@tinycloud/sdk-core 3.0.0-beta.18 → 3.0.0-beta.19

package/dist/index.d.cts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { bo as CredentialHolderBinding, bp as CredentialFlowDescriptor, bq as CredentialRequirement, br as StoredCredentialRecord, bs as VerifiedCredential, bt as CredentialStorageReceipt, bu as IssuedCredentialEnvelope, bv as CredentialIssuerMetadata } from './credential-admission-CFjUChF8.cjs';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bw as CREDENTIAL_ACQUISITION_PROTOCOL, bx as CREDENTIAL_CONTRACT_VERSION, by as CREDENTIAL_FORMAT, bw as CREDENTIAL_PROTOCOL, bz as CREDENTIAL_STEP_REGISTRY_VERSION, g as CompactUcanAuthorizationV1, bA as CredentialClaimDescriptor, bB as CredentialEndpointId, bC as CredentialInputDescriptor, bD as CredentialProgressEvent, bE as CredentialStepDescriptor, bF as CredentialStepType, bG as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, h as EIP191_JCS_SIGNATURE_SUITE, bH as HOLDER_BINDING_DOMAIN, bI as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, i as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, j as POLICY_CAPABILITY_V1_DOMAIN, k as POLICY_CAPABILITY_V1_SCHEMA, l as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, m as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, n as POLICY_ENGINE_RECORD_SCHEMA, o as POLICY_PRESENTATION_V3_DOMAIN, p as POLICY_PRESENTATION_V3_SCHEMA, q as POLICY_PRESENTATION_V4_DOMAIN, r as POLICY_PRESENTATION_V4_SCHEMA, s as POLICY_SCHEMA, t as POLICY_SESSION_UCAN_V1_PROFILE, u as POLICY_STATUS_SCHEMA, v as POLICY_V1_DOMAIN, w as POLICY_V1_SCHEMA, x as POLICY_V2_DOMAIN, y as POLICY_V2_SCHEMA, a as Policy, D as PolicyCredentialAdmissionV3, F as PolicyCredentialAdmissionV4, G as PolicyCredentialPresentationV3, H as PolicyCredentialPresentationV4, I as PolicyCredentialRequirementV1, P as PolicyEngineRecord, K as PolicyRootStatusV3, O as PolicyRootV3, Q as PolicySessionUcanFactV1, R as PolicySessionUcanV1, T as PolicyStatus, V as ROOT_REVOCATION_V1_DOMAIN, W as ROOT_REVOCATION_V1_SCHEMA, X as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Y as ROOT_STATUS_RENEWAL_V1_DOMAIN, Z as ROOT_STATUS_V1_DOMAIN, _ as RegisterPolicyV3Input, $ as RegisterPolicyV3Receipt, a0 as SignCompactUcanAuthorizationInput, a1 as SignCompactUcanRootAuthorizationInput, a2 as SignatureMaterialError, a3 as SignatureSuite, a4 as SignatureVerificationError, a5 as SignedObjectCanonicalizationError, a6 as SignedObjectDigestError, a7 as SignedObjectErrorCode, a8 as SignedObjectIdError, a9 as SignedObjectKind, aa as SignedObjectMaterial, ab as SignedObjectProfileError, ac as SignedObjectSchemaError, ad as SignedObjectSignature, S as SignedObjectSigner, ae as SignedObjectVerificationResult, af as SignedPolicyObject, ag as SigningKeyBindingError, ah as UnifiedContentSource, ai as UnifiedEncryptionCapability, aj as UnifiedKvCapability, ak as UnifiedNativeCapability, al as UnifiedPolicyCapability, am as UnifiedPolicyV1, an as UnifiedPolicyV2, ao as UnifiedResourceSelector, ap as UnsignedPolicy, aq as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, ar as UnsignedPolicyObject, as as UnsignedPolicyStatus, at as UnsignedUnifiedPolicyV2, au as UnsupportedSignatureSuiteError, av as admitPolicyCredentialV3, aw as admitPolicyCredentialV4, ax as buildPolicyCredentialPresentationV3, ay as buildPolicyCredentialPresentationV4, az as canonicalizeSignedObjectUnsigned, aA as canonicalizeUnifiedPolicyCapability, aB as compactAttenuationContains, aC as contentSourceDigestHex, aD as createAndSignPolicy, aE as createAndSignPolicyEngineRecord, aF as createAndSignPolicyStatus, aG as createAndSignSignedObject, aJ as deriveSignedObjectMaterial, aK as getPolicyRootStatusV3, aL as issuedCredentialEnvelopeFromVerified, aN as normalizeUnifiedPolicyCapability, aO as parseCompactUcanAuthorization, aP as parsePolicySessionUcan, aQ as policyCidFromCanonicalBytes, aR as policyDigestHex, aS as policyIdForDigestHex, aT as policyV2DigestHex, aU as projectUnifiedPolicyCapabilities, aV as projectUnifiedPolicyCapability, aW as registerPolicyV3, aX as renewPolicyRootStatusV3, aZ as revokePolicyRootV3, a_ as signCompactUcanAuthorization, a$ as signCompactUcanRootAuthorization, b0 as signPolicyCredentialPresentationV4, b1 as signedObjectIdFor, b2 as toSignedObjectError, b3 as unifiedNativeProjectionHashHex, b4 as unifiedPolicyCapabilityContains, b5 as unifiedPolicyCapabilityDigestHex, b6 as unifiedPolicyCapabilityFromNative, b7 as validatePolicyCredentialRequirementV1, b8 as validatePolicyEngineRecordSigned, b9 as validatePolicyEngineRecordSignedShape, ba as validatePolicyEngineRecordUnsigned, bb as validatePolicySigned, bc as validatePolicySignedShape, bd as validatePolicyStatusSigned, be as validatePolicyStatusSignedShape, bf as validatePolicyStatusUnsigned, bg as validatePolicyUnsigned, bh as validateUnifiedPolicyV2, bi as verifyPolicy, bj as verifyPolicyEngineRecord, bk as verifyPolicyRootRevocationV3, bl as verifyPolicyRootStatusCheckpointV3, bm as verifyPolicyStatus, bn as verifySignedObject } from './credential-admission-CFjUChF8.cjs';
+import { bq as CredentialHolderBinding, br as CredentialFlowDescriptor, bs as CredentialRequirement, bt as StoredCredentialRecord, bu as VerifiedCredential, bv as CredentialStorageReceipt, bw as IssuedCredentialEnvelope, bx as CredentialIssuerMetadata } from './credential-admission-BxpkckU0.cjs';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, by as CREDENTIAL_ACQUISITION_PROTOCOL, bz as CREDENTIAL_CONTRACT_VERSION, bA as CREDENTIAL_FORMAT, by as CREDENTIAL_PROTOCOL, bB as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bC as CredentialClaimDescriptor, bD as CredentialEndpointId, bE as CredentialInputDescriptor, bF as CredentialProgressEvent, bG as CredentialStepDescriptor, bH as CredentialStepType, bI as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bJ as HOLDER_BINDING_DOMAIN, bK as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as policyCidFromCanonicalBytes, aS as policyDigestHex, aT as policyIdForDigestHex, aU as policyV2DigestHex, aV as projectUnifiedPolicyCapabilities, aW as projectUnifiedPolicyCapability, aX as registerPolicyV3, aY as renewPolicyRootStatusV3, a_ as revokePolicyRootV3, a$ as signCompactPolicyDescendant, b0 as signCompactUcanAuthorization, b1 as signCompactUcanRootAuthorization, b2 as signPolicyCredentialPresentationV4, b3 as signedObjectIdFor, b4 as toSignedObjectError, b5 as unifiedNativeProjectionHashHex, b6 as unifiedPolicyCapabilityContains, b7 as unifiedPolicyCapabilityDigestHex, b8 as unifiedPolicyCapabilityFromNative, b9 as validatePolicyCredentialRequirementV1, ba as validatePolicyEngineRecordSigned, bb as validatePolicyEngineRecordSignedShape, bc as validatePolicyEngineRecordUnsigned, bd as validatePolicySigned, be as validatePolicySignedShape, bf as validatePolicyStatusSigned, bg as validatePolicyStatusSignedShape, bh as validatePolicyStatusUnsigned, bi as validatePolicyUnsigned, bj as validateUnifiedPolicyV2, bk as verifyPolicy, bl as verifyPolicyEngineRecord, bm as verifyPolicyRootRevocationV3, bn as verifyPolicyRootStatusCheckpointV3, bo as verifyPolicyStatus, bp as verifySignedObject } from './credential-admission-BxpkckU0.cjs';
 export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from '@tinycloud/share-envelope';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, parseSecretCatalogKey, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
-import { bo as CredentialHolderBinding, bp as CredentialFlowDescriptor, bq as CredentialRequirement, br as StoredCredentialRecord, bs as VerifiedCredential, bt as CredentialStorageReceipt, bu as IssuedCredentialEnvelope, bv as CredentialIssuerMetadata } from './credential-admission-DIEPgQ0o.js';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, bw as CREDENTIAL_ACQUISITION_PROTOCOL, bx as CREDENTIAL_CONTRACT_VERSION, by as CREDENTIAL_FORMAT, bw as CREDENTIAL_PROTOCOL, bz as CREDENTIAL_STEP_REGISTRY_VERSION, g as CompactUcanAuthorizationV1, bA as CredentialClaimDescriptor, bB as CredentialEndpointId, bC as CredentialInputDescriptor, bD as CredentialProgressEvent, bE as CredentialStepDescriptor, bF as CredentialStepType, bG as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, h as EIP191_JCS_SIGNATURE_SUITE, bH as HOLDER_BINDING_DOMAIN, bI as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, i as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, j as POLICY_CAPABILITY_V1_DOMAIN, k as POLICY_CAPABILITY_V1_SCHEMA, l as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, m as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, n as POLICY_ENGINE_RECORD_SCHEMA, o as POLICY_PRESENTATION_V3_DOMAIN, p as POLICY_PRESENTATION_V3_SCHEMA, q as POLICY_PRESENTATION_V4_DOMAIN, r as POLICY_PRESENTATION_V4_SCHEMA, s as POLICY_SCHEMA, t as POLICY_SESSION_UCAN_V1_PROFILE, u as POLICY_STATUS_SCHEMA, v as POLICY_V1_DOMAIN, w as POLICY_V1_SCHEMA, x as POLICY_V2_DOMAIN, y as POLICY_V2_SCHEMA, a as Policy, D as PolicyCredentialAdmissionV3, F as PolicyCredentialAdmissionV4, G as PolicyCredentialPresentationV3, H as PolicyCredentialPresentationV4, I as PolicyCredentialRequirementV1, P as PolicyEngineRecord, K as PolicyRootStatusV3, O as PolicyRootV3, Q as PolicySessionUcanFactV1, R as PolicySessionUcanV1, T as PolicyStatus, V as ROOT_REVOCATION_V1_DOMAIN, W as ROOT_REVOCATION_V1_SCHEMA, X as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Y as ROOT_STATUS_RENEWAL_V1_DOMAIN, Z as ROOT_STATUS_V1_DOMAIN, _ as RegisterPolicyV3Input, $ as RegisterPolicyV3Receipt, a0 as SignCompactUcanAuthorizationInput, a1 as SignCompactUcanRootAuthorizationInput, a2 as SignatureMaterialError, a3 as SignatureSuite, a4 as SignatureVerificationError, a5 as SignedObjectCanonicalizationError, a6 as SignedObjectDigestError, a7 as SignedObjectErrorCode, a8 as SignedObjectIdError, a9 as SignedObjectKind, aa as SignedObjectMaterial, ab as SignedObjectProfileError, ac as SignedObjectSchemaError, ad as SignedObjectSignature, S as SignedObjectSigner, ae as SignedObjectVerificationResult, af as SignedPolicyObject, ag as SigningKeyBindingError, ah as UnifiedContentSource, ai as UnifiedEncryptionCapability, aj as UnifiedKvCapability, ak as UnifiedNativeCapability, al as UnifiedPolicyCapability, am as UnifiedPolicyV1, an as UnifiedPolicyV2, ao as UnifiedResourceSelector, ap as UnsignedPolicy, aq as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, ar as UnsignedPolicyObject, as as UnsignedPolicyStatus, at as UnsignedUnifiedPolicyV2, au as UnsupportedSignatureSuiteError, av as admitPolicyCredentialV3, aw as admitPolicyCredentialV4, ax as buildPolicyCredentialPresentationV3, ay as buildPolicyCredentialPresentationV4, az as canonicalizeSignedObjectUnsigned, aA as canonicalizeUnifiedPolicyCapability, aB as compactAttenuationContains, aC as contentSourceDigestHex, aD as createAndSignPolicy, aE as createAndSignPolicyEngineRecord, aF as createAndSignPolicyStatus, aG as createAndSignSignedObject, aJ as deriveSignedObjectMaterial, aK as getPolicyRootStatusV3, aL as issuedCredentialEnvelopeFromVerified, aN as normalizeUnifiedPolicyCapability, aO as parseCompactUcanAuthorization, aP as parsePolicySessionUcan, aQ as policyCidFromCanonicalBytes, aR as policyDigestHex, aS as policyIdForDigestHex, aT as policyV2DigestHex, aU as projectUnifiedPolicyCapabilities, aV as projectUnifiedPolicyCapability, aW as registerPolicyV3, aX as renewPolicyRootStatusV3, aZ as revokePolicyRootV3, a_ as signCompactUcanAuthorization, a$ as signCompactUcanRootAuthorization, b0 as signPolicyCredentialPresentationV4, b1 as signedObjectIdFor, b2 as toSignedObjectError, b3 as unifiedNativeProjectionHashHex, b4 as unifiedPolicyCapabilityContains, b5 as unifiedPolicyCapabilityDigestHex, b6 as unifiedPolicyCapabilityFromNative, b7 as validatePolicyCredentialRequirementV1, b8 as validatePolicyEngineRecordSigned, b9 as validatePolicyEngineRecordSignedShape, ba as validatePolicyEngineRecordUnsigned, bb as validatePolicySigned, bc as validatePolicySignedShape, bd as validatePolicyStatusSigned, be as validatePolicyStatusSignedShape, bf as validatePolicyStatusUnsigned, bg as validatePolicyUnsigned, bh as validateUnifiedPolicyV2, bi as verifyPolicy, bj as verifyPolicyEngineRecord, bk as verifyPolicyRootRevocationV3, bl as verifyPolicyRootStatusCheckpointV3, bm as verifyPolicyStatus, bn as verifySignedObject } from './credential-admission-DIEPgQ0o.js';
+import { bq as CredentialHolderBinding, br as CredentialFlowDescriptor, bs as CredentialRequirement, bt as StoredCredentialRecord, bu as VerifiedCredential, bv as CredentialStorageReceipt, bw as IssuedCredentialEnvelope, bx as CredentialIssuerMetadata } from './credential-admission-CO9WMtGs.js';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, by as CREDENTIAL_ACQUISITION_PROTOCOL, bz as CREDENTIAL_CONTRACT_VERSION, bA as CREDENTIAL_FORMAT, by as CREDENTIAL_PROTOCOL, bB as CREDENTIAL_STEP_REGISTRY_VERSION, f as CompactPolicyDescendantInput, h as CompactUcanAuthorizationV1, bC as CredentialClaimDescriptor, bD as CredentialEndpointId, bE as CredentialInputDescriptor, bF as CredentialProgressEvent, bG as CredentialStepDescriptor, bH as CredentialStepType, bI as CredentialUxState, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, bJ as HOLDER_BINDING_DOMAIN, bK as IssuerVerificationKey, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, a as Policy, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, P as PolicyEngineRecord, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, S as SignedObjectSigner, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, U as UnsignedPolicyEngineRecord, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as policyCidFromCanonicalBytes, aS as policyDigestHex, aT as policyIdForDigestHex, aU as policyV2DigestHex, aV as projectUnifiedPolicyCapabilities, aW as projectUnifiedPolicyCapability, aX as registerPolicyV3, aY as renewPolicyRootStatusV3, a_ as revokePolicyRootV3, a$ as signCompactPolicyDescendant, b0 as signCompactUcanAuthorization, b1 as signCompactUcanRootAuthorization, b2 as signPolicyCredentialPresentationV4, b3 as signedObjectIdFor, b4 as toSignedObjectError, b5 as unifiedNativeProjectionHashHex, b6 as unifiedPolicyCapabilityContains, b7 as unifiedPolicyCapabilityDigestHex, b8 as unifiedPolicyCapabilityFromNative, b9 as validatePolicyCredentialRequirementV1, ba as validatePolicyEngineRecordSigned, bb as validatePolicyEngineRecordSignedShape, bc as validatePolicyEngineRecordUnsigned, bd as validatePolicySigned, be as validatePolicySignedShape, bf as validatePolicyStatusSigned, bg as validatePolicyStatusSignedShape, bh as validatePolicyStatusUnsigned, bi as validatePolicyUnsigned, bj as validateUnifiedPolicyV2, bk as verifyPolicy, bl as verifyPolicyEngineRecord, bm as verifyPolicyRootRevocationV3, bn as verifyPolicyRootStatusCheckpointV3, bo as verifyPolicyStatus, bp as verifySignedObject } from './credential-admission-CO9WMtGs.js';
 export { canonicalEmailDomain, canonicalMailbox, isCanonicalEmailDomain, mailboxBelongsToDomain } from '@tinycloud/share-envelope';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, ParsedSecretCatalogKey, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretCatalogEntry, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, parseSecretCatalogKey, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';

package/dist/index.js

@@ -4031,8 +4031,9 @@ async function signCompactUcanAuthorization(input) {
     throw new Error("compact invocation lifetime must be between one and 60 seconds");
   return signCompactUcan(input);
 }
+var MAX_POLICY_ROOT_SECONDS = 31 * 24 * 60 * 60;
 async function signCompactUcanRootAuthorization(input) {
-  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 31 * 24 * 60 * 60)
+  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > MAX_POLICY_ROOT_SECONDS)
     throw new Error("compact policy root lifetime must be between one second and 31 days");
   return signCompactUcan({ ...input, proofs: [] });
 }
@@ -4067,7 +4068,7 @@ function createCompactPolicyInvocation(input) {
   const signature = ed255193.sign(signingInput, input.privateKey);
   return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url2(signature)}`);
 }
-function createCompactPolicyDescendant(input) {
+function compactPolicyDescendantClaims(input) {
   const parent = parseCompactUcanAuthorization(input.parentAuthorization, input.parentCid);
   if (parent.payload.aud !== input.issuerDid) throw new Error("policy descendant issuer is not the parent audience");
   const parentFact = parent.payload.fct[0];
@@ -4075,29 +4076,53 @@ function createCompactPolicyDescendant(input) {
   if (!Number.isInteger(depth) || depth <= 0) throw new Error("policy descendant depth is exhausted");
   if (!compactAttenuationContains(parent.payload.att, input.attenuation))
     throw new Error("policy descendant exceeds the parent attenuation");
+  const now = Math.max(input.now ?? parent.payload.nbf + 1, parent.payload.nbf + 1);
+  const exp = Math.min(input.expiresAt ?? parent.payload.exp - 1, parent.payload.exp - 1);
+  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
+  return {
+    parentCid: parent.cid,
+    fact: { ...parentFact, remainingRedelegationDepth: depth - 1 },
+    notBefore: now,
+    expiresAt: exp,
+    nonce: input.nonce ?? encodeBase64Url2(crypto.getRandomValues(new Uint8Array(16)))
+  };
+}
+function createCompactPolicyDescendant(input) {
+  const claims = compactPolicyDescendantClaims(input);
   const principal = input.issuerDid.split("#", 1)[0];
   const didMaterial = base58btc.decode(principal.slice("did:key:".length));
   const publicKey = ed255193.getPublicKey(input.privateKey);
   if (didMaterial.length !== 34 || !equalBytes(publicKey, didMaterial.slice(2))) throw new Error("policy descendant signer does not bind issuer DID");
-  const now = Math.max(input.now ?? Math.floor(Date.now() / 1e3), parent.payload.nbf + 1);
-  const exp = Math.min(input.expiresAt ?? now + 60, now + 60, parent.payload.exp - 1);
-  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
   const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url2(publicKey) }, typ: "JWT", ucv: "0.10.0" };
   const payload = {
     att: input.attenuation,
     aud: input.audienceDid,
-    exp,
-    fct: [{ ...parentFact, remainingRedelegationDepth: depth - 1 }],
+    exp: claims.expiresAt,
+    fct: [claims.fact],
     iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
-    nbf: now,
-    nnc: input.nonce ?? encodeBase64Url2(crypto.getRandomValues(new Uint8Array(16))),
-    prf: [parent.cid]
+    nbf: claims.notBefore,
+    nnc: claims.nonce,
+    prf: [claims.parentCid]
   };
   const protectedSegment = encodeBase64Url2(new TextEncoder().encode(jcsCanonicalize(header)));
   const payloadSegment = encodeBase64Url2(new TextEncoder().encode(jcsCanonicalize(payload)));
   const signature = ed255193.sign(new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`), input.privateKey);
   return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url2(signature)}`);
 }
+async function signCompactPolicyDescendant(input) {
+  const claims = compactPolicyDescendantClaims(input);
+  return signCompactUcan({
+    issuerDid: input.issuerDid,
+    audienceDid: input.audienceDid,
+    attenuation: input.attenuation,
+    facts: [claims.fact],
+    proofs: [claims.parentCid],
+    notBefore: claims.notBefore,
+    expiresAt: claims.expiresAt,
+    nonce: claims.nonce,
+    sign: input.sign
+  });
+}
 function compactAttenuationContains(parent, child) {
   const selector = (value) => {
     if (value.length !== 1 || !isRecordValue(value[0])) return void 0;
@@ -4167,7 +4192,7 @@ function parsePolicySessionUcan(authorization, expectedProofs) {
     throw new Error("policy session UCAN fact is incomplete");
   if (hasV4AuditFactShape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)))
     throw new Error("policy session UCAN v4 audit facts are invalid");
-  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > MAX_POLICY_ROOT_SECONDS || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
     throw new Error("policy session UCAN fact is invalid");
   return {
     authorization,
@@ -4591,24 +4616,21 @@ async function admitPolicyCredentialV3(input) {
     policy,
     challenge
   });
-  const response = await fetchFn(
+  const response = await postPolicyDelegation(
+    fetchFn,
     new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin),
     {
-      method: "POST",
-      redirect: "error",
-      signal: input.signal,
-      headers: { accept: "application/json", "content-type": "application/json" },
-      body: JSON.stringify({
-        policyCid: input.policyCid,
-        challengeId: challenge.challengeId,
-        nonce: challenge.nonce,
-        requirement: validateCredentialRequirement(input.requirement),
-        credential: envelopeFromVerified(input.credential),
-        accountAuthorizationCid,
-        credentialSpaceId,
-        presentation
-      })
-    }
+      policyCid: input.policyCid,
+      challengeId: challenge.challengeId,
+      nonce: challenge.nonce,
+      requirement: validateCredentialRequirement(input.requirement),
+      credential: envelopeFromVerified(input.credential),
+      accountAuthorizationCid,
+      credentialSpaceId,
+      presentation
+    },
+    requestedSessionExpiry(input.requestedExpiresAt, policy),
+    input.signal
   );
   if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
   const value = record(await response.json(), "policy delegation");
@@ -4649,20 +4671,20 @@ async function admitPolicyCredentialV4(input) {
     policy,
     challenge
   });
-  const response = await fetchFn(new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin), {
-    method: "POST",
-    redirect: "error",
-    signal: input.signal,
-    headers: { accept: "application/json", "content-type": "application/json" },
-    body: JSON.stringify({
+  const response = await postPolicyDelegation(
+    fetchFn,
+    new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin),
+    {
       policyCid: input.policyCid,
       challengeId: challenge.challengeId,
       nonce: challenge.nonce,
       requirement: validateCredentialRequirement(input.requirement),
       credential: envelopeFromVerified(input.credential),
       presentation
-    })
-  });
+    },
+    requestedSessionExpiry(input.requestedExpiresAt, policy),
+    input.signal
+  );
   if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
   const value = record(await response.json(), "policy delegation");
   if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") throw new Error("policy delegation response is invalid");
@@ -4686,6 +4708,27 @@ async function admitPolicyCredentialV4(input) {
   input.signal?.throwIfAborted();
   return Object.freeze({ challenge, presentation, session, delegationImported: true });
 }
+function requestedSessionExpiry(requested, policy) {
+  const value = requested === void 0 ? policy.expiresAt : requested;
+  if (value === null || value === void 0) return void 0;
+  const seconds = Math.floor(Date.parse(value) / 1e3);
+  if (!Number.isFinite(seconds) || seconds <= Math.floor(Date.now() / 1e3) + 60) return void 0;
+  return new Date(seconds * 1e3).toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+async function postPolicyDelegation(fetchFn, url, body, requestedExpiresAt, signal) {
+  const send = (payload) => fetchFn(url, {
+    method: "POST",
+    redirect: "error",
+    signal,
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify(payload)
+  });
+  if (requestedExpiresAt === void 0) return send(body);
+  const response = await send({ ...body, requestedExpiresAt });
+  if (response.status !== 422) return response;
+  await response.body?.cancel().catch(() => void 0);
+  return send(body);
+}
 function policyRuntimeBasePath2(value) {
   const path = value ?? "/policy/v3";
   if (!/^\/policy(?:\/[a-z0-9-]+)*$/.test(path)) {
@@ -18820,6 +18863,7 @@ export {
   serviceError5 as serviceError,
   sha256Base64Url,
   shareCapabilityAllows,
+  signCompactPolicyDescendant,
   signCompactUcanAuthorization,
   signCompactUcanRootAuthorization,
   signLocationRecord,