@tinycloud/sdk-core 2.11.0 → 3.0.0-beta.0

package/dist/{unified-HWqC-h7O.d.ts → credential-admission-cvHe-HUC.d.ts}

@@ -1,6 +1,243 @@
 import { a as JsonValue } from './capability-BjzXwtNw.js';
 import { z } from 'zod';
 
+declare const CREDENTIAL_ACQUISITION_PROTOCOL: "tinycloud.credentials/acquisition/v1";
+declare const HOLDER_BINDING_DOMAIN: "tinycloud.credentials/holder-binding/v1";
+declare const CREDENTIAL_CONTRACT_VERSION: 1;
+declare const CREDENTIAL_STEP_REGISTRY_VERSION: 1;
+declare const CREDENTIAL_FORMAT: "vc+sd-jwt";
+type CredentialStepType = "collect_input" | "mailbox_otp" | "holder_signature";
+type CredentialEndpointId = "request" | "state" | "challenge" | "proof" | "holder_binding" | "holder_signature" | "issue" | "result";
+interface CredentialClaimDescriptor {
+    readonly name: string;
+    readonly matching: "normalized_exact";
+    readonly selectiveDisclosure: boolean;
+}
+interface CredentialInputDescriptor {
+    readonly id: string;
+    readonly label: string;
+    readonly schema: {
+        readonly type: "string";
+        readonly minLength?: number;
+        readonly maxLength?: number;
+        readonly pattern?: string;
+        readonly format?: "email";
+    };
+    readonly prefill: "privacy_hint_only";
+    readonly autocomplete: "off";
+}
+interface CredentialStepDescriptor {
+    readonly type: CredentialStepType;
+    readonly version: 1;
+}
+/** The canonical TC-462 descriptor. Its bytes are hashed without normalization. */
+interface CredentialFlowDescriptor {
+    readonly type: "tinycloud.credentials/descriptor/v1";
+    readonly contractVersion: 1;
+    readonly protocol: typeof CREDENTIAL_ACQUISITION_PROTOCOL;
+    readonly profile: string;
+    readonly profileVersion: 1;
+    readonly display: {
+        readonly title: string;
+        readonly description: string;
+        readonly consent: string;
+        readonly securityTextLocked: true;
+    };
+    readonly accessibility: {
+        readonly progressLabel: string;
+        readonly errorLiveRegion: "assertive";
+    };
+    readonly theme: {
+        readonly tokenVersion: "tinycloud.credentials/tokens/v1";
+        readonly allowed: readonly ("accentColor" | "fontFamily" | "borderRadius")[];
+    };
+    readonly issuer: {
+        readonly origin: string;
+        readonly did: string;
+        readonly kid: string;
+    };
+    readonly interaction: {
+        readonly origin: "https://credentials.org";
+        readonly pathTemplate: "/credentials/acquire/{requestId}";
+    };
+    readonly format: {
+        readonly id: typeof CREDENTIAL_FORMAT;
+        readonly vct: string;
+    };
+    readonly claims: readonly CredentialClaimDescriptor[];
+    readonly subjectRelationship: "holder_is_subject";
+    readonly inputs: readonly CredentialInputDescriptor[];
+    readonly steps: readonly CredentialStepDescriptor[];
+    readonly holderBinding: {
+        readonly required: true;
+        readonly alg: "EdDSA";
+        readonly domain: typeof HOLDER_BINDING_DOMAIN;
+        readonly version: 1;
+    };
+    readonly endpoints: Readonly<Record<"request" | "state" | "challenge" | "proof" | "holderBinding" | "holderSignature" | "issue" | "result", CredentialEndpointId>>;
+    readonly lifecycle: {
+        readonly requestTtlSeconds: number;
+        readonly challengeTtlSeconds: number;
+        readonly maxProofAttempts: number;
+        readonly challengeConsumption: "atomic_once";
+        readonly retry: "bounded";
+    };
+    readonly status: {
+        readonly type: "none";
+        readonly freshnessSeconds: number;
+    };
+    readonly revocation: {
+        readonly supported: false;
+    };
+    readonly presentation: {
+        readonly stateVersion: "tinycloud.credentials/ux-states/v1";
+        readonly states: readonly CredentialUxState[];
+    };
+}
+interface CredentialRequirement {
+    readonly type: "TinyCloudCredentialRequirement";
+    readonly version: 1;
+    readonly profile: {
+        readonly id: string;
+        readonly version: 1;
+    };
+    readonly credentialType: {
+        readonly id: string;
+        readonly version: 1;
+    };
+    readonly claims: Readonly<Record<string, string>>;
+    readonly maxAgeSeconds?: number;
+}
+interface CredentialHolderBinding {
+    readonly type: typeof HOLDER_BINDING_DOMAIN;
+    readonly protocol: typeof CREDENTIAL_ACQUISITION_PROTOCOL;
+    readonly requestId: string;
+    readonly profile: string;
+    readonly profileVersion: 1;
+    readonly descriptorDigest: string;
+    readonly requirementDigest: string;
+    readonly issuer: string;
+    readonly issuerKid: string;
+    readonly holderDid: string;
+    readonly normalizedClaimsDigest: string;
+    readonly challengeNonce: string;
+    readonly audience: string;
+    readonly openerOrigin: string;
+    readonly completionOrigin: string;
+    readonly completionContext: string;
+    readonly jti: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+interface IssuerVerificationKey {
+    readonly kid: string;
+    readonly alg: "EdDSA";
+    readonly jwk: {
+        readonly kty: "OKP";
+        readonly crv: "Ed25519";
+        readonly x: string;
+    };
+    readonly validFrom: string;
+    readonly validUntil: string;
+    readonly retiredAt?: string;
+}
+interface CredentialIssuerMetadata {
+    readonly type: "OpenCredentialsIssuerMetadata";
+    readonly version: 1;
+    readonly origin: string;
+    readonly issuerDid: string;
+    readonly keys: readonly IssuerVerificationKey[];
+    readonly cache: {
+        readonly maxAgeSeconds: number;
+        readonly etag: string;
+    };
+}
+interface IssuedCredentialEnvelope {
+    readonly type: "OpenCredentialsIssuedCredential";
+    readonly version: 1;
+    readonly protocol: typeof CREDENTIAL_ACQUISITION_PROTOCOL;
+    readonly profile: {
+        readonly id: string;
+        readonly version: 1;
+    };
+    readonly credentialType: {
+        readonly id: string;
+        readonly version: 1;
+    };
+    readonly schema: string;
+    readonly format: typeof CREDENTIAL_FORMAT;
+    readonly issuerDid: string;
+    readonly issuerKid: string;
+    readonly subjectDid: string;
+    readonly holderDid: string;
+    readonly claims: Readonly<Record<string, string>>;
+    readonly claimsDigest: string;
+    readonly descriptorDigest: string;
+    readonly credentialId: string;
+    readonly issuedAt: string;
+    readonly notBefore: string;
+    readonly expiresAt: string;
+    readonly status: {
+        readonly method: "none";
+        readonly freshnessSeconds: number;
+    };
+    readonly credential: string;
+}
+interface VerifiedCredential extends IssuedCredentialEnvelope {
+    readonly verifiedAt: string;
+    readonly credentialDigest: string;
+    readonly statusCheckedAt: string;
+}
+interface StoredCredentialRecord {
+    readonly type: "TinyCloudStoredCredential";
+    readonly version: 1;
+    readonly ownerDid: string;
+    readonly recordId: string;
+    readonly requirementDigest: string;
+    readonly descriptorDigest: string;
+    readonly profile: {
+        readonly id: string;
+        readonly version: 1;
+    };
+    readonly credentialType: {
+        readonly id: string;
+        readonly version: 1;
+    };
+    readonly issuerDid: string;
+    readonly issuerKid: string;
+    readonly holderDid: string;
+    readonly claims: Readonly<Record<string, string>>;
+    readonly claimsDigest: string;
+    readonly credentialDigest: string;
+    readonly credential: string;
+    readonly schema: string;
+    readonly credentialId: string;
+    readonly issuedAt: string;
+    readonly notBefore: string;
+    readonly expiresAt: string;
+    readonly status: {
+        readonly method: "none";
+        readonly freshnessSeconds: number;
+    };
+    readonly verifiedAt: string;
+    readonly storedAt: string;
+}
+interface CredentialStorageReceipt {
+    readonly type: "TinyCloudCredentialStorageReceipt";
+    readonly version: 1;
+    readonly ownerDid: string;
+    readonly recordId: string;
+    readonly recordDigest: string;
+    readonly storedAt: string;
+    readonly etag?: string;
+}
+type CredentialUxState = "collecting" | "challenging" | "proving" | "signing" | "issuing" | "verifying" | "saving" | "success" | "recovery";
+interface CredentialProgressEvent {
+    readonly state: CredentialUxState | "checking";
+    readonly stepId?: string;
+    readonly correlationId?: string;
+}
+
 type SignedObjectErrorCode = "schema-invalid" | "canonicalization-mismatch" | "digest-mismatch" | "id-mismatch" | "signing-key-binding" | "signature-material-invalid" | "signature-suite-unsupported" | "signature-invalid";
 declare class SignedObjectProfileError extends Error {
     readonly code: SignedObjectErrorCode;
@@ -225,6 +462,8 @@ interface PolicyChallengeV3 {
     readonly nonce: string;
     readonly policyCid: string;
     readonly recipientDid: string;
+    readonly expiresAt?: string;
+    readonly nodeAudience?: string;
     readonly [key: string]: unknown;
 }
 declare function requestPolicyChallengeV3(input: {
@@ -393,8 +632,20 @@ interface SignCompactUcanAuthorizationInput {
     readonly nonce: string;
     readonly sign: (bytes: Uint8Array) => Promise<Uint8Array>;
 }
+interface SignCompactUcanRootAuthorizationInput {
+    readonly issuerDid: string;
+    readonly audienceDid: string;
+    readonly attenuation: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>;
+    readonly facts: readonly [Readonly<Record<string, unknown>>];
+    readonly notBefore: number;
+    readonly expiresAt: number;
+    readonly nonce: string;
+    readonly sign: (bytes: Uint8Array) => Promise<Uint8Array>;
+}
 /** Sign exact compact-UCAN bytes with a caller-owned, potentially non-extractable key. */
 declare function signCompactUcanAuthorization(input: SignCompactUcanAuthorizationInput): Promise<CompactUcanAuthorizationV1>;
+/** Sign a proofless policy root without weakening the 60-second invocation profile. */
+declare function signCompactUcanRootAuthorization(input: SignCompactUcanRootAuthorizationInput): Promise<CompactUcanAuthorizationV1>;
 interface CompactPolicyInvocationInput {
     readonly sessionAuthorization: string;
     readonly sessionCid: string;
@@ -426,4 +677,105 @@ declare function compactAttenuationContains(parent: Readonly<Record<string, Read
 declare function parseCompactUcanAuthorization(input: string, expectedCid?: string): CompactUcanAuthorizationV1;
 declare function parsePolicySessionUcan(authorization: string, expectedProofs?: readonly [string, string]): PolicySessionUcanV1;
 
-export { type UnifiedPolicyCapability as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, SignedObjectCanonicalizationError as B, CONTENT_SOURCE_V1_DOMAIN as C, SignedObjectDigestError as D, ED25519_JCS_SIGNATURE_SUITE as E, type SignedObjectErrorCode as F, SignedObjectIdError as G, type SignedObjectKind as H, type SignedObjectMaterial as I, type JsonObject as J, SignedObjectProfileError as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, SignedObjectSchemaError as O, type PolicyEngineRecord as P, type SignedObjectSignature as Q, ROOT_REVOCATION_V1_DOMAIN as R, type SignedObjectSigner as S, type SignedObjectVerificationResult as T, type UnsignedPolicyEngineRecord as U, type SignedPolicyObject as V, SigningKeyBindingError as W, type UnifiedContentSource as X, type UnifiedEncryptionCapability as Y, type UnifiedKvCapability as Z, type UnifiedNativeCapability as _, type Policy as a, type UnifiedPolicyV1 as a0, type UnifiedResourceSelector as a1, type UnsignedPolicy as a2, type UnsignedPolicyObject as a3, type UnsignedPolicyStatus as a4, UnsupportedSignatureSuiteError as a5, canonicalizeSignedObjectUnsigned as a6, canonicalizeUnifiedPolicyCapability as a7, compactAttenuationContains as a8, contentSourceDigestHex as a9, unifiedPolicyCapabilityFromNative as aA, validatePolicyEngineRecordSigned as aB, validatePolicyEngineRecordSignedShape as aC, validatePolicyEngineRecordUnsigned as aD, validatePolicySigned as aE, validatePolicySignedShape as aF, validatePolicyStatusSigned as aG, validatePolicyStatusSignedShape as aH, validatePolicyStatusUnsigned as aI, validatePolicyUnsigned as aJ, verifyPolicy as aK, verifyPolicyEngineRecord as aL, verifyPolicyRootRevocationV3 as aM, verifyPolicyRootStatusCheckpointV3 as aN, verifyPolicyStatus as aO, verifySignedObject as aP, createAndSignPolicy as aa, createAndSignPolicyEngineRecord as ab, createAndSignPolicyStatus as ac, createAndSignSignedObject as ad, createCompactPolicyDescendant as ae, createCompactPolicyInvocation as af, deriveSignedObjectMaterial as ag, getPolicyRootStatusV3 as ah, mintPolicySessionV3 as ai, normalizeUnifiedPolicyCapability as aj, parseCompactUcanAuthorization as ak, parsePolicySessionUcan as al, policyCidFromCanonicalBytes as am, policyDigestHex as an, policyIdForDigestHex as ao, projectUnifiedPolicyCapabilities as ap, projectUnifiedPolicyCapability as aq, renewPolicyRootStatusV3 as ar, requestPolicyChallengeV3 as as, revokePolicyRootV3 as at, signCompactUcanAuthorization as au, signedObjectIdFor as av, toSignedObjectError as aw, unifiedNativeProjectionHashHex as ax, unifiedPolicyCapabilityContains as ay, unifiedPolicyCapabilityDigestHex as az, type CompactPolicyInvocationInput as b, type CompactUcanAuthorizationV1 as c, EIP191_JCS_SIGNATURE_SUITE as d, LAST_V2_READ_AT as e, POLICY_CAPABILITY_V1_DOMAIN as f, POLICY_CAPABILITY_V1_SCHEMA as g, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as h, POLICY_ENGINE_RECORD_SCHEMA as i, POLICY_SCHEMA as j, POLICY_SESSION_UCAN_V1_PROFILE as k, POLICY_STATUS_SCHEMA as l, POLICY_V1_DOMAIN as m, POLICY_V1_SCHEMA as n, type PolicyChallengeV3 as o, type PolicyRootStatusV3 as p, type PolicySessionUcanV1 as q, type PolicyStatus as r, ROOT_REVOCATION_V1_SCHEMA as s, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as t, ROOT_STATUS_RENEWAL_V1_DOMAIN as u, ROOT_STATUS_V1_DOMAIN as v, type SignCompactUcanAuthorizationInput as w, SignatureMaterialError as x, type SignatureSuite as y, SignatureVerificationError as z };
+declare const POLICY_V2_SCHEMA: "xyz.tinycloud.policy/policy/v2";
+declare const POLICY_V2_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
+declare const POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE: "TinyCloudPolicyCredentialRequirement";
+declare const POLICY_PRESENTATION_V3_SCHEMA: "xyz.tinycloud.policy/presentation/v3";
+declare const POLICY_PRESENTATION_V3_DOMAIN = "xyz.tinycloud.policy/Presentation/v3\0";
+interface PolicyCredentialRequirementV1 {
+    readonly type: typeof POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE;
+    readonly version: 1;
+    readonly requirementDigest: string;
+    readonly descriptorDigest: string;
+    readonly issuerDid: string;
+    readonly issuerKid: string;
+    readonly profile: {
+        readonly id: string;
+        readonly version: 1;
+    };
+    readonly credentialType: {
+        readonly id: string;
+        readonly version: 1;
+    };
+}
+interface UnifiedPolicyV2 {
+    readonly schema: typeof POLICY_V2_SCHEMA;
+    readonly policyId: string;
+    readonly ownerDid: string;
+    readonly createdAt: string;
+    readonly expiresAt?: string;
+    readonly contentSource: UnifiedContentSource;
+    readonly capabilityCeiling: readonly UnifiedPolicyCapability[];
+    readonly credentialRequirement: PolicyCredentialRequirementV1;
+    readonly signature: {
+        readonly suite: "Ed25519";
+        readonly signerDid: string;
+        readonly value: string;
+    };
+}
+type UnsignedUnifiedPolicyV2 = Omit<UnifiedPolicyV2, "policyId" | "signature">;
+interface PolicyCredentialPresentationV3 {
+    readonly schema: typeof POLICY_PRESENTATION_V3_SCHEMA;
+    readonly jti: string;
+    readonly challengeId: string;
+    readonly nonce: string;
+    readonly policyCid: string;
+    readonly nodeAudience: string;
+    readonly holderDid: string;
+    readonly subjectDid: string;
+    readonly credentialSpaceOwnerDid: string;
+    readonly credentialDigest: string;
+    readonly requirementDigest: string;
+    readonly descriptorDigest: string;
+    readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly signature: {
+        readonly suite: "Ed25519";
+        readonly signerDid: string;
+        readonly value: string;
+    };
+}
+declare function validatePolicyCredentialRequirementV1(value: unknown): PolicyCredentialRequirementV1;
+declare function policyV2DigestHex(input: UnsignedUnifiedPolicyV2): string;
+/**
+ * Validate the exact non-PII Policy/v2 commitment consumed by the holder.
+ * The caller supplies policy bytes already owner-signature verified by Share;
+ * Node remains the authoritative signature verifier at admission.
+ */
+declare function validateUnifiedPolicyV2(value: unknown, expectedPolicyCid?: string): UnifiedPolicyV2;
+interface BuildPolicyCredentialPresentationV3Input {
+    readonly policy: UnifiedPolicyV2;
+    readonly policyCid: string;
+    readonly challenge: PolicyChallengeV3;
+    readonly requirement: CredentialRequirement;
+    readonly credential: VerifiedCredential;
+    readonly credentialSpaceOwnerDid: string;
+    readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
+    readonly sign: (digest: Uint8Array) => Promise<Uint8Array>;
+    readonly now?: Date;
+    readonly jti?: string;
+}
+declare function buildPolicyCredentialPresentationV3(input: BuildPolicyCredentialPresentationV3Input): Promise<PolicyCredentialPresentationV3>;
+interface AdmitPolicyCredentialV3Input extends Omit<BuildPolicyCredentialPresentationV3Input, "challenge"> {
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+    readonly nodeOrigin: string;
+    /** Root authorization CID of the recipient's active TinyCloud account session. */
+    readonly accountAuthorizationCid: string;
+    /** Recipient-owned `credentials` space covered by the account authorization. */
+    readonly credentialSpaceId: string;
+    readonly fetch?: typeof fetch;
+}
+interface PolicyCredentialAdmissionV3 {
+    readonly challenge: PolicyChallengeV3;
+    readonly presentation: PolicyCredentialPresentationV3;
+    readonly session: PolicySessionUcanV1;
+}
+/**
+ * Present verified TC-463 output to the Policy/v3 admission ceremony.
+ * Raw credential material appears only in the TLS POST body.
+ */
+declare function admitPolicyCredentialV3(input: AdmitPolicyCredentialV3Input): Promise<PolicyCredentialAdmissionV3>;
+
+export { type SignedObjectMaterial as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyStatus as D, ED25519_JCS_SIGNATURE_SUITE as E, ROOT_REVOCATION_V1_SCHEMA as F, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as G, ROOT_STATUS_RENEWAL_V1_DOMAIN as H, ROOT_STATUS_V1_DOMAIN as I, type JsonObject as J, type SignCompactUcanAuthorizationInput as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type SignCompactUcanRootAuthorizationInput as O, type PolicyEngineRecord as P, SignatureMaterialError as Q, ROOT_REVOCATION_V1_DOMAIN as R, type SignedObjectSigner as S, type SignatureSuite as T, type UnsignedPolicyEngineRecord as U, SignatureVerificationError as V, SignedObjectCanonicalizationError as W, SignedObjectDigestError as X, type SignedObjectErrorCode as Y, SignedObjectIdError as Z, type SignedObjectKind as _, type Policy as a, validatePolicyUnsigned as a$, SignedObjectProfileError as a0, SignedObjectSchemaError as a1, type SignedObjectSignature as a2, type SignedObjectVerificationResult as a3, type SignedPolicyObject as a4, SigningKeyBindingError as a5, type UnifiedContentSource as a6, type UnifiedEncryptionCapability as a7, type UnifiedKvCapability as a8, type UnifiedNativeCapability as a9, parsePolicySessionUcan as aA, policyCidFromCanonicalBytes as aB, policyDigestHex as aC, policyIdForDigestHex as aD, policyV2DigestHex as aE, projectUnifiedPolicyCapabilities as aF, projectUnifiedPolicyCapability as aG, renewPolicyRootStatusV3 as aH, requestPolicyChallengeV3 as aI, revokePolicyRootV3 as aJ, signCompactUcanAuthorization as aK, signCompactUcanRootAuthorization as aL, signedObjectIdFor as aM, toSignedObjectError as aN, unifiedNativeProjectionHashHex as aO, unifiedPolicyCapabilityContains as aP, unifiedPolicyCapabilityDigestHex as aQ, unifiedPolicyCapabilityFromNative as aR, validatePolicyCredentialRequirementV1 as aS, validatePolicyEngineRecordSigned as aT, validatePolicyEngineRecordSignedShape as aU, validatePolicyEngineRecordUnsigned as aV, validatePolicySigned as aW, validatePolicySignedShape as aX, validatePolicyStatusSigned as aY, validatePolicyStatusSignedShape as aZ, validatePolicyStatusUnsigned as a_, type UnifiedPolicyCapability as aa, type UnifiedPolicyV1 as ab, type UnifiedPolicyV2 as ac, type UnifiedResourceSelector as ad, type UnsignedPolicy as ae, type UnsignedPolicyObject as af, type UnsignedPolicyStatus as ag, type UnsignedUnifiedPolicyV2 as ah, UnsupportedSignatureSuiteError as ai, admitPolicyCredentialV3 as aj, buildPolicyCredentialPresentationV3 as ak, canonicalizeSignedObjectUnsigned as al, canonicalizeUnifiedPolicyCapability as am, compactAttenuationContains as an, contentSourceDigestHex as ao, createAndSignPolicy as ap, createAndSignPolicyEngineRecord as aq, createAndSignPolicyStatus as ar, createAndSignSignedObject as as, createCompactPolicyDescendant as at, createCompactPolicyInvocation as au, deriveSignedObjectMaterial as av, getPolicyRootStatusV3 as aw, mintPolicySessionV3 as ax, normalizeUnifiedPolicyCapability as ay, parseCompactUcanAuthorization as az, type AdmitPolicyCredentialV3Input as b, validateUnifiedPolicyV2 as b0, verifyPolicy as b1, verifyPolicyEngineRecord as b2, verifyPolicyRootRevocationV3 as b3, verifyPolicyRootStatusCheckpointV3 as b4, verifyPolicyStatus as b5, verifySignedObject as b6, type CredentialHolderBinding as b7, type CredentialFlowDescriptor as b8, type CredentialRequirement as b9, type StoredCredentialRecord as ba, type VerifiedCredential as bb, type CredentialStorageReceipt as bc, type IssuedCredentialEnvelope as bd, type CredentialIssuerMetadata as be, CREDENTIAL_ACQUISITION_PROTOCOL as bf, CREDENTIAL_CONTRACT_VERSION as bg, CREDENTIAL_FORMAT as bh, CREDENTIAL_STEP_REGISTRY_VERSION as bi, type CredentialClaimDescriptor as bj, type CredentialEndpointId as bk, type CredentialInputDescriptor as bl, type CredentialProgressEvent as bm, type CredentialStepDescriptor as bn, type CredentialStepType as bo, type CredentialUxState as bp, HOLDER_BINDING_DOMAIN as bq, type IssuerVerificationKey as br, type CompactPolicyInvocationInput as c, type CompactUcanAuthorizationV1 as d, EIP191_JCS_SIGNATURE_SUITE as e, LAST_V2_READ_AT as f, POLICY_CAPABILITY_V1_DOMAIN as g, POLICY_CAPABILITY_V1_SCHEMA as h, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as i, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as j, POLICY_ENGINE_RECORD_SCHEMA as k, POLICY_PRESENTATION_V3_DOMAIN as l, POLICY_PRESENTATION_V3_SCHEMA as m, POLICY_SCHEMA as n, POLICY_SESSION_UCAN_V1_PROFILE as o, POLICY_STATUS_SCHEMA as p, POLICY_V1_DOMAIN as q, POLICY_V1_SCHEMA as r, POLICY_V2_DOMAIN as s, POLICY_V2_SCHEMA as t, type PolicyChallengeV3 as u, type PolicyCredentialAdmissionV3 as v, type PolicyCredentialPresentationV3 as w, type PolicyCredentialRequirementV1 as x, type PolicyRootStatusV3 as y, type PolicySessionUcanV1 as z };

package/dist/delegations/index.cjs

@@ -4169,14 +4169,14 @@ function decodeBase64Url(value) {
   if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1)
     throw new Error("value is not canonical base64url");
   const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
-  const binary = typeof Buffer !== "undefined" ? Buffer.from(normalized, "base64").toString("binary") : atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "="));
+  const binary = typeof atob === "function" ? atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=")) : Buffer.from(normalized, "base64").toString("binary");
   const bytes2 = Uint8Array.from(binary, (character) => character.charCodeAt(0));
-  const encoded = typeof Buffer !== "undefined" ? Buffer.from(bytes2).toString("base64url") : btoa(String.fromCharCode(...bytes2)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  const encoded = typeof btoa === "function" ? btoa(String.fromCharCode(...bytes2)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : Buffer.from(bytes2).toString("base64url");
   if (encoded !== value) throw new Error("value is not canonical base64url");
   return bytes2;
 }
 function encodeBase64Url(value) {
-  return typeof Buffer !== "undefined" ? Buffer.from(value).toString("base64url") : btoa(String.fromCharCode(...value)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  return typeof btoa === "function" ? btoa(String.fromCharCode(...value)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : Buffer.from(value).toString("base64url");
 }
 function equalBytes2(left, right) {
   return left.length === right.length && left.every((byte, index) => byte === right[index]);
@@ -4588,9 +4588,9 @@ var ShareRecipientClient = class {
       const authority = Object.entries(session.att).find(([parentResource, abilities]) => {
         if (!(action in abilities)) return false;
         if (serviceName === "encryption") return parentResource.startsWith("urn:tinycloud:encryption:") && parentResource === cleanPath;
-        const match = /^tinycloud:\/\/[^/]+\/kv\/(.+)$/.exec(parentResource);
-        if (match === null) return false;
-        const parentPath = match[1];
+        const marker = parentResource.indexOf("/kv/");
+        if (marker < 1) return false;
+        const parentPath = parentResource.slice(marker + 4);
         const caveats = abilities[action] ?? [];
         const prefix = caveats.some((value) => isRecord(value) && value.kind === "prefix");
         return cleanPath === parentPath || prefix && cleanPath.startsWith(`${parentPath}/`);
@@ -4616,10 +4616,10 @@ var ShareRecipientClient = class {
   policySessionProjection(delegation) {
     const session = parsePolicySessionUcan(delegation.delegationHeader.Authorization);
     if (session.cid !== delegation.cid || session.aud !== delegation.delegateDID) throw new ShareAccessError("SHARE_SESSION_INVALID");
-    const kvResource = Object.keys(session.att).find((resource) => /^tinycloud:\/\/[^/]+\/kv\/.+$/.test(resource));
-    const match = kvResource === void 0 ? void 0 : /^tinycloud:\/\/([^/]+)\/kv\/(.+)$/.exec(kvResource);
-    if (match === void 0 || match === null) throw new ShareAccessError("SHARE_SESSION_INVALID");
-    return { spaceId: match[1] };
+    const kvResource = Object.keys(session.att).find((resource) => resource.indexOf("/kv/") > 0);
+    const marker = kvResource?.indexOf("/kv/") ?? -1;
+    if (kvResource === void 0 || marker < 1) throw new ShareAccessError("SHARE_SESSION_INVALID");
+    return { spaceId: kvResource.slice(0, marker) };
   }
   createKV(origin, session, invokeOverride) {
     const invoke = invokeOverride ?? this.options.invoke ?? nativeInvoke;