@tinycloud/sdk-core 3.0.0-beta.5 → 3.0.0-beta.6

package/dist/index.js

@@ -1790,16 +1790,16 @@ function policyCapabilityContains(authority, request) {
   return caveatsContain(auth.caveats, req.caveats);
 }
 function normalizePolicyCapabilityWithOptions(input, options2) {
-  const object3 = expectObject(input, "$");
-  assertExactKeys(object3, ["service", "space", "path", "actions", "caveats"], "$");
-  const service = requiredString(object3, "service", "$", "policy-capability-malformed-service");
+  const object4 = expectObject(input, "$");
+  assertExactKeys(object4, ["service", "space", "path", "actions", "caveats"], "$");
+  const service = requiredString(object4, "service", "$", "policy-capability-malformed-service");
   if (!CEILING_SERVICES.has(service)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-service",
       "$.service is outside the frozen permissionsCeiling vocabulary"
     );
   }
-  const space = requiredString(object3, "space", "$", "policy-capability-malformed-space");
+  const space = requiredString(object4, "space", "$", "policy-capability-malformed-space");
   validateConcreteSpace(space);
   const canonicalSpace = space.normalize("NFC");
   if (options2.requireCanonical && canonicalSpace !== space) {
@@ -1808,7 +1808,7 @@ function normalizePolicyCapabilityWithOptions(input, options2) {
       "$.space must already be canonical NFC"
     );
   }
-  const rawPath = requiredString(object3, "path", "$", "policy-capability-malformed-path");
+  const rawPath = requiredString(object4, "path", "$", "policy-capability-malformed-path");
   validateRawPath(rawPath, options2);
   const path = normalizePath(rawPath);
   if (options2.requireCanonical && path !== rawPath) {
@@ -1819,7 +1819,7 @@ function normalizePolicyCapabilityWithOptions(input, options2) {
   }
   validateRawPath(path, options2);
   const actions = normalizeActions(
-    requiredArray(object3, "actions", "$", "policy-capability-malformed-action"),
+    requiredArray(object4, "actions", "$", "policy-capability-malformed-action"),
     service,
     options2
   );
@@ -1828,9 +1828,9 @@ function normalizePolicyCapabilityWithOptions(input, options2) {
   output.space = canonicalSpace;
   output.path = path;
   output.actions = actions;
-  if (hasOwn(object3, "caveats")) {
+  if (hasOwn(object4, "caveats")) {
     output.caveats = validateCaveats(
-      requiredValue(object3, "caveats", "$", "policy-capability-malformed-caveats"),
+      requiredValue(object4, "caveats", "$", "policy-capability-malformed-caveats"),
       output.service
     );
   }
@@ -1853,9 +1853,9 @@ function expectObject(input, path) {
     );
   }
 }
-function assertExactKeys(object3, allowed, path) {
+function assertExactKeys(object4, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object3)) {
+  for (const key of Object.keys(object4)) {
     if (!allowedSet.has(key)) {
       throw new PolicyCapabilityError(
         key === "id" || key === "scope" ? "policy-capability-malformed" : "policy-capability-unknown-key",
@@ -1864,21 +1864,21 @@ function assertExactKeys(object3, allowed, path) {
     }
   }
 }
-function requiredValue(object3, key, path, code3) {
-  if (!hasOwn(object3, key)) {
+function requiredValue(object4, key, path, code3) {
+  if (!hasOwn(object4, key)) {
     throw new PolicyCapabilityError(code3, `${path}.${key} is required`);
   }
-  return object3[key];
+  return object4[key];
 }
-function requiredString(object3, key, path, code3) {
-  const value = requiredValue(object3, key, path, code3);
+function requiredString(object4, key, path, code3) {
+  const value = requiredValue(object4, key, path, code3);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyCapabilityError(code3, `${path}.${key} must be a non-empty string`);
   }
   return value;
 }
-function requiredArray(object3, key, path, code3) {
-  const value = requiredValue(object3, key, path, code3);
+function requiredArray(object4, key, path, code3) {
+  const value = requiredValue(object4, key, path, code3);
   if (!Array.isArray(value)) {
     throw new PolicyCapabilityError(code3, `${path}.${key} must be an array`);
   }
@@ -2023,11 +2023,11 @@ function validateSqlStatement(input, path) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new PolicyCapabilityError("policy-capability-malformed-caveats", `${path} must be an object`);
   }
-  const object3 = input;
-  assertCaveatKeys(object3, ["name", "sql", "fixedParams"], path);
-  caveatString(object3, "name", path);
-  caveatString(object3, "sql", path);
-  const fixedParams = requiredCaveat(object3, "fixedParams", path);
+  const object4 = input;
+  assertCaveatKeys(object4, ["name", "sql", "fixedParams"], path);
+  caveatString(object4, "name", path);
+  caveatString(object4, "sql", path);
+  const fixedParams = requiredCaveat(object4, "fixedParams", path);
   if (!Array.isArray(fixedParams)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
@@ -2042,20 +2042,20 @@ function validateFixedParam(input, path) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new PolicyCapabilityError("policy-capability-malformed-caveats", `${path} must be an object`);
   }
-  const object3 = input;
-  assertCaveatKeys(object3, ["index", "value"], path);
-  const index = requiredCaveat(object3, "index", path);
+  const object4 = input;
+  assertCaveatKeys(object4, ["index", "value"], path);
+  const index = requiredCaveat(object4, "index", path);
   if (typeof index !== "number" || !Number.isSafeInteger(index) || index < 0) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
       `${path}.index must be a non-negative integer`
     );
   }
-  requiredCaveat(object3, "value", path);
+  requiredCaveat(object4, "value", path);
 }
-function assertCaveatKeys(object3, allowed, path) {
+function assertCaveatKeys(object4, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object3)) {
+  for (const key of Object.keys(object4)) {
     if (!allowedSet.has(key)) {
       throw new PolicyCapabilityError(
         "policy-capability-malformed-caveats",
@@ -2064,17 +2064,17 @@ function assertCaveatKeys(object3, allowed, path) {
     }
   }
 }
-function requiredCaveat(object3, key, path) {
-  if (!hasOwn(object3, key)) {
+function requiredCaveat(object4, key, path) {
+  if (!hasOwn(object4, key)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
       `${path}.${key} is required`
     );
   }
-  return object3[key];
+  return object4[key];
 }
-function caveatString(object3, key, path) {
-  const value = requiredCaveat(object3, key, path);
+function caveatString(object4, key, path) {
+  const value = requiredCaveat(object4, key, path);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
@@ -2105,8 +2105,8 @@ function caveatsContain(authority, request) {
     (statement) => authorityStatements.some((candidate) => jcsCanonicalize(candidate) === jcsCanonicalize(statement))
   );
 }
-function hasOwn(object3, key) {
-  return objectHasOwn2(object3, key);
+function hasOwn(object4, key) {
+  return objectHasOwn2(object4, key);
 }
 
 // src/policy/signed-object.ts
@@ -2434,17 +2434,17 @@ async function createAndSignSignedObject(input, signer) {
 }
 function createAndSignPolicy(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object3) => validatePolicySignedShape(object3)
+    (object4) => validatePolicySignedShape(object4)
   );
 }
 function createAndSignPolicyStatus(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object3) => validatePolicyStatusSignedShape(object3)
+    (object4) => validatePolicyStatusSignedShape(object4)
   );
 }
 function createAndSignPolicyEngineRecord(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object3) => validatePolicyEngineRecordSignedShape(object3)
+    (object4) => validatePolicyEngineRecordSignedShape(object4)
   );
 }
 async function verifySignedObject(input) {
@@ -2548,9 +2548,9 @@ function validateUnsignedForDescriptor(input, descriptor) {
   }
 }
 function validatePolicyShape(input, signed) {
-  const object3 = expectJsonObject(normalizeJson(input), "$");
+  const object4 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object3,
+    object4,
     signed ? [
       "schema",
       "policyId",
@@ -2578,30 +2578,30 @@ function validatePolicyShape(input, signed) {
     ],
     "$"
   );
-  expectConst(requiredString2(object3, "schema", "$"), POLICY_SCHEMA, "$.schema");
+  expectConst(requiredString2(object4, "schema", "$"), POLICY_SCHEMA, "$.schema");
   if (signed) {
-    requiredString2(object3, "policyId", "$");
-    validateSignature(requiredValue2(object3, "signature", "$"));
+    requiredString2(object4, "policyId", "$");
+    validateSignature(requiredValue2(object4, "signature", "$"));
   }
-  requiredString2(object3, "ownerDid", "$");
-  requiredString2(object3, "signingKeyDid", "$");
-  requiredDateString(object3, "createdAt", "$");
-  optionalDateString(object3, "expiresAt", "$");
-  validatePolicyResource(requiredValue2(object3, "resource", "$"), "$.resource");
-  validateExpression(requiredValue2(object3, "when", "$"), "$.when");
-  validateGrant(requiredValue2(object3, "grant", "$"), "$.grant");
-  if (hasOwn2(object3, "disclosure")) {
-    validateDisclosure(requiredValue2(object3, "disclosure", "$"), "$.disclosure");
+  requiredString2(object4, "ownerDid", "$");
+  requiredString2(object4, "signingKeyDid", "$");
+  requiredDateString(object4, "createdAt", "$");
+  optionalDateString(object4, "expiresAt", "$");
+  validatePolicyResource(requiredValue2(object4, "resource", "$"), "$.resource");
+  validateExpression(requiredValue2(object4, "when", "$"), "$.when");
+  validateGrant(requiredValue2(object4, "grant", "$"), "$.grant");
+  if (hasOwn2(object4, "disclosure")) {
+    validateDisclosure(requiredValue2(object4, "disclosure", "$"), "$.disclosure");
   }
-  if (hasOwn2(object3, "audit")) {
-    validateAudit(requiredValue2(object3, "audit", "$"), "$.audit");
+  if (hasOwn2(object4, "audit")) {
+    validateAudit(requiredValue2(object4, "audit", "$"), "$.audit");
   }
-  return object3;
+  return object4;
 }
 function validatePolicyStatusShape(input, signed) {
-  const object3 = expectJsonObject(normalizeJson(input), "$");
+  const object4 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object3,
+    object4,
     signed ? [
       "schema",
       "statusId",
@@ -2625,28 +2625,28 @@ function validatePolicyStatusShape(input, signed) {
     ],
     "$"
   );
-  expectConst(requiredString2(object3, "schema", "$"), POLICY_STATUS_SCHEMA, "$.schema");
+  expectConst(requiredString2(object4, "schema", "$"), POLICY_STATUS_SCHEMA, "$.schema");
   if (signed) {
-    requiredString2(object3, "statusId", "$");
-    validateSignature(requiredValue2(object3, "signature", "$"));
+    requiredString2(object4, "statusId", "$");
+    validateSignature(requiredValue2(object4, "signature", "$"));
   }
-  requiredString2(object3, "policyId", "$");
-  requiredString2(object3, "ownerDid", "$");
-  requiredInteger(object3, "sequence", "$", 0);
-  expectOneOf(requiredString2(object3, "disposition", "$"), [
+  requiredString2(object4, "policyId", "$");
+  requiredString2(object4, "ownerDid", "$");
+  requiredInteger(object4, "sequence", "$", 0);
+  expectOneOf(requiredString2(object4, "disposition", "$"), [
     "active",
     "suspended",
     "revoked"
   ], "$.disposition");
-  requiredDateString(object3, "effectiveAt", "$");
-  optionalString(object3, "reasonCode", "$");
-  requiredString2(object3, "signingKeyDid", "$");
-  return object3;
+  requiredDateString(object4, "effectiveAt", "$");
+  optionalString(object4, "reasonCode", "$");
+  requiredString2(object4, "signingKeyDid", "$");
+  return object4;
 }
 function validatePolicyEngineRecordShape(input, signed) {
-  const object3 = expectJsonObject(normalizeJson(input), "$");
+  const object4 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object3,
+    object4,
     signed ? [
       "schema",
       "engineRecordId",
@@ -2671,44 +2671,44 @@ function validatePolicyEngineRecordShape(input, signed) {
     "$"
   );
   expectConst(
-    requiredString2(object3, "schema", "$"),
+    requiredString2(object4, "schema", "$"),
     POLICY_ENGINE_RECORD_SCHEMA,
     "$.schema"
   );
   if (signed) {
-    requiredString2(object3, "engineRecordId", "$");
-    validateSignature(requiredValue2(object3, "signature", "$"));
+    requiredString2(object4, "engineRecordId", "$");
+    validateSignature(requiredValue2(object4, "signature", "$"));
   }
-  requiredString2(object3, "ownerDid", "$");
-  requiredString2(object3, "endpoint", "$");
-  requiredString2(object3, "audience", "$");
+  requiredString2(object4, "ownerDid", "$");
+  requiredString2(object4, "endpoint", "$");
+  requiredString2(object4, "audience", "$");
   requiredStringArray(
-    object3,
+    object4,
     "supportedPolicyVersions",
     "$",
     (value, path) => expectConst(value, "v0", path)
   );
-  requiredStringArray(object3, "supportedEvidenceVerifiers", "$");
-  requiredString2(object3, "grantIssuerDid", "$");
-  requiredDateString(object3, "expiresAt", "$");
-  return object3;
+  requiredStringArray(object4, "supportedEvidenceVerifiers", "$");
+  requiredString2(object4, "grantIssuerDid", "$");
+  requiredDateString(object4, "expiresAt", "$");
+  return object4;
 }
 function validateSignature(input) {
-  const object3 = expectJsonObject(input, "$.signature");
-  assertExactKeys2(object3, ["suite", "signerDid", "value"], "$.signature");
-  const suite = requiredString2(object3, "suite", "$.signature");
+  const object4 = expectJsonObject(input, "$.signature");
+  assertExactKeys2(object4, ["suite", "signerDid", "value"], "$.signature");
+  const suite = requiredString2(object4, "suite", "$.signature");
   assertSupportedSignatureSuite(suite);
-  const signerDid = requiredString2(object3, "signerDid", "$.signature");
-  const value = requiredString2(object3, "value", "$.signature");
+  const signerDid = requiredString2(object4, "signerDid", "$.signature");
+  const value = requiredString2(object4, "value", "$.signature");
   decodeSignatureValue(value, suite);
   return { suite, signerDid, value };
 }
 function validatePolicyResource(input, path) {
-  const object3 = expectJsonObject(input, path);
-  assertExactKeys2(object3, ["resourceType", "resourceId", "permissionsCeiling"], path);
-  requiredString2(object3, "resourceType", path);
-  requiredString2(object3, "resourceId", path);
-  const ceiling = requiredArray2(object3, "permissionsCeiling", path, 1);
+  const object4 = expectJsonObject(input, path);
+  assertExactKeys2(object4, ["resourceType", "resourceId", "permissionsCeiling"], path);
+  requiredString2(object4, "resourceType", path);
+  requiredString2(object4, "resourceId", path);
+  const ceiling = requiredArray2(object4, "permissionsCeiling", path, 1);
   for (let index = 0; index < ceiling.length; index++) {
     validatePolicyCapability(ceiling[index], `${path}.permissionsCeiling[${index}]`);
   }
@@ -2724,10 +2724,10 @@ function validatePolicyPermissionsCeilingForSigning(input) {
   }
 }
 function validatePolicyCapability(input, path) {
-  const object3 = expectJsonObject(input, path);
+  const object4 = expectJsonObject(input, path);
   try {
-    const canonical = canonicalizePolicyCapability(object3);
-    if (jcsCanonicalize(object3) !== jcsCanonicalize(canonical)) {
+    const canonical = canonicalizePolicyCapability(object4);
+    if (jcsCanonicalize(object4) !== jcsCanonicalize(canonical)) {
       throw new SignedObjectSchemaError(`${path} must be canonical PolicyCapability JSON`);
     }
   } catch (error) {
@@ -2740,10 +2740,10 @@ function validatePolicyCapability(input, path) {
   }
 }
 function validatePolicyCapabilityForSigning(input, path) {
-  const object3 = expectJsonObject(input, path);
+  const object4 = expectJsonObject(input, path);
   try {
-    const canonical = normalizePolicyCapability(object3);
-    if (jcsCanonicalize(object3) !== jcsCanonicalize(canonical)) {
+    const canonical = normalizePolicyCapability(object4);
+    if (jcsCanonicalize(object4) !== jcsCanonicalize(canonical)) {
       throw new SignedObjectSchemaError(`${path} must be strict canonical PolicyCapability JSON`);
     }
   } catch (error) {
@@ -2756,43 +2756,43 @@ function validatePolicyCapabilityForSigning(input, path) {
   }
 }
 function validateExpression(input, path) {
-  const object3 = expectJsonObject(input, path);
-  const keys = Object.keys(object3);
+  const object4 = expectJsonObject(input, path);
+  const keys = Object.keys(object4);
   if (keys.length !== 1) {
     throw new SignedObjectSchemaError(`${path} must have exactly one expression key`);
   }
   const key = keys[0];
   if (key === "allOf" || key === "anyOf") {
-    const values = requiredArray2(object3, key, path, 1);
+    const values = requiredArray2(object4, key, path, 1);
     for (let index = 0; index < values.length; index++) {
       validateExpression(values[index], `${path}.${key}[${index}]`);
     }
     return;
   }
   if (key === "subject") {
-    const subject = expectJsonObject(requiredValue2(object3, "subject", path), `${path}.subject`);
+    const subject = expectJsonObject(requiredValue2(object4, "subject", path), `${path}.subject`);
     assertExactKeys2(subject, ["did"], `${path}.subject`);
     requiredString2(subject, "did", `${path}.subject`);
     return;
   }
   if (key === "evidence") {
-    validateEvidenceRequirement(requiredValue2(object3, "evidence", path), `${path}.evidence`);
+    validateEvidenceRequirement(requiredValue2(object4, "evidence", path), `${path}.evidence`);
     return;
   }
   throw new SignedObjectSchemaError(`${path} has unknown expression key ${key}`);
 }
 function validateEvidenceRequirement(input, path) {
-  const object3 = expectJsonObject(input, path);
+  const object4 = expectJsonObject(input, path);
   assertExactKeys2(
-    object3,
+    object4,
     ["requirementId", "verifier", "requirements", "authority", "freshness"],
     path
   );
-  requiredString2(object3, "requirementId", path);
-  requiredString2(object3, "verifier", path);
-  requiredValue2(object3, "requirements", path);
-  if (hasOwn2(object3, "authority")) {
-    const authority = expectJsonObject(requiredValue2(object3, "authority", path), `${path}.authority`);
+  requiredString2(object4, "requirementId", path);
+  requiredString2(object4, "verifier", path);
+  requiredValue2(object4, "requirements", path);
+  if (hasOwn2(object4, "authority")) {
+    const authority = expectJsonObject(requiredValue2(object4, "authority", path), `${path}.authority`);
     assertExactKeys2(
       authority,
       ["profile", "acceptedIssuers", "allowOwnerAuthorizedIssuer"],
@@ -2804,35 +2804,35 @@ function validateEvidenceRequirement(input, path) {
     }
     optionalBoolean(authority, "allowOwnerAuthorizedIssuer", `${path}.authority`);
   }
-  if (hasOwn2(object3, "freshness")) {
-    const freshness = expectJsonObject(requiredValue2(object3, "freshness", path), `${path}.freshness`);
+  if (hasOwn2(object4, "freshness")) {
+    const freshness = expectJsonObject(requiredValue2(object4, "freshness", path), `${path}.freshness`);
     assertExactKeys2(freshness, ["maxStatusAgeSeconds"], `${path}.freshness`);
     requiredInteger(freshness, "maxStatusAgeSeconds", `${path}.freshness`, 0);
   }
 }
 function validateGrant(input, path) {
-  const object3 = expectJsonObject(input, path);
-  assertExactKeys2(object3, ["output", "maxTtlSeconds", "delegationMode", "revocation"], path);
-  expectConst(requiredString2(object3, "output", path), "portable-delegation", `${path}.output`);
-  requiredInteger(object3, "maxTtlSeconds", path, 1);
-  expectOneOf(requiredString2(object3, "delegationMode", path), [
+  const object4 = expectJsonObject(input, path);
+  assertExactKeys2(object4, ["output", "maxTtlSeconds", "delegationMode", "revocation"], path);
+  expectConst(requiredString2(object4, "output", path), "portable-delegation", `${path}.output`);
+  requiredInteger(object4, "maxTtlSeconds", path, 1);
+  expectOneOf(requiredString2(object4, "delegationMode", path), [
     "terminal",
     "attenuable"
   ], `${path}.delegationMode`);
-  expectOneOf(requiredString2(object3, "revocation", path), [
+  expectOneOf(requiredString2(object4, "revocation", path), [
     "refresh_only",
     "active_cutoff"
   ], `${path}.revocation`);
 }
 function validateDisclosure(input, path) {
-  const object3 = expectJsonObject(input, path);
-  assertExactKeys2(object3, ["denial"], path);
-  expectOneOf(requiredString2(object3, "denial", path), ["none", "code", "debug"], `${path}.denial`);
+  const object4 = expectJsonObject(input, path);
+  assertExactKeys2(object4, ["denial"], path);
+  expectOneOf(requiredString2(object4, "denial", path), ["none", "code", "debug"], `${path}.denial`);
 }
 function validateAudit(input, path) {
-  const object3 = expectJsonObject(input, path);
-  assertExactKeys2(object3, ["issuance"], path);
-  expectOneOf(requiredString2(object3, "issuance", path), ["off", "security", "full"], `${path}.issuance`);
+  const object4 = expectJsonObject(input, path);
+  assertExactKeys2(object4, ["issuance"], path);
+  expectOneOf(requiredString2(object4, "issuance", path), ["off", "security", "full"], `${path}.issuance`);
 }
 function materialForUnsigned(unsigned, descriptor) {
   const jcs = jcsCanonicalize(unsigned);
@@ -2981,9 +2981,9 @@ function encodeSignatureValue(value, suite) {
   decodeSignatureValue(encoded, suite);
   return encoded;
 }
-function stripOwnIdAndSignature(object3, descriptor) {
+function stripOwnIdAndSignature(object4, descriptor) {
   const output = /* @__PURE__ */ Object.create(null);
-  for (const [key, value] of Object.entries(object3)) {
+  for (const [key, value] of Object.entries(object4)) {
     if (key === descriptor.idField || key === "signature") {
       continue;
     }
@@ -2992,8 +2992,8 @@ function stripOwnIdAndSignature(object3, descriptor) {
   return output;
 }
 function descriptorForUnsigned(input) {
-  const object3 = expectJsonObject(normalizeJson(input), "$");
-  return descriptorForSchema(requiredString2(object3, "schema", "$"));
+  const object4 = expectJsonObject(normalizeJson(input), "$");
+  return descriptorForSchema(requiredString2(object4, "schema", "$"));
 }
 function descriptorForSchema(schema) {
   if (schema === POLICY_SCHEMA) return DESCRIPTORS.Policy;
@@ -3007,28 +3007,28 @@ function expectJsonObject(input, path) {
   }
   return input;
 }
-function assertExactKeys2(object3, allowed, path) {
+function assertExactKeys2(object4, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object3)) {
+  for (const key of Object.keys(object4)) {
     if (!allowedSet.has(key)) {
       throw new SignedObjectSchemaError(`${path} has unknown field ${key}`);
     }
   }
 }
-function requiredValue2(object3, key, path) {
-  if (!hasOwn2(object3, key)) {
+function requiredValue2(object4, key, path) {
+  if (!hasOwn2(object4, key)) {
     throw new SignedObjectSchemaError(`${path}.${key} is required`);
   }
-  return object3[key];
+  return object4[key];
 }
-function requiredString2(object3, key, path) {
-  return requireStringType(requiredValue2(object3, key, path), `${path}.${key}`);
+function requiredString2(object4, key, path) {
+  return requireStringType(requiredValue2(object4, key, path), `${path}.${key}`);
 }
-function optionalString(object3, key, path) {
-  if (!hasOwn2(object3, key)) {
+function optionalString(object4, key, path) {
+  if (!hasOwn2(object4, key)) {
     return;
   }
-  requireStringType(requiredValue2(object3, key, path), `${path}.${key}`);
+  requireStringType(requiredValue2(object4, key, path), `${path}.${key}`);
 }
 function requireStringType(value, path) {
   if (typeof value !== "string" || value.length === 0) {
@@ -3036,16 +3036,16 @@ function requireStringType(value, path) {
   }
   return value;
 }
-function optionalBoolean(object3, key, path) {
-  if (!hasOwn2(object3, key)) {
+function optionalBoolean(object4, key, path) {
+  if (!hasOwn2(object4, key)) {
     return;
   }
-  if (typeof requiredValue2(object3, key, path) !== "boolean") {
+  if (typeof requiredValue2(object4, key, path) !== "boolean") {
     throw new SignedObjectSchemaError(`${path}.${key} must be a boolean`);
   }
 }
-function requiredInteger(object3, key, path, minimum) {
-  const value = requiredValue2(object3, key, path);
+function requiredInteger(object4, key, path, minimum) {
+  const value = requiredValue2(object4, key, path);
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum) {
     throw new SignedObjectSchemaError(
       `${path}.${key} must be an integer >= ${minimum}`
@@ -3053,8 +3053,8 @@ function requiredInteger(object3, key, path, minimum) {
   }
   return value;
 }
-function requiredArray2(object3, key, path, minimum) {
-  const value = requiredValue2(object3, key, path);
+function requiredArray2(object4, key, path, minimum) {
+  const value = requiredValue2(object4, key, path);
   if (!Array.isArray(value) || value.length < minimum) {
     throw new SignedObjectSchemaError(
       `${path}.${key} must be an array with at least ${minimum} item(s)`
@@ -3062,22 +3062,22 @@ function requiredArray2(object3, key, path, minimum) {
   }
   return value;
 }
-function requiredStringArray(object3, key, path, check) {
-  const values = requiredArray2(object3, key, path, 0);
+function requiredStringArray(object4, key, path, check) {
+  const values = requiredArray2(object4, key, path, 0);
   for (let index = 0; index < values.length; index++) {
     const itemPath = `${path}.${key}[${index}]`;
     const value = requireStringType(values[index], itemPath);
     check?.(value, itemPath);
   }
 }
-function requiredDateString(object3, key, path) {
-  assertRfc3339(requiredString2(object3, key, path), `${path}.${key}`);
+function requiredDateString(object4, key, path) {
+  assertRfc3339(requiredString2(object4, key, path), `${path}.${key}`);
 }
-function optionalDateString(object3, key, path) {
-  if (!hasOwn2(object3, key)) {
+function optionalDateString(object4, key, path) {
+  if (!hasOwn2(object4, key)) {
     return;
   }
-  assertRfc3339(requiredString2(object3, key, path), `${path}.${key}`);
+  assertRfc3339(requiredString2(object4, key, path), `${path}.${key}`);
 }
 function assertRfc3339(value, path) {
   const match = value.match(
@@ -3109,8 +3109,8 @@ function expectOneOf(actual, allowed, path) {
   }
   throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);
 }
-function hasOwn2(object3, key) {
-  return objectHasOwn3(object3, key);
+function hasOwn2(object4, key) {
+  return objectHasOwn3(object4, key);
 }
 function assertSupportedSignatureSuite(suite) {
   if (suite !== ED25519_JCS_SIGNATURE_SUITE && suite !== EIP191_JCS_SIGNATURE_SUITE) {
@@ -3337,9 +3337,9 @@ function expectObject2(input, path, code3) {
     );
   }
 }
-function assertExactKeys3(object3, allowed, path) {
+function assertExactKeys3(object4, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object3)) {
+  for (const key of Object.keys(object4)) {
     if (!allowedSet.has(key)) {
       throw new PolicyAuthoringError(
         "policy-authoring-unknown-key",
@@ -3348,17 +3348,17 @@ function assertExactKeys3(object3, allowed, path) {
     }
   }
 }
-function requiredValue3(object3, key, path) {
-  if (!hasOwn3(object3, key)) {
+function requiredValue3(object4, key, path) {
+  if (!hasOwn3(object4, key)) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
       `${path}.${key} is required`
     );
   }
-  return object3[key];
+  return object4[key];
 }
-function requiredString3(object3, key, path) {
-  const value = requiredValue3(object3, key, path);
+function requiredString3(object4, key, path) {
+  const value = requiredValue3(object4, key, path);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
@@ -3367,11 +3367,11 @@ function requiredString3(object3, key, path) {
   }
   return value;
 }
-function fieldString(object3, key, path, code3) {
-  if (!hasOwn3(object3, key)) {
+function fieldString(object4, key, path, code3) {
+  if (!hasOwn3(object4, key)) {
     throw new PolicyAuthoringError(code3, `${path}.${key} is required`);
   }
-  const value = object3[key];
+  const value = object4[key];
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyAuthoringError(
       code3,
@@ -3409,8 +3409,8 @@ function parseStrictRfc3339(value, path) {
 var objectHasOwn4 = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
   Object.prototype.hasOwnProperty
 );
-function hasOwn3(object3, key) {
-  return objectHasOwn4(object3, key);
+function hasOwn3(object4, key) {
+  return objectHasOwn4(object4, key);
 }
 
 // src/policy/unified.ts
@@ -7929,13 +7929,13 @@ function canonicalizeRecapCaveats(caveats) {
     }
     if (Array.isArray(value)) return `[${value.map(canonicalize).join(",")}]`;
     if (typeof value === "object") {
-      const object3 = value;
-      const prototype = Object.getPrototypeOf(object3);
+      const object4 = value;
+      const prototype = Object.getPrototypeOf(object4);
       if (prototype !== Object.prototype && prototype !== null) {
         throw new Error("ReCap caveats must contain only JSON values.");
       }
-      return `{${Object.keys(object3).sort().map(
-        (key) => `${JSON.stringify(key)}:${canonicalize(object3[key])}`
+      return `{${Object.keys(object4).sort().map(
+        (key) => `${JSON.stringify(key)}:${canonicalize(object4[key])}`
       ).join(",")}}`;
     }
     throw new Error("ReCap caveats must contain only JSON values.");
@@ -8070,8 +8070,8 @@ function canonicalJson(value) {
   }
   if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
   if (typeof value === "object") {
-    const object3 = value;
-    return `{${Object.keys(object3).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object3[key])}`).join(",")}}`;
+    const object4 = value;
+    return `{${Object.keys(object4).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object4[key])}`).join(",")}}`;
   }
   throw new ShareEnvelopeError("invalid-envelope", "unsupported JSON value");
 }
@@ -9253,8 +9253,8 @@ function canonicalJsonForProof(value) {
   }
   if (Array.isArray(value)) return `[${value.map(canonicalJsonForProof).join(",")}]`;
   if (typeof value === "object") {
-    const object3 = value;
-    return `{${Object.keys(object3).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonForProof(object3[key])}`).join(",")}}`;
+    const object4 = value;
+    return `{${Object.keys(object4).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonForProof(object4[key])}`).join(",")}}`;
   }
   throw new ShareAccessError("SHARE_SESSION_INVALID");
 }
@@ -9963,12 +9963,12 @@ var ShareRecipientClient = class {
     this.assertDetachedProof(request.proof);
   }
   parseSessionCapability(value) {
-    const object3 = this.requireObject(value, "session capability");
-    if (typeof object3.spaceId !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability space is invalid");
-    if (!Array.isArray(object3.actions) || object3.actions.some((action) => !["read", "list", "edit"].includes(action))) throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability actions are invalid");
-    const resource = this.requireObject(object3.resource, "session capability resource");
+    const object4 = this.requireObject(value, "session capability");
+    if (typeof object4.spaceId !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability space is invalid");
+    if (!Array.isArray(object4.actions) || object4.actions.some((action) => !["read", "list", "edit"].includes(action))) throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability actions are invalid");
+    const resource = this.requireObject(object4.resource, "session capability resource");
     if (resource.kind !== "exact" && resource.kind !== "prefix" || typeof resource.path !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability resource is invalid");
-    return { spaceId: object3.spaceId, actions: [...new Set(object3.actions)], resource: { kind: resource.kind, path: resource.path } };
+    return { spaceId: object4.spaceId, actions: [...new Set(object4.actions)], resource: { kind: resource.kind, path: resource.path } };
   }
   assertProvidedPolicySession(session, envelope) {
     const sessionExpiry = dateValue(session.expiresAt);
@@ -11709,6 +11709,97 @@ function shareDeliveryTrustedKid(publicKey) {
   return `${did}#${did.slice("did:key:".length)}`;
 }
 
+// src/delegations/share-delivery-v3.ts
+import { ed25519 as ed2551910 } from "@noble/curves/ed25519";
+var SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v3\0";
+var AUTHORIZATION_KEYS2 = [
+  "type",
+  "version",
+  "jti",
+  "shareCid",
+  "shareId",
+  "policyCid",
+  "policyRootCid",
+  "enforcementRootCid",
+  "nodeAudience",
+  "enforcerDid",
+  "targetOrigin",
+  "openCredentialsAudience",
+  "holder",
+  "recipientMatcher",
+  "deliveryEmail",
+  "shareUrl",
+  "returnOrigin",
+  "documentName",
+  "senderDid",
+  "senderTrust",
+  "contentSource",
+  "contentSourceDigestHex",
+  "shareExpiresAt",
+  "issuedAt",
+  "reportAbuseToken",
+  "actions",
+  "resource",
+  "requestBodyDigest",
+  "idempotencyKey",
+  "expiresAt",
+  "dataAuthority"
+];
+function exactObject(value, keys, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
+  const record2 = value;
+  if (Object.keys(record2).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record2, key))) throw new Error(`${label} has unknown or missing fields`);
+  return record2;
+}
+function decodeBase64Url3(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("share delivery value is not canonical base64url");
+  if (typeof atob === "function") {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
+    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+  }
+  if (typeof Buffer !== "undefined") return new Uint8Array(Buffer.from(value, "base64url"));
+  throw new Error("base64url decoding is unavailable");
+}
+function object3(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
+  return value;
+}
+function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes2));
+  } catch {
+    throw new Error("v3 share delivery response is not valid UTF-8 JSON");
+  }
+  const root = exactObject(parsed, ["authorization", "proof"], "v3 share delivery response");
+  const authorization = exactObject(root.authorization, AUTHORIZATION_KEYS2, "v3 share delivery authorization");
+  const proof = exactObject(root.proof, ["alg", "kid", "signature"], "v3 share delivery proof");
+  const envelope = object3(expected.request.envelope, "v3 share envelope");
+  const policyRoot = object3(envelope.policyRoot, "v3 policy root");
+  const enforcementRoot = object3(envelope.enforcementRoot, "v3 enforcement root");
+  const target = object3(envelope.target, "v3 target");
+  const display = object3(envelope.display, "v3 display");
+  const resource = object3(envelope.resource, "v3 resource");
+  const envelopeSignature = object3(envelope.signature, "v3 envelope signature");
+  const shareUrl = new URL(expected.request.shareUrl);
+  const targetOrigin = String(target.origin);
+  const targetUrl = new URL(targetOrigin);
+  const targetHost = targetUrl.hostname;
+  const expectedNodeAudience = `did:web:${targetHost}`;
+  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 3 || authorization.dataAuthority !== false || authorization.jti !== expected.request.jti || authorization.shareCid !== expected.request.shareCid || authorization.shareId !== envelope.shareId || authorization.policyCid !== envelope.policyCid || authorization.policyRootCid !== policyRoot.cid || authorization.enforcementRootCid !== enforcementRoot.cid || authorization.enforcerDid !== target.nodeAudience || authorization.targetOrigin !== target.origin || authorization.nodeAudience !== expectedNodeAudience || expected.nodeProof.kid.split("#", 1)[0] !== expectedNodeAudience || authorization.recipientMatcher === void 0 || canonicalizeSignedObjectUnsigned(authorization.recipientMatcher) !== canonicalizeSignedObjectUnsigned(envelope.recipientMatcher) || canonicalizeSignedObjectUnsigned(authorization.contentSource) !== canonicalizeSignedObjectUnsigned(envelope.contentSource) || authorization.contentSourceDigestHex !== envelope.contentSourceDigestHex || authorization.deliveryEmail !== expected.request.recipientEmail || authorization.shareUrl !== expected.request.shareUrl || authorization.documentName !== expected.request.documentName || authorization.documentName !== display.filename || authorization.senderDid !== envelopeSignature.signerDid || authorization.senderTrust !== "verified" || canonicalizeSignedObjectUnsigned(authorization.actions) !== canonicalizeSignedObjectUnsigned(envelope.actions) || authorization.resource !== resource.path || authorization.shareExpiresAt !== envelope.expiry || authorization.requestBodyDigest !== expected.request.requestBodyDigest || authorization.expiresAt !== expected.request.expiresAt || authorization.idempotencyKey !== expected.request.jti || authorization.reportAbuseToken !== expected.request.jti || authorization.returnOrigin !== shareUrl.origin || shareUrl.pathname !== `/s/${authorization.shareCid}` || shareUrl.hash !== `#k=${expected.request.envelopeKey}` || targetUrl.protocol !== "https:" || shareUrl.protocol !== "https:") throw new Error("v3 share delivery authorization is not bound to the submitted request");
+  if (typeof authorization.openCredentialsAudience !== "string" || authorization.openCredentialsAudience !== expected.credentialsAudience || authorization.openCredentialsAudience === authorization.nodeAudience || authorization.openCredentialsAudience === authorization.returnOrigin) throw new Error("v3 share delivery credentials audience is untrusted");
+  if (proof.alg !== "EdDSA" || proof.kid !== expected.nodeProof.kid || typeof proof.signature !== "string") throw new Error("v3 share delivery proof is invalid");
+  const issuedAt = Date.parse(String(authorization.issuedAt));
+  const expiresAt = Date.parse(String(authorization.expiresAt));
+  const shareExpiresAt = Date.parse(String(authorization.shareExpiresAt));
+  if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || !Number.isFinite(shareExpiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 5 * 6e4 || shareExpiresAt <= issuedAt || typeof authorization.holder !== "string" || !authorization.holder.startsWith("did:")) throw new Error("v3 share delivery authorization time or holder is invalid");
+  const publicKey = expected.nodeProof.publicKey.length === 34 ? expected.nodeProof.publicKey.slice(2) : expected.nodeProof.publicKey;
+  const signature = decodeBase64Url3(proof.signature);
+  const signed = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN}${canonicalizeSignedObjectUnsigned(authorization)}`);
+  if (publicKey.length !== 32 || signature.length !== 64 || !ed2551910.verify(signature, signed, publicKey)) throw new Error("v3 share delivery proof signature is invalid");
+  return { authorization, proof };
+}
+
 // src/delegations/sender-share-store.ts
 var MemorySenderShareRecordStorage = class {
   constructor() {
@@ -14469,8 +14560,8 @@ function stableJson(value) {
   if (Array.isArray(value)) {
     return `[${value.map(stableJson).join(",")}]`;
   }
-  const object3 = value;
-  return `{${Object.keys(object3).sort().map((key) => `${JSON.stringify(key)}:${stableJson(object3[key])}`).join(",")}}`;
+  const object4 = value;
+  return `{${Object.keys(object4).sort().map((key) => `${JSON.stringify(key)}:${stableJson(object4[key])}`).join(",")}}`;
 }
 function indexedDelegationFromRow(row) {
   const [
@@ -17475,7 +17566,7 @@ function portForProtocol(protocol) {
 }
 
 // src/location.ts
-import { ed25519 as ed2551910 } from "@noble/curves/ed25519";
+import { ed25519 as ed2551911 } from "@noble/curves/ed25519";
 import { verifyMessage as verifyMessage2 } from "viem";
 var DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL = "https://registry.tinycloud.xyz";
 var DEFAULT_TINYCLOUD_FALLBACK_HOST = "https://node.tinycloud.xyz";
@@ -18041,13 +18132,13 @@ async function verifyPkhSignature(did, payload, signature) {
 }
 function verifyDidKeySignature(did, payload, signature) {
   const publicKey = ed25519PublicKeyFromDidKey2(did);
-  const signatureBytes = decodeBase64Url3(signature);
+  const signatureBytes = decodeBase64Url4(signature);
   if (signatureBytes.length !== 64) {
     throw new LocationRecordValidationError(
       "did:key signature must be a base64url Ed25519 signature"
     );
   }
-  return ed2551910.verify(
+  return ed2551911.verify(
     signatureBytes,
     new TextEncoder().encode(payload),
     publicKey
@@ -18055,7 +18146,7 @@ function verifyDidKeySignature(did, payload, signature) {
 }
 function verifyDidKeyEd25519Signature(did, payload, signature) {
   const publicKey = ed25519PublicKeyFromDidKey2(did);
-  return ed2551910.verify(signature, payload, publicKey);
+  return ed2551911.verify(signature, payload, publicKey);
 }
 function ed25519PublicKeyFromDidKey2(did) {
   const identifier = did.slice("did:key:".length);
@@ -18094,7 +18185,7 @@ function base64UrlEncode3(bytes2) {
   }
   return output;
 }
-function decodeBase64Url3(value) {
+function decodeBase64Url4(value) {
   const alphabet2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   const bytes2 = [];
   let buffer = 0;
@@ -18254,6 +18345,7 @@ export {
   SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG,
   SHARE_DELIVERY_AUTHORIZATION_DOMAIN,
+  SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN,
   SPACE,
   SQL,
   SQLAction,
@@ -18524,6 +18616,7 @@ export {
   validatePolicyStatusUnsigned,
   validatePolicyUnsigned,
   validateShareDeliveryAuthorizationBytes,
+  validateShareDeliveryAuthorizationV3Bytes,
   validateUnifiedPolicyV2,
   verifyDecryptResponse,
   verifyDidKeyEd25519Signature,