@tinycloud/sdk-core 3.0.0-beta.1 → 3.0.0-beta.11

package/dist/{credential-admission-C_cO1QqB.d.cts → credential-admission-CFjUChF8.d.cts}

@@ -445,6 +445,49 @@ interface UnifiedPolicyV1 {
         readonly value: string;
     };
 }
+interface PolicyRootV3 {
+    readonly cid: string;
+    readonly authorization: string;
+}
+interface RegisterPolicyV3Input {
+    readonly nodeOrigin: string;
+    readonly policyCid: string;
+    readonly policy: Readonly<Record<string, unknown>>;
+    readonly policyRoot: PolicyRootV3;
+    readonly enforcementRoot: PolicyRootV3;
+    readonly contentSourceDigestHex: string;
+    readonly nativeProjectionHashHex: string;
+    readonly rootExpiresAt: string;
+    readonly enforcerDid: string;
+    readonly expectedNodeAudience: string;
+    readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
+}
+interface AttestedEnforcerBindingV2 {
+    readonly schema: "xyz.tinycloud.policy/attested-enforcer/v2";
+    readonly enforcerDid: string;
+    readonly nodeAudience: string;
+    readonly attestationBindingDigestHex: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly signature: {
+        readonly suite: "Ed25519";
+        readonly signerDid: string;
+        readonly value: string;
+    };
+}
+interface RegisterPolicyV3Receipt {
+    readonly policyCid: string;
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+    readonly attestedEnforcerBinding: AttestedEnforcerBindingV2;
+}
+type PolicySessionUcanFactV1 = Readonly<Record<string, unknown>> & {
+    /** Present only on accountless PolicyCredentialPresentation/v4 admissions. */
+    readonly credentialIdAuditDigestHex?: string;
+    /** Present only on accountless PolicyCredentialPresentation/v4 admissions. */
+    readonly presentationJtiAuditDigestHex?: string;
+};
 interface PolicySessionUcanV1 {
     readonly authorization: string;
     readonly cid: string;
@@ -455,7 +498,7 @@ interface PolicySessionUcanV1 {
     readonly nbf: number;
     readonly exp: number;
     readonly nnc: string;
-    readonly fact: Readonly<Record<string, unknown>>;
+    readonly fact: PolicySessionUcanFactV1;
 }
 interface PolicyChallengeV3 {
     readonly challengeId: string;
@@ -468,10 +511,17 @@ interface PolicyChallengeV3 {
 }
 declare function requestPolicyChallengeV3(input: {
     readonly nodeOrigin: string;
+    /**
+     * Policy control routes are part of the recipient's TinyCloud Node.  This is
+     * deliberately a path, not a second origin: applications must not send a
+     * credential presentation to a separately discovered policy service.
+     */
+    readonly policyRuntimePath?: string;
     readonly policyCid: string;
     readonly recipientDid: string;
     readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
     readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
 }): Promise<PolicyChallengeV3>;
 declare function mintPolicySessionV3(input: {
     readonly nodeOrigin: string;
@@ -485,6 +535,7 @@ declare function mintPolicySessionV3(input: {
     readonly presentation: Readonly<Record<string, unknown>>;
     readonly challenge?: PolicyChallengeV3;
     readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
 }): Promise<PolicySessionUcanV1>;
 interface PolicyRootStatusV3 {
     readonly rootCid: string;
@@ -543,6 +594,12 @@ declare function projectUnifiedPolicyCapabilities(input: readonly unknown[]): Un
 declare function unifiedNativeProjectionHashHex(input: readonly unknown[]): string;
 declare function unifiedPolicyCapabilityFromNative(input: unknown): UnifiedPolicyCapability;
 declare function contentSourceDigestHex(input: UnifiedContentSource): string;
+/**
+ * Register a signed policy and its sibling roots with the embedded Node
+ * Policy/v3 runtime. This is intentionally application-neutral: callers
+ * supply policy material, while Node owns both transport endpoints.
+ */
+declare function registerPolicyV3(input: RegisterPolicyV3Input): Promise<RegisterPolicyV3Receipt>;
 declare function policyDigestHex(policy: Omit<UnifiedPolicyV1, "policyId" | "signature">): string;
 declare function policyIdForDigestHex(digestHex: string): string;
 declare function policyCidFromCanonicalBytes(bytes: Uint8Array): string;
@@ -682,6 +739,8 @@ declare const POLICY_V2_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
 declare const POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE: "TinyCloudPolicyCredentialRequirement";
 declare const POLICY_PRESENTATION_V3_SCHEMA: "xyz.tinycloud.policy/presentation/v3";
 declare const POLICY_PRESENTATION_V3_DOMAIN = "xyz.tinycloud.policy/Presentation/v3\0";
+declare const POLICY_PRESENTATION_V4_SCHEMA: "xyz.tinycloud.policy/presentation/v4";
+declare const POLICY_PRESENTATION_V4_DOMAIN = "xyz.tinycloud.policy/Presentation/v4\0";
 interface PolicyCredentialRequirementV1 {
     readonly type: typeof POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE;
     readonly version: 1;
@@ -736,6 +795,29 @@ interface PolicyCredentialPresentationV3 {
         readonly value: string;
     };
 }
+interface UnsignedPolicyCredentialPresentationV4 {
+    readonly schema: typeof POLICY_PRESENTATION_V4_SCHEMA;
+    readonly jti: string;
+    readonly challengeId: string;
+    readonly nonce: string;
+    readonly policyCid: string;
+    readonly nodeAudience: string;
+    readonly holderDid: string;
+    readonly subjectDid: string;
+    readonly credentialDigest: string;
+    readonly requirementDigest: string;
+    readonly descriptorDigest: string;
+    readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+interface PolicyCredentialPresentationV4 extends UnsignedPolicyCredentialPresentationV4 {
+    readonly signature: {
+        readonly suite: "Ed25519";
+        readonly signerDid: string;
+        readonly value: string;
+    };
+}
 declare function validatePolicyCredentialRequirementV1(value: unknown): PolicyCredentialRequirementV1;
 declare function policyV2DigestHex(input: UnsignedUnifiedPolicyV2): string;
 /**
@@ -744,6 +826,21 @@ declare function policyV2DigestHex(input: UnsignedUnifiedPolicyV2): string;
  * Node remains the authoritative signature verifier at admission.
  */
 declare function validateUnifiedPolicyV2(value: unknown, expectedPolicyCid?: string): UnifiedPolicyV2;
+declare function issuedCredentialEnvelopeFromVerified(verified: VerifiedCredential): IssuedCredentialEnvelope;
+/** Sign the exact accountless v4 wire value. No account custody fields exist. */
+declare function signPolicyCredentialPresentationV4(value: UnsignedPolicyCredentialPresentationV4, sign: (digest: Uint8Array) => Promise<Uint8Array>): Promise<PolicyCredentialPresentationV4>;
+interface BuildPolicyCredentialPresentationV4Input {
+    readonly policy: UnifiedPolicyV2;
+    readonly policyCid: string;
+    readonly challenge: PolicyChallengeV3;
+    readonly requirement: CredentialRequirement;
+    readonly credential: VerifiedCredential;
+    readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
+    readonly sign: (digest: Uint8Array) => Promise<Uint8Array>;
+    readonly now?: Date;
+    readonly jti?: string;
+}
+declare function buildPolicyCredentialPresentationV4(input: BuildPolicyCredentialPresentationV4Input): Promise<PolicyCredentialPresentationV4>;
 interface BuildPolicyCredentialPresentationV3Input {
     readonly policy: UnifiedPolicyV2;
     readonly policyCid: string;
@@ -761,11 +858,14 @@ interface AdmitPolicyCredentialV3Input extends Omit<BuildPolicyCredentialPresent
     readonly policyRootCid: string;
     readonly enforcementRootCid: string;
     readonly nodeOrigin: string;
+    /** Path to the embedded Node policy runtime. Defaults to `/policy/v3`. */
+    readonly policyRuntimePath?: string;
     /** Root authorization CID of the recipient's active TinyCloud account session. */
     readonly accountAuthorizationCid: string;
     /** Recipient-owned `credentials` space covered by the account authorization. */
     readonly credentialSpaceId: string;
     readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
 }
 interface PolicyCredentialAdmissionV3 {
     readonly challenge: PolicyChallengeV3;
@@ -777,5 +877,25 @@ interface PolicyCredentialAdmissionV3 {
  * Raw credential material appears only in the TLS POST body.
  */
 declare function admitPolicyCredentialV3(input: AdmitPolicyCredentialV3Input): Promise<PolicyCredentialAdmissionV3>;
+interface AdmitPolicyCredentialV4Input extends Omit<BuildPolicyCredentialPresentationV4Input, "challenge"> {
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+    readonly expectedNodeAudience: string;
+    readonly expectedEnforcerDid: string;
+    readonly nodeOrigin: string;
+    /** Path to the embedded Node policy runtime. Defaults to `/policy/v3`. */
+    readonly policyRuntimePath?: string;
+    readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
+}
+interface PolicyCredentialAdmissionV4 {
+    readonly challenge: PolicyChallengeV3;
+    readonly presentation: PolicyCredentialPresentationV4;
+    readonly session: PolicySessionUcanV1;
+    /** The ordinary delegation has been activated using Node's generic `/delegate`. */
+    readonly delegationImported: true;
+}
+/** Accountless admission. The request deliberately has no account custody fields. */
+declare function admitPolicyCredentialV4(input: AdmitPolicyCredentialV4Input): Promise<PolicyCredentialAdmissionV4>;
 
-export { type SignedObjectMaterial as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyStatus as D, ED25519_JCS_SIGNATURE_SUITE as E, ROOT_REVOCATION_V1_SCHEMA as F, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as G, ROOT_STATUS_RENEWAL_V1_DOMAIN as H, ROOT_STATUS_V1_DOMAIN as I, type JsonObject as J, type SignCompactUcanAuthorizationInput as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type SignCompactUcanRootAuthorizationInput as O, type PolicyEngineRecord as P, SignatureMaterialError as Q, ROOT_REVOCATION_V1_DOMAIN as R, type SignedObjectSigner as S, type SignatureSuite as T, type UnsignedPolicyEngineRecord as U, SignatureVerificationError as V, SignedObjectCanonicalizationError as W, SignedObjectDigestError as X, type SignedObjectErrorCode as Y, SignedObjectIdError as Z, type SignedObjectKind as _, type Policy as a, validatePolicyUnsigned as a$, SignedObjectProfileError as a0, SignedObjectSchemaError as a1, type SignedObjectSignature as a2, type SignedObjectVerificationResult as a3, type SignedPolicyObject as a4, SigningKeyBindingError as a5, type UnifiedContentSource as a6, type UnifiedEncryptionCapability as a7, type UnifiedKvCapability as a8, type UnifiedNativeCapability as a9, parsePolicySessionUcan as aA, policyCidFromCanonicalBytes as aB, policyDigestHex as aC, policyIdForDigestHex as aD, policyV2DigestHex as aE, projectUnifiedPolicyCapabilities as aF, projectUnifiedPolicyCapability as aG, renewPolicyRootStatusV3 as aH, requestPolicyChallengeV3 as aI, revokePolicyRootV3 as aJ, signCompactUcanAuthorization as aK, signCompactUcanRootAuthorization as aL, signedObjectIdFor as aM, toSignedObjectError as aN, unifiedNativeProjectionHashHex as aO, unifiedPolicyCapabilityContains as aP, unifiedPolicyCapabilityDigestHex as aQ, unifiedPolicyCapabilityFromNative as aR, validatePolicyCredentialRequirementV1 as aS, validatePolicyEngineRecordSigned as aT, validatePolicyEngineRecordSignedShape as aU, validatePolicyEngineRecordUnsigned as aV, validatePolicySigned as aW, validatePolicySignedShape as aX, validatePolicyStatusSigned as aY, validatePolicyStatusSignedShape as aZ, validatePolicyStatusUnsigned as a_, type UnifiedPolicyCapability as aa, type UnifiedPolicyV1 as ab, type UnifiedPolicyV2 as ac, type UnifiedResourceSelector as ad, type UnsignedPolicy as ae, type UnsignedPolicyObject as af, type UnsignedPolicyStatus as ag, type UnsignedUnifiedPolicyV2 as ah, UnsupportedSignatureSuiteError as ai, admitPolicyCredentialV3 as aj, buildPolicyCredentialPresentationV3 as ak, canonicalizeSignedObjectUnsigned as al, canonicalizeUnifiedPolicyCapability as am, compactAttenuationContains as an, contentSourceDigestHex as ao, createAndSignPolicy as ap, createAndSignPolicyEngineRecord as aq, createAndSignPolicyStatus as ar, createAndSignSignedObject as as, createCompactPolicyDescendant as at, createCompactPolicyInvocation as au, deriveSignedObjectMaterial as av, getPolicyRootStatusV3 as aw, mintPolicySessionV3 as ax, normalizeUnifiedPolicyCapability as ay, parseCompactUcanAuthorization as az, type AdmitPolicyCredentialV3Input as b, validateUnifiedPolicyV2 as b0, verifyPolicy as b1, verifyPolicyEngineRecord as b2, verifyPolicyRootRevocationV3 as b3, verifyPolicyRootStatusCheckpointV3 as b4, verifyPolicyStatus as b5, verifySignedObject as b6, type CredentialHolderBinding as b7, type CredentialFlowDescriptor as b8, type CredentialRequirement as b9, type StoredCredentialRecord as ba, type VerifiedCredential as bb, type CredentialStorageReceipt as bc, type IssuedCredentialEnvelope as bd, type CredentialIssuerMetadata as be, CREDENTIAL_ACQUISITION_PROTOCOL as bf, CREDENTIAL_CONTRACT_VERSION as bg, CREDENTIAL_FORMAT as bh, CREDENTIAL_STEP_REGISTRY_VERSION as bi, type CredentialClaimDescriptor as bj, type CredentialEndpointId as bk, type CredentialInputDescriptor as bl, type CredentialProgressEvent as bm, type CredentialStepDescriptor as bn, type CredentialStepType as bo, type CredentialUxState as bp, HOLDER_BINDING_DOMAIN as bq, type IssuerVerificationKey as br, type CompactPolicyInvocationInput as c, type CompactUcanAuthorizationV1 as d, EIP191_JCS_SIGNATURE_SUITE as e, LAST_V2_READ_AT as f, POLICY_CAPABILITY_V1_DOMAIN as g, POLICY_CAPABILITY_V1_SCHEMA as h, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as i, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as j, POLICY_ENGINE_RECORD_SCHEMA as k, POLICY_PRESENTATION_V3_DOMAIN as l, POLICY_PRESENTATION_V3_SCHEMA as m, POLICY_SCHEMA as n, POLICY_SESSION_UCAN_V1_PROFILE as o, POLICY_STATUS_SCHEMA as p, POLICY_V1_DOMAIN as q, POLICY_V1_SCHEMA as r, POLICY_V2_DOMAIN as s, POLICY_V2_SCHEMA as t, type PolicyChallengeV3 as u, type PolicyCredentialAdmissionV3 as v, type PolicyCredentialPresentationV3 as w, type PolicyCredentialRequirementV1 as x, type PolicyRootStatusV3 as y, type PolicySessionUcanV1 as z };
+export { type RegisterPolicyV3Receipt as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyCredentialAdmissionV3 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialAdmissionV4 as F, type PolicyCredentialPresentationV3 as G, type PolicyCredentialPresentationV4 as H, type PolicyCredentialRequirementV1 as I, type JsonObject as J, type PolicyRootStatusV3 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicyRootV3 as O, type PolicyEngineRecord as P, type PolicySessionUcanFactV1 as Q, type PolicySessionUcanV1 as R, type SignedObjectSigner as S, type PolicyStatus as T, type UnsignedPolicyEngineRecord as U, ROOT_REVOCATION_V1_DOMAIN as V, ROOT_REVOCATION_V1_SCHEMA as W, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as X, ROOT_STATUS_RENEWAL_V1_DOMAIN as Y, ROOT_STATUS_V1_DOMAIN as Z, type RegisterPolicyV3Input as _, type Policy as a, signCompactUcanRootAuthorization as a$, type SignCompactUcanAuthorizationInput as a0, type SignCompactUcanRootAuthorizationInput as a1, SignatureMaterialError as a2, type SignatureSuite as a3, SignatureVerificationError as a4, SignedObjectCanonicalizationError as a5, SignedObjectDigestError as a6, type SignedObjectErrorCode as a7, SignedObjectIdError as a8, type SignedObjectKind as a9, canonicalizeUnifiedPolicyCapability as aA, compactAttenuationContains as aB, contentSourceDigestHex as aC, createAndSignPolicy as aD, createAndSignPolicyEngineRecord as aE, createAndSignPolicyStatus as aF, createAndSignSignedObject as aG, createCompactPolicyDescendant as aH, createCompactPolicyInvocation as aI, deriveSignedObjectMaterial as aJ, getPolicyRootStatusV3 as aK, issuedCredentialEnvelopeFromVerified as aL, mintPolicySessionV3 as aM, normalizeUnifiedPolicyCapability as aN, parseCompactUcanAuthorization as aO, parsePolicySessionUcan as aP, policyCidFromCanonicalBytes as aQ, policyDigestHex as aR, policyIdForDigestHex as aS, policyV2DigestHex as aT, projectUnifiedPolicyCapabilities as aU, projectUnifiedPolicyCapability as aV, registerPolicyV3 as aW, renewPolicyRootStatusV3 as aX, requestPolicyChallengeV3 as aY, revokePolicyRootV3 as aZ, signCompactUcanAuthorization as a_, type SignedObjectMaterial as aa, SignedObjectProfileError as ab, SignedObjectSchemaError as ac, type SignedObjectSignature as ad, type SignedObjectVerificationResult as ae, type SignedPolicyObject as af, SigningKeyBindingError as ag, type UnifiedContentSource as ah, type UnifiedEncryptionCapability as ai, type UnifiedKvCapability as aj, type UnifiedNativeCapability as ak, type UnifiedPolicyCapability as al, type UnifiedPolicyV1 as am, type UnifiedPolicyV2 as an, type UnifiedResourceSelector as ao, type UnsignedPolicy as ap, type UnsignedPolicyCredentialPresentationV4 as aq, type UnsignedPolicyObject as ar, type UnsignedPolicyStatus as as, type UnsignedUnifiedPolicyV2 as at, UnsupportedSignatureSuiteError as au, admitPolicyCredentialV3 as av, admitPolicyCredentialV4 as aw, buildPolicyCredentialPresentationV3 as ax, buildPolicyCredentialPresentationV4 as ay, canonicalizeSignedObjectUnsigned as az, type AdmitPolicyCredentialV3Input as b, signPolicyCredentialPresentationV4 as b0, signedObjectIdFor as b1, toSignedObjectError as b2, unifiedNativeProjectionHashHex as b3, unifiedPolicyCapabilityContains as b4, unifiedPolicyCapabilityDigestHex as b5, unifiedPolicyCapabilityFromNative as b6, validatePolicyCredentialRequirementV1 as b7, validatePolicyEngineRecordSigned as b8, validatePolicyEngineRecordSignedShape as b9, type CredentialClaimDescriptor as bA, type CredentialEndpointId as bB, type CredentialInputDescriptor as bC, type CredentialProgressEvent as bD, type CredentialStepDescriptor as bE, type CredentialStepType as bF, type CredentialUxState as bG, HOLDER_BINDING_DOMAIN as bH, type IssuerVerificationKey as bI, validatePolicyEngineRecordUnsigned as ba, validatePolicySigned as bb, validatePolicySignedShape as bc, validatePolicyStatusSigned as bd, validatePolicyStatusSignedShape as be, validatePolicyStatusUnsigned as bf, validatePolicyUnsigned as bg, validateUnifiedPolicyV2 as bh, verifyPolicy as bi, verifyPolicyEngineRecord as bj, verifyPolicyRootRevocationV3 as bk, verifyPolicyRootStatusCheckpointV3 as bl, verifyPolicyStatus as bm, verifySignedObject as bn, type CredentialHolderBinding as bo, type CredentialFlowDescriptor as bp, type CredentialRequirement as bq, type StoredCredentialRecord as br, type VerifiedCredential as bs, type CredentialStorageReceipt as bt, type IssuedCredentialEnvelope as bu, type CredentialIssuerMetadata as bv, CREDENTIAL_ACQUISITION_PROTOCOL as bw, CREDENTIAL_CONTRACT_VERSION as bx, CREDENTIAL_FORMAT as by, CREDENTIAL_STEP_REGISTRY_VERSION as bz, type AdmitPolicyCredentialV4Input as c, type AttestedEnforcerBindingV2 as d, type BuildPolicyCredentialPresentationV4Input as e, type CompactPolicyInvocationInput as f, type CompactUcanAuthorizationV1 as g, EIP191_JCS_SIGNATURE_SUITE as h, LAST_V2_READ_AT as i, POLICY_CAPABILITY_V1_DOMAIN as j, POLICY_CAPABILITY_V1_SCHEMA as k, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as l, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as m, POLICY_ENGINE_RECORD_SCHEMA as n, POLICY_PRESENTATION_V3_DOMAIN as o, POLICY_PRESENTATION_V3_SCHEMA as p, POLICY_PRESENTATION_V4_DOMAIN as q, POLICY_PRESENTATION_V4_SCHEMA as r, POLICY_SCHEMA as s, POLICY_SESSION_UCAN_V1_PROFILE as t, POLICY_STATUS_SCHEMA as u, POLICY_V1_DOMAIN as v, POLICY_V1_SCHEMA as w, POLICY_V2_DOMAIN as x, POLICY_V2_SCHEMA as y, type PolicyChallengeV3 as z };

package/dist/{credential-admission-cvHe-HUC.d.ts → credential-admission-DIEPgQ0o.d.ts}

@@ -445,6 +445,49 @@ interface UnifiedPolicyV1 {
         readonly value: string;
     };
 }
+interface PolicyRootV3 {
+    readonly cid: string;
+    readonly authorization: string;
+}
+interface RegisterPolicyV3Input {
+    readonly nodeOrigin: string;
+    readonly policyCid: string;
+    readonly policy: Readonly<Record<string, unknown>>;
+    readonly policyRoot: PolicyRootV3;
+    readonly enforcementRoot: PolicyRootV3;
+    readonly contentSourceDigestHex: string;
+    readonly nativeProjectionHashHex: string;
+    readonly rootExpiresAt: string;
+    readonly enforcerDid: string;
+    readonly expectedNodeAudience: string;
+    readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
+}
+interface AttestedEnforcerBindingV2 {
+    readonly schema: "xyz.tinycloud.policy/attested-enforcer/v2";
+    readonly enforcerDid: string;
+    readonly nodeAudience: string;
+    readonly attestationBindingDigestHex: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly signature: {
+        readonly suite: "Ed25519";
+        readonly signerDid: string;
+        readonly value: string;
+    };
+}
+interface RegisterPolicyV3Receipt {
+    readonly policyCid: string;
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+    readonly attestedEnforcerBinding: AttestedEnforcerBindingV2;
+}
+type PolicySessionUcanFactV1 = Readonly<Record<string, unknown>> & {
+    /** Present only on accountless PolicyCredentialPresentation/v4 admissions. */
+    readonly credentialIdAuditDigestHex?: string;
+    /** Present only on accountless PolicyCredentialPresentation/v4 admissions. */
+    readonly presentationJtiAuditDigestHex?: string;
+};
 interface PolicySessionUcanV1 {
     readonly authorization: string;
     readonly cid: string;
@@ -455,7 +498,7 @@ interface PolicySessionUcanV1 {
     readonly nbf: number;
     readonly exp: number;
     readonly nnc: string;
-    readonly fact: Readonly<Record<string, unknown>>;
+    readonly fact: PolicySessionUcanFactV1;
 }
 interface PolicyChallengeV3 {
     readonly challengeId: string;
@@ -468,10 +511,17 @@ interface PolicyChallengeV3 {
 }
 declare function requestPolicyChallengeV3(input: {
     readonly nodeOrigin: string;
+    /**
+     * Policy control routes are part of the recipient's TinyCloud Node.  This is
+     * deliberately a path, not a second origin: applications must not send a
+     * credential presentation to a separately discovered policy service.
+     */
+    readonly policyRuntimePath?: string;
     readonly policyCid: string;
     readonly recipientDid: string;
     readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
     readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
 }): Promise<PolicyChallengeV3>;
 declare function mintPolicySessionV3(input: {
     readonly nodeOrigin: string;
@@ -485,6 +535,7 @@ declare function mintPolicySessionV3(input: {
     readonly presentation: Readonly<Record<string, unknown>>;
     readonly challenge?: PolicyChallengeV3;
     readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
 }): Promise<PolicySessionUcanV1>;
 interface PolicyRootStatusV3 {
     readonly rootCid: string;
@@ -543,6 +594,12 @@ declare function projectUnifiedPolicyCapabilities(input: readonly unknown[]): Un
 declare function unifiedNativeProjectionHashHex(input: readonly unknown[]): string;
 declare function unifiedPolicyCapabilityFromNative(input: unknown): UnifiedPolicyCapability;
 declare function contentSourceDigestHex(input: UnifiedContentSource): string;
+/**
+ * Register a signed policy and its sibling roots with the embedded Node
+ * Policy/v3 runtime. This is intentionally application-neutral: callers
+ * supply policy material, while Node owns both transport endpoints.
+ */
+declare function registerPolicyV3(input: RegisterPolicyV3Input): Promise<RegisterPolicyV3Receipt>;
 declare function policyDigestHex(policy: Omit<UnifiedPolicyV1, "policyId" | "signature">): string;
 declare function policyIdForDigestHex(digestHex: string): string;
 declare function policyCidFromCanonicalBytes(bytes: Uint8Array): string;
@@ -682,6 +739,8 @@ declare const POLICY_V2_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
 declare const POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE: "TinyCloudPolicyCredentialRequirement";
 declare const POLICY_PRESENTATION_V3_SCHEMA: "xyz.tinycloud.policy/presentation/v3";
 declare const POLICY_PRESENTATION_V3_DOMAIN = "xyz.tinycloud.policy/Presentation/v3\0";
+declare const POLICY_PRESENTATION_V4_SCHEMA: "xyz.tinycloud.policy/presentation/v4";
+declare const POLICY_PRESENTATION_V4_DOMAIN = "xyz.tinycloud.policy/Presentation/v4\0";
 interface PolicyCredentialRequirementV1 {
     readonly type: typeof POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE;
     readonly version: 1;
@@ -736,6 +795,29 @@ interface PolicyCredentialPresentationV3 {
         readonly value: string;
     };
 }
+interface UnsignedPolicyCredentialPresentationV4 {
+    readonly schema: typeof POLICY_PRESENTATION_V4_SCHEMA;
+    readonly jti: string;
+    readonly challengeId: string;
+    readonly nonce: string;
+    readonly policyCid: string;
+    readonly nodeAudience: string;
+    readonly holderDid: string;
+    readonly subjectDid: string;
+    readonly credentialDigest: string;
+    readonly requirementDigest: string;
+    readonly descriptorDigest: string;
+    readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+interface PolicyCredentialPresentationV4 extends UnsignedPolicyCredentialPresentationV4 {
+    readonly signature: {
+        readonly suite: "Ed25519";
+        readonly signerDid: string;
+        readonly value: string;
+    };
+}
 declare function validatePolicyCredentialRequirementV1(value: unknown): PolicyCredentialRequirementV1;
 declare function policyV2DigestHex(input: UnsignedUnifiedPolicyV2): string;
 /**
@@ -744,6 +826,21 @@ declare function policyV2DigestHex(input: UnsignedUnifiedPolicyV2): string;
  * Node remains the authoritative signature verifier at admission.
  */
 declare function validateUnifiedPolicyV2(value: unknown, expectedPolicyCid?: string): UnifiedPolicyV2;
+declare function issuedCredentialEnvelopeFromVerified(verified: VerifiedCredential): IssuedCredentialEnvelope;
+/** Sign the exact accountless v4 wire value. No account custody fields exist. */
+declare function signPolicyCredentialPresentationV4(value: UnsignedPolicyCredentialPresentationV4, sign: (digest: Uint8Array) => Promise<Uint8Array>): Promise<PolicyCredentialPresentationV4>;
+interface BuildPolicyCredentialPresentationV4Input {
+    readonly policy: UnifiedPolicyV2;
+    readonly policyCid: string;
+    readonly challenge: PolicyChallengeV3;
+    readonly requirement: CredentialRequirement;
+    readonly credential: VerifiedCredential;
+    readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
+    readonly sign: (digest: Uint8Array) => Promise<Uint8Array>;
+    readonly now?: Date;
+    readonly jti?: string;
+}
+declare function buildPolicyCredentialPresentationV4(input: BuildPolicyCredentialPresentationV4Input): Promise<PolicyCredentialPresentationV4>;
 interface BuildPolicyCredentialPresentationV3Input {
     readonly policy: UnifiedPolicyV2;
     readonly policyCid: string;
@@ -761,11 +858,14 @@ interface AdmitPolicyCredentialV3Input extends Omit<BuildPolicyCredentialPresent
     readonly policyRootCid: string;
     readonly enforcementRootCid: string;
     readonly nodeOrigin: string;
+    /** Path to the embedded Node policy runtime. Defaults to `/policy/v3`. */
+    readonly policyRuntimePath?: string;
     /** Root authorization CID of the recipient's active TinyCloud account session. */
     readonly accountAuthorizationCid: string;
     /** Recipient-owned `credentials` space covered by the account authorization. */
     readonly credentialSpaceId: string;
     readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
 }
 interface PolicyCredentialAdmissionV3 {
     readonly challenge: PolicyChallengeV3;
@@ -777,5 +877,25 @@ interface PolicyCredentialAdmissionV3 {
  * Raw credential material appears only in the TLS POST body.
  */
 declare function admitPolicyCredentialV3(input: AdmitPolicyCredentialV3Input): Promise<PolicyCredentialAdmissionV3>;
+interface AdmitPolicyCredentialV4Input extends Omit<BuildPolicyCredentialPresentationV4Input, "challenge"> {
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+    readonly expectedNodeAudience: string;
+    readonly expectedEnforcerDid: string;
+    readonly nodeOrigin: string;
+    /** Path to the embedded Node policy runtime. Defaults to `/policy/v3`. */
+    readonly policyRuntimePath?: string;
+    readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
+}
+interface PolicyCredentialAdmissionV4 {
+    readonly challenge: PolicyChallengeV3;
+    readonly presentation: PolicyCredentialPresentationV4;
+    readonly session: PolicySessionUcanV1;
+    /** The ordinary delegation has been activated using Node's generic `/delegate`. */
+    readonly delegationImported: true;
+}
+/** Accountless admission. The request deliberately has no account custody fields. */
+declare function admitPolicyCredentialV4(input: AdmitPolicyCredentialV4Input): Promise<PolicyCredentialAdmissionV4>;
 
-export { type SignedObjectMaterial as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyStatus as D, ED25519_JCS_SIGNATURE_SUITE as E, ROOT_REVOCATION_V1_SCHEMA as F, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as G, ROOT_STATUS_RENEWAL_V1_DOMAIN as H, ROOT_STATUS_V1_DOMAIN as I, type JsonObject as J, type SignCompactUcanAuthorizationInput as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type SignCompactUcanRootAuthorizationInput as O, type PolicyEngineRecord as P, SignatureMaterialError as Q, ROOT_REVOCATION_V1_DOMAIN as R, type SignedObjectSigner as S, type SignatureSuite as T, type UnsignedPolicyEngineRecord as U, SignatureVerificationError as V, SignedObjectCanonicalizationError as W, SignedObjectDigestError as X, type SignedObjectErrorCode as Y, SignedObjectIdError as Z, type SignedObjectKind as _, type Policy as a, validatePolicyUnsigned as a$, SignedObjectProfileError as a0, SignedObjectSchemaError as a1, type SignedObjectSignature as a2, type SignedObjectVerificationResult as a3, type SignedPolicyObject as a4, SigningKeyBindingError as a5, type UnifiedContentSource as a6, type UnifiedEncryptionCapability as a7, type UnifiedKvCapability as a8, type UnifiedNativeCapability as a9, parsePolicySessionUcan as aA, policyCidFromCanonicalBytes as aB, policyDigestHex as aC, policyIdForDigestHex as aD, policyV2DigestHex as aE, projectUnifiedPolicyCapabilities as aF, projectUnifiedPolicyCapability as aG, renewPolicyRootStatusV3 as aH, requestPolicyChallengeV3 as aI, revokePolicyRootV3 as aJ, signCompactUcanAuthorization as aK, signCompactUcanRootAuthorization as aL, signedObjectIdFor as aM, toSignedObjectError as aN, unifiedNativeProjectionHashHex as aO, unifiedPolicyCapabilityContains as aP, unifiedPolicyCapabilityDigestHex as aQ, unifiedPolicyCapabilityFromNative as aR, validatePolicyCredentialRequirementV1 as aS, validatePolicyEngineRecordSigned as aT, validatePolicyEngineRecordSignedShape as aU, validatePolicyEngineRecordUnsigned as aV, validatePolicySigned as aW, validatePolicySignedShape as aX, validatePolicyStatusSigned as aY, validatePolicyStatusSignedShape as aZ, validatePolicyStatusUnsigned as a_, type UnifiedPolicyCapability as aa, type UnifiedPolicyV1 as ab, type UnifiedPolicyV2 as ac, type UnifiedResourceSelector as ad, type UnsignedPolicy as ae, type UnsignedPolicyObject as af, type UnsignedPolicyStatus as ag, type UnsignedUnifiedPolicyV2 as ah, UnsupportedSignatureSuiteError as ai, admitPolicyCredentialV3 as aj, buildPolicyCredentialPresentationV3 as ak, canonicalizeSignedObjectUnsigned as al, canonicalizeUnifiedPolicyCapability as am, compactAttenuationContains as an, contentSourceDigestHex as ao, createAndSignPolicy as ap, createAndSignPolicyEngineRecord as aq, createAndSignPolicyStatus as ar, createAndSignSignedObject as as, createCompactPolicyDescendant as at, createCompactPolicyInvocation as au, deriveSignedObjectMaterial as av, getPolicyRootStatusV3 as aw, mintPolicySessionV3 as ax, normalizeUnifiedPolicyCapability as ay, parseCompactUcanAuthorization as az, type AdmitPolicyCredentialV3Input as b, validateUnifiedPolicyV2 as b0, verifyPolicy as b1, verifyPolicyEngineRecord as b2, verifyPolicyRootRevocationV3 as b3, verifyPolicyRootStatusCheckpointV3 as b4, verifyPolicyStatus as b5, verifySignedObject as b6, type CredentialHolderBinding as b7, type CredentialFlowDescriptor as b8, type CredentialRequirement as b9, type StoredCredentialRecord as ba, type VerifiedCredential as bb, type CredentialStorageReceipt as bc, type IssuedCredentialEnvelope as bd, type CredentialIssuerMetadata as be, CREDENTIAL_ACQUISITION_PROTOCOL as bf, CREDENTIAL_CONTRACT_VERSION as bg, CREDENTIAL_FORMAT as bh, CREDENTIAL_STEP_REGISTRY_VERSION as bi, type CredentialClaimDescriptor as bj, type CredentialEndpointId as bk, type CredentialInputDescriptor as bl, type CredentialProgressEvent as bm, type CredentialStepDescriptor as bn, type CredentialStepType as bo, type CredentialUxState as bp, HOLDER_BINDING_DOMAIN as bq, type IssuerVerificationKey as br, type CompactPolicyInvocationInput as c, type CompactUcanAuthorizationV1 as d, EIP191_JCS_SIGNATURE_SUITE as e, LAST_V2_READ_AT as f, POLICY_CAPABILITY_V1_DOMAIN as g, POLICY_CAPABILITY_V1_SCHEMA as h, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as i, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as j, POLICY_ENGINE_RECORD_SCHEMA as k, POLICY_PRESENTATION_V3_DOMAIN as l, POLICY_PRESENTATION_V3_SCHEMA as m, POLICY_SCHEMA as n, POLICY_SESSION_UCAN_V1_PROFILE as o, POLICY_STATUS_SCHEMA as p, POLICY_V1_DOMAIN as q, POLICY_V1_SCHEMA as r, POLICY_V2_DOMAIN as s, POLICY_V2_SCHEMA as t, type PolicyChallengeV3 as u, type PolicyCredentialAdmissionV3 as v, type PolicyCredentialPresentationV3 as w, type PolicyCredentialRequirementV1 as x, type PolicyRootStatusV3 as y, type PolicySessionUcanV1 as z };
+export { type RegisterPolicyV3Receipt as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyCredentialAdmissionV3 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialAdmissionV4 as F, type PolicyCredentialPresentationV3 as G, type PolicyCredentialPresentationV4 as H, type PolicyCredentialRequirementV1 as I, type JsonObject as J, type PolicyRootStatusV3 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicyRootV3 as O, type PolicyEngineRecord as P, type PolicySessionUcanFactV1 as Q, type PolicySessionUcanV1 as R, type SignedObjectSigner as S, type PolicyStatus as T, type UnsignedPolicyEngineRecord as U, ROOT_REVOCATION_V1_DOMAIN as V, ROOT_REVOCATION_V1_SCHEMA as W, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as X, ROOT_STATUS_RENEWAL_V1_DOMAIN as Y, ROOT_STATUS_V1_DOMAIN as Z, type RegisterPolicyV3Input as _, type Policy as a, signCompactUcanRootAuthorization as a$, type SignCompactUcanAuthorizationInput as a0, type SignCompactUcanRootAuthorizationInput as a1, SignatureMaterialError as a2, type SignatureSuite as a3, SignatureVerificationError as a4, SignedObjectCanonicalizationError as a5, SignedObjectDigestError as a6, type SignedObjectErrorCode as a7, SignedObjectIdError as a8, type SignedObjectKind as a9, canonicalizeUnifiedPolicyCapability as aA, compactAttenuationContains as aB, contentSourceDigestHex as aC, createAndSignPolicy as aD, createAndSignPolicyEngineRecord as aE, createAndSignPolicyStatus as aF, createAndSignSignedObject as aG, createCompactPolicyDescendant as aH, createCompactPolicyInvocation as aI, deriveSignedObjectMaterial as aJ, getPolicyRootStatusV3 as aK, issuedCredentialEnvelopeFromVerified as aL, mintPolicySessionV3 as aM, normalizeUnifiedPolicyCapability as aN, parseCompactUcanAuthorization as aO, parsePolicySessionUcan as aP, policyCidFromCanonicalBytes as aQ, policyDigestHex as aR, policyIdForDigestHex as aS, policyV2DigestHex as aT, projectUnifiedPolicyCapabilities as aU, projectUnifiedPolicyCapability as aV, registerPolicyV3 as aW, renewPolicyRootStatusV3 as aX, requestPolicyChallengeV3 as aY, revokePolicyRootV3 as aZ, signCompactUcanAuthorization as a_, type SignedObjectMaterial as aa, SignedObjectProfileError as ab, SignedObjectSchemaError as ac, type SignedObjectSignature as ad, type SignedObjectVerificationResult as ae, type SignedPolicyObject as af, SigningKeyBindingError as ag, type UnifiedContentSource as ah, type UnifiedEncryptionCapability as ai, type UnifiedKvCapability as aj, type UnifiedNativeCapability as ak, type UnifiedPolicyCapability as al, type UnifiedPolicyV1 as am, type UnifiedPolicyV2 as an, type UnifiedResourceSelector as ao, type UnsignedPolicy as ap, type UnsignedPolicyCredentialPresentationV4 as aq, type UnsignedPolicyObject as ar, type UnsignedPolicyStatus as as, type UnsignedUnifiedPolicyV2 as at, UnsupportedSignatureSuiteError as au, admitPolicyCredentialV3 as av, admitPolicyCredentialV4 as aw, buildPolicyCredentialPresentationV3 as ax, buildPolicyCredentialPresentationV4 as ay, canonicalizeSignedObjectUnsigned as az, type AdmitPolicyCredentialV3Input as b, signPolicyCredentialPresentationV4 as b0, signedObjectIdFor as b1, toSignedObjectError as b2, unifiedNativeProjectionHashHex as b3, unifiedPolicyCapabilityContains as b4, unifiedPolicyCapabilityDigestHex as b5, unifiedPolicyCapabilityFromNative as b6, validatePolicyCredentialRequirementV1 as b7, validatePolicyEngineRecordSigned as b8, validatePolicyEngineRecordSignedShape as b9, type CredentialClaimDescriptor as bA, type CredentialEndpointId as bB, type CredentialInputDescriptor as bC, type CredentialProgressEvent as bD, type CredentialStepDescriptor as bE, type CredentialStepType as bF, type CredentialUxState as bG, HOLDER_BINDING_DOMAIN as bH, type IssuerVerificationKey as bI, validatePolicyEngineRecordUnsigned as ba, validatePolicySigned as bb, validatePolicySignedShape as bc, validatePolicyStatusSigned as bd, validatePolicyStatusSignedShape as be, validatePolicyStatusUnsigned as bf, validatePolicyUnsigned as bg, validateUnifiedPolicyV2 as bh, verifyPolicy as bi, verifyPolicyEngineRecord as bj, verifyPolicyRootRevocationV3 as bk, verifyPolicyRootStatusCheckpointV3 as bl, verifyPolicyStatus as bm, verifySignedObject as bn, type CredentialHolderBinding as bo, type CredentialFlowDescriptor as bp, type CredentialRequirement as bq, type StoredCredentialRecord as br, type VerifiedCredential as bs, type CredentialStorageReceipt as bt, type IssuedCredentialEnvelope as bu, type CredentialIssuerMetadata as bv, CREDENTIAL_ACQUISITION_PROTOCOL as bw, CREDENTIAL_CONTRACT_VERSION as bx, CREDENTIAL_FORMAT as by, CREDENTIAL_STEP_REGISTRY_VERSION as bz, type AdmitPolicyCredentialV4Input as c, type AttestedEnforcerBindingV2 as d, type BuildPolicyCredentialPresentationV4Input as e, type CompactPolicyInvocationInput as f, type CompactUcanAuthorizationV1 as g, EIP191_JCS_SIGNATURE_SUITE as h, LAST_V2_READ_AT as i, POLICY_CAPABILITY_V1_DOMAIN as j, POLICY_CAPABILITY_V1_SCHEMA as k, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as l, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as m, POLICY_ENGINE_RECORD_SCHEMA as n, POLICY_PRESENTATION_V3_DOMAIN as o, POLICY_PRESENTATION_V3_SCHEMA as p, POLICY_PRESENTATION_V4_DOMAIN as q, POLICY_PRESENTATION_V4_SCHEMA as r, POLICY_SCHEMA as s, POLICY_SESSION_UCAN_V1_PROFILE as t, POLICY_STATUS_SCHEMA as u, POLICY_V1_DOMAIN as v, POLICY_V1_SCHEMA as w, POLICY_V2_DOMAIN as x, POLICY_V2_SCHEMA as y, type PolicyChallengeV3 as z };