@tinycloud/sdk-core 2.11.0 → 3.0.0-beta.0

package/dist/policy/index.d.cts

@@ -1,5 +1,5 @@
-import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../unified-BlXXf3l7.cjs';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, C as CONTENT_SOURCE_V1_DOMAIN, b as CompactPolicyInvocationInput, c as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, d as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, e as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, f as POLICY_CAPABILITY_V1_DOMAIN, g as POLICY_CAPABILITY_V1_SCHEMA, h as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, i as POLICY_ENGINE_RECORD_SCHEMA, j as POLICY_SCHEMA, k as POLICY_SESSION_UCAN_V1_PROFILE, l as POLICY_STATUS_SCHEMA, m as POLICY_V1_DOMAIN, n as POLICY_V1_SCHEMA, o as PolicyChallengeV3, p as PolicyRootStatusV3, q as PolicySessionUcanV1, r as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, s as ROOT_REVOCATION_V1_SCHEMA, t as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, u as ROOT_STATUS_RENEWAL_V1_DOMAIN, v as ROOT_STATUS_V1_DOMAIN, w as SignCompactUcanAuthorizationInput, x as SignatureMaterialError, y as SignatureSuite, z as SignatureVerificationError, B as SignedObjectCanonicalizationError, D as SignedObjectDigestError, F as SignedObjectErrorCode, G as SignedObjectIdError, H as SignedObjectKind, I as SignedObjectMaterial, K as SignedObjectProfileError, O as SignedObjectSchemaError, Q as SignedObjectSignature, T as SignedObjectVerificationResult, V as SignedPolicyObject, W as SigningKeyBindingError, X as UnifiedContentSource, Y as UnifiedEncryptionCapability, Z as UnifiedKvCapability, _ as UnifiedNativeCapability, $ as UnifiedPolicyCapability, a0 as UnifiedPolicyV1, a1 as UnifiedResourceSelector, a2 as UnsignedPolicy, a3 as UnsignedPolicyObject, a4 as UnsignedPolicyStatus, a5 as UnsupportedSignatureSuiteError, a6 as canonicalizeSignedObjectUnsigned, a7 as canonicalizeUnifiedPolicyCapability, a8 as compactAttenuationContains, a9 as contentSourceDigestHex, aa as createAndSignPolicy, ab as createAndSignPolicyEngineRecord, ac as createAndSignPolicyStatus, ad as createAndSignSignedObject, ae as createCompactPolicyDescendant, af as createCompactPolicyInvocation, ag as deriveSignedObjectMaterial, ah as getPolicyRootStatusV3, ai as mintPolicySessionV3, aj as normalizeUnifiedPolicyCapability, ak as parseCompactUcanAuthorization, al as parsePolicySessionUcan, am as policyCidFromCanonicalBytes, an as policyDigestHex, ao as policyIdForDigestHex, ap as projectUnifiedPolicyCapabilities, aq as projectUnifiedPolicyCapability, ar as renewPolicyRootStatusV3, as as requestPolicyChallengeV3, at as revokePolicyRootV3, au as signCompactUcanAuthorization, av as signedObjectIdFor, aw as toSignedObjectError, ax as unifiedNativeProjectionHashHex, ay as unifiedPolicyCapabilityContains, az as unifiedPolicyCapabilityDigestHex, aA as unifiedPolicyCapabilityFromNative, aB as validatePolicyEngineRecordSigned, aC as validatePolicyEngineRecordSignedShape, aD as validatePolicyEngineRecordUnsigned, aE as validatePolicySigned, aF as validatePolicySignedShape, aG as validatePolicyStatusSigned, aH as validatePolicyStatusSignedShape, aI as validatePolicyStatusUnsigned, aJ as validatePolicyUnsigned, aK as verifyPolicy, aL as verifyPolicyEngineRecord, aM as verifyPolicyRootRevocationV3, aN as verifyPolicyRootStatusCheckpointV3, aO as verifyPolicyStatus, aP as verifySignedObject } from '../unified-BlXXf3l7.cjs';
+import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-C_cO1QqB.cjs';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, B as BuildPolicyCredentialPresentationV3Input, C as CONTENT_SOURCE_V1_DOMAIN, c as CompactPolicyInvocationInput, d as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, e as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, f as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, g as POLICY_CAPABILITY_V1_DOMAIN, h as POLICY_CAPABILITY_V1_SCHEMA, i as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, j as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, k as POLICY_ENGINE_RECORD_SCHEMA, l as POLICY_PRESENTATION_V3_DOMAIN, m as POLICY_PRESENTATION_V3_SCHEMA, n as POLICY_SCHEMA, o as POLICY_SESSION_UCAN_V1_PROFILE, p as POLICY_STATUS_SCHEMA, q as POLICY_V1_DOMAIN, r as POLICY_V1_SCHEMA, s as POLICY_V2_DOMAIN, t as POLICY_V2_SCHEMA, u as PolicyChallengeV3, v as PolicyCredentialAdmissionV3, w as PolicyCredentialPresentationV3, x as PolicyCredentialRequirementV1, y as PolicyRootStatusV3, z as PolicySessionUcanV1, D as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, F as ROOT_REVOCATION_V1_SCHEMA, G as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, H as ROOT_STATUS_RENEWAL_V1_DOMAIN, I as ROOT_STATUS_V1_DOMAIN, K as SignCompactUcanAuthorizationInput, O as SignCompactUcanRootAuthorizationInput, Q as SignatureMaterialError, T as SignatureSuite, V as SignatureVerificationError, W as SignedObjectCanonicalizationError, X as SignedObjectDigestError, Y as SignedObjectErrorCode, Z as SignedObjectIdError, _ as SignedObjectKind, $ as SignedObjectMaterial, a0 as SignedObjectProfileError, a1 as SignedObjectSchemaError, a2 as SignedObjectSignature, a3 as SignedObjectVerificationResult, a4 as SignedPolicyObject, a5 as SigningKeyBindingError, a6 as UnifiedContentSource, a7 as UnifiedEncryptionCapability, a8 as UnifiedKvCapability, a9 as UnifiedNativeCapability, aa as UnifiedPolicyCapability, ab as UnifiedPolicyV1, ac as UnifiedPolicyV2, ad as UnifiedResourceSelector, ae as UnsignedPolicy, af as UnsignedPolicyObject, ag as UnsignedPolicyStatus, ah as UnsignedUnifiedPolicyV2, ai as UnsupportedSignatureSuiteError, aj as admitPolicyCredentialV3, ak as buildPolicyCredentialPresentationV3, al as canonicalizeSignedObjectUnsigned, am as canonicalizeUnifiedPolicyCapability, an as compactAttenuationContains, ao as contentSourceDigestHex, ap as createAndSignPolicy, aq as createAndSignPolicyEngineRecord, ar as createAndSignPolicyStatus, as as createAndSignSignedObject, at as createCompactPolicyDescendant, au as createCompactPolicyInvocation, av as deriveSignedObjectMaterial, aw as getPolicyRootStatusV3, ax as mintPolicySessionV3, ay as normalizeUnifiedPolicyCapability, az as parseCompactUcanAuthorization, aA as parsePolicySessionUcan, aB as policyCidFromCanonicalBytes, aC as policyDigestHex, aD as policyIdForDigestHex, aE as policyV2DigestHex, aF as projectUnifiedPolicyCapabilities, aG as projectUnifiedPolicyCapability, aH as renewPolicyRootStatusV3, aI as requestPolicyChallengeV3, aJ as revokePolicyRootV3, aK as signCompactUcanAuthorization, aL as signCompactUcanRootAuthorization, aM as signedObjectIdFor, aN as toSignedObjectError, aO as unifiedNativeProjectionHashHex, aP as unifiedPolicyCapabilityContains, aQ as unifiedPolicyCapabilityDigestHex, aR as unifiedPolicyCapabilityFromNative, aS as validatePolicyCredentialRequirementV1, aT as validatePolicyEngineRecordSigned, aU as validatePolicyEngineRecordSignedShape, aV as validatePolicyEngineRecordUnsigned, aW as validatePolicySigned, aX as validatePolicySignedShape, aY as validatePolicyStatusSigned, aZ as validatePolicyStatusSignedShape, a_ as validatePolicyStatusUnsigned, a$ as validatePolicyUnsigned, b0 as validateUnifiedPolicyV2, b1 as verifyPolicy, b2 as verifyPolicyEngineRecord, b3 as verifyPolicyRootRevocationV3, b4 as verifyPolicyRootStatusCheckpointV3, b5 as verifyPolicyStatus, b6 as verifySignedObject } from '../credential-admission-C_cO1QqB.cjs';
 import { J as JsonObject, P as PolicyCapabilityError } from '../capability-BjzXwtNw.cjs';
 export { a as JsonValue, b as PolicyCapability, c as PolicyCapabilityErrorCode, d as canonicalizePolicyCapability, j as jcsCanonicalize, n as normalizeJson, e as normalizePolicyCapability, p as policyCapabilityContains, f as policyCapabilityDigestHex, s as serializeJcsJson } from '../capability-BjzXwtNw.cjs';
 import 'zod';

package/dist/policy/index.d.ts

@@ -1,5 +1,5 @@
-import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../unified-HWqC-h7O.js';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, C as CONTENT_SOURCE_V1_DOMAIN, b as CompactPolicyInvocationInput, c as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, d as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, e as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, f as POLICY_CAPABILITY_V1_DOMAIN, g as POLICY_CAPABILITY_V1_SCHEMA, h as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, i as POLICY_ENGINE_RECORD_SCHEMA, j as POLICY_SCHEMA, k as POLICY_SESSION_UCAN_V1_PROFILE, l as POLICY_STATUS_SCHEMA, m as POLICY_V1_DOMAIN, n as POLICY_V1_SCHEMA, o as PolicyChallengeV3, p as PolicyRootStatusV3, q as PolicySessionUcanV1, r as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, s as ROOT_REVOCATION_V1_SCHEMA, t as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, u as ROOT_STATUS_RENEWAL_V1_DOMAIN, v as ROOT_STATUS_V1_DOMAIN, w as SignCompactUcanAuthorizationInput, x as SignatureMaterialError, y as SignatureSuite, z as SignatureVerificationError, B as SignedObjectCanonicalizationError, D as SignedObjectDigestError, F as SignedObjectErrorCode, G as SignedObjectIdError, H as SignedObjectKind, I as SignedObjectMaterial, K as SignedObjectProfileError, O as SignedObjectSchemaError, Q as SignedObjectSignature, T as SignedObjectVerificationResult, V as SignedPolicyObject, W as SigningKeyBindingError, X as UnifiedContentSource, Y as UnifiedEncryptionCapability, Z as UnifiedKvCapability, _ as UnifiedNativeCapability, $ as UnifiedPolicyCapability, a0 as UnifiedPolicyV1, a1 as UnifiedResourceSelector, a2 as UnsignedPolicy, a3 as UnsignedPolicyObject, a4 as UnsignedPolicyStatus, a5 as UnsupportedSignatureSuiteError, a6 as canonicalizeSignedObjectUnsigned, a7 as canonicalizeUnifiedPolicyCapability, a8 as compactAttenuationContains, a9 as contentSourceDigestHex, aa as createAndSignPolicy, ab as createAndSignPolicyEngineRecord, ac as createAndSignPolicyStatus, ad as createAndSignSignedObject, ae as createCompactPolicyDescendant, af as createCompactPolicyInvocation, ag as deriveSignedObjectMaterial, ah as getPolicyRootStatusV3, ai as mintPolicySessionV3, aj as normalizeUnifiedPolicyCapability, ak as parseCompactUcanAuthorization, al as parsePolicySessionUcan, am as policyCidFromCanonicalBytes, an as policyDigestHex, ao as policyIdForDigestHex, ap as projectUnifiedPolicyCapabilities, aq as projectUnifiedPolicyCapability, ar as renewPolicyRootStatusV3, as as requestPolicyChallengeV3, at as revokePolicyRootV3, au as signCompactUcanAuthorization, av as signedObjectIdFor, aw as toSignedObjectError, ax as unifiedNativeProjectionHashHex, ay as unifiedPolicyCapabilityContains, az as unifiedPolicyCapabilityDigestHex, aA as unifiedPolicyCapabilityFromNative, aB as validatePolicyEngineRecordSigned, aC as validatePolicyEngineRecordSignedShape, aD as validatePolicyEngineRecordUnsigned, aE as validatePolicySigned, aF as validatePolicySignedShape, aG as validatePolicyStatusSigned, aH as validatePolicyStatusSignedShape, aI as validatePolicyStatusUnsigned, aJ as validatePolicyUnsigned, aK as verifyPolicy, aL as verifyPolicyEngineRecord, aM as verifyPolicyRootRevocationV3, aN as verifyPolicyRootStatusCheckpointV3, aO as verifyPolicyStatus, aP as verifySignedObject } from '../unified-HWqC-h7O.js';
+import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-cvHe-HUC.js';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, B as BuildPolicyCredentialPresentationV3Input, C as CONTENT_SOURCE_V1_DOMAIN, c as CompactPolicyInvocationInput, d as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, e as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, f as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, g as POLICY_CAPABILITY_V1_DOMAIN, h as POLICY_CAPABILITY_V1_SCHEMA, i as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, j as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, k as POLICY_ENGINE_RECORD_SCHEMA, l as POLICY_PRESENTATION_V3_DOMAIN, m as POLICY_PRESENTATION_V3_SCHEMA, n as POLICY_SCHEMA, o as POLICY_SESSION_UCAN_V1_PROFILE, p as POLICY_STATUS_SCHEMA, q as POLICY_V1_DOMAIN, r as POLICY_V1_SCHEMA, s as POLICY_V2_DOMAIN, t as POLICY_V2_SCHEMA, u as PolicyChallengeV3, v as PolicyCredentialAdmissionV3, w as PolicyCredentialPresentationV3, x as PolicyCredentialRequirementV1, y as PolicyRootStatusV3, z as PolicySessionUcanV1, D as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, F as ROOT_REVOCATION_V1_SCHEMA, G as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, H as ROOT_STATUS_RENEWAL_V1_DOMAIN, I as ROOT_STATUS_V1_DOMAIN, K as SignCompactUcanAuthorizationInput, O as SignCompactUcanRootAuthorizationInput, Q as SignatureMaterialError, T as SignatureSuite, V as SignatureVerificationError, W as SignedObjectCanonicalizationError, X as SignedObjectDigestError, Y as SignedObjectErrorCode, Z as SignedObjectIdError, _ as SignedObjectKind, $ as SignedObjectMaterial, a0 as SignedObjectProfileError, a1 as SignedObjectSchemaError, a2 as SignedObjectSignature, a3 as SignedObjectVerificationResult, a4 as SignedPolicyObject, a5 as SigningKeyBindingError, a6 as UnifiedContentSource, a7 as UnifiedEncryptionCapability, a8 as UnifiedKvCapability, a9 as UnifiedNativeCapability, aa as UnifiedPolicyCapability, ab as UnifiedPolicyV1, ac as UnifiedPolicyV2, ad as UnifiedResourceSelector, ae as UnsignedPolicy, af as UnsignedPolicyObject, ag as UnsignedPolicyStatus, ah as UnsignedUnifiedPolicyV2, ai as UnsupportedSignatureSuiteError, aj as admitPolicyCredentialV3, ak as buildPolicyCredentialPresentationV3, al as canonicalizeSignedObjectUnsigned, am as canonicalizeUnifiedPolicyCapability, an as compactAttenuationContains, ao as contentSourceDigestHex, ap as createAndSignPolicy, aq as createAndSignPolicyEngineRecord, ar as createAndSignPolicyStatus, as as createAndSignSignedObject, at as createCompactPolicyDescendant, au as createCompactPolicyInvocation, av as deriveSignedObjectMaterial, aw as getPolicyRootStatusV3, ax as mintPolicySessionV3, ay as normalizeUnifiedPolicyCapability, az as parseCompactUcanAuthorization, aA as parsePolicySessionUcan, aB as policyCidFromCanonicalBytes, aC as policyDigestHex, aD as policyIdForDigestHex, aE as policyV2DigestHex, aF as projectUnifiedPolicyCapabilities, aG as projectUnifiedPolicyCapability, aH as renewPolicyRootStatusV3, aI as requestPolicyChallengeV3, aJ as revokePolicyRootV3, aK as signCompactUcanAuthorization, aL as signCompactUcanRootAuthorization, aM as signedObjectIdFor, aN as toSignedObjectError, aO as unifiedNativeProjectionHashHex, aP as unifiedPolicyCapabilityContains, aQ as unifiedPolicyCapabilityDigestHex, aR as unifiedPolicyCapabilityFromNative, aS as validatePolicyCredentialRequirementV1, aT as validatePolicyEngineRecordSigned, aU as validatePolicyEngineRecordSignedShape, aV as validatePolicyEngineRecordUnsigned, aW as validatePolicySigned, aX as validatePolicySignedShape, aY as validatePolicyStatusSigned, aZ as validatePolicyStatusSignedShape, a_ as validatePolicyStatusUnsigned, a$ as validatePolicyUnsigned, b0 as validateUnifiedPolicyV2, b1 as verifyPolicy, b2 as verifyPolicyEngineRecord, b3 as verifyPolicyRootRevocationV3, b4 as verifyPolicyRootStatusCheckpointV3, b5 as verifyPolicyStatus, b6 as verifySignedObject } from '../credential-admission-cvHe-HUC.js';
 import { J as JsonObject, P as PolicyCapabilityError } from '../capability-BjzXwtNw.js';
 export { a as JsonValue, b as PolicyCapability, c as PolicyCapabilityErrorCode, d as canonicalizePolicyCapability, j as jcsCanonicalize, n as normalizeJson, e as normalizePolicyCapability, p as policyCapabilityContains, f as policyCapabilityDigestHex, s as serializeJcsJson } from '../capability-BjzXwtNw.js';
 import 'zod';

package/dist/policy/index.js

@@ -2664,13 +2664,13 @@ function base64UrlDecode(value) {
   return decoded;
 }
 function hexToBytes(value) {
-  const hex2 = value.slice(2);
-  if (hex2.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex2)) {
+  const hex3 = value.slice(2);
+  if (hex3.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(hex3)) {
     throw new SignatureMaterialError("hex signature must have even length");
   }
-  const output = new Uint8Array(hex2.length / 2);
+  const output = new Uint8Array(hex3.length / 2);
   for (let index = 0; index < output.length; index++) {
-    output[index] = Number.parseInt(hex2.slice(index * 2, index * 2 + 2), 16);
+    output[index] = Number.parseInt(hex3.slice(index * 2, index * 2 + 2), 16);
   }
   return output;
 }
@@ -3426,11 +3426,15 @@ function nonEmptyString(value, label) {
   return value;
 }
 function parseKvResource(resource) {
-  const match = /^tinycloud:\/\/([^/]+)\/kv\/(.+)$/.exec(resource);
-  if (!match || match[1].includes(":") || match[1].includes("?") || match[1].includes("#") || match[1].includes("%") || match[2].startsWith("/") || match[2].endsWith("/") || match[2].includes("//") || match[2].split("/").some((part) => part === "." || part === ".." || part.length === 0)) {
+  const marker = resource.indexOf("/kv/");
+  const encodedSpace = marker < 1 ? "" : resource.slice(0, marker);
+  const legacy = encodedSpace.startsWith("tinycloud://");
+  const space = legacy ? encodedSpace.slice("tinycloud://".length) : encodedSpace;
+  const path = marker < 1 ? "" : resource.slice(marker + 4);
+  if (marker < 1 || (legacy ? /[:/?#%]/.test(space) : !encodedSpace.startsWith("tinycloud:") || /[/?#%]/.test(encodedSpace)) || path.startsWith("/") || path.endsWith("/") || path.includes("//") || path.split("/").some((part) => part === "." || part === ".." || part.length === 0)) {
     throw new Error("KV resource is not canonical");
   }
-  return { space: match[1], path: match[2] };
+  return { space, path };
 }
 function parseEncryptionResource(resource) {
   if (!resource.startsWith("urn:tinycloud:encryption:")) throw new Error("encryption capability is invalid");
@@ -3575,7 +3579,7 @@ function unifiedPolicyCapabilityFromNative(input) {
     throw new Error("native capability is not supported");
   const caveat = object(value.caveat, "native.caveat");
   exactKeys(caveat, ["type", "kind", "value"], "native selector caveat");
-  if (caveat.type !== "xyz.tinycloud.resource/selector" || caveat.kind !== "exact" && caveat.kind !== "prefix" || caveat.value !== `tinycloud://${value.space}/kv/${value.path}`)
+  if (caveat.type !== "xyz.tinycloud.resource/selector" || caveat.kind !== "exact" && caveat.kind !== "prefix" || caveat.value !== `${value.space.startsWith("tinycloud:") ? value.space : `tinycloud://${value.space}`}/kv/${value.path}`)
     throw new Error("native selector caveat does not match capability");
   return normalizeUnifiedPolicyCapability({
     kind: "kv",
@@ -3634,9 +3638,7 @@ var CompactPayloadSchema = z.object({
   nnc: z.string().min(1),
   prf: z.array(z.string().min(1))
 }).strict();
-async function signCompactUcanAuthorization(input) {
-  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 60)
-    throw new Error("compact invocation lifetime must be between one and 60 seconds");
+async function signCompactUcan(input) {
   const principal = input.issuerDid.split("#", 1)[0];
   const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
   if (didMaterial.length !== 34 || didMaterial[0] !== 237 || didMaterial[1] !== 1)
@@ -3658,6 +3660,16 @@ async function signCompactUcanAuthorization(input) {
   if (signature.length !== 64) throw new Error("compact Authorization signature must be Ed25519");
   return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
 }
+async function signCompactUcanAuthorization(input) {
+  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 60)
+    throw new Error("compact invocation lifetime must be between one and 60 seconds");
+  return signCompactUcan(input);
+}
+async function signCompactUcanRootAuthorization(input) {
+  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 31 * 24 * 60 * 60)
+    throw new Error("compact policy root lifetime must be between one second and 31 days");
+  return signCompactUcan({ ...input, proofs: [] });
+}
 function createCompactPolicyInvocation(input) {
   const session = parsePolicySessionUcan(input.sessionAuthorization);
   if (session.cid !== input.sessionCid || session.aud !== input.recipientDid)
@@ -3804,14 +3816,14 @@ function decodeBase64Url(value) {
   if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1)
     throw new Error("value is not canonical base64url");
   const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
-  const binary = typeof Buffer !== "undefined" ? Buffer.from(normalized, "base64").toString("binary") : atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "="));
+  const binary = typeof atob === "function" ? atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=")) : Buffer.from(normalized, "base64").toString("binary");
   const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
-  const encoded = typeof Buffer !== "undefined" ? Buffer.from(bytes).toString("base64url") : btoa(String.fromCharCode(...bytes)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  const encoded = typeof btoa === "function" ? btoa(String.fromCharCode(...bytes)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : Buffer.from(bytes).toString("base64url");
   if (encoded !== value) throw new Error("value is not canonical base64url");
   return bytes;
 }
 function encodeBase64Url(value) {
-  return typeof Buffer !== "undefined" ? Buffer.from(value).toString("base64url") : btoa(String.fromCharCode(...value)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  return typeof btoa === "function" ? btoa(String.fromCharCode(...value)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : Buffer.from(value).toString("base64url");
 }
 function equalBytes(left, right) {
   return left.length === right.length && left.every((byte, index) => byte === right[index]);
@@ -3835,6 +3847,389 @@ function base32Lower(bytes) {
   if (bits > 0) output += alphabet2[buffer << 5 - bits & 31];
   return output;
 }
+
+// src/policy/credential-admission.ts
+import { ed25519 as ed255193 } from "@noble/curves/ed25519";
+import { sha256 as sha2565 } from "@noble/hashes/sha256";
+
+// src/credentials/digest.ts
+function encodeBase64Url2(bytes) {
+  if (typeof btoa === "function") {
+    let binary = "";
+    for (const byte of bytes) binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+  }
+  return Buffer.from(bytes).toString("base64url");
+}
+async function sha256Base64Url(value) {
+  const bytes = typeof value === "string" ? new TextEncoder().encode(value) : value;
+  return encodeBase64Url2(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)));
+}
+async function canonicalDigest(value) {
+  return sha256Base64Url(jcsCanonicalize(value));
+}
+function isDigest(value) {
+  return typeof value === "string" && /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+
+// src/credentials/errors.ts
+var RECOVERABLE = /* @__PURE__ */ new Set([
+  "CANCELED",
+  "ISSUER_UNREADY",
+  "OFFLINE",
+  "POPUP_BLOCKED",
+  "REQUEST_EXPIRED",
+  "SIGNATURE_REJECTED",
+  "UNSUPPORTED_PROFILE",
+  "UNSUPPORTED_VERSION",
+  "VERIFIED_NOT_SAVED"
+]);
+var CredentialError = class extends Error {
+  constructor(code2, message, details = {}) {
+    super(message);
+    this.code = code2;
+    this.details = details;
+    this.name = "CredentialError";
+    this.recoverable = RECOVERABLE.has(code2);
+  }
+};
+
+// src/credentials/requirement.ts
+var ID = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
+function validateCredentialRequirement(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential requirement is invalid");
+  const raw = value;
+  if (Object.keys(raw).some((key) => !["type", "version", "profile", "credentialType", "claims", "maxAgeSeconds"].includes(key)) || raw.type !== "TinyCloudCredentialRequirement" || raw.version !== 1) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential requirement version is unsupported");
+  const pair = (candidate, label) => {
+    if (typeof candidate !== "object" || candidate === null || Array.isArray(candidate)) throw new CredentialError("UNSUPPORTED_PROFILE", `${label} is invalid`);
+    const item = candidate;
+    if (Object.keys(item).length !== 2 || typeof item.id !== "string" || !ID.test(item.id) || item.version !== 1) throw new CredentialError("UNSUPPORTED_PROFILE", `${label} version is unsupported`);
+    return { id: item.id, version: 1 };
+  };
+  if (typeof raw.claims !== "object" || raw.claims === null || Array.isArray(raw.claims)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claims are invalid");
+  const claims = {};
+  for (const [key, value2] of Object.entries(raw.claims).sort(([a], [b]) => a.localeCompare(b))) {
+    if (!ID.test(key) || typeof value2 !== "string" || value2.length === 0 || value2.length > 4096) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claim is invalid");
+    claims[key] = value2;
+  }
+  if (raw.maxAgeSeconds !== void 0 && (!Number.isSafeInteger(raw.maxAgeSeconds) || raw.maxAgeSeconds < 1)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential freshness is invalid");
+  return Object.freeze({ type: "TinyCloudCredentialRequirement", version: 1, profile: pair(raw.profile, "profile"), credentialType: pair(raw.credentialType, "credentialType"), claims: Object.freeze(claims), ...raw.maxAgeSeconds === void 0 ? {} : { maxAgeSeconds: raw.maxAgeSeconds } });
+}
+async function credentialRequirementDigest(requirement) {
+  return canonicalDigest(validateCredentialRequirement(requirement));
+}
+
+// src/policy/credential-admission.ts
+var POLICY_V2_SCHEMA = "xyz.tinycloud.policy/policy/v2";
+var POLICY_V2_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
+var POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE = "TinyCloudPolicyCredentialRequirement";
+var POLICY_PRESENTATION_V3_SCHEMA = "xyz.tinycloud.policy/presentation/v3";
+var POLICY_PRESENTATION_V3_DOMAIN = "xyz.tinycloud.policy/Presentation/v3\0";
+function record(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function exactKeys2(value, keys, label) {
+  const expected = [...keys].sort();
+  const actual = Object.keys(value).sort();
+  if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
+    throw new Error(`${label} contains an unknown or missing field`);
+  }
+}
+function nonEmpty(value, label) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`${label} must be a non-empty string`);
+  }
+  return value;
+}
+function policyNodeOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("policy node origin is invalid");
+  }
+  if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") {
+    throw new Error("policy node origin is invalid");
+  }
+  return url.origin;
+}
+function versionPair(value, label) {
+  const item = record(value, label);
+  exactKeys2(item, ["id", "version"], label);
+  if (item.version !== 1) throw new Error(`${label} version is unsupported`);
+  return Object.freeze({ id: nonEmpty(item.id, `${label}.id`), version: 1 });
+}
+function validatePolicyCredentialRequirementV1(value) {
+  const item = record(value, "policy credential requirement");
+  exactKeys2(
+    item,
+    [
+      "type",
+      "version",
+      "requirementDigest",
+      "descriptorDigest",
+      "issuerDid",
+      "issuerKid",
+      "profile",
+      "credentialType"
+    ],
+    "policy credential requirement"
+  );
+  if (item.type !== POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE || item.version !== 1 || !isDigest(item.requirementDigest) || !isDigest(item.descriptorDigest)) {
+    throw new Error("policy credential requirement is invalid");
+  }
+  return Object.freeze({
+    type: POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE,
+    version: 1,
+    requirementDigest: item.requirementDigest,
+    descriptorDigest: item.descriptorDigest,
+    issuerDid: nonEmpty(item.issuerDid, "policy credential issuer"),
+    issuerKid: nonEmpty(item.issuerKid, "policy credential issuer key"),
+    profile: versionPair(item.profile, "policy credential profile"),
+    credentialType: versionPair(
+      item.credentialType,
+      "policy credential type"
+    )
+  });
+}
+function hex2(bytes) {
+  return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function policyV2DigestHex(input) {
+  const canonicalPolicy = {
+    ...input,
+    credentialRequirement: validatePolicyCredentialRequirementV1(
+      input.credentialRequirement
+    ),
+    capabilityCeiling: input.capabilityCeiling.map(
+      normalizeUnifiedPolicyCapability
+    )
+  };
+  return hex2(
+    sha2565(
+      new TextEncoder().encode(
+        POLICY_V2_DOMAIN + jcsCanonicalize(canonicalPolicy)
+      )
+    )
+  );
+}
+function date(value, label) {
+  const text = nonEmpty(value, label);
+  if (!Number.isFinite(Date.parse(text))) throw new Error(`${label} is invalid`);
+  return text;
+}
+function rfc3339Seconds(value) {
+  return new Date(Math.floor(value.getTime() / 1e3) * 1e3).toISOString().replace(/\.000Z$/, "Z");
+}
+function validateUnifiedPolicyV2(value, expectedPolicyCid) {
+  const item = record(value, "Policy/v2");
+  const allowed = [
+    "schema",
+    "policyId",
+    "ownerDid",
+    "createdAt",
+    "contentSource",
+    "capabilityCeiling",
+    "credentialRequirement",
+    "signature",
+    ...item.expiresAt === void 0 ? [] : ["expiresAt"]
+  ];
+  exactKeys2(item, allowed, "Policy/v2");
+  if (item.schema !== POLICY_V2_SCHEMA || !Array.isArray(item.capabilityCeiling)) {
+    throw new Error("Policy/v2 is invalid");
+  }
+  const ownerDid = nonEmpty(item.ownerDid, "Policy/v2 ownerDid");
+  const signature = record(item.signature, "Policy/v2 signature");
+  exactKeys2(signature, ["suite", "signerDid", "value"], "Policy/v2 signature");
+  if (signature.suite !== "Ed25519" || signature.signerDid !== ownerDid || typeof signature.value !== "string" || signature.value.length === 0) {
+    throw new Error("Policy/v2 signature binding is invalid");
+  }
+  const policy = Object.freeze({
+    schema: POLICY_V2_SCHEMA,
+    policyId: nonEmpty(item.policyId, "Policy/v2 policyId"),
+    ownerDid,
+    createdAt: date(item.createdAt, "Policy/v2 createdAt"),
+    ...item.expiresAt === void 0 ? {} : { expiresAt: date(item.expiresAt, "Policy/v2 expiresAt") },
+    contentSource: item.contentSource,
+    capabilityCeiling: Object.freeze(
+      item.capabilityCeiling.map(normalizeUnifiedPolicyCapability)
+    ),
+    credentialRequirement: validatePolicyCredentialRequirementV1(
+      item.credentialRequirement
+    ),
+    signature: Object.freeze({
+      suite: "Ed25519",
+      signerDid: ownerDid,
+      value: signature.value
+    })
+  });
+  const unsigned = { ...policy };
+  delete unsigned.policyId;
+  delete unsigned.signature;
+  const digestHex = policyV2DigestHex(unsigned);
+  if (policy.policyId !== policyIdForDigestHex(digestHex)) {
+    throw new Error("Policy/v2 policyId binding is invalid");
+  }
+  if (expectedPolicyCid !== void 0) {
+    const cid = policyCidFromCanonicalBytes(
+      new TextEncoder().encode(jcsCanonicalize(policy))
+    );
+    if (cid !== expectedPolicyCid) throw new Error("Policy/v2 CID binding is invalid");
+  }
+  return policy;
+}
+function didKeyBytes(did) {
+  const principal = did.split("#", 1)[0];
+  if (!principal.startsWith("did:key:")) throw new Error("holder DID must be did:key");
+  const material = base58btc.decode(principal.slice("did:key:".length));
+  if (material.length !== 34 || material[0] !== 237 || material[1] !== 1) {
+    throw new Error("holder DID must contain an Ed25519 key");
+  }
+  return material.slice(2);
+}
+function envelopeFromVerified(verified) {
+  const {
+    verifiedAt: _verifiedAt,
+    credentialDigest: _credentialDigest,
+    statusCheckedAt: _statusCheckedAt,
+    ...envelope
+  } = verified;
+  return envelope;
+}
+async function buildPolicyCredentialPresentationV3(input) {
+  const policy = validateUnifiedPolicyV2(input.policy, input.policyCid);
+  const requirement = validateCredentialRequirement(input.requirement);
+  const commitment = policy.credentialRequirement;
+  const requirementDigest = await credentialRequirementDigest(requirement);
+  const credentialDigest = await sha256Base64Url(input.credential.credential);
+  if (requirementDigest !== commitment.requirementDigest || input.credential.descriptorDigest !== commitment.descriptorDigest || input.credential.credentialDigest !== credentialDigest || input.credential.issuerDid !== commitment.issuerDid || input.credential.issuerKid !== commitment.issuerKid || jcsCanonicalize(input.credential.profile) !== jcsCanonicalize(commitment.profile) || jcsCanonicalize(input.credential.credentialType) !== jcsCanonicalize(commitment.credentialType)) {
+    throw new Error("credential does not match the signed Policy/v2 requirement");
+  }
+  const requestedCapabilities = input.requestedCapabilities.map(
+    normalizeUnifiedPolicyCapability
+  );
+  if (requestedCapabilities.length === 0 || requestedCapabilities.some(
+    (requested) => !policy.capabilityCeiling.some(
+      (authority) => unifiedPolicyCapabilityContains(authority, requested)
+    )
+  )) {
+    throw new Error("requested capabilities exceed the signed Policy/v2 ceiling");
+  }
+  const challenge = input.challenge;
+  const holderDid = input.credential.holderDid;
+  if (challenge.policyCid !== input.policyCid || challenge.recipientDid !== holderDid || input.credential.subjectDid !== holderDid || typeof challenge.nodeAudience !== "string" || challenge.nodeAudience.length === 0 || typeof challenge.expiresAt !== "string" || !Number.isFinite(Date.parse(challenge.expiresAt))) {
+    throw new Error("policy challenge binding is invalid");
+  }
+  didKeyBytes(holderDid);
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const challengeExpiry = Date.parse(challenge.expiresAt);
+  const credentialExpiry = Date.parse(input.credential.expiresAt);
+  const expiresAtMs = Math.min(
+    now.getTime() + 6e4,
+    challengeExpiry,
+    credentialExpiry
+  );
+  if (expiresAtMs <= now.getTime()) throw new Error("policy challenge is expired");
+  const unsigned = Object.freeze({
+    schema: POLICY_PRESENTATION_V3_SCHEMA,
+    jti: input.jti ?? encodeBase64Url2(crypto.getRandomValues(new Uint8Array(16))),
+    challengeId: challenge.challengeId,
+    nonce: challenge.nonce,
+    policyCid: input.policyCid,
+    nodeAudience: challenge.nodeAudience,
+    holderDid,
+    subjectDid: input.credential.subjectDid,
+    credentialSpaceOwnerDid: nonEmpty(
+      input.credentialSpaceOwnerDid,
+      "credential space owner DID"
+    ),
+    credentialDigest,
+    requirementDigest,
+    descriptorDigest: input.credential.descriptorDigest,
+    requestedCapabilities: Object.freeze(requestedCapabilities),
+    issuedAt: rfc3339Seconds(now),
+    expiresAt: rfc3339Seconds(new Date(expiresAtMs))
+  });
+  const digest2 = sha2565(
+    new TextEncoder().encode(
+      POLICY_PRESENTATION_V3_DOMAIN + jcsCanonicalize(unsigned)
+    )
+  );
+  const signature = await input.sign(digest2);
+  if (signature.length !== 64 || !ed255193.verify(signature, digest2, didKeyBytes(holderDid))) {
+    throw new Error("policy presentation signature is invalid");
+  }
+  return Object.freeze({
+    ...unsigned,
+    signature: Object.freeze({
+      suite: "Ed25519",
+      signerDid: holderDid,
+      value: encodeBase64Url2(signature)
+    })
+  });
+}
+async function admitPolicyCredentialV3(input) {
+  const policy = validateUnifiedPolicyV2(input.policy, input.policyCid);
+  const nodeOrigin = policyNodeOrigin(input.nodeOrigin);
+  const accountAuthorizationCid = nonEmpty(
+    input.accountAuthorizationCid,
+    "account authorization CID"
+  );
+  const credentialSpaceId = nonEmpty(
+    input.credentialSpaceId,
+    "credential space ID"
+  );
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const challenge = await requestPolicyChallengeV3({
+    nodeOrigin,
+    policyCid: input.policyCid,
+    recipientDid: input.credential.holderDid,
+    requestedCapabilities: input.requestedCapabilities,
+    fetch: fetchFn
+  });
+  const presentation = await buildPolicyCredentialPresentationV3({
+    ...input,
+    policy,
+    challenge
+  });
+  const response = await fetchFn(
+    new URL("/share/v3/policy/delegations", nodeOrigin),
+    {
+      method: "POST",
+      redirect: "error",
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({
+        policyCid: input.policyCid,
+        challengeId: challenge.challengeId,
+        nonce: challenge.nonce,
+        requirement: validateCredentialRequirement(input.requirement),
+        credential: envelopeFromVerified(input.credential),
+        accountAuthorizationCid,
+        credentialSpaceId,
+        presentation
+      })
+    }
+  );
+  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  const value = record(await response.json(), "policy delegation");
+  if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") {
+    throw new Error("policy delegation response is invalid");
+  }
+  const session = parsePolicySessionUcan(value.authorization, [
+    input.policyRootCid,
+    input.enforcementRootCid
+  ]);
+  const expectedAttenuation = compactAttenuationForPolicyCapabilities(
+    input.requestedCapabilities
+  );
+  if (session.cid !== value.sessionCid || session.aud !== input.credential.holderDid || session.fact.policyCid !== input.policyCid || session.fact.recipientDid !== input.credential.holderDid || session.fact.policyDelegationCid !== input.policyRootCid || session.fact.enforcementDelegationCid !== input.enforcementRootCid || jcsCanonicalize(session.att) !== jcsCanonicalize(expectedAttenuation)) {
+    throw new Error("policy delegation signed binding is invalid");
+  }
+  return Object.freeze({ challenge, presentation, session });
+}
 export {
   ATTESTED_ENFORCER_BINDING_V2_SCHEMA,
   CONTENT_SOURCE_V1_DOMAIN,
@@ -3847,13 +4242,18 @@ export {
   OWNER_NODE_ENDPOINT_SCHEMA,
   POLICY_CAPABILITY_V1_DOMAIN,
   POLICY_CAPABILITY_V1_SCHEMA,
+  POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE,
   POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA,
   POLICY_ENGINE_RECORD_SCHEMA,
+  POLICY_PRESENTATION_V3_DOMAIN,
+  POLICY_PRESENTATION_V3_SCHEMA,
   POLICY_SCHEMA,
   POLICY_SESSION_UCAN_V1_PROFILE,
   POLICY_STATUS_SCHEMA,
   POLICY_V1_DOMAIN,
   POLICY_V1_SCHEMA,
+  POLICY_V2_DOMAIN,
+  POLICY_V2_SCHEMA,
   POLICY_VERSION_V0,
   PolicyAuthoringError,
   PolicyCapabilityError,
@@ -3873,6 +4273,8 @@ export {
   TRANSCRIPT_SHARE_BOOTSTRAP_SCHEMA,
   UnsupportedSignatureSuiteError,
   W3C_VC_CREDENTIAL_VERIFIER,
+  admitPolicyCredentialV3,
+  buildPolicyCredentialPresentationV3,
   canonicalizePolicyCapability,
   canonicalizeSignedObjectUnsigned,
   canonicalizeUnifiedPolicyCapability,
@@ -3902,6 +4304,7 @@ export {
   policyCidFromCanonicalBytes,
   policyDigestHex,
   policyIdForDigestHex,
+  policyV2DigestHex,
   projectUnifiedPolicyCapabilities,
   projectUnifiedPolicyCapability,
   renewPolicyRootStatusV3,
@@ -3909,12 +4312,14 @@ export {
   revokePolicyRootV3,
   serialize as serializeJcsJson,
   signCompactUcanAuthorization,
+  signCompactUcanRootAuthorization,
   signedObjectIdFor,
   toSignedObjectError,
   unifiedNativeProjectionHashHex,
   unifiedPolicyCapabilityContains,
   unifiedPolicyCapabilityDigestHex,
   unifiedPolicyCapabilityFromNative,
+  validatePolicyCredentialRequirementV1,
   validatePolicyEngineRecordSigned,
   validatePolicyEngineRecordSignedShape,
   validatePolicyEngineRecordUnsigned,
@@ -3924,6 +4329,7 @@ export {
   validatePolicyStatusSignedShape,
   validatePolicyStatusUnsigned,
   validatePolicyUnsigned,
+  validateUnifiedPolicyV2,
   verifyPolicy,
   verifyPolicyEngineRecord,
   verifyPolicyEngineRecordForRequester,