@tinycloud/sdk-core 3.0.0-beta.1 → 3.0.0-beta.5

package/dist/{credential-admission-C_cO1QqB.d.cts → credential-admission-BVUC6kdw.d.cts}

@@ -445,6 +445,12 @@ interface UnifiedPolicyV1 {
         readonly value: string;
     };
 }
+type PolicySessionUcanFactV1 = Readonly<Record<string, unknown>> & {
+    /** Present only on accountless PolicyCredentialPresentation/v4 admissions. */
+    readonly credentialIdAuditDigestHex?: string;
+    /** Present only on accountless PolicyCredentialPresentation/v4 admissions. */
+    readonly presentationJtiAuditDigestHex?: string;
+};
 interface PolicySessionUcanV1 {
     readonly authorization: string;
     readonly cid: string;
@@ -455,7 +461,7 @@ interface PolicySessionUcanV1 {
     readonly nbf: number;
     readonly exp: number;
     readonly nnc: string;
-    readonly fact: Readonly<Record<string, unknown>>;
+    readonly fact: PolicySessionUcanFactV1;
 }
 interface PolicyChallengeV3 {
     readonly challengeId: string;
@@ -472,6 +478,7 @@ declare function requestPolicyChallengeV3(input: {
     readonly recipientDid: string;
     readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
     readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
 }): Promise<PolicyChallengeV3>;
 declare function mintPolicySessionV3(input: {
     readonly nodeOrigin: string;
@@ -485,6 +492,7 @@ declare function mintPolicySessionV3(input: {
     readonly presentation: Readonly<Record<string, unknown>>;
     readonly challenge?: PolicyChallengeV3;
     readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
 }): Promise<PolicySessionUcanV1>;
 interface PolicyRootStatusV3 {
     readonly rootCid: string;
@@ -682,6 +690,8 @@ declare const POLICY_V2_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
 declare const POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE: "TinyCloudPolicyCredentialRequirement";
 declare const POLICY_PRESENTATION_V3_SCHEMA: "xyz.tinycloud.policy/presentation/v3";
 declare const POLICY_PRESENTATION_V3_DOMAIN = "xyz.tinycloud.policy/Presentation/v3\0";
+declare const POLICY_PRESENTATION_V4_SCHEMA: "xyz.tinycloud.policy/presentation/v4";
+declare const POLICY_PRESENTATION_V4_DOMAIN = "xyz.tinycloud.policy/Presentation/v4\0";
 interface PolicyCredentialRequirementV1 {
     readonly type: typeof POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE;
     readonly version: 1;
@@ -736,6 +746,29 @@ interface PolicyCredentialPresentationV3 {
         readonly value: string;
     };
 }
+interface UnsignedPolicyCredentialPresentationV4 {
+    readonly schema: typeof POLICY_PRESENTATION_V4_SCHEMA;
+    readonly jti: string;
+    readonly challengeId: string;
+    readonly nonce: string;
+    readonly policyCid: string;
+    readonly nodeAudience: string;
+    readonly holderDid: string;
+    readonly subjectDid: string;
+    readonly credentialDigest: string;
+    readonly requirementDigest: string;
+    readonly descriptorDigest: string;
+    readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+interface PolicyCredentialPresentationV4 extends UnsignedPolicyCredentialPresentationV4 {
+    readonly signature: {
+        readonly suite: "Ed25519";
+        readonly signerDid: string;
+        readonly value: string;
+    };
+}
 declare function validatePolicyCredentialRequirementV1(value: unknown): PolicyCredentialRequirementV1;
 declare function policyV2DigestHex(input: UnsignedUnifiedPolicyV2): string;
 /**
@@ -744,6 +777,21 @@ declare function policyV2DigestHex(input: UnsignedUnifiedPolicyV2): string;
  * Node remains the authoritative signature verifier at admission.
  */
 declare function validateUnifiedPolicyV2(value: unknown, expectedPolicyCid?: string): UnifiedPolicyV2;
+declare function issuedCredentialEnvelopeFromVerified(verified: VerifiedCredential): IssuedCredentialEnvelope;
+/** Sign the exact accountless v4 wire value. No account custody fields exist. */
+declare function signPolicyCredentialPresentationV4(value: UnsignedPolicyCredentialPresentationV4, sign: (digest: Uint8Array) => Promise<Uint8Array>): Promise<PolicyCredentialPresentationV4>;
+interface BuildPolicyCredentialPresentationV4Input {
+    readonly policy: UnifiedPolicyV2;
+    readonly policyCid: string;
+    readonly challenge: PolicyChallengeV3;
+    readonly requirement: CredentialRequirement;
+    readonly credential: VerifiedCredential;
+    readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
+    readonly sign: (digest: Uint8Array) => Promise<Uint8Array>;
+    readonly now?: Date;
+    readonly jti?: string;
+}
+declare function buildPolicyCredentialPresentationV4(input: BuildPolicyCredentialPresentationV4Input): Promise<PolicyCredentialPresentationV4>;
 interface BuildPolicyCredentialPresentationV3Input {
     readonly policy: UnifiedPolicyV2;
     readonly policyCid: string;
@@ -766,6 +814,7 @@ interface AdmitPolicyCredentialV3Input extends Omit<BuildPolicyCredentialPresent
     /** Recipient-owned `credentials` space covered by the account authorization. */
     readonly credentialSpaceId: string;
     readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
 }
 interface PolicyCredentialAdmissionV3 {
     readonly challenge: PolicyChallengeV3;
@@ -777,5 +826,21 @@ interface PolicyCredentialAdmissionV3 {
  * Raw credential material appears only in the TLS POST body.
  */
 declare function admitPolicyCredentialV3(input: AdmitPolicyCredentialV3Input): Promise<PolicyCredentialAdmissionV3>;
+interface AdmitPolicyCredentialV4Input extends Omit<BuildPolicyCredentialPresentationV4Input, "challenge"> {
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+    readonly expectedNodeAudience: string;
+    readonly expectedEnforcerDid: string;
+    readonly nodeOrigin: string;
+    readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
+}
+interface PolicyCredentialAdmissionV4 {
+    readonly challenge: PolicyChallengeV3;
+    readonly presentation: PolicyCredentialPresentationV4;
+    readonly session: PolicySessionUcanV1;
+}
+/** Accountless admission. The request deliberately has no account custody fields. */
+declare function admitPolicyCredentialV4(input: AdmitPolicyCredentialV4Input): Promise<PolicyCredentialAdmissionV4>;
 
-export { type SignedObjectMaterial as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyStatus as D, ED25519_JCS_SIGNATURE_SUITE as E, ROOT_REVOCATION_V1_SCHEMA as F, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as G, ROOT_STATUS_RENEWAL_V1_DOMAIN as H, ROOT_STATUS_V1_DOMAIN as I, type JsonObject as J, type SignCompactUcanAuthorizationInput as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type SignCompactUcanRootAuthorizationInput as O, type PolicyEngineRecord as P, SignatureMaterialError as Q, ROOT_REVOCATION_V1_DOMAIN as R, type SignedObjectSigner as S, type SignatureSuite as T, type UnsignedPolicyEngineRecord as U, SignatureVerificationError as V, SignedObjectCanonicalizationError as W, SignedObjectDigestError as X, type SignedObjectErrorCode as Y, SignedObjectIdError as Z, type SignedObjectKind as _, type Policy as a, validatePolicyUnsigned as a$, SignedObjectProfileError as a0, SignedObjectSchemaError as a1, type SignedObjectSignature as a2, type SignedObjectVerificationResult as a3, type SignedPolicyObject as a4, SigningKeyBindingError as a5, type UnifiedContentSource as a6, type UnifiedEncryptionCapability as a7, type UnifiedKvCapability as a8, type UnifiedNativeCapability as a9, parsePolicySessionUcan as aA, policyCidFromCanonicalBytes as aB, policyDigestHex as aC, policyIdForDigestHex as aD, policyV2DigestHex as aE, projectUnifiedPolicyCapabilities as aF, projectUnifiedPolicyCapability as aG, renewPolicyRootStatusV3 as aH, requestPolicyChallengeV3 as aI, revokePolicyRootV3 as aJ, signCompactUcanAuthorization as aK, signCompactUcanRootAuthorization as aL, signedObjectIdFor as aM, toSignedObjectError as aN, unifiedNativeProjectionHashHex as aO, unifiedPolicyCapabilityContains as aP, unifiedPolicyCapabilityDigestHex as aQ, unifiedPolicyCapabilityFromNative as aR, validatePolicyCredentialRequirementV1 as aS, validatePolicyEngineRecordSigned as aT, validatePolicyEngineRecordSignedShape as aU, validatePolicyEngineRecordUnsigned as aV, validatePolicySigned as aW, validatePolicySignedShape as aX, validatePolicyStatusSigned as aY, validatePolicyStatusSignedShape as aZ, validatePolicyStatusUnsigned as a_, type UnifiedPolicyCapability as aa, type UnifiedPolicyV1 as ab, type UnifiedPolicyV2 as ac, type UnifiedResourceSelector as ad, type UnsignedPolicy as ae, type UnsignedPolicyObject as af, type UnsignedPolicyStatus as ag, type UnsignedUnifiedPolicyV2 as ah, UnsupportedSignatureSuiteError as ai, admitPolicyCredentialV3 as aj, buildPolicyCredentialPresentationV3 as ak, canonicalizeSignedObjectUnsigned as al, canonicalizeUnifiedPolicyCapability as am, compactAttenuationContains as an, contentSourceDigestHex as ao, createAndSignPolicy as ap, createAndSignPolicyEngineRecord as aq, createAndSignPolicyStatus as ar, createAndSignSignedObject as as, createCompactPolicyDescendant as at, createCompactPolicyInvocation as au, deriveSignedObjectMaterial as av, getPolicyRootStatusV3 as aw, mintPolicySessionV3 as ax, normalizeUnifiedPolicyCapability as ay, parseCompactUcanAuthorization as az, type AdmitPolicyCredentialV3Input as b, validateUnifiedPolicyV2 as b0, verifyPolicy as b1, verifyPolicyEngineRecord as b2, verifyPolicyRootRevocationV3 as b3, verifyPolicyRootStatusCheckpointV3 as b4, verifyPolicyStatus as b5, verifySignedObject as b6, type CredentialHolderBinding as b7, type CredentialFlowDescriptor as b8, type CredentialRequirement as b9, type StoredCredentialRecord as ba, type VerifiedCredential as bb, type CredentialStorageReceipt as bc, type IssuedCredentialEnvelope as bd, type CredentialIssuerMetadata as be, CREDENTIAL_ACQUISITION_PROTOCOL as bf, CREDENTIAL_CONTRACT_VERSION as bg, CREDENTIAL_FORMAT as bh, CREDENTIAL_STEP_REGISTRY_VERSION as bi, type CredentialClaimDescriptor as bj, type CredentialEndpointId as bk, type CredentialInputDescriptor as bl, type CredentialProgressEvent as bm, type CredentialStepDescriptor as bn, type CredentialStepType as bo, type CredentialUxState as bp, HOLDER_BINDING_DOMAIN as bq, type IssuerVerificationKey as br, type CompactPolicyInvocationInput as c, type CompactUcanAuthorizationV1 as d, EIP191_JCS_SIGNATURE_SUITE as e, LAST_V2_READ_AT as f, POLICY_CAPABILITY_V1_DOMAIN as g, POLICY_CAPABILITY_V1_SCHEMA as h, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as i, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as j, POLICY_ENGINE_RECORD_SCHEMA as k, POLICY_PRESENTATION_V3_DOMAIN as l, POLICY_PRESENTATION_V3_SCHEMA as m, POLICY_SCHEMA as n, POLICY_SESSION_UCAN_V1_PROFILE as o, POLICY_STATUS_SCHEMA as p, POLICY_V1_DOMAIN as q, POLICY_V1_SCHEMA as r, POLICY_V2_DOMAIN as s, POLICY_V2_SCHEMA as t, type PolicyChallengeV3 as u, type PolicyCredentialAdmissionV3 as v, type PolicyCredentialPresentationV3 as w, type PolicyCredentialRequirementV1 as x, type PolicyRootStatusV3 as y, type PolicySessionUcanV1 as z };
+export { type SignatureSuite as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyCredentialAdmissionV4 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialPresentationV3 as F, type PolicyCredentialPresentationV4 as G, type PolicyCredentialRequirementV1 as H, type PolicyRootStatusV3 as I, type JsonObject as J, type PolicySessionUcanFactV1 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicySessionUcanV1 as O, type PolicyEngineRecord as P, type PolicyStatus as Q, ROOT_REVOCATION_V1_DOMAIN as R, type SignedObjectSigner as S, ROOT_REVOCATION_V1_SCHEMA as T, type UnsignedPolicyEngineRecord as U, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as V, ROOT_STATUS_RENEWAL_V1_DOMAIN as W, ROOT_STATUS_V1_DOMAIN as X, type SignCompactUcanAuthorizationInput as Y, type SignCompactUcanRootAuthorizationInput as Z, SignatureMaterialError as _, type Policy as a, unifiedPolicyCapabilityContains as a$, SignatureVerificationError as a0, SignedObjectCanonicalizationError as a1, SignedObjectDigestError as a2, type SignedObjectErrorCode as a3, SignedObjectIdError as a4, type SignedObjectKind as a5, type SignedObjectMaterial as a6, SignedObjectProfileError as a7, SignedObjectSchemaError as a8, type SignedObjectSignature as a9, createAndSignPolicyEngineRecord as aA, createAndSignPolicyStatus as aB, createAndSignSignedObject as aC, createCompactPolicyDescendant as aD, createCompactPolicyInvocation as aE, deriveSignedObjectMaterial as aF, getPolicyRootStatusV3 as aG, issuedCredentialEnvelopeFromVerified as aH, mintPolicySessionV3 as aI, normalizeUnifiedPolicyCapability as aJ, parseCompactUcanAuthorization as aK, parsePolicySessionUcan as aL, policyCidFromCanonicalBytes as aM, policyDigestHex as aN, policyIdForDigestHex as aO, policyV2DigestHex as aP, projectUnifiedPolicyCapabilities as aQ, projectUnifiedPolicyCapability as aR, renewPolicyRootStatusV3 as aS, requestPolicyChallengeV3 as aT, revokePolicyRootV3 as aU, signCompactUcanAuthorization as aV, signCompactUcanRootAuthorization as aW, signPolicyCredentialPresentationV4 as aX, signedObjectIdFor as aY, toSignedObjectError as aZ, unifiedNativeProjectionHashHex as a_, type SignedObjectVerificationResult as aa, type SignedPolicyObject as ab, SigningKeyBindingError as ac, type UnifiedContentSource as ad, type UnifiedEncryptionCapability as ae, type UnifiedKvCapability as af, type UnifiedNativeCapability as ag, type UnifiedPolicyCapability as ah, type UnifiedPolicyV1 as ai, type UnifiedPolicyV2 as aj, type UnifiedResourceSelector as ak, type UnsignedPolicy as al, type UnsignedPolicyCredentialPresentationV4 as am, type UnsignedPolicyObject as an, type UnsignedPolicyStatus as ao, type UnsignedUnifiedPolicyV2 as ap, UnsupportedSignatureSuiteError as aq, admitPolicyCredentialV3 as ar, admitPolicyCredentialV4 as as, buildPolicyCredentialPresentationV3 as at, buildPolicyCredentialPresentationV4 as au, canonicalizeSignedObjectUnsigned as av, canonicalizeUnifiedPolicyCapability as aw, compactAttenuationContains as ax, contentSourceDigestHex as ay, createAndSignPolicy as az, type AdmitPolicyCredentialV3Input as b, unifiedPolicyCapabilityDigestHex as b0, unifiedPolicyCapabilityFromNative as b1, validatePolicyCredentialRequirementV1 as b2, validatePolicyEngineRecordSigned as b3, validatePolicyEngineRecordSignedShape as b4, validatePolicyEngineRecordUnsigned as b5, validatePolicySigned as b6, validatePolicySignedShape as b7, validatePolicyStatusSigned as b8, validatePolicyStatusSignedShape as b9, type CredentialStepType as bA, type CredentialUxState as bB, HOLDER_BINDING_DOMAIN as bC, type IssuerVerificationKey as bD, validatePolicyStatusUnsigned as ba, validatePolicyUnsigned as bb, validateUnifiedPolicyV2 as bc, verifyPolicy as bd, verifyPolicyEngineRecord as be, verifyPolicyRootRevocationV3 as bf, verifyPolicyRootStatusCheckpointV3 as bg, verifyPolicyStatus as bh, verifySignedObject as bi, type CredentialHolderBinding as bj, type CredentialFlowDescriptor as bk, type CredentialRequirement as bl, type StoredCredentialRecord as bm, type VerifiedCredential as bn, type CredentialStorageReceipt as bo, type IssuedCredentialEnvelope as bp, type CredentialIssuerMetadata as bq, CREDENTIAL_ACQUISITION_PROTOCOL as br, CREDENTIAL_CONTRACT_VERSION as bs, CREDENTIAL_FORMAT as bt, CREDENTIAL_STEP_REGISTRY_VERSION as bu, type CredentialClaimDescriptor as bv, type CredentialEndpointId as bw, type CredentialInputDescriptor as bx, type CredentialProgressEvent as by, type CredentialStepDescriptor as bz, type AdmitPolicyCredentialV4Input as c, type BuildPolicyCredentialPresentationV4Input as d, type CompactPolicyInvocationInput as e, type CompactUcanAuthorizationV1 as f, EIP191_JCS_SIGNATURE_SUITE as g, LAST_V2_READ_AT as h, POLICY_CAPABILITY_V1_DOMAIN as i, POLICY_CAPABILITY_V1_SCHEMA as j, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as k, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as l, POLICY_ENGINE_RECORD_SCHEMA as m, POLICY_PRESENTATION_V3_DOMAIN as n, POLICY_PRESENTATION_V3_SCHEMA as o, POLICY_PRESENTATION_V4_DOMAIN as p, POLICY_PRESENTATION_V4_SCHEMA as q, POLICY_SCHEMA as r, POLICY_SESSION_UCAN_V1_PROFILE as s, POLICY_STATUS_SCHEMA as t, POLICY_V1_DOMAIN as u, POLICY_V1_SCHEMA as v, POLICY_V2_DOMAIN as w, POLICY_V2_SCHEMA as x, type PolicyChallengeV3 as y, type PolicyCredentialAdmissionV3 as z };

package/dist/{credential-admission-cvHe-HUC.d.ts → credential-admission-BgvwOTIV.d.ts}

@@ -445,6 +445,12 @@ interface UnifiedPolicyV1 {
         readonly value: string;
     };
 }
+type PolicySessionUcanFactV1 = Readonly<Record<string, unknown>> & {
+    /** Present only on accountless PolicyCredentialPresentation/v4 admissions. */
+    readonly credentialIdAuditDigestHex?: string;
+    /** Present only on accountless PolicyCredentialPresentation/v4 admissions. */
+    readonly presentationJtiAuditDigestHex?: string;
+};
 interface PolicySessionUcanV1 {
     readonly authorization: string;
     readonly cid: string;
@@ -455,7 +461,7 @@ interface PolicySessionUcanV1 {
     readonly nbf: number;
     readonly exp: number;
     readonly nnc: string;
-    readonly fact: Readonly<Record<string, unknown>>;
+    readonly fact: PolicySessionUcanFactV1;
 }
 interface PolicyChallengeV3 {
     readonly challengeId: string;
@@ -472,6 +478,7 @@ declare function requestPolicyChallengeV3(input: {
     readonly recipientDid: string;
     readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
     readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
 }): Promise<PolicyChallengeV3>;
 declare function mintPolicySessionV3(input: {
     readonly nodeOrigin: string;
@@ -485,6 +492,7 @@ declare function mintPolicySessionV3(input: {
     readonly presentation: Readonly<Record<string, unknown>>;
     readonly challenge?: PolicyChallengeV3;
     readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
 }): Promise<PolicySessionUcanV1>;
 interface PolicyRootStatusV3 {
     readonly rootCid: string;
@@ -682,6 +690,8 @@ declare const POLICY_V2_DOMAIN = "xyz.tinycloud.policy/policy/v2\0";
 declare const POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE: "TinyCloudPolicyCredentialRequirement";
 declare const POLICY_PRESENTATION_V3_SCHEMA: "xyz.tinycloud.policy/presentation/v3";
 declare const POLICY_PRESENTATION_V3_DOMAIN = "xyz.tinycloud.policy/Presentation/v3\0";
+declare const POLICY_PRESENTATION_V4_SCHEMA: "xyz.tinycloud.policy/presentation/v4";
+declare const POLICY_PRESENTATION_V4_DOMAIN = "xyz.tinycloud.policy/Presentation/v4\0";
 interface PolicyCredentialRequirementV1 {
     readonly type: typeof POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE;
     readonly version: 1;
@@ -736,6 +746,29 @@ interface PolicyCredentialPresentationV3 {
         readonly value: string;
     };
 }
+interface UnsignedPolicyCredentialPresentationV4 {
+    readonly schema: typeof POLICY_PRESENTATION_V4_SCHEMA;
+    readonly jti: string;
+    readonly challengeId: string;
+    readonly nonce: string;
+    readonly policyCid: string;
+    readonly nodeAudience: string;
+    readonly holderDid: string;
+    readonly subjectDid: string;
+    readonly credentialDigest: string;
+    readonly requirementDigest: string;
+    readonly descriptorDigest: string;
+    readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+interface PolicyCredentialPresentationV4 extends UnsignedPolicyCredentialPresentationV4 {
+    readonly signature: {
+        readonly suite: "Ed25519";
+        readonly signerDid: string;
+        readonly value: string;
+    };
+}
 declare function validatePolicyCredentialRequirementV1(value: unknown): PolicyCredentialRequirementV1;
 declare function policyV2DigestHex(input: UnsignedUnifiedPolicyV2): string;
 /**
@@ -744,6 +777,21 @@ declare function policyV2DigestHex(input: UnsignedUnifiedPolicyV2): string;
  * Node remains the authoritative signature verifier at admission.
  */
 declare function validateUnifiedPolicyV2(value: unknown, expectedPolicyCid?: string): UnifiedPolicyV2;
+declare function issuedCredentialEnvelopeFromVerified(verified: VerifiedCredential): IssuedCredentialEnvelope;
+/** Sign the exact accountless v4 wire value. No account custody fields exist. */
+declare function signPolicyCredentialPresentationV4(value: UnsignedPolicyCredentialPresentationV4, sign: (digest: Uint8Array) => Promise<Uint8Array>): Promise<PolicyCredentialPresentationV4>;
+interface BuildPolicyCredentialPresentationV4Input {
+    readonly policy: UnifiedPolicyV2;
+    readonly policyCid: string;
+    readonly challenge: PolicyChallengeV3;
+    readonly requirement: CredentialRequirement;
+    readonly credential: VerifiedCredential;
+    readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
+    readonly sign: (digest: Uint8Array) => Promise<Uint8Array>;
+    readonly now?: Date;
+    readonly jti?: string;
+}
+declare function buildPolicyCredentialPresentationV4(input: BuildPolicyCredentialPresentationV4Input): Promise<PolicyCredentialPresentationV4>;
 interface BuildPolicyCredentialPresentationV3Input {
     readonly policy: UnifiedPolicyV2;
     readonly policyCid: string;
@@ -766,6 +814,7 @@ interface AdmitPolicyCredentialV3Input extends Omit<BuildPolicyCredentialPresent
     /** Recipient-owned `credentials` space covered by the account authorization. */
     readonly credentialSpaceId: string;
     readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
 }
 interface PolicyCredentialAdmissionV3 {
     readonly challenge: PolicyChallengeV3;
@@ -777,5 +826,21 @@ interface PolicyCredentialAdmissionV3 {
  * Raw credential material appears only in the TLS POST body.
  */
 declare function admitPolicyCredentialV3(input: AdmitPolicyCredentialV3Input): Promise<PolicyCredentialAdmissionV3>;
+interface AdmitPolicyCredentialV4Input extends Omit<BuildPolicyCredentialPresentationV4Input, "challenge"> {
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+    readonly expectedNodeAudience: string;
+    readonly expectedEnforcerDid: string;
+    readonly nodeOrigin: string;
+    readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
+}
+interface PolicyCredentialAdmissionV4 {
+    readonly challenge: PolicyChallengeV3;
+    readonly presentation: PolicyCredentialPresentationV4;
+    readonly session: PolicySessionUcanV1;
+}
+/** Accountless admission. The request deliberately has no account custody fields. */
+declare function admitPolicyCredentialV4(input: AdmitPolicyCredentialV4Input): Promise<PolicyCredentialAdmissionV4>;
 
-export { type SignedObjectMaterial as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyStatus as D, ED25519_JCS_SIGNATURE_SUITE as E, ROOT_REVOCATION_V1_SCHEMA as F, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as G, ROOT_STATUS_RENEWAL_V1_DOMAIN as H, ROOT_STATUS_V1_DOMAIN as I, type JsonObject as J, type SignCompactUcanAuthorizationInput as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type SignCompactUcanRootAuthorizationInput as O, type PolicyEngineRecord as P, SignatureMaterialError as Q, ROOT_REVOCATION_V1_DOMAIN as R, type SignedObjectSigner as S, type SignatureSuite as T, type UnsignedPolicyEngineRecord as U, SignatureVerificationError as V, SignedObjectCanonicalizationError as W, SignedObjectDigestError as X, type SignedObjectErrorCode as Y, SignedObjectIdError as Z, type SignedObjectKind as _, type Policy as a, validatePolicyUnsigned as a$, SignedObjectProfileError as a0, SignedObjectSchemaError as a1, type SignedObjectSignature as a2, type SignedObjectVerificationResult as a3, type SignedPolicyObject as a4, SigningKeyBindingError as a5, type UnifiedContentSource as a6, type UnifiedEncryptionCapability as a7, type UnifiedKvCapability as a8, type UnifiedNativeCapability as a9, parsePolicySessionUcan as aA, policyCidFromCanonicalBytes as aB, policyDigestHex as aC, policyIdForDigestHex as aD, policyV2DigestHex as aE, projectUnifiedPolicyCapabilities as aF, projectUnifiedPolicyCapability as aG, renewPolicyRootStatusV3 as aH, requestPolicyChallengeV3 as aI, revokePolicyRootV3 as aJ, signCompactUcanAuthorization as aK, signCompactUcanRootAuthorization as aL, signedObjectIdFor as aM, toSignedObjectError as aN, unifiedNativeProjectionHashHex as aO, unifiedPolicyCapabilityContains as aP, unifiedPolicyCapabilityDigestHex as aQ, unifiedPolicyCapabilityFromNative as aR, validatePolicyCredentialRequirementV1 as aS, validatePolicyEngineRecordSigned as aT, validatePolicyEngineRecordSignedShape as aU, validatePolicyEngineRecordUnsigned as aV, validatePolicySigned as aW, validatePolicySignedShape as aX, validatePolicyStatusSigned as aY, validatePolicyStatusSignedShape as aZ, validatePolicyStatusUnsigned as a_, type UnifiedPolicyCapability as aa, type UnifiedPolicyV1 as ab, type UnifiedPolicyV2 as ac, type UnifiedResourceSelector as ad, type UnsignedPolicy as ae, type UnsignedPolicyObject as af, type UnsignedPolicyStatus as ag, type UnsignedUnifiedPolicyV2 as ah, UnsupportedSignatureSuiteError as ai, admitPolicyCredentialV3 as aj, buildPolicyCredentialPresentationV3 as ak, canonicalizeSignedObjectUnsigned as al, canonicalizeUnifiedPolicyCapability as am, compactAttenuationContains as an, contentSourceDigestHex as ao, createAndSignPolicy as ap, createAndSignPolicyEngineRecord as aq, createAndSignPolicyStatus as ar, createAndSignSignedObject as as, createCompactPolicyDescendant as at, createCompactPolicyInvocation as au, deriveSignedObjectMaterial as av, getPolicyRootStatusV3 as aw, mintPolicySessionV3 as ax, normalizeUnifiedPolicyCapability as ay, parseCompactUcanAuthorization as az, type AdmitPolicyCredentialV3Input as b, validateUnifiedPolicyV2 as b0, verifyPolicy as b1, verifyPolicyEngineRecord as b2, verifyPolicyRootRevocationV3 as b3, verifyPolicyRootStatusCheckpointV3 as b4, verifyPolicyStatus as b5, verifySignedObject as b6, type CredentialHolderBinding as b7, type CredentialFlowDescriptor as b8, type CredentialRequirement as b9, type StoredCredentialRecord as ba, type VerifiedCredential as bb, type CredentialStorageReceipt as bc, type IssuedCredentialEnvelope as bd, type CredentialIssuerMetadata as be, CREDENTIAL_ACQUISITION_PROTOCOL as bf, CREDENTIAL_CONTRACT_VERSION as bg, CREDENTIAL_FORMAT as bh, CREDENTIAL_STEP_REGISTRY_VERSION as bi, type CredentialClaimDescriptor as bj, type CredentialEndpointId as bk, type CredentialInputDescriptor as bl, type CredentialProgressEvent as bm, type CredentialStepDescriptor as bn, type CredentialStepType as bo, type CredentialUxState as bp, HOLDER_BINDING_DOMAIN as bq, type IssuerVerificationKey as br, type CompactPolicyInvocationInput as c, type CompactUcanAuthorizationV1 as d, EIP191_JCS_SIGNATURE_SUITE as e, LAST_V2_READ_AT as f, POLICY_CAPABILITY_V1_DOMAIN as g, POLICY_CAPABILITY_V1_SCHEMA as h, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as i, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as j, POLICY_ENGINE_RECORD_SCHEMA as k, POLICY_PRESENTATION_V3_DOMAIN as l, POLICY_PRESENTATION_V3_SCHEMA as m, POLICY_SCHEMA as n, POLICY_SESSION_UCAN_V1_PROFILE as o, POLICY_STATUS_SCHEMA as p, POLICY_V1_DOMAIN as q, POLICY_V1_SCHEMA as r, POLICY_V2_DOMAIN as s, POLICY_V2_SCHEMA as t, type PolicyChallengeV3 as u, type PolicyCredentialAdmissionV3 as v, type PolicyCredentialPresentationV3 as w, type PolicyCredentialRequirementV1 as x, type PolicyRootStatusV3 as y, type PolicySessionUcanV1 as z };
+export { type SignatureSuite as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyCredentialAdmissionV4 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialPresentationV3 as F, type PolicyCredentialPresentationV4 as G, type PolicyCredentialRequirementV1 as H, type PolicyRootStatusV3 as I, type JsonObject as J, type PolicySessionUcanFactV1 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicySessionUcanV1 as O, type PolicyEngineRecord as P, type PolicyStatus as Q, ROOT_REVOCATION_V1_DOMAIN as R, type SignedObjectSigner as S, ROOT_REVOCATION_V1_SCHEMA as T, type UnsignedPolicyEngineRecord as U, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as V, ROOT_STATUS_RENEWAL_V1_DOMAIN as W, ROOT_STATUS_V1_DOMAIN as X, type SignCompactUcanAuthorizationInput as Y, type SignCompactUcanRootAuthorizationInput as Z, SignatureMaterialError as _, type Policy as a, unifiedPolicyCapabilityContains as a$, SignatureVerificationError as a0, SignedObjectCanonicalizationError as a1, SignedObjectDigestError as a2, type SignedObjectErrorCode as a3, SignedObjectIdError as a4, type SignedObjectKind as a5, type SignedObjectMaterial as a6, SignedObjectProfileError as a7, SignedObjectSchemaError as a8, type SignedObjectSignature as a9, createAndSignPolicyEngineRecord as aA, createAndSignPolicyStatus as aB, createAndSignSignedObject as aC, createCompactPolicyDescendant as aD, createCompactPolicyInvocation as aE, deriveSignedObjectMaterial as aF, getPolicyRootStatusV3 as aG, issuedCredentialEnvelopeFromVerified as aH, mintPolicySessionV3 as aI, normalizeUnifiedPolicyCapability as aJ, parseCompactUcanAuthorization as aK, parsePolicySessionUcan as aL, policyCidFromCanonicalBytes as aM, policyDigestHex as aN, policyIdForDigestHex as aO, policyV2DigestHex as aP, projectUnifiedPolicyCapabilities as aQ, projectUnifiedPolicyCapability as aR, renewPolicyRootStatusV3 as aS, requestPolicyChallengeV3 as aT, revokePolicyRootV3 as aU, signCompactUcanAuthorization as aV, signCompactUcanRootAuthorization as aW, signPolicyCredentialPresentationV4 as aX, signedObjectIdFor as aY, toSignedObjectError as aZ, unifiedNativeProjectionHashHex as a_, type SignedObjectVerificationResult as aa, type SignedPolicyObject as ab, SigningKeyBindingError as ac, type UnifiedContentSource as ad, type UnifiedEncryptionCapability as ae, type UnifiedKvCapability as af, type UnifiedNativeCapability as ag, type UnifiedPolicyCapability as ah, type UnifiedPolicyV1 as ai, type UnifiedPolicyV2 as aj, type UnifiedResourceSelector as ak, type UnsignedPolicy as al, type UnsignedPolicyCredentialPresentationV4 as am, type UnsignedPolicyObject as an, type UnsignedPolicyStatus as ao, type UnsignedUnifiedPolicyV2 as ap, UnsupportedSignatureSuiteError as aq, admitPolicyCredentialV3 as ar, admitPolicyCredentialV4 as as, buildPolicyCredentialPresentationV3 as at, buildPolicyCredentialPresentationV4 as au, canonicalizeSignedObjectUnsigned as av, canonicalizeUnifiedPolicyCapability as aw, compactAttenuationContains as ax, contentSourceDigestHex as ay, createAndSignPolicy as az, type AdmitPolicyCredentialV3Input as b, unifiedPolicyCapabilityDigestHex as b0, unifiedPolicyCapabilityFromNative as b1, validatePolicyCredentialRequirementV1 as b2, validatePolicyEngineRecordSigned as b3, validatePolicyEngineRecordSignedShape as b4, validatePolicyEngineRecordUnsigned as b5, validatePolicySigned as b6, validatePolicySignedShape as b7, validatePolicyStatusSigned as b8, validatePolicyStatusSignedShape as b9, type CredentialStepType as bA, type CredentialUxState as bB, HOLDER_BINDING_DOMAIN as bC, type IssuerVerificationKey as bD, validatePolicyStatusUnsigned as ba, validatePolicyUnsigned as bb, validateUnifiedPolicyV2 as bc, verifyPolicy as bd, verifyPolicyEngineRecord as be, verifyPolicyRootRevocationV3 as bf, verifyPolicyRootStatusCheckpointV3 as bg, verifyPolicyStatus as bh, verifySignedObject as bi, type CredentialHolderBinding as bj, type CredentialFlowDescriptor as bk, type CredentialRequirement as bl, type StoredCredentialRecord as bm, type VerifiedCredential as bn, type CredentialStorageReceipt as bo, type IssuedCredentialEnvelope as bp, type CredentialIssuerMetadata as bq, CREDENTIAL_ACQUISITION_PROTOCOL as br, CREDENTIAL_CONTRACT_VERSION as bs, CREDENTIAL_FORMAT as bt, CREDENTIAL_STEP_REGISTRY_VERSION as bu, type CredentialClaimDescriptor as bv, type CredentialEndpointId as bw, type CredentialInputDescriptor as bx, type CredentialProgressEvent as by, type CredentialStepDescriptor as bz, type AdmitPolicyCredentialV4Input as c, type BuildPolicyCredentialPresentationV4Input as d, type CompactPolicyInvocationInput as e, type CompactUcanAuthorizationV1 as f, EIP191_JCS_SIGNATURE_SUITE as g, LAST_V2_READ_AT as h, POLICY_CAPABILITY_V1_DOMAIN as i, POLICY_CAPABILITY_V1_SCHEMA as j, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as k, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as l, POLICY_ENGINE_RECORD_SCHEMA as m, POLICY_PRESENTATION_V3_DOMAIN as n, POLICY_PRESENTATION_V3_SCHEMA as o, POLICY_PRESENTATION_V4_DOMAIN as p, POLICY_PRESENTATION_V4_SCHEMA as q, POLICY_SCHEMA as r, POLICY_SESSION_UCAN_V1_PROFILE as s, POLICY_STATUS_SCHEMA as t, POLICY_V1_DOMAIN as u, POLICY_V1_SCHEMA as v, POLICY_V2_DOMAIN as w, POLICY_V2_SCHEMA as x, type PolicyChallengeV3 as y, type PolicyCredentialAdmissionV3 as z };

package/dist/delegations/index.cjs

@@ -4007,6 +4007,11 @@ var POLICY_SESSION_FACT_KEYS = [
   "issuanceAuditDigestHex",
   "remainingRedelegationDepth"
 ];
+var POLICY_SESSION_V4_AUDIT_FACT_KEYS = [
+  "credentialIdAuditDigestHex",
+  "presentationJtiAuditDigestHex"
+];
+var LOWER_SHA256_HEX = /^[0-9a-f]{64}$/;
 var CompactHeaderSchema = import_zod4.z.object({
   alg: import_zod4.z.literal("EdDSA"),
   jwk: import_zod4.z.object({ alg: import_zod4.z.literal("EdDSA"), crv: import_zod4.z.literal("Ed25519"), kty: import_zod4.z.literal("OKP"), x: import_zod4.z.string().min(1) }).strict(),
@@ -4148,9 +4153,13 @@ function parsePolicySessionUcan(authorization, expectedProofs) {
   if (expectedProofs !== void 0 && (parsed.payload.prf[0] !== expectedProofs[0] || parsed.payload.prf[1] !== expectedProofs[1]))
     throw new Error("policy session UCAN ordered proofs do not match");
   const factKeys = Object.keys(fact);
-  if (factKeys.length !== POLICY_SESSION_FACT_KEYS.length || factKeys.some((key) => !POLICY_SESSION_FACT_KEYS.includes(key)) || POLICY_SESSION_FACT_KEYS.some((key) => !(key in fact)))
+  const hasLegacyFactShape = factKeys.length === POLICY_SESSION_FACT_KEYS.length && factKeys.every((key) => POLICY_SESSION_FACT_KEYS.includes(key)) && POLICY_SESSION_FACT_KEYS.every((key) => key in fact);
+  const hasV4AuditFactShape = factKeys.length === POLICY_SESSION_FACT_KEYS.length + POLICY_SESSION_V4_AUDIT_FACT_KEYS.length && factKeys.every((key) => POLICY_SESSION_FACT_KEYS.includes(key) || POLICY_SESSION_V4_AUDIT_FACT_KEYS.includes(key)) && POLICY_SESSION_FACT_KEYS.every((key) => key in fact) && POLICY_SESSION_V4_AUDIT_FACT_KEYS.every((key) => key in fact);
+  if (!hasLegacyFactShape && !hasV4AuditFactShape)
     throw new Error("policy session UCAN fact is incomplete");
-  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.enforcerDid || parsed.payload.aud !== fact.recipientDid)
+  if (hasV4AuditFactShape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)))
+    throw new Error("policy session UCAN v4 audit facts are invalid");
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
     throw new Error("policy session UCAN fact is invalid");
   return {
     authorization,