSOR_BYTES) throw new ShareAccessError("SHARE_TOO_LARGE");
-      return { status: response.status, headers, type: record.type, version: record.version, action: record.action, resource: record.resource, keys: entries.map((entry) => entry.path), entries, truncated: nextCursor !== void 0, nextCursor };
+      return { status: response.status, headers, type: record2.type, version: record2.version, action: record2.action, resource: record2.resource, keys: entries.map((entry) => entry.path), entries, truncated: nextCursor !== void 0, nextCursor };
     }
     if (input.action === "get") {
-      if (record.content === void 0 || record.bodyDigest === void 0) throw new ShareAccessError("SHARE_RESPONSE_INVALID");
+      if (record2.content === void 0 || record2.bodyDigest === void 0) throw new ShareAccessError("SHARE_RESPONSE_INVALID");
       let bytes2;
       try {
-        bytes2 = base64UrlToBytes2(record.content);
+        bytes2 = base64UrlToBytes2(record2.content);
       } catch {
         throw new ShareAccessError("SHARE_RESPONSE_INVALID");
       }
-      if (bytes2.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES) || !this.digestMatches(record.bodyDigest, bytes2)) throw new ShareAccessError("SHARE_RESPONSE_INTEGRITY");
-      return { status: response.status, headers, bytes: bytes2, bodyDigest: record.bodyDigest, type: record.type, version: record.version, action: record.action, resource: record.resource };
+      if (bytes2.byteLength > (this.options.maxContentBytes ?? DEFAULT_MAX_CONTENT_BYTES) || !this.digestMatches(record2.bodyDigest, bytes2)) throw new ShareAccessError("SHARE_RESPONSE_INTEGRITY");
+      return { status: response.status, headers, bytes: bytes2, bodyDigest: record2.bodyDigest, type: record2.type, version: record2.version, action: record2.action, resource: record2.resource };
     }
     if (input.action === "metadata") {
-      if (record.metadata === void 0) throw new ShareAccessError("SHARE_RESPONSE_INVALID");
-      return { status: response.status, headers, metadata: record.metadata, etag: record.etag ?? void 0, type: record.type, version: record.version, action: record.action, resource: record.resource };
+      if (record2.metadata === void 0) throw new ShareAccessError("SHARE_RESPONSE_INVALID");
+      return { status: response.status, headers, metadata: record2.metadata, etag: record2.etag ?? void 0, type: record2.type, version: record2.version, action: record2.action, resource: record2.resource };
     }
-    const responseEtag = record.etag;
-    const responseBodyDigest = record.bodyDigest;
+    const responseEtag = record2.etag;
+    const responseBodyDigest = record2.bodyDigest;
     if (responseEtag === void 0 || responseEtag === null || responseEtag.length === 0 || headers.etag !== void 0 && responseEtag !== headers.etag) throw new ShareAccessError("SHARE_RESPONSE_INVALID");
     if (input.bodyDigest === void 0 || responseBodyDigest === void 0 || responseBodyDigest !== input.bodyDigest || !this.digestMatches(responseBodyDigest, input.body ?? new Uint8Array())) throw new ShareAccessError("SHARE_RESPONSE_INTEGRITY");
-    return { status: response.status, headers, bodyDigest: responseBodyDigest, type: record.type, version: record.version, action: record.action, resource: record.resource };
+    return { status: response.status, headers, bodyDigest: responseBodyDigest, type: record2.type, version: record2.version, action: record2.action, resource: record2.resource };
   }
   validateNativeResult(input, result) {
     if (!isNativeSuccess(result)) throw new ShareAccessError("SHARE_RESPONSE_MISMATCH");
@@ -9318,7 +9674,7 @@ var ShareRecipientClient = class {
     }]);
   }
   digestMatches(value, bytes2) {
-    const digest4 = bytesToBase64Url2(sha2568(bytes2));
+    const digest4 = bytesToBase64Url2(sha2569(bytes2));
     return value === digest4 || value === `sha-256=:${digest4}:`;
   }
   assertNativeRequestBounds(envelope, session, operation, path, limit, cursor) {
@@ -9536,7 +9892,7 @@ var ShareRecipientClient = class {
         nodeAudience: binding.nodeAudience,
         ...isV2 ? {
           enforcerDid: challenge.enforcerDid,
-          credentialDigest: typeof presentation.credentialDigest === "string" ? presentation.credentialDigest : bytesToBase64Url2(sha2568(new TextEncoder().encode(credential)))
+          credentialDigest: typeof presentation.credentialDigest === "string" ? presentation.credentialDigest : bytesToBase64Url2(sha2569(new TextEncoder().encode(credential)))
         } : {},
         action,
         ...binding.actions === void 0 ? {} : { actions: [...binding.actions] },
@@ -9602,7 +9958,7 @@ var ShareRecipientClient = class {
     }
     if (isJwsProof && detached.kid !== `${signerDid}#${encoded}` || isEd25519Proof && detached.signerDid !== signerDid || signature.length !== 64) throw new ShareAccessError("SHARE_SESSION_INVALID", "Node proof binding is invalid");
     const bytes2 = new TextEncoder().encode(`${domain}${canonicalJsonForProof(message)}`);
-    if (!ed255195.verify(signature, bytes2, key)) throw new ShareAccessError("SHARE_SESSION_INVALID", "Node proof signature is invalid");
+    if (!ed255196.verify(signature, bytes2, key)) throw new ShareAccessError("SHARE_SESSION_INVALID", "Node proof signature is invalid");
   }
   assertChallengeRequestBinding(request, challenge) {
     const source = isRecord(request.body) ? request.body : request;
@@ -10806,7 +11162,7 @@ function shareKeyMatchesDid(key, didUrl) {
     if (!publicKey) return false;
     const jwkBytes = decodeBase64UrlBytes(key.x);
     const privateKey = decodeBase64UrlBytes(key.d);
-    const derivedPublicKey = ed255196.getPublicKey(privateKey);
+    const derivedPublicKey = ed255197.getPublicKey(privateKey);
     return privateKey.length === 32 && publicKey.length === jwkBytes.length && publicKey.every((byte, index) => byte === jwkBytes[index]) && derivedPublicKey.length === jwkBytes.length && derivedPublicKey.every((byte, index) => byte === jwkBytes[index]);
   } catch {
     return false;
@@ -10856,8 +11212,8 @@ function verifySignedChild(result, expected, computeCid) {
 }
 
 // src/delegations/owner-policy.ts
-import { ed25519 as ed255197 } from "@noble/curves/ed25519";
-import { sha256 as sha2569 } from "@noble/hashes/sha256";
+import { ed25519 as ed255198 } from "@noble/curves/ed25519";
+import { sha256 as sha25610 } from "@noble/hashes/sha256";
 var MAX_CONTENT_BYTES = 100 * 1024 * 1024;
 var ENFORCEMENT_DOMAIN = "xyz.tinycloud.share/policy-enforcement/v2\0";
 var POLICY_DOMAIN = "xyz.tinycloud.share/policy/v2\0";
@@ -10884,10 +11240,10 @@ function fromB64(value) {
   throw new Error("base64url decoding is unavailable");
 }
 function cid(bytesValue) {
-  return CID.createV1(code, create(sha2562.code, sha2569(bytesValue))).toString(base32.encoder);
+  return CID.createV1(code, create(sha2562.code, sha25610(bytesValue))).toString(base32.encoder);
 }
 function digest3(bytesValue) {
-  return b64(sha2569(bytesValue));
+  return b64(sha25610(bytesValue));
 }
 function didKeyFromEd25519PublicKey(publicKey) {
   if (publicKey.length !== 32) throw new Error("share key public key must be 32 bytes");
@@ -10959,9 +11315,9 @@ function dagCborEncode(value) {
 }
 function assertObject(value, keys, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
-  const record = value;
-  if (Object.keys(record).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} has unknown or missing fields`);
-  return record;
+  const record2 = value;
+  if (Object.keys(record2).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record2, key))) throw new Error(`${label} has unknown or missing fields`);
+  return record2;
 }
 async function createDelegatedShareKey(options2) {
   if (!globalThis.crypto?.subtle) throw new Error("WebCrypto Ed25519 is required for delegated share keys");
@@ -11072,7 +11428,7 @@ function validateOwnerSharePolicyRegistration(value, expected) {
   const publicKey = encodedKid.length === 34 ? encodedKid.slice(2) : encodedKid;
   const signatureBytes = fromB64(proof.signature);
   const signedBytes = new TextEncoder().encode(`${OWNER_SHARE_REGISTRATION_DOMAIN}${canonicalizeSignedObjectUnsigned(registrationCore)}`);
-  if (signatureBytes.length !== 64 || !ed255197.verify(signatureBytes, signedBytes, publicKey)) throw new Error("owner-share registration proof signature is invalid");
+  if (signatureBytes.length !== 64 || !ed255198.verify(signatureBytes, signedBytes, publicKey)) throw new Error("owner-share registration proof signature is invalid");
   return { registration, proof };
 }
 function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
@@ -11086,7 +11442,7 @@ function validateOwnerSharePolicyRegistrationBytes(bytesValue, expected) {
 }
 
 // src/delegations/share-delivery.ts
-import { ed25519 as ed255198 } from "@noble/curves/ed25519";
+import { ed25519 as ed255199 } from "@noble/curves/ed25519";
 var SHARE_DELIVERY_AUTHORIZATION_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v2\0";
 function isCanonicalHttpsOrigin(value) {
   let url;
@@ -11135,9 +11491,9 @@ var AUTHORIZATION_KEYS = [
 ];
 function assertObject2(value, keys, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
-  const record = value;
-  if (Object.keys(record).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record, key))) throw new Error(`${label} has unknown or missing fields`);
-  return record;
+  const record2 = value;
+  if (Object.keys(record2).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record2, key))) throw new Error(`${label} has unknown or missing fields`);
+  return record2;
 }
 function fromB642(value) {
   if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("share delivery value is not canonical base64url");
@@ -11174,7 +11530,7 @@ function validateShareDeliveryAuthorizationBytes(bytesValue, expected) {
   if (publicKey.length !== 32) throw new Error("share delivery authorization proof key is invalid");
   const signatureBytes = fromB642(proof.signature);
   const signedBytes = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_DOMAIN}${canonicalizeSignedObjectUnsigned(authorization)}`);
-  if (signatureBytes.length !== 64 || !ed255198.verify(signatureBytes, signedBytes, publicKey)) throw new Error("share delivery authorization proof signature is invalid");
+  if (signatureBytes.length !== 64 || !ed255199.verify(signatureBytes, signedBytes, publicKey)) throw new Error("share delivery authorization proof signature is invalid");
   return { authorization, proof };
 }
 function shareDeliveryTrustedKid(publicKey) {
@@ -11191,8 +11547,8 @@ var MemorySenderShareRecordStorage = class {
   constructor() {
     this.records = /* @__PURE__ */ new Map();
   }
-  async put(record) {
-    this.records.set(record.shareId, record);
+  async put(record2) {
+    this.records.set(record2.shareId, record2);
   }
   async list() {
     return [...this.records.values()];
@@ -11228,7 +11584,7 @@ var SenderShareStore = class {
   async save(receipt, key) {
     const registration = receipt.registration;
     if (registration.shareKeyDid !== key.did) throw new Error("share key does not match the registered receipt");
-    const record = {
+    const record2 = {
       shareId: registration.shareId,
       registrationCid: registration.registrationCid,
       policyCid: registration.policyCid,
@@ -11244,15 +11600,15 @@ var SenderShareStore = class {
       registeredAt: registration.registeredAt,
       expiresAt: registration.expiresAt
     };
-    await this.records.put(record);
-    await this.keys.put(record.shareId, { cryptoKey: key.cryptoKey, publicKey: key.publicKey, extractable: key.extractable });
-    return record;
+    await this.records.put(record2);
+    await this.keys.put(record2.shareId, { cryptoKey: key.cryptoKey, publicKey: key.publicKey, extractable: key.extractable });
+    return record2;
   }
   /** List shares created in any session, most recent first. */
   async list(options2) {
     const now = this.now().getTime();
     const records = await this.records.list();
-    return records.filter((record) => (options2?.includeRevoked ?? false) || record.revokedAt === void 0).filter((record) => (options2?.includeExpired ?? false) || Date.parse(record.expiresAt) > now).sort((left, right) => Date.parse(right.registeredAt) - Date.parse(left.registeredAt));
+    return records.filter((record2) => (options2?.includeRevoked ?? false) || record2.revokedAt === void 0).filter((record2) => (options2?.includeExpired ?? false) || Date.parse(record2.expiresAt) > now).sort((left, right) => Date.parse(right.registeredAt) - Date.parse(left.registeredAt));
   }
   async get(shareId) {
     return this.records.get(shareId);
@@ -11275,15 +11631,15 @@ var SenderShareStore = class {
    * returned CID, then call {@link markRevoked} once that succeeds.
    */
   async revocationTarget(shareId, scope) {
-    const record = await this.records.get(shareId);
-    if (record === void 0) throw new Error(`Unknown share: ${shareId}`);
-    return scope === "direct" ? record.enforcementDelegationCid : record.ownerDelegationCid;
+    const record2 = await this.records.get(shareId);
+    if (record2 === void 0) throw new Error(`Unknown share: ${shareId}`);
+    return scope === "direct" ? record2.enforcementDelegationCid : record2.ownerDelegationCid;
   }
   /** Mark a share revoked locally after the caller's node-side revoke call succeeds. */
   async markRevoked(shareId, revokedAt = this.now().toISOString()) {
-    const record = await this.records.get(shareId);
-    if (record === void 0) throw new Error(`Unknown share: ${shareId}`);
-    const revoked = { ...record, revokedAt };
+    const record2 = await this.records.get(shareId);
+    if (record2 === void 0) throw new Error(`Unknown share: ${shareId}`);
+    const revoked = { ...record2, revokedAt };
     await this.records.put(revoked);
     return revoked;
   }
@@ -13117,27 +13473,27 @@ var AccountService = class {
         const kvResult = this.accountKV();
         if (!kvResult.ok) return kvResult;
         let registered;
-        for (const record of request.registryRecords) {
-          const manifestHash = hashJson(record.manifests);
-          if (!options2.assumeUnregistered && await this.indexHasApplicationHash(record.app_id, manifestHash)) {
+        for (const record2 of request.registryRecords) {
+          const manifestHash = hashJson(record2.manifests);
+          if (!options2.assumeUnregistered && await this.indexHasApplicationHash(record2.app_id, manifestHash)) {
             registered = {
-              appId: record.app_id,
-              manifests: record.manifests,
+              appId: record2.app_id,
+              manifests: record2.manifests,
               manifestHash,
-              name: record.manifests[0]?.name,
-              description: record.manifests[0]?.description
+              name: record2.manifests[0]?.name,
+              description: record2.manifests[0]?.description
             };
             continue;
           }
           const stored = {
-            app_id: record.app_id,
-            manifests: record.manifests,
+            app_id: record2.app_id,
+            manifests: record2.manifests,
             manifest_hash: manifestHash,
             updated_at: (/* @__PURE__ */ new Date()).toISOString()
           };
-          const written = await kvResult.data.put(record.key, stored);
+          const written = await kvResult.data.put(record2.key, stored);
           if (!written.ok) return accountErr(written.error);
-          registered = applicationFromRecord(record.key, stored);
+          registered = applicationFromRecord(record2.key, stored);
           await this.upsertApplicationIndexQuietly(registered);
         }
         return ok3(registered);
@@ -13211,11 +13567,11 @@ var AccountService = class {
         if (!kvResult.ok) return kvResult;
         const stored = spaces.map((space) => spaceRecordFromInput(space));
         const registered = stored.map(
-          (record) => spaceFromRecord(spaceKey(record.space_id), record)
+          (record2) => spaceFromRecord(spaceKey(record2.space_id), record2)
         );
-        const items = stored.map((record) => ({
-          key: spaceKey(record.space_id),
-          value: record
+        const items = stored.map((record2) => ({
+          key: spaceKey(record2.space_id),
+          value: record2
         }));
         const batchResult = await kvResult.data.batchPut(items);
         if (batchResult.ok) {
@@ -13226,10 +13582,10 @@ var AccountService = class {
           return accountErr(batchResult.error);
         }
         const reconcileFailures = [];
-        for (const record of stored) {
-          const written = await kvResult.data.put(spaceKey(record.space_id), record);
+        for (const record2 of stored) {
+          const written = await kvResult.data.put(spaceKey(record2.space_id), record2);
           if (!written.ok) {
-            reconcileFailures.push(`${record.space_id}: ${written.error.message}`);
+            reconcileFailures.push(`${record2.space_id}: ${written.error.message}`);
           }
         }
         if (reconcileFailures.length > 0) {
@@ -13849,16 +14205,16 @@ function applicationKey(appId) {
 function appIdFromKey(key) {
   return key.startsWith(ACCOUNT_REGISTRY_PATH) ? key.slice(ACCOUNT_REGISTRY_PATH.length) : key;
 }
-function applicationFromRecord(key, record) {
-  const manifests = Array.isArray(record.manifests) ? record.manifests : [];
+function applicationFromRecord(key, record2) {
+  const manifests = Array.isArray(record2.manifests) ? record2.manifests : [];
   const first = manifests[0];
   return {
-    appId: record.app_id ?? record.appId ?? first?.app_id ?? appIdFromKey(key),
+    appId: record2.app_id ?? record2.appId ?? first?.app_id ?? appIdFromKey(key),
     manifests,
-    updatedAt: record.updated_at ?? record.updatedAt,
+    updatedAt: record2.updated_at ?? record2.updatedAt,
     name: first?.name,
     description: first?.description,
-    manifestHash: record.manifest_hash ?? record.manifestHash ?? hashJson(manifests)
+    manifestHash: record2.manifest_hash ?? record2.manifestHash ?? hashJson(manifests)
   };
 }
 function indexedApplicationFromRow(row) {
@@ -13901,17 +14257,17 @@ function spaceRecordFromInput(space) {
     expires_at: accountSpace.expiresAt instanceof Date ? accountSpace.expiresAt.toISOString() : accountSpace.expiresAt
   };
 }
-function spaceFromRecord(key, record) {
-  const expiresAt = record.expires_at ?? record.expiresAt;
+function spaceFromRecord(key, record2) {
+  const expiresAt = record2.expires_at ?? record2.expiresAt;
   return {
-    spaceId: record.space_id ?? record.spaceId ?? spaceIdFromKey(key),
-    name: record.name ?? spaceIdFromKey(key).split(":").pop() ?? spaceIdFromKey(key),
-    ownerDid: record.owner_did ?? record.ownerDid ?? record.owner ?? "",
-    type: record.type ?? "discovered",
-    permissions: Array.isArray(record.permissions) ? record.permissions : [],
-    status: record.status ?? "active",
-    registeredAt: record.registered_at ?? record.registeredAt,
-    updatedAt: record.updated_at ?? record.updatedAt,
+    spaceId: record2.space_id ?? record2.spaceId ?? spaceIdFromKey(key),
+    name: record2.name ?? spaceIdFromKey(key).split(":").pop() ?? spaceIdFromKey(key),
+    ownerDid: record2.owner_did ?? record2.ownerDid ?? record2.owner ?? "",
+    type: record2.type ?? "discovered",
+    permissions: Array.isArray(record2.permissions) ? record2.permissions : [],
+    status: record2.status ?? "active",
+    registeredAt: record2.registered_at ?? record2.registeredAt,
+    updatedAt: record2.updated_at ?? record2.updatedAt,
     expiresAt: expiresAt ? new Date(expiresAt) : void 0
   };
 }
@@ -16722,7 +17078,7 @@ function portForProtocol(protocol) {
 }
 
 // src/location.ts
-import { ed25519 as ed255199 } from "@noble/curves/ed25519";
+import { ed25519 as ed2551910 } from "@noble/curves/ed25519";
 import { verifyMessage as verifyMessage2 } from "viem";
 var DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL = "https://registry.tinycloud.xyz";
 var DEFAULT_TINYCLOUD_FALLBACK_HOST = "https://node.tinycloud.xyz";
@@ -16787,13 +17143,13 @@ var CloudLocationResolutionError = class extends Error {
     this.attempts = attempts;
   }
 };
-function locationPayloadForRecord(record) {
+function locationPayloadForRecord(record2) {
   return {
-    version: record.version,
-    subject: record.subject,
-    multiaddrs: [...record.multiaddrs],
-    updated_at: record.updated_at,
-    sequence: record.sequence
+    version: record2.version,
+    subject: record2.subject,
+    multiaddrs: [...record2.multiaddrs],
+    updated_at: record2.updated_at,
+    sequence: record2.sequence
   };
 }
 function canonicalLocationPayload(payload) {
@@ -16852,13 +17208,13 @@ function validateLocationRecord(input) {
   return { ...payload, signature };
 }
 async function verifyLocationRecord(input) {
-  const record = validateLocationRecord(input);
-  const payload = canonicalLocationPayload(locationPayloadForRecord(record));
-  if (record.subject.startsWith("did:pkh:")) {
-    return verifyPkhSignature(record.subject, payload, record.signature);
+  const record2 = validateLocationRecord(input);
+  const payload = canonicalLocationPayload(locationPayloadForRecord(record2));
+  if (record2.subject.startsWith("did:pkh:")) {
+    return verifyPkhSignature(record2.subject, payload, record2.signature);
   }
-  if (record.subject.startsWith("did:key:")) {
-    return verifyDidKeySignature(record.subject, payload, record.signature);
+  if (record2.subject.startsWith("did:key:")) {
+    return verifyDidKeySignature(record2.subject, payload, record2.signature);
   }
   return false;
 }
@@ -17044,18 +17400,18 @@ async function fetchRegistryLocalLinkCandidates(options2, fetchFn, existingCandi
   }
   const registryUrl = options2.registryUrl ?? DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL;
   try {
-    const record = await fetchLocationRecord(registryUrl, options2.subject, fetchFn);
-    if (!record) {
+    const record2 = await fetchLocationRecord(registryUrl, options2.subject, fetchFn);
+    if (!record2) {
       return [];
     }
     const shouldVerify = options2.verifyRecords ?? true;
-    if (shouldVerify && !await verifyLocationRecord(record)) {
+    if (shouldVerify && !await verifyLocationRecord(record2)) {
       debugLog(
         `registry record signature invalid for ${options2.subject}; skipping local-link lookup`
       );
       return [];
     }
-    return extractLocalLinkUrls(record).filter((url) => !existingCandidates.some((c) => c.url === url)).map((url) => ({
+    return extractLocalLinkUrls(record2).filter((url) => !existingCandidates.some((c) => c.url === url)).map((url) => ({
       source: "local-link",
       url,
       timeoutMs: LOCAL_LINK_PROBE_TIMEOUT_MS
@@ -17064,12 +17420,12 @@ async function fetchRegistryLocalLinkCandidates(options2, fetchFn, existingCandi
     return [];
   }
 }
-function extractLocalLinkUrls(record) {
-  if (!record) {
+function extractLocalLinkUrls(record2) {
+  if (!record2) {
     return [];
   }
   const urls = [];
-  for (const addr of record.multiaddrs) {
+  for (const addr of record2.multiaddrs) {
     let url;
     try {
       url = multiaddrToHttpUrl(addr);
@@ -17168,12 +17524,12 @@ async function resolveCentralized(subject, options2, verifyRecords) {
     if (!options2.centralizedRegistryUrl) {
       return null;
     }
-    const record = await fetchLocationRecord(
+    const record2 = await fetchLocationRecord(
       options2.centralizedRegistryUrl,
       subject,
       options2.fetch
     );
-    return toCandidate(subject, "centralized", record, verifyRecords);
+    return toCandidate(subject, "centralized", record2, verifyRecords);
   });
 }
 async function resolveFallback(subject, multiaddrs) {
@@ -17205,18 +17561,18 @@ async function toCandidate(subject, source, input, verifyRecord) {
   }
   const maybeRecord = input;
   if (maybeRecord.version === 1 && maybeRecord.signature !== void 0) {
-    const record = validateLocationRecord(input);
-    if (record.subject !== subject) {
+    const record2 = validateLocationRecord(input);
+    if (record2.subject !== subject) {
       throw new LocationRecordValidationError(
         "location record subject does not match requested subject"
       );
     }
-    if (verifyRecord && !await verifyLocationRecord(record)) {
+    if (verifyRecord && !await verifyLocationRecord(record2)) {
       throw new LocationRecordValidationError(
         "location record signature is invalid"
       );
     }
-    return { source, multiaddrs: [...record.multiaddrs], record };
+    return { source, multiaddrs: [...record2.multiaddrs], record: record2 };
   }
   const candidateInput = input;
   if (!Array.isArray(candidateInput.multiaddrs)) {
@@ -17226,18 +17582,18 @@ async function toCandidate(subject, source, input, verifyRecord) {
   }
   validateMultiaddrs(candidateInput.multiaddrs);
   if (candidateInput.record !== void 0) {
-    const record = validateLocationRecord(candidateInput.record);
-    if (record.subject !== subject) {
+    const record2 = validateLocationRecord(candidateInput.record);
+    if (record2.subject !== subject) {
       throw new LocationRecordValidationError(
         "location record subject does not match requested subject"
       );
     }
-    if (verifyRecord && !await verifyLocationRecord(record)) {
+    if (verifyRecord && !await verifyLocationRecord(record2)) {
       throw new LocationRecordValidationError(
         "location record signature is invalid"
       );
     }
-    return { source, multiaddrs: [...candidateInput.multiaddrs], record };
+    return { source, multiaddrs: [...candidateInput.multiaddrs], record: record2 };
   }
   return { source, multiaddrs: [...candidateInput.multiaddrs] };
 }
@@ -17294,7 +17650,7 @@ function verifyDidKeySignature(did, payload, signature) {
       "did:key signature must be a base64url Ed25519 signature"
     );
   }
-  return ed255199.verify(
+  return ed2551910.verify(
     signatureBytes,
     new TextEncoder().encode(payload),
     publicKey
@@ -17302,7 +17658,7 @@ function verifyDidKeySignature(did, payload, signature) {
 }
 function verifyDidKeyEd25519Signature(did, payload, signature) {
   const publicKey = ed25519PublicKeyFromDidKey2(did);
-  return ed255199.verify(signature, payload, publicKey);
+  return ed2551910.verify(signature, payload, publicKey);
 }
 function ed25519PublicKeyFromDidKey2(did) {
   const identifier = did.slice("did:key:".length);
@@ -17462,6 +17818,7 @@ export {
   OPENKEY_ACTION_ID_SEPARATOR,
   POLICY_CAPABILITY_V1_DOMAIN,
   POLICY_CAPABILITY_V1_SCHEMA,
+  POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE,
   POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA,
   POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA,
   POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA,
@@ -17469,11 +17826,15 @@ export {
   POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES,
   POLICY_ENGINE_RECORD_SCHEMA,
   POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA,
+  POLICY_PRESENTATION_V3_DOMAIN,
+  POLICY_PRESENTATION_V3_SCHEMA,
   POLICY_SCHEMA,
   POLICY_SESSION_UCAN_V1_PROFILE,
   POLICY_STATUS_SCHEMA,
   POLICY_V1_DOMAIN,
   POLICY_V1_SCHEMA,
+  POLICY_V2_DOMAIN,
+  POLICY_V2_SCHEMA,
   PORTABLE_DELEGATION_SCHEMA,
   PermissionNotInManifestError,
   PrefixedKVService,
@@ -17541,6 +17902,7 @@ export {
   actionContains,
   activateSessionWithHost,
   addressStorageKey,
+  admitPolicyCredentialV3,
   applyPrefix,
   bootstrapEncryptionNetworkId,
   bootstrapSpaceId,
@@ -17550,6 +17912,7 @@ export {
   buildDecryptFacts,
   buildDecryptInvocation,
   buildNetworkId2 as buildNetworkId,
+  buildPolicyCredentialPresentationV3,
   buildSpaceUri,
   canonicalDigest,
   canonicalHashHex,
@@ -17689,6 +18052,7 @@ export {
   policyCidFromCanonicalBytes,
   policyDigestHex,
   policyIdForDigestHex,
+  policyV2DigestHex,
   principalDid,
   principalDidEquals,
   projectUnifiedPolicyCapabilities,
@@ -17712,6 +18076,7 @@ export {
   shareCapabilityAllows,
   shareDeliveryTrustedKid,
   signCompactUcanAuthorization,
+  signCompactUcanRootAuthorization,
   signLocationRecord,
   signShareEnvelope,
   signedObjectIdFor,
@@ -17735,6 +18100,7 @@ export {
   validateOwnerSharePolicyRegistration,
   validateOwnerSharePolicyRegistrationBytes,
   validatePersistedSessionData,
+  validatePolicyCredentialRequirementV1,
   validatePolicyEngineRecordSigned,
   validatePolicyEngineRecordSignedShape,
   validatePolicyEngineRecordUnsigned,
@@ -17745,6 +18111,7 @@ export {
   validatePolicyStatusUnsigned,
   validatePolicyUnsigned,
   validateShareDeliveryAuthorizationBytes,
+  validateUnifiedPolicyV2,
   verifyDecryptResponse,
   verifyDidKeyEd25519Signature,
   verifyEip191MessageSignature,