@tinycloud/sdk-core 3.0.0-beta.1 → 3.0.0-beta.2

package/dist/policy/index.d.cts

@@ -1,5 +1,5 @@
-import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-C_cO1QqB.cjs';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, B as BuildPolicyCredentialPresentationV3Input, C as CONTENT_SOURCE_V1_DOMAIN, c as CompactPolicyInvocationInput, d as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, e as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, f as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, g as POLICY_CAPABILITY_V1_DOMAIN, h as POLICY_CAPABILITY_V1_SCHEMA, i as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, j as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, k as POLICY_ENGINE_RECORD_SCHEMA, l as POLICY_PRESENTATION_V3_DOMAIN, m as POLICY_PRESENTATION_V3_SCHEMA, n as POLICY_SCHEMA, o as POLICY_SESSION_UCAN_V1_PROFILE, p as POLICY_STATUS_SCHEMA, q as POLICY_V1_DOMAIN, r as POLICY_V1_SCHEMA, s as POLICY_V2_DOMAIN, t as POLICY_V2_SCHEMA, u as PolicyChallengeV3, v as PolicyCredentialAdmissionV3, w as PolicyCredentialPresentationV3, x as PolicyCredentialRequirementV1, y as PolicyRootStatusV3, z as PolicySessionUcanV1, D as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, F as ROOT_REVOCATION_V1_SCHEMA, G as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, H as ROOT_STATUS_RENEWAL_V1_DOMAIN, I as ROOT_STATUS_V1_DOMAIN, K as SignCompactUcanAuthorizationInput, O as SignCompactUcanRootAuthorizationInput, Q as SignatureMaterialError, T as SignatureSuite, V as SignatureVerificationError, W as SignedObjectCanonicalizationError, X as SignedObjectDigestError, Y as SignedObjectErrorCode, Z as SignedObjectIdError, _ as SignedObjectKind, $ as SignedObjectMaterial, a0 as SignedObjectProfileError, a1 as SignedObjectSchemaError, a2 as SignedObjectSignature, a3 as SignedObjectVerificationResult, a4 as SignedPolicyObject, a5 as SigningKeyBindingError, a6 as UnifiedContentSource, a7 as UnifiedEncryptionCapability, a8 as UnifiedKvCapability, a9 as UnifiedNativeCapability, aa as UnifiedPolicyCapability, ab as UnifiedPolicyV1, ac as UnifiedPolicyV2, ad as UnifiedResourceSelector, ae as UnsignedPolicy, af as UnsignedPolicyObject, ag as UnsignedPolicyStatus, ah as UnsignedUnifiedPolicyV2, ai as UnsupportedSignatureSuiteError, aj as admitPolicyCredentialV3, ak as buildPolicyCredentialPresentationV3, al as canonicalizeSignedObjectUnsigned, am as canonicalizeUnifiedPolicyCapability, an as compactAttenuationContains, ao as contentSourceDigestHex, ap as createAndSignPolicy, aq as createAndSignPolicyEngineRecord, ar as createAndSignPolicyStatus, as as createAndSignSignedObject, at as createCompactPolicyDescendant, au as createCompactPolicyInvocation, av as deriveSignedObjectMaterial, aw as getPolicyRootStatusV3, ax as mintPolicySessionV3, ay as normalizeUnifiedPolicyCapability, az as parseCompactUcanAuthorization, aA as parsePolicySessionUcan, aB as policyCidFromCanonicalBytes, aC as policyDigestHex, aD as policyIdForDigestHex, aE as policyV2DigestHex, aF as projectUnifiedPolicyCapabilities, aG as projectUnifiedPolicyCapability, aH as renewPolicyRootStatusV3, aI as requestPolicyChallengeV3, aJ as revokePolicyRootV3, aK as signCompactUcanAuthorization, aL as signCompactUcanRootAuthorization, aM as signedObjectIdFor, aN as toSignedObjectError, aO as unifiedNativeProjectionHashHex, aP as unifiedPolicyCapabilityContains, aQ as unifiedPolicyCapabilityDigestHex, aR as unifiedPolicyCapabilityFromNative, aS as validatePolicyCredentialRequirementV1, aT as validatePolicyEngineRecordSigned, aU as validatePolicyEngineRecordSignedShape, aV as validatePolicyEngineRecordUnsigned, aW as validatePolicySigned, aX as validatePolicySignedShape, aY as validatePolicyStatusSigned, aZ as validatePolicyStatusSignedShape, a_ as validatePolicyStatusUnsigned, a$ as validatePolicyUnsigned, b0 as validateUnifiedPolicyV2, b1 as verifyPolicy, b2 as verifyPolicyEngineRecord, b3 as verifyPolicyRootRevocationV3, b4 as verifyPolicyRootStatusCheckpointV3, b5 as verifyPolicyStatus, b6 as verifySignedObject } from '../credential-admission-C_cO1QqB.cjs';
+import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-BVUC6kdw.cjs';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, B as BuildPolicyCredentialPresentationV3Input, d as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, e as CompactPolicyInvocationInput, f as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, g as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, h as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, i as POLICY_CAPABILITY_V1_DOMAIN, j as POLICY_CAPABILITY_V1_SCHEMA, k as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, l as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, m as POLICY_ENGINE_RECORD_SCHEMA, n as POLICY_PRESENTATION_V3_DOMAIN, o as POLICY_PRESENTATION_V3_SCHEMA, p as POLICY_PRESENTATION_V4_DOMAIN, q as POLICY_PRESENTATION_V4_SCHEMA, r as POLICY_SCHEMA, s as POLICY_SESSION_UCAN_V1_PROFILE, t as POLICY_STATUS_SCHEMA, u as POLICY_V1_DOMAIN, v as POLICY_V1_SCHEMA, w as POLICY_V2_DOMAIN, x as POLICY_V2_SCHEMA, y as PolicyChallengeV3, z as PolicyCredentialAdmissionV3, D as PolicyCredentialAdmissionV4, F as PolicyCredentialPresentationV3, G as PolicyCredentialPresentationV4, H as PolicyCredentialRequirementV1, I as PolicyRootStatusV3, K as PolicySessionUcanFactV1, O as PolicySessionUcanV1, Q as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, T as ROOT_REVOCATION_V1_SCHEMA, V as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, W as ROOT_STATUS_RENEWAL_V1_DOMAIN, X as ROOT_STATUS_V1_DOMAIN, Y as SignCompactUcanAuthorizationInput, Z as SignCompactUcanRootAuthorizationInput, _ as SignatureMaterialError, $ as SignatureSuite, a0 as SignatureVerificationError, a1 as SignedObjectCanonicalizationError, a2 as SignedObjectDigestError, a3 as SignedObjectErrorCode, a4 as SignedObjectIdError, a5 as SignedObjectKind, a6 as SignedObjectMaterial, a7 as SignedObjectProfileError, a8 as SignedObjectSchemaError, a9 as SignedObjectSignature, aa as SignedObjectVerificationResult, ab as SignedPolicyObject, ac as SigningKeyBindingError, ad as UnifiedContentSource, ae as UnifiedEncryptionCapability, af as UnifiedKvCapability, ag as UnifiedNativeCapability, ah as UnifiedPolicyCapability, ai as UnifiedPolicyV1, aj as UnifiedPolicyV2, ak as UnifiedResourceSelector, al as UnsignedPolicy, am as UnsignedPolicyCredentialPresentationV4, an as UnsignedPolicyObject, ao as UnsignedPolicyStatus, ap as UnsignedUnifiedPolicyV2, aq as UnsupportedSignatureSuiteError, ar as admitPolicyCredentialV3, as as admitPolicyCredentialV4, at as buildPolicyCredentialPresentationV3, au as buildPolicyCredentialPresentationV4, av as canonicalizeSignedObjectUnsigned, aw as canonicalizeUnifiedPolicyCapability, ax as compactAttenuationContains, ay as contentSourceDigestHex, az as createAndSignPolicy, aA as createAndSignPolicyEngineRecord, aB as createAndSignPolicyStatus, aC as createAndSignSignedObject, aD as createCompactPolicyDescendant, aE as createCompactPolicyInvocation, aF as deriveSignedObjectMaterial, aG as getPolicyRootStatusV3, aH as issuedCredentialEnvelopeFromVerified, aI as mintPolicySessionV3, aJ as normalizeUnifiedPolicyCapability, aK as parseCompactUcanAuthorization, aL as parsePolicySessionUcan, aM as policyCidFromCanonicalBytes, aN as policyDigestHex, aO as policyIdForDigestHex, aP as policyV2DigestHex, aQ as projectUnifiedPolicyCapabilities, aR as projectUnifiedPolicyCapability, aS as renewPolicyRootStatusV3, aT as requestPolicyChallengeV3, aU as revokePolicyRootV3, aV as signCompactUcanAuthorization, aW as signCompactUcanRootAuthorization, aX as signPolicyCredentialPresentationV4, aY as signedObjectIdFor, aZ as toSignedObjectError, a_ as unifiedNativeProjectionHashHex, a$ as unifiedPolicyCapabilityContains, b0 as unifiedPolicyCapabilityDigestHex, b1 as unifiedPolicyCapabilityFromNative, b2 as validatePolicyCredentialRequirementV1, b3 as validatePolicyEngineRecordSigned, b4 as validatePolicyEngineRecordSignedShape, b5 as validatePolicyEngineRecordUnsigned, b6 as validatePolicySigned, b7 as validatePolicySignedShape, b8 as validatePolicyStatusSigned, b9 as validatePolicyStatusSignedShape, ba as validatePolicyStatusUnsigned, bb as validatePolicyUnsigned, bc as validateUnifiedPolicyV2, bd as verifyPolicy, be as verifyPolicyEngineRecord, bf as verifyPolicyRootRevocationV3, bg as verifyPolicyRootStatusCheckpointV3, bh as verifyPolicyStatus, bi as verifySignedObject } from '../credential-admission-BVUC6kdw.cjs';
 import { J as JsonObject, P as PolicyCapabilityError } from '../capability-BjzXwtNw.cjs';
 export { a as JsonValue, b as PolicyCapability, c as PolicyCapabilityErrorCode, d as canonicalizePolicyCapability, j as jcsCanonicalize, n as normalizeJson, e as normalizePolicyCapability, p as policyCapabilityContains, f as policyCapabilityDigestHex, s as serializeJcsJson } from '../capability-BjzXwtNw.cjs';
 import 'zod';

package/dist/policy/index.d.ts

@@ -1,5 +1,5 @@
-import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-cvHe-HUC.js';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, B as BuildPolicyCredentialPresentationV3Input, C as CONTENT_SOURCE_V1_DOMAIN, c as CompactPolicyInvocationInput, d as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, e as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, f as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, g as POLICY_CAPABILITY_V1_DOMAIN, h as POLICY_CAPABILITY_V1_SCHEMA, i as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, j as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, k as POLICY_ENGINE_RECORD_SCHEMA, l as POLICY_PRESENTATION_V3_DOMAIN, m as POLICY_PRESENTATION_V3_SCHEMA, n as POLICY_SCHEMA, o as POLICY_SESSION_UCAN_V1_PROFILE, p as POLICY_STATUS_SCHEMA, q as POLICY_V1_DOMAIN, r as POLICY_V1_SCHEMA, s as POLICY_V2_DOMAIN, t as POLICY_V2_SCHEMA, u as PolicyChallengeV3, v as PolicyCredentialAdmissionV3, w as PolicyCredentialPresentationV3, x as PolicyCredentialRequirementV1, y as PolicyRootStatusV3, z as PolicySessionUcanV1, D as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, F as ROOT_REVOCATION_V1_SCHEMA, G as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, H as ROOT_STATUS_RENEWAL_V1_DOMAIN, I as ROOT_STATUS_V1_DOMAIN, K as SignCompactUcanAuthorizationInput, O as SignCompactUcanRootAuthorizationInput, Q as SignatureMaterialError, T as SignatureSuite, V as SignatureVerificationError, W as SignedObjectCanonicalizationError, X as SignedObjectDigestError, Y as SignedObjectErrorCode, Z as SignedObjectIdError, _ as SignedObjectKind, $ as SignedObjectMaterial, a0 as SignedObjectProfileError, a1 as SignedObjectSchemaError, a2 as SignedObjectSignature, a3 as SignedObjectVerificationResult, a4 as SignedPolicyObject, a5 as SigningKeyBindingError, a6 as UnifiedContentSource, a7 as UnifiedEncryptionCapability, a8 as UnifiedKvCapability, a9 as UnifiedNativeCapability, aa as UnifiedPolicyCapability, ab as UnifiedPolicyV1, ac as UnifiedPolicyV2, ad as UnifiedResourceSelector, ae as UnsignedPolicy, af as UnsignedPolicyObject, ag as UnsignedPolicyStatus, ah as UnsignedUnifiedPolicyV2, ai as UnsupportedSignatureSuiteError, aj as admitPolicyCredentialV3, ak as buildPolicyCredentialPresentationV3, al as canonicalizeSignedObjectUnsigned, am as canonicalizeUnifiedPolicyCapability, an as compactAttenuationContains, ao as contentSourceDigestHex, ap as createAndSignPolicy, aq as createAndSignPolicyEngineRecord, ar as createAndSignPolicyStatus, as as createAndSignSignedObject, at as createCompactPolicyDescendant, au as createCompactPolicyInvocation, av as deriveSignedObjectMaterial, aw as getPolicyRootStatusV3, ax as mintPolicySessionV3, ay as normalizeUnifiedPolicyCapability, az as parseCompactUcanAuthorization, aA as parsePolicySessionUcan, aB as policyCidFromCanonicalBytes, aC as policyDigestHex, aD as policyIdForDigestHex, aE as policyV2DigestHex, aF as projectUnifiedPolicyCapabilities, aG as projectUnifiedPolicyCapability, aH as renewPolicyRootStatusV3, aI as requestPolicyChallengeV3, aJ as revokePolicyRootV3, aK as signCompactUcanAuthorization, aL as signCompactUcanRootAuthorization, aM as signedObjectIdFor, aN as toSignedObjectError, aO as unifiedNativeProjectionHashHex, aP as unifiedPolicyCapabilityContains, aQ as unifiedPolicyCapabilityDigestHex, aR as unifiedPolicyCapabilityFromNative, aS as validatePolicyCredentialRequirementV1, aT as validatePolicyEngineRecordSigned, aU as validatePolicyEngineRecordSignedShape, aV as validatePolicyEngineRecordUnsigned, aW as validatePolicySigned, aX as validatePolicySignedShape, aY as validatePolicyStatusSigned, aZ as validatePolicyStatusSignedShape, a_ as validatePolicyStatusUnsigned, a$ as validatePolicyUnsigned, b0 as validateUnifiedPolicyV2, b1 as verifyPolicy, b2 as verifyPolicyEngineRecord, b3 as verifyPolicyRootRevocationV3, b4 as verifyPolicyRootStatusCheckpointV3, b5 as verifyPolicyStatus, b6 as verifySignedObject } from '../credential-admission-cvHe-HUC.js';
+import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-BgvwOTIV.js';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, B as BuildPolicyCredentialPresentationV3Input, d as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, e as CompactPolicyInvocationInput, f as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, g as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, h as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, i as POLICY_CAPABILITY_V1_DOMAIN, j as POLICY_CAPABILITY_V1_SCHEMA, k as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, l as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, m as POLICY_ENGINE_RECORD_SCHEMA, n as POLICY_PRESENTATION_V3_DOMAIN, o as POLICY_PRESENTATION_V3_SCHEMA, p as POLICY_PRESENTATION_V4_DOMAIN, q as POLICY_PRESENTATION_V4_SCHEMA, r as POLICY_SCHEMA, s as POLICY_SESSION_UCAN_V1_PROFILE, t as POLICY_STATUS_SCHEMA, u as POLICY_V1_DOMAIN, v as POLICY_V1_SCHEMA, w as POLICY_V2_DOMAIN, x as POLICY_V2_SCHEMA, y as PolicyChallengeV3, z as PolicyCredentialAdmissionV3, D as PolicyCredentialAdmissionV4, F as PolicyCredentialPresentationV3, G as PolicyCredentialPresentationV4, H as PolicyCredentialRequirementV1, I as PolicyRootStatusV3, K as PolicySessionUcanFactV1, O as PolicySessionUcanV1, Q as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, T as ROOT_REVOCATION_V1_SCHEMA, V as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, W as ROOT_STATUS_RENEWAL_V1_DOMAIN, X as ROOT_STATUS_V1_DOMAIN, Y as SignCompactUcanAuthorizationInput, Z as SignCompactUcanRootAuthorizationInput, _ as SignatureMaterialError, $ as SignatureSuite, a0 as SignatureVerificationError, a1 as SignedObjectCanonicalizationError, a2 as SignedObjectDigestError, a3 as SignedObjectErrorCode, a4 as SignedObjectIdError, a5 as SignedObjectKind, a6 as SignedObjectMaterial, a7 as SignedObjectProfileError, a8 as SignedObjectSchemaError, a9 as SignedObjectSignature, aa as SignedObjectVerificationResult, ab as SignedPolicyObject, ac as SigningKeyBindingError, ad as UnifiedContentSource, ae as UnifiedEncryptionCapability, af as UnifiedKvCapability, ag as UnifiedNativeCapability, ah as UnifiedPolicyCapability, ai as UnifiedPolicyV1, aj as UnifiedPolicyV2, ak as UnifiedResourceSelector, al as UnsignedPolicy, am as UnsignedPolicyCredentialPresentationV4, an as UnsignedPolicyObject, ao as UnsignedPolicyStatus, ap as UnsignedUnifiedPolicyV2, aq as UnsupportedSignatureSuiteError, ar as admitPolicyCredentialV3, as as admitPolicyCredentialV4, at as buildPolicyCredentialPresentationV3, au as buildPolicyCredentialPresentationV4, av as canonicalizeSignedObjectUnsigned, aw as canonicalizeUnifiedPolicyCapability, ax as compactAttenuationContains, ay as contentSourceDigestHex, az as createAndSignPolicy, aA as createAndSignPolicyEngineRecord, aB as createAndSignPolicyStatus, aC as createAndSignSignedObject, aD as createCompactPolicyDescendant, aE as createCompactPolicyInvocation, aF as deriveSignedObjectMaterial, aG as getPolicyRootStatusV3, aH as issuedCredentialEnvelopeFromVerified, aI as mintPolicySessionV3, aJ as normalizeUnifiedPolicyCapability, aK as parseCompactUcanAuthorization, aL as parsePolicySessionUcan, aM as policyCidFromCanonicalBytes, aN as policyDigestHex, aO as policyIdForDigestHex, aP as policyV2DigestHex, aQ as projectUnifiedPolicyCapabilities, aR as projectUnifiedPolicyCapability, aS as renewPolicyRootStatusV3, aT as requestPolicyChallengeV3, aU as revokePolicyRootV3, aV as signCompactUcanAuthorization, aW as signCompactUcanRootAuthorization, aX as signPolicyCredentialPresentationV4, aY as signedObjectIdFor, aZ as toSignedObjectError, a_ as unifiedNativeProjectionHashHex, a$ as unifiedPolicyCapabilityContains, b0 as unifiedPolicyCapabilityDigestHex, b1 as unifiedPolicyCapabilityFromNative, b2 as validatePolicyCredentialRequirementV1, b3 as validatePolicyEngineRecordSigned, b4 as validatePolicyEngineRecordSignedShape, b5 as validatePolicyEngineRecordUnsigned, b6 as validatePolicySigned, b7 as validatePolicySignedShape, b8 as validatePolicyStatusSigned, b9 as validatePolicyStatusSignedShape, ba as validatePolicyStatusUnsigned, bb as validatePolicyUnsigned, bc as validateUnifiedPolicyV2, bd as verifyPolicy, be as verifyPolicyEngineRecord, bf as verifyPolicyRootRevocationV3, bg as verifyPolicyRootStatusCheckpointV3, bh as verifyPolicyStatus, bi as verifySignedObject } from '../credential-admission-BgvwOTIV.js';
 import { J as JsonObject, P as PolicyCapabilityError } from '../capability-BjzXwtNw.js';
 export { a as JsonValue, b as PolicyCapability, c as PolicyCapabilityErrorCode, d as canonicalizePolicyCapability, j as jcsCanonicalize, n as normalizeJson, e as normalizePolicyCapability, p as policyCapabilityContains, f as policyCapabilityDigestHex, s as serializeJcsJson } from '../capability-BjzXwtNw.js';
 import 'zod';

package/dist/policy/index.js

@@ -3213,6 +3213,7 @@ async function requestPolicyChallengeV3(input) {
   const response = await fetchFn(new URL("/share/v3/policy/challenges", input.nodeOrigin), {
     method: "POST",
     redirect: "error",
+    signal: input.signal,
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ policyCid: input.policyCid, recipientDid: input.recipientDid, requestedCapabilities: input.requestedCapabilities.map(normalizeUnifiedPolicyCapability) })
   });
@@ -3230,6 +3231,7 @@ async function mintPolicySessionV3(input) {
   const response = await fetchFn(new URL("/share/v3/policy/delegations", input.nodeOrigin), {
     method: "POST",
     redirect: "error",
+    signal: input.signal,
     headers: { accept: "application/json", "content-type": "application/json" },
     body: JSON.stringify({ policyCid: input.policyCid, challengeId: challenge.challengeId, nonce: challenge.nonce, claim: input.claim, presentation: input.presentation })
   });
@@ -3403,6 +3405,11 @@ var POLICY_SESSION_FACT_KEYS = [
   "issuanceAuditDigestHex",
   "remainingRedelegationDepth"
 ];
+var POLICY_SESSION_V4_AUDIT_FACT_KEYS = [
+  "credentialIdAuditDigestHex",
+  "presentationJtiAuditDigestHex"
+];
+var LOWER_SHA256_HEX = /^[0-9a-f]{64}$/;
 var KV_ACTIONS = /* @__PURE__ */ new Set([
   "tinycloud.kv/get",
   "tinycloud.kv/list",
@@ -3795,9 +3802,13 @@ function parsePolicySessionUcan(authorization, expectedProofs) {
   if (expectedProofs !== void 0 && (parsed.payload.prf[0] !== expectedProofs[0] || parsed.payload.prf[1] !== expectedProofs[1]))
     throw new Error("policy session UCAN ordered proofs do not match");
   const factKeys = Object.keys(fact);
-  if (factKeys.length !== POLICY_SESSION_FACT_KEYS.length || factKeys.some((key) => !POLICY_SESSION_FACT_KEYS.includes(key)) || POLICY_SESSION_FACT_KEYS.some((key) => !(key in fact)))
+  const hasLegacyFactShape = factKeys.length === POLICY_SESSION_FACT_KEYS.length && factKeys.every((key) => POLICY_SESSION_FACT_KEYS.includes(key)) && POLICY_SESSION_FACT_KEYS.every((key) => key in fact);
+  const hasV4AuditFactShape = factKeys.length === POLICY_SESSION_FACT_KEYS.length + POLICY_SESSION_V4_AUDIT_FACT_KEYS.length && factKeys.every((key) => POLICY_SESSION_FACT_KEYS.includes(key) || POLICY_SESSION_V4_AUDIT_FACT_KEYS.includes(key)) && POLICY_SESSION_FACT_KEYS.every((key) => key in fact) && POLICY_SESSION_V4_AUDIT_FACT_KEYS.every((key) => key in fact);
+  if (!hasLegacyFactShape && !hasV4AuditFactShape)
     throw new Error("policy session UCAN fact is incomplete");
-  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.enforcerDid || parsed.payload.aud !== fact.recipientDid)
+  if (hasV4AuditFactShape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)))
+    throw new Error("policy session UCAN v4 audit facts are invalid");
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
     throw new Error("policy session UCAN fact is invalid");
   return {
     authorization,
@@ -3925,6 +3936,8 @@ var POLICY_V2_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
 var POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE = "TinyCloudPolicyCredentialRequirement";
 var POLICY_PRESENTATION_V3_SCHEMA = "xyz.tinycloud.policy/presentation/v3";
 var POLICY_PRESENTATION_V3_DOMAIN = "xyz.tinycloud.policy/Presentation/v3\0";
+var POLICY_PRESENTATION_V4_SCHEMA = "xyz.tinycloud.policy/presentation/v4";
+var POLICY_PRESENTATION_V4_DOMAIN = "xyz.tinycloud.policy/Presentation/v4\0";
 function record(value, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     throw new Error(`${label} must be an object`);
@@ -4099,6 +4112,97 @@ function envelopeFromVerified(verified) {
   } = verified;
   return envelope;
 }
+function issuedCredentialEnvelopeFromVerified(verified) {
+  return envelopeFromVerified(verified);
+}
+async function signPolicyCredentialPresentationV4(value, sign) {
+  const item = record(value, "Policy presentation v4");
+  exactKeys2(item, [
+    "schema",
+    "jti",
+    "challengeId",
+    "nonce",
+    "policyCid",
+    "nodeAudience",
+    "holderDid",
+    "subjectDid",
+    "credentialDigest",
+    "requirementDigest",
+    "descriptorDigest",
+    "requestedCapabilities",
+    "issuedAt",
+    "expiresAt"
+  ], "Policy presentation v4");
+  if (item.schema !== POLICY_PRESENTATION_V4_SCHEMA || item.holderDid !== item.subjectDid || !Array.isArray(item.requestedCapabilities)) throw new Error("Policy presentation v4 is invalid");
+  const holderDid = nonEmpty(item.holderDid, "Policy presentation v4 holder DID");
+  didKeyBytes(holderDid);
+  const unsigned = Object.freeze({
+    schema: POLICY_PRESENTATION_V4_SCHEMA,
+    jti: nonEmpty(item.jti, "Policy presentation v4 jti"),
+    challengeId: nonEmpty(item.challengeId, "Policy presentation v4 challenge"),
+    nonce: nonEmpty(item.nonce, "Policy presentation v4 nonce"),
+    policyCid: nonEmpty(item.policyCid, "Policy presentation v4 policy CID"),
+    nodeAudience: nonEmpty(item.nodeAudience, "Policy presentation v4 audience"),
+    holderDid,
+    subjectDid: holderDid,
+    credentialDigest: nonEmpty(item.credentialDigest, "Policy presentation v4 credential digest"),
+    requirementDigest: nonEmpty(item.requirementDigest, "Policy presentation v4 requirement digest"),
+    descriptorDigest: nonEmpty(item.descriptorDigest, "Policy presentation v4 descriptor digest"),
+    // The low-level signer preserves the frozen wire bytes exactly. The
+    // policy-aware builder performs capability normalization and containment.
+    requestedCapabilities: Object.freeze(item.requestedCapabilities),
+    issuedAt: date(item.issuedAt, "Policy presentation v4 issuedAt"),
+    expiresAt: date(item.expiresAt, "Policy presentation v4 expiresAt")
+  });
+  const digest2 = sha2565(new TextEncoder().encode(
+    POLICY_PRESENTATION_V4_DOMAIN + jcsCanonicalize(unsigned)
+  ));
+  const signature = await sign(digest2);
+  if (signature.length !== 64 || !ed255193.verify(signature, digest2, didKeyBytes(holderDid))) throw new Error("policy presentation signature is invalid");
+  return Object.freeze({
+    ...unsigned,
+    signature: Object.freeze({
+      suite: "Ed25519",
+      signerDid: holderDid,
+      value: encodeBase64Url2(signature)
+    })
+  });
+}
+async function buildPolicyCredentialPresentationV4(input) {
+  const policy = validateUnifiedPolicyV2(input.policy, input.policyCid);
+  const requirement = validateCredentialRequirement(input.requirement);
+  const commitment = policy.credentialRequirement;
+  const requirementDigest = await credentialRequirementDigest(requirement);
+  const credentialDigest = await sha256Base64Url(input.credential.credential);
+  if (requirementDigest !== commitment.requirementDigest || input.credential.descriptorDigest !== commitment.descriptorDigest || input.credential.credentialDigest !== credentialDigest || input.credential.issuerDid !== commitment.issuerDid || input.credential.issuerKid !== commitment.issuerKid || jcsCanonicalize(input.credential.profile) !== jcsCanonicalize(commitment.profile) || jcsCanonicalize(input.credential.credentialType) !== jcsCanonicalize(commitment.credentialType)) throw new Error("credential does not match the signed Policy/v2 requirement");
+  const requestedCapabilities = input.requestedCapabilities.map(normalizeUnifiedPolicyCapability);
+  if (requestedCapabilities.length === 0 || requestedCapabilities.some((requested) => !policy.capabilityCeiling.some((authority) => unifiedPolicyCapabilityContains(authority, requested)))) throw new Error("requested capabilities exceed the signed Policy/v2 ceiling");
+  const holderDid = input.credential.holderDid;
+  if (input.challenge.policyCid !== input.policyCid || input.challenge.recipientDid !== holderDid || input.credential.subjectDid !== holderDid || typeof input.challenge.nodeAudience !== "string" || input.challenge.nodeAudience.length === 0 || typeof input.challenge.expiresAt !== "string" || !Number.isFinite(Date.parse(input.challenge.expiresAt))) throw new Error("policy challenge binding is invalid");
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const expiresAtMs = Math.min(
+    now.getTime() + 6e4,
+    Date.parse(input.challenge.expiresAt),
+    Date.parse(input.credential.expiresAt)
+  );
+  if (expiresAtMs <= now.getTime()) throw new Error("policy challenge is expired");
+  return signPolicyCredentialPresentationV4(Object.freeze({
+    schema: POLICY_PRESENTATION_V4_SCHEMA,
+    jti: input.jti ?? encodeBase64Url2(crypto.getRandomValues(new Uint8Array(16))),
+    challengeId: input.challenge.challengeId,
+    nonce: input.challenge.nonce,
+    policyCid: input.policyCid,
+    nodeAudience: input.challenge.nodeAudience,
+    holderDid,
+    subjectDid: holderDid,
+    credentialDigest,
+    requirementDigest,
+    descriptorDigest: input.credential.descriptorDigest,
+    requestedCapabilities: Object.freeze(requestedCapabilities),
+    issuedAt: rfc3339Seconds(now),
+    expiresAt: rfc3339Seconds(new Date(expiresAtMs))
+  }), input.sign);
+}
 async function buildPolicyCredentialPresentationV3(input) {
   const policy = validateUnifiedPolicyV2(input.policy, input.policyCid);
   const requirement = validateCredentialRequirement(input.requirement);
@@ -4188,7 +4292,8 @@ async function admitPolicyCredentialV3(input) {
     policyCid: input.policyCid,
     recipientDid: input.credential.holderDid,
     requestedCapabilities: input.requestedCapabilities,
-    fetch: fetchFn
+    fetch: fetchFn,
+    signal: input.signal
   });
   const presentation = await buildPolicyCredentialPresentationV3({
     ...input,
@@ -4200,6 +4305,7 @@ async function admitPolicyCredentialV3(input) {
     {
       method: "POST",
       redirect: "error",
+      signal: input.signal,
       headers: { accept: "application/json", "content-type": "application/json" },
       body: JSON.stringify({
         policyCid: input.policyCid,
@@ -4228,6 +4334,57 @@ async function admitPolicyCredentialV3(input) {
   if (session.cid !== value.sessionCid || session.aud !== input.credential.holderDid || session.fact.policyCid !== input.policyCid || session.fact.recipientDid !== input.credential.holderDid || session.fact.policyDelegationCid !== input.policyRootCid || session.fact.enforcementDelegationCid !== input.enforcementRootCid || jcsCanonicalize(session.att) !== jcsCanonicalize(expectedAttenuation)) {
     throw new Error("policy delegation signed binding is invalid");
   }
+  input.signal?.throwIfAborted();
+  return Object.freeze({ challenge, presentation, session });
+}
+function validatePolicyCredentialAdmissionV4Authority(session, expected) {
+  if (session.iss.split("#", 1)[0] !== expected.nodeAudience || session.fact.nodeAudience !== expected.nodeAudience || session.fact.enforcerDid !== expected.enforcerDid) throw new Error("policy delegation authority binding is invalid");
+}
+async function admitPolicyCredentialV4(input) {
+  const policy = validateUnifiedPolicyV2(input.policy, input.policyCid);
+  const nodeOrigin = policyNodeOrigin(input.nodeOrigin);
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const challenge = await requestPolicyChallengeV3({
+    nodeOrigin,
+    policyCid: input.policyCid,
+    recipientDid: input.credential.holderDid,
+    requestedCapabilities: input.requestedCapabilities,
+    fetch: fetchFn,
+    signal: input.signal
+  });
+  const presentation = await buildPolicyCredentialPresentationV4({
+    ...input,
+    policy,
+    challenge
+  });
+  const response = await fetchFn(new URL("/share/v3/policy/delegations", nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    signal: input.signal,
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify({
+      policyCid: input.policyCid,
+      challengeId: challenge.challengeId,
+      nonce: challenge.nonce,
+      requirement: validateCredentialRequirement(input.requirement),
+      credential: envelopeFromVerified(input.credential),
+      presentation
+    })
+  });
+  if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
+  const value = record(await response.json(), "policy delegation");
+  if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") throw new Error("policy delegation response is invalid");
+  const session = parsePolicySessionUcan(value.authorization, [
+    input.policyRootCid,
+    input.enforcementRootCid
+  ]);
+  const expectedAttenuation = compactAttenuationForPolicyCapabilities(input.requestedCapabilities);
+  validatePolicyCredentialAdmissionV4Authority(session, {
+    nodeAudience: input.expectedNodeAudience,
+    enforcerDid: input.expectedEnforcerDid
+  });
+  if (session.cid !== value.sessionCid || session.aud !== input.credential.holderDid || session.fact.policyCid !== input.policyCid || session.fact.recipientDid !== input.credential.holderDid || session.fact.policyDelegationCid !== input.policyRootCid || session.fact.enforcementDelegationCid !== input.enforcementRootCid || jcsCanonicalize(session.att) !== jcsCanonicalize(expectedAttenuation)) throw new Error("policy delegation signed binding is invalid");
+  input.signal?.throwIfAborted();
   return Object.freeze({ challenge, presentation, session });
 }
 export {
@@ -4247,6 +4404,8 @@ export {
   POLICY_ENGINE_RECORD_SCHEMA,
   POLICY_PRESENTATION_V3_DOMAIN,
   POLICY_PRESENTATION_V3_SCHEMA,
+  POLICY_PRESENTATION_V4_DOMAIN,
+  POLICY_PRESENTATION_V4_SCHEMA,
   POLICY_SCHEMA,
   POLICY_SESSION_UCAN_V1_PROFILE,
   POLICY_STATUS_SCHEMA,
@@ -4274,7 +4433,9 @@ export {
   UnsupportedSignatureSuiteError,
   W3C_VC_CREDENTIAL_VERIFIER,
   admitPolicyCredentialV3,
+  admitPolicyCredentialV4,
   buildPolicyCredentialPresentationV3,
+  buildPolicyCredentialPresentationV4,
   canonicalizePolicyCapability,
   canonicalizeSignedObjectUnsigned,
   canonicalizeUnifiedPolicyCapability,
@@ -4292,6 +4453,7 @@ export {
   createUnsignedPolicyEngineRecord,
   deriveSignedObjectMaterial,
   getPolicyRootStatusV3,
+  issuedCredentialEnvelopeFromVerified,
   jcsCanonicalize,
   mintPolicySessionV3,
   normalizeJson,
@@ -4313,6 +4475,7 @@ export {
   serialize as serializeJcsJson,
   signCompactUcanAuthorization,
   signCompactUcanRootAuthorization,
+  signPolicyCredentialPresentationV4,
   signedObjectIdFor,
   toSignedObjectError,
   unifiedNativeProjectionHashHex,