@tinycloud/sdk-core 3.0.0-beta.5 → 3.0.0-beta.7

package/dist/index.cjs

@@ -64,6 +64,7 @@ __export(index_exports, {
   CREDENTIAL_CONTRACT_VERSION: () => CREDENTIAL_CONTRACT_VERSION,
   CREDENTIAL_ERROR_CODES: () => CREDENTIAL_ERROR_CODES,
   CREDENTIAL_FORMAT: () => CREDENTIAL_FORMAT,
+  CREDENTIAL_INVITATION_REQUEST_DOMAIN: () => CREDENTIAL_INVITATION_REQUEST_DOMAIN,
   CREDENTIAL_PROTOCOL: () => CREDENTIAL_ACQUISITION_PROTOCOL,
   CREDENTIAL_STEP_REGISTRY_VERSION: () => CREDENTIAL_STEP_REGISTRY_VERSION,
   CapabilityKeyRegistry: () => CapabilityKeyRegistry,
@@ -87,6 +88,7 @@ __export(index_exports, {
   DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
   DEFAULT_TINYCLOUD_FALLBACK_HOST: () => DEFAULT_TINYCLOUD_FALLBACK_HOST,
   DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL: () => DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL,
+  DELIVERY_ADMISSION_DOMAIN: () => DELIVERY_ADMISSION_DOMAIN,
   DUCKDB: () => import_bootstrap4.DUCKDB,
   DataVaultService: () => import_sdk_services8.DataVaultService,
   DatabaseHandle: () => import_sdk_services8.DatabaseHandle,
@@ -392,6 +394,7 @@ __export(index_exports, {
   projectUnifiedPolicyCapabilities: () => projectUnifiedPolicyCapabilities,
   projectUnifiedPolicyCapability: () => projectUnifiedPolicyCapability,
   recapCaveatsEqual: () => recapCaveatsEqual,
+  registerPolicyV3: () => registerPolicyV3,
   renewPolicyRootStatusV3: () => renewPolicyRootStatusV3,
   requestTinyCloudManageKeyScope: () => requestTinyCloudManageKeyScope,
   resolveCloudLocation: () => resolveCloudLocation,
@@ -447,6 +450,7 @@ __export(index_exports, {
   validatePolicyStatusUnsigned: () => validatePolicyStatusUnsigned,
   validatePolicyUnsigned: () => validatePolicyUnsigned,
   validateShareDeliveryAuthorizationBytes: () => validateShareDeliveryAuthorizationBytes,
+  validateShareDeliveryAuthorizationV3Bytes: () => validateShareDeliveryAuthorizationV3Bytes,
   validateUnifiedPolicyV2: () => validateUnifiedPolicyV2,
   verifyDecryptResponse: () => import_sdk_services8.verifyDecryptResponse,
   verifyDidKeyEd25519Signature: () => verifyDidKeyEd25519Signature,
@@ -2242,16 +2246,16 @@ function policyCapabilityContains(authority, request) {
   return caveatsContain(auth.caveats, req.caveats);
 }
 function normalizePolicyCapabilityWithOptions(input, options2) {
-  const object3 = expectObject(input, "$");
-  assertExactKeys(object3, ["service", "space", "path", "actions", "caveats"], "$");
-  const service = requiredString(object3, "service", "$", "policy-capability-malformed-service");
+  const object4 = expectObject(input, "$");
+  assertExactKeys(object4, ["service", "space", "path", "actions", "caveats"], "$");
+  const service = requiredString(object4, "service", "$", "policy-capability-malformed-service");
   if (!CEILING_SERVICES.has(service)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-service",
       "$.service is outside the frozen permissionsCeiling vocabulary"
     );
   }
-  const space = requiredString(object3, "space", "$", "policy-capability-malformed-space");
+  const space = requiredString(object4, "space", "$", "policy-capability-malformed-space");
   validateConcreteSpace(space);
   const canonicalSpace = space.normalize("NFC");
   if (options2.requireCanonical && canonicalSpace !== space) {
@@ -2260,7 +2264,7 @@ function normalizePolicyCapabilityWithOptions(input, options2) {
       "$.space must already be canonical NFC"
     );
   }
-  const rawPath = requiredString(object3, "path", "$", "policy-capability-malformed-path");
+  const rawPath = requiredString(object4, "path", "$", "policy-capability-malformed-path");
   validateRawPath(rawPath, options2);
   const path = normalizePath(rawPath);
   if (options2.requireCanonical && path !== rawPath) {
@@ -2271,7 +2275,7 @@ function normalizePolicyCapabilityWithOptions(input, options2) {
   }
   validateRawPath(path, options2);
   const actions = normalizeActions(
-    requiredArray(object3, "actions", "$", "policy-capability-malformed-action"),
+    requiredArray(object4, "actions", "$", "policy-capability-malformed-action"),
     service,
     options2
   );
@@ -2280,9 +2284,9 @@ function normalizePolicyCapabilityWithOptions(input, options2) {
   output.space = canonicalSpace;
   output.path = path;
   output.actions = actions;
-  if (hasOwn(object3, "caveats")) {
+  if (hasOwn(object4, "caveats")) {
     output.caveats = validateCaveats(
-      requiredValue(object3, "caveats", "$", "policy-capability-malformed-caveats"),
+      requiredValue(object4, "caveats", "$", "policy-capability-malformed-caveats"),
       output.service
     );
   }
@@ -2305,9 +2309,9 @@ function expectObject(input, path) {
     );
   }
 }
-function assertExactKeys(object3, allowed, path) {
+function assertExactKeys(object4, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object3)) {
+  for (const key of Object.keys(object4)) {
     if (!allowedSet.has(key)) {
       throw new PolicyCapabilityError(
         key === "id" || key === "scope" ? "policy-capability-malformed" : "policy-capability-unknown-key",
@@ -2316,21 +2320,21 @@ function assertExactKeys(object3, allowed, path) {
     }
   }
 }
-function requiredValue(object3, key, path, code3) {
-  if (!hasOwn(object3, key)) {
+function requiredValue(object4, key, path, code3) {
+  if (!hasOwn(object4, key)) {
     throw new PolicyCapabilityError(code3, `${path}.${key} is required`);
   }
-  return object3[key];
+  return object4[key];
 }
-function requiredString(object3, key, path, code3) {
-  const value = requiredValue(object3, key, path, code3);
+function requiredString(object4, key, path, code3) {
+  const value = requiredValue(object4, key, path, code3);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyCapabilityError(code3, `${path}.${key} must be a non-empty string`);
   }
   return value;
 }
-function requiredArray(object3, key, path, code3) {
-  const value = requiredValue(object3, key, path, code3);
+function requiredArray(object4, key, path, code3) {
+  const value = requiredValue(object4, key, path, code3);
   if (!Array.isArray(value)) {
     throw new PolicyCapabilityError(code3, `${path}.${key} must be an array`);
   }
@@ -2475,11 +2479,11 @@ function validateSqlStatement(input, path) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new PolicyCapabilityError("policy-capability-malformed-caveats", `${path} must be an object`);
   }
-  const object3 = input;
-  assertCaveatKeys(object3, ["name", "sql", "fixedParams"], path);
-  caveatString(object3, "name", path);
-  caveatString(object3, "sql", path);
-  const fixedParams = requiredCaveat(object3, "fixedParams", path);
+  const object4 = input;
+  assertCaveatKeys(object4, ["name", "sql", "fixedParams"], path);
+  caveatString(object4, "name", path);
+  caveatString(object4, "sql", path);
+  const fixedParams = requiredCaveat(object4, "fixedParams", path);
   if (!Array.isArray(fixedParams)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
@@ -2494,20 +2498,20 @@ function validateFixedParam(input, path) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new PolicyCapabilityError("policy-capability-malformed-caveats", `${path} must be an object`);
   }
-  const object3 = input;
-  assertCaveatKeys(object3, ["index", "value"], path);
-  const index = requiredCaveat(object3, "index", path);
+  const object4 = input;
+  assertCaveatKeys(object4, ["index", "value"], path);
+  const index = requiredCaveat(object4, "index", path);
   if (typeof index !== "number" || !Number.isSafeInteger(index) || index < 0) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
       `${path}.index must be a non-negative integer`
     );
   }
-  requiredCaveat(object3, "value", path);
+  requiredCaveat(object4, "value", path);
 }
-function assertCaveatKeys(object3, allowed, path) {
+function assertCaveatKeys(object4, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object3)) {
+  for (const key of Object.keys(object4)) {
     if (!allowedSet.has(key)) {
       throw new PolicyCapabilityError(
         "policy-capability-malformed-caveats",
@@ -2516,17 +2520,17 @@ function assertCaveatKeys(object3, allowed, path) {
     }
   }
 }
-function requiredCaveat(object3, key, path) {
-  if (!hasOwn(object3, key)) {
+function requiredCaveat(object4, key, path) {
+  if (!hasOwn(object4, key)) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
       `${path}.${key} is required`
     );
   }
-  return object3[key];
+  return object4[key];
 }
-function caveatString(object3, key, path) {
-  const value = requiredCaveat(object3, key, path);
+function caveatString(object4, key, path) {
+  const value = requiredCaveat(object4, key, path);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyCapabilityError(
       "policy-capability-malformed-caveats",
@@ -2557,8 +2561,8 @@ function caveatsContain(authority, request) {
     (statement) => authorityStatements.some((candidate) => jcsCanonicalize(candidate) === jcsCanonicalize(statement))
   );
 }
-function hasOwn(object3, key) {
-  return objectHasOwn2(object3, key);
+function hasOwn(object4, key) {
+  return objectHasOwn2(object4, key);
 }
 
 // src/policy/signed-object.ts
@@ -2886,17 +2890,17 @@ async function createAndSignSignedObject(input, signer) {
 }
 function createAndSignPolicy(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object3) => validatePolicySignedShape(object3)
+    (object4) => validatePolicySignedShape(object4)
   );
 }
 function createAndSignPolicyStatus(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object3) => validatePolicyStatusSignedShape(object3)
+    (object4) => validatePolicyStatusSignedShape(object4)
   );
 }
 function createAndSignPolicyEngineRecord(input, signer) {
   return createAndSignSignedObject(input, signer).then(
-    (object3) => validatePolicyEngineRecordSignedShape(object3)
+    (object4) => validatePolicyEngineRecordSignedShape(object4)
   );
 }
 async function verifySignedObject(input) {
@@ -3000,9 +3004,9 @@ function validateUnsignedForDescriptor(input, descriptor) {
   }
 }
 function validatePolicyShape(input, signed) {
-  const object3 = expectJsonObject(normalizeJson(input), "$");
+  const object4 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object3,
+    object4,
     signed ? [
       "schema",
       "policyId",
@@ -3030,30 +3034,30 @@ function validatePolicyShape(input, signed) {
     ],
     "$"
   );
-  expectConst(requiredString2(object3, "schema", "$"), POLICY_SCHEMA, "$.schema");
+  expectConst(requiredString2(object4, "schema", "$"), POLICY_SCHEMA, "$.schema");
   if (signed) {
-    requiredString2(object3, "policyId", "$");
-    validateSignature(requiredValue2(object3, "signature", "$"));
+    requiredString2(object4, "policyId", "$");
+    validateSignature(requiredValue2(object4, "signature", "$"));
   }
-  requiredString2(object3, "ownerDid", "$");
-  requiredString2(object3, "signingKeyDid", "$");
-  requiredDateString(object3, "createdAt", "$");
-  optionalDateString(object3, "expiresAt", "$");
-  validatePolicyResource(requiredValue2(object3, "resource", "$"), "$.resource");
-  validateExpression(requiredValue2(object3, "when", "$"), "$.when");
-  validateGrant(requiredValue2(object3, "grant", "$"), "$.grant");
-  if (hasOwn2(object3, "disclosure")) {
-    validateDisclosure(requiredValue2(object3, "disclosure", "$"), "$.disclosure");
+  requiredString2(object4, "ownerDid", "$");
+  requiredString2(object4, "signingKeyDid", "$");
+  requiredDateString(object4, "createdAt", "$");
+  optionalDateString(object4, "expiresAt", "$");
+  validatePolicyResource(requiredValue2(object4, "resource", "$"), "$.resource");
+  validateExpression(requiredValue2(object4, "when", "$"), "$.when");
+  validateGrant(requiredValue2(object4, "grant", "$"), "$.grant");
+  if (hasOwn2(object4, "disclosure")) {
+    validateDisclosure(requiredValue2(object4, "disclosure", "$"), "$.disclosure");
   }
-  if (hasOwn2(object3, "audit")) {
-    validateAudit(requiredValue2(object3, "audit", "$"), "$.audit");
+  if (hasOwn2(object4, "audit")) {
+    validateAudit(requiredValue2(object4, "audit", "$"), "$.audit");
   }
-  return object3;
+  return object4;
 }
 function validatePolicyStatusShape(input, signed) {
-  const object3 = expectJsonObject(normalizeJson(input), "$");
+  const object4 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object3,
+    object4,
     signed ? [
       "schema",
       "statusId",
@@ -3077,28 +3081,28 @@ function validatePolicyStatusShape(input, signed) {
     ],
     "$"
   );
-  expectConst(requiredString2(object3, "schema", "$"), POLICY_STATUS_SCHEMA, "$.schema");
+  expectConst(requiredString2(object4, "schema", "$"), POLICY_STATUS_SCHEMA, "$.schema");
   if (signed) {
-    requiredString2(object3, "statusId", "$");
-    validateSignature(requiredValue2(object3, "signature", "$"));
+    requiredString2(object4, "statusId", "$");
+    validateSignature(requiredValue2(object4, "signature", "$"));
   }
-  requiredString2(object3, "policyId", "$");
-  requiredString2(object3, "ownerDid", "$");
-  requiredInteger(object3, "sequence", "$", 0);
-  expectOneOf(requiredString2(object3, "disposition", "$"), [
+  requiredString2(object4, "policyId", "$");
+  requiredString2(object4, "ownerDid", "$");
+  requiredInteger(object4, "sequence", "$", 0);
+  expectOneOf(requiredString2(object4, "disposition", "$"), [
     "active",
     "suspended",
     "revoked"
   ], "$.disposition");
-  requiredDateString(object3, "effectiveAt", "$");
-  optionalString(object3, "reasonCode", "$");
-  requiredString2(object3, "signingKeyDid", "$");
-  return object3;
+  requiredDateString(object4, "effectiveAt", "$");
+  optionalString(object4, "reasonCode", "$");
+  requiredString2(object4, "signingKeyDid", "$");
+  return object4;
 }
 function validatePolicyEngineRecordShape(input, signed) {
-  const object3 = expectJsonObject(normalizeJson(input), "$");
+  const object4 = expectJsonObject(normalizeJson(input), "$");
   assertExactKeys2(
-    object3,
+    object4,
     signed ? [
       "schema",
       "engineRecordId",
@@ -3123,44 +3127,44 @@ function validatePolicyEngineRecordShape(input, signed) {
     "$"
   );
   expectConst(
-    requiredString2(object3, "schema", "$"),
+    requiredString2(object4, "schema", "$"),
     POLICY_ENGINE_RECORD_SCHEMA,
     "$.schema"
   );
   if (signed) {
-    requiredString2(object3, "engineRecordId", "$");
-    validateSignature(requiredValue2(object3, "signature", "$"));
+    requiredString2(object4, "engineRecordId", "$");
+    validateSignature(requiredValue2(object4, "signature", "$"));
   }
-  requiredString2(object3, "ownerDid", "$");
-  requiredString2(object3, "endpoint", "$");
-  requiredString2(object3, "audience", "$");
+  requiredString2(object4, "ownerDid", "$");
+  requiredString2(object4, "endpoint", "$");
+  requiredString2(object4, "audience", "$");
   requiredStringArray(
-    object3,
+    object4,
     "supportedPolicyVersions",
     "$",
     (value, path) => expectConst(value, "v0", path)
   );
-  requiredStringArray(object3, "supportedEvidenceVerifiers", "$");
-  requiredString2(object3, "grantIssuerDid", "$");
-  requiredDateString(object3, "expiresAt", "$");
-  return object3;
+  requiredStringArray(object4, "supportedEvidenceVerifiers", "$");
+  requiredString2(object4, "grantIssuerDid", "$");
+  requiredDateString(object4, "expiresAt", "$");
+  return object4;
 }
 function validateSignature(input) {
-  const object3 = expectJsonObject(input, "$.signature");
-  assertExactKeys2(object3, ["suite", "signerDid", "value"], "$.signature");
-  const suite = requiredString2(object3, "suite", "$.signature");
+  const object4 = expectJsonObject(input, "$.signature");
+  assertExactKeys2(object4, ["suite", "signerDid", "value"], "$.signature");
+  const suite = requiredString2(object4, "suite", "$.signature");
   assertSupportedSignatureSuite(suite);
-  const signerDid = requiredString2(object3, "signerDid", "$.signature");
-  const value = requiredString2(object3, "value", "$.signature");
+  const signerDid = requiredString2(object4, "signerDid", "$.signature");
+  const value = requiredString2(object4, "value", "$.signature");
   decodeSignatureValue(value, suite);
   return { suite, signerDid, value };
 }
 function validatePolicyResource(input, path) {
-  const object3 = expectJsonObject(input, path);
-  assertExactKeys2(object3, ["resourceType", "resourceId", "permissionsCeiling"], path);
-  requiredString2(object3, "resourceType", path);
-  requiredString2(object3, "resourceId", path);
-  const ceiling = requiredArray2(object3, "permissionsCeiling", path, 1);
+  const object4 = expectJsonObject(input, path);
+  assertExactKeys2(object4, ["resourceType", "resourceId", "permissionsCeiling"], path);
+  requiredString2(object4, "resourceType", path);
+  requiredString2(object4, "resourceId", path);
+  const ceiling = requiredArray2(object4, "permissionsCeiling", path, 1);
   for (let index = 0; index < ceiling.length; index++) {
     validatePolicyCapability(ceiling[index], `${path}.permissionsCeiling[${index}]`);
   }
@@ -3176,10 +3180,10 @@ function validatePolicyPermissionsCeilingForSigning(input) {
   }
 }
 function validatePolicyCapability(input, path) {
-  const object3 = expectJsonObject(input, path);
+  const object4 = expectJsonObject(input, path);
   try {
-    const canonical = canonicalizePolicyCapability(object3);
-    if (jcsCanonicalize(object3) !== jcsCanonicalize(canonical)) {
+    const canonical = canonicalizePolicyCapability(object4);
+    if (jcsCanonicalize(object4) !== jcsCanonicalize(canonical)) {
       throw new SignedObjectSchemaError(`${path} must be canonical PolicyCapability JSON`);
     }
   } catch (error) {
@@ -3192,10 +3196,10 @@ function validatePolicyCapability(input, path) {
   }
 }
 function validatePolicyCapabilityForSigning(input, path) {
-  const object3 = expectJsonObject(input, path);
+  const object4 = expectJsonObject(input, path);
   try {
-    const canonical = normalizePolicyCapability(object3);
-    if (jcsCanonicalize(object3) !== jcsCanonicalize(canonical)) {
+    const canonical = normalizePolicyCapability(object4);
+    if (jcsCanonicalize(object4) !== jcsCanonicalize(canonical)) {
       throw new SignedObjectSchemaError(`${path} must be strict canonical PolicyCapability JSON`);
     }
   } catch (error) {
@@ -3208,43 +3212,43 @@ function validatePolicyCapabilityForSigning(input, path) {
   }
 }
 function validateExpression(input, path) {
-  const object3 = expectJsonObject(input, path);
-  const keys = Object.keys(object3);
+  const object4 = expectJsonObject(input, path);
+  const keys = Object.keys(object4);
   if (keys.length !== 1) {
     throw new SignedObjectSchemaError(`${path} must have exactly one expression key`);
   }
   const key = keys[0];
   if (key === "allOf" || key === "anyOf") {
-    const values = requiredArray2(object3, key, path, 1);
+    const values = requiredArray2(object4, key, path, 1);
     for (let index = 0; index < values.length; index++) {
       validateExpression(values[index], `${path}.${key}[${index}]`);
     }
     return;
   }
   if (key === "subject") {
-    const subject = expectJsonObject(requiredValue2(object3, "subject", path), `${path}.subject`);
+    const subject = expectJsonObject(requiredValue2(object4, "subject", path), `${path}.subject`);
     assertExactKeys2(subject, ["did"], `${path}.subject`);
     requiredString2(subject, "did", `${path}.subject`);
     return;
   }
   if (key === "evidence") {
-    validateEvidenceRequirement(requiredValue2(object3, "evidence", path), `${path}.evidence`);
+    validateEvidenceRequirement(requiredValue2(object4, "evidence", path), `${path}.evidence`);
     return;
   }
   throw new SignedObjectSchemaError(`${path} has unknown expression key ${key}`);
 }
 function validateEvidenceRequirement(input, path) {
-  const object3 = expectJsonObject(input, path);
+  const object4 = expectJsonObject(input, path);
   assertExactKeys2(
-    object3,
+    object4,
     ["requirementId", "verifier", "requirements", "authority", "freshness"],
     path
   );
-  requiredString2(object3, "requirementId", path);
-  requiredString2(object3, "verifier", path);
-  requiredValue2(object3, "requirements", path);
-  if (hasOwn2(object3, "authority")) {
-    const authority = expectJsonObject(requiredValue2(object3, "authority", path), `${path}.authority`);
+  requiredString2(object4, "requirementId", path);
+  requiredString2(object4, "verifier", path);
+  requiredValue2(object4, "requirements", path);
+  if (hasOwn2(object4, "authority")) {
+    const authority = expectJsonObject(requiredValue2(object4, "authority", path), `${path}.authority`);
     assertExactKeys2(
       authority,
       ["profile", "acceptedIssuers", "allowOwnerAuthorizedIssuer"],
@@ -3256,35 +3260,35 @@ function validateEvidenceRequirement(input, path) {
     }
     optionalBoolean(authority, "allowOwnerAuthorizedIssuer", `${path}.authority`);
   }
-  if (hasOwn2(object3, "freshness")) {
-    const freshness = expectJsonObject(requiredValue2(object3, "freshness", path), `${path}.freshness`);
+  if (hasOwn2(object4, "freshness")) {
+    const freshness = expectJsonObject(requiredValue2(object4, "freshness", path), `${path}.freshness`);
     assertExactKeys2(freshness, ["maxStatusAgeSeconds"], `${path}.freshness`);
     requiredInteger(freshness, "maxStatusAgeSeconds", `${path}.freshness`, 0);
   }
 }
 function validateGrant(input, path) {
-  const object3 = expectJsonObject(input, path);
-  assertExactKeys2(object3, ["output", "maxTtlSeconds", "delegationMode", "revocation"], path);
-  expectConst(requiredString2(object3, "output", path), "portable-delegation", `${path}.output`);
-  requiredInteger(object3, "maxTtlSeconds", path, 1);
-  expectOneOf(requiredString2(object3, "delegationMode", path), [
+  const object4 = expectJsonObject(input, path);
+  assertExactKeys2(object4, ["output", "maxTtlSeconds", "delegationMode", "revocation"], path);
+  expectConst(requiredString2(object4, "output", path), "portable-delegation", `${path}.output`);
+  requiredInteger(object4, "maxTtlSeconds", path, 1);
+  expectOneOf(requiredString2(object4, "delegationMode", path), [
     "terminal",
     "attenuable"
   ], `${path}.delegationMode`);
-  expectOneOf(requiredString2(object3, "revocation", path), [
+  expectOneOf(requiredString2(object4, "revocation", path), [
     "refresh_only",
     "active_cutoff"
   ], `${path}.revocation`);
 }
 function validateDisclosure(input, path) {
-  const object3 = expectJsonObject(input, path);
-  assertExactKeys2(object3, ["denial"], path);
-  expectOneOf(requiredString2(object3, "denial", path), ["none", "code", "debug"], `${path}.denial`);
+  const object4 = expectJsonObject(input, path);
+  assertExactKeys2(object4, ["denial"], path);
+  expectOneOf(requiredString2(object4, "denial", path), ["none", "code", "debug"], `${path}.denial`);
 }
 function validateAudit(input, path) {
-  const object3 = expectJsonObject(input, path);
-  assertExactKeys2(object3, ["issuance"], path);
-  expectOneOf(requiredString2(object3, "issuance", path), ["off", "security", "full"], `${path}.issuance`);
+  const object4 = expectJsonObject(input, path);
+  assertExactKeys2(object4, ["issuance"], path);
+  expectOneOf(requiredString2(object4, "issuance", path), ["off", "security", "full"], `${path}.issuance`);
 }
 function materialForUnsigned(unsigned, descriptor) {
   const jcs = jcsCanonicalize(unsigned);
@@ -3433,9 +3437,9 @@ function encodeSignatureValue(value, suite) {
   decodeSignatureValue(encoded, suite);
   return encoded;
 }
-function stripOwnIdAndSignature(object3, descriptor) {
+function stripOwnIdAndSignature(object4, descriptor) {
   const output = /* @__PURE__ */ Object.create(null);
-  for (const [key, value] of Object.entries(object3)) {
+  for (const [key, value] of Object.entries(object4)) {
     if (key === descriptor.idField || key === "signature") {
       continue;
     }
@@ -3444,8 +3448,8 @@ function stripOwnIdAndSignature(object3, descriptor) {
   return output;
 }
 function descriptorForUnsigned(input) {
-  const object3 = expectJsonObject(normalizeJson(input), "$");
-  return descriptorForSchema(requiredString2(object3, "schema", "$"));
+  const object4 = expectJsonObject(normalizeJson(input), "$");
+  return descriptorForSchema(requiredString2(object4, "schema", "$"));
 }
 function descriptorForSchema(schema) {
   if (schema === POLICY_SCHEMA) return DESCRIPTORS.Policy;
@@ -3459,28 +3463,28 @@ function expectJsonObject(input, path) {
   }
   return input;
 }
-function assertExactKeys2(object3, allowed, path) {
+function assertExactKeys2(object4, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object3)) {
+  for (const key of Object.keys(object4)) {
     if (!allowedSet.has(key)) {
       throw new SignedObjectSchemaError(`${path} has unknown field ${key}`);
     }
   }
 }
-function requiredValue2(object3, key, path) {
-  if (!hasOwn2(object3, key)) {
+function requiredValue2(object4, key, path) {
+  if (!hasOwn2(object4, key)) {
     throw new SignedObjectSchemaError(`${path}.${key} is required`);
   }
-  return object3[key];
+  return object4[key];
 }
-function requiredString2(object3, key, path) {
-  return requireStringType(requiredValue2(object3, key, path), `${path}.${key}`);
+function requiredString2(object4, key, path) {
+  return requireStringType(requiredValue2(object4, key, path), `${path}.${key}`);
 }
-function optionalString(object3, key, path) {
-  if (!hasOwn2(object3, key)) {
+function optionalString(object4, key, path) {
+  if (!hasOwn2(object4, key)) {
     return;
   }
-  requireStringType(requiredValue2(object3, key, path), `${path}.${key}`);
+  requireStringType(requiredValue2(object4, key, path), `${path}.${key}`);
 }
 function requireStringType(value, path) {
   if (typeof value !== "string" || value.length === 0) {
@@ -3488,16 +3492,16 @@ function requireStringType(value, path) {
   }
   return value;
 }
-function optionalBoolean(object3, key, path) {
-  if (!hasOwn2(object3, key)) {
+function optionalBoolean(object4, key, path) {
+  if (!hasOwn2(object4, key)) {
     return;
   }
-  if (typeof requiredValue2(object3, key, path) !== "boolean") {
+  if (typeof requiredValue2(object4, key, path) !== "boolean") {
     throw new SignedObjectSchemaError(`${path}.${key} must be a boolean`);
   }
 }
-function requiredInteger(object3, key, path, minimum) {
-  const value = requiredValue2(object3, key, path);
+function requiredInteger(object4, key, path, minimum) {
+  const value = requiredValue2(object4, key, path);
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum) {
     throw new SignedObjectSchemaError(
       `${path}.${key} must be an integer >= ${minimum}`
@@ -3505,8 +3509,8 @@ function requiredInteger(object3, key, path, minimum) {
   }
   return value;
 }
-function requiredArray2(object3, key, path, minimum) {
-  const value = requiredValue2(object3, key, path);
+function requiredArray2(object4, key, path, minimum) {
+  const value = requiredValue2(object4, key, path);
   if (!Array.isArray(value) || value.length < minimum) {
     throw new SignedObjectSchemaError(
       `${path}.${key} must be an array with at least ${minimum} item(s)`
@@ -3514,22 +3518,22 @@ function requiredArray2(object3, key, path, minimum) {
   }
   return value;
 }
-function requiredStringArray(object3, key, path, check) {
-  const values = requiredArray2(object3, key, path, 0);
+function requiredStringArray(object4, key, path, check) {
+  const values = requiredArray2(object4, key, path, 0);
   for (let index = 0; index < values.length; index++) {
     const itemPath = `${path}.${key}[${index}]`;
     const value = requireStringType(values[index], itemPath);
     check?.(value, itemPath);
   }
 }
-function requiredDateString(object3, key, path) {
-  assertRfc3339(requiredString2(object3, key, path), `${path}.${key}`);
+function requiredDateString(object4, key, path) {
+  assertRfc3339(requiredString2(object4, key, path), `${path}.${key}`);
 }
-function optionalDateString(object3, key, path) {
-  if (!hasOwn2(object3, key)) {
+function optionalDateString(object4, key, path) {
+  if (!hasOwn2(object4, key)) {
     return;
   }
-  assertRfc3339(requiredString2(object3, key, path), `${path}.${key}`);
+  assertRfc3339(requiredString2(object4, key, path), `${path}.${key}`);
 }
 function assertRfc3339(value, path) {
   const match = value.match(
@@ -3561,8 +3565,8 @@ function expectOneOf(actual, allowed, path) {
   }
   throw new SignedObjectSchemaError(`${path} has unsupported value ${actual}`);
 }
-function hasOwn2(object3, key) {
-  return objectHasOwn3(object3, key);
+function hasOwn2(object4, key) {
+  return objectHasOwn3(object4, key);
 }
 function assertSupportedSignatureSuite(suite) {
   if (suite !== ED25519_JCS_SIGNATURE_SUITE && suite !== EIP191_JCS_SIGNATURE_SUITE) {
@@ -3789,9 +3793,9 @@ function expectObject2(input, path, code3) {
     );
   }
 }
-function assertExactKeys3(object3, allowed, path) {
+function assertExactKeys3(object4, allowed, path) {
   const allowedSet = new Set(allowed);
-  for (const key of Object.keys(object3)) {
+  for (const key of Object.keys(object4)) {
     if (!allowedSet.has(key)) {
       throw new PolicyAuthoringError(
         "policy-authoring-unknown-key",
@@ -3800,17 +3804,17 @@ function assertExactKeys3(object3, allowed, path) {
     }
   }
 }
-function requiredValue3(object3, key, path) {
-  if (!hasOwn3(object3, key)) {
+function requiredValue3(object4, key, path) {
+  if (!hasOwn3(object4, key)) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
       `${path}.${key} is required`
     );
   }
-  return object3[key];
+  return object4[key];
 }
-function requiredString3(object3, key, path) {
-  const value = requiredValue3(object3, key, path);
+function requiredString3(object4, key, path) {
+  const value = requiredValue3(object4, key, path);
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyAuthoringError(
       "policy-authoring-malformed",
@@ -3819,11 +3823,11 @@ function requiredString3(object3, key, path) {
   }
   return value;
 }
-function fieldString(object3, key, path, code3) {
-  if (!hasOwn3(object3, key)) {
+function fieldString(object4, key, path, code3) {
+  if (!hasOwn3(object4, key)) {
     throw new PolicyAuthoringError(code3, `${path}.${key} is required`);
   }
-  const value = object3[key];
+  const value = object4[key];
   if (typeof value !== "string" || value.length === 0) {
     throw new PolicyAuthoringError(
       code3,
@@ -3861,8 +3865,8 @@ function parseStrictRfc3339(value, path) {
 var objectHasOwn4 = Object.hasOwn ?? Object.prototype.hasOwnProperty.call.bind(
   Object.prototype.hasOwnProperty
 );
-function hasOwn3(object3, key) {
-  return objectHasOwn4(object3, key);
+function hasOwn3(object4, key) {
+  return objectHasOwn4(object4, key);
 }
 
 // src/policy/unified.ts
@@ -3889,7 +3893,8 @@ var MAX_LEGACY_ENVELOPE_EXPIRES_AT = "2026-12-29T00:00:00Z";
 var LAST_V2_READ_AT = "2027-01-05T00:00:00Z";
 async function requestPolicyChallengeV3(input) {
   const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
-  const response = await fetchFn(new URL("/share/v3/policy/challenges", input.nodeOrigin), {
+  const policyRuntimePath = policyRuntimeBasePath(input.policyRuntimePath);
+  const response = await fetchFn(new URL(`${policyRuntimePath}/challenges`, input.nodeOrigin), {
     method: "POST",
     redirect: "error",
     signal: input.signal,
@@ -3902,6 +3907,13 @@ async function requestPolicyChallengeV3(input) {
     throw new Error("policy challenge binding is invalid");
   return value;
 }
+function policyRuntimeBasePath(value) {
+  const path = value ?? "/policy/v3";
+  if (!/^\/policy(?:\/[a-z0-9-]+)*$/.test(path)) {
+    throw new Error("policy runtime path is invalid");
+  }
+  return path;
+}
 function compactAttenuationForPolicyCapabilities(input) {
   const attenuation = {};
   for (const raw of input) {
@@ -3947,7 +3959,7 @@ function verifyPolicyRootStatusCheckpointV3(input) {
 }
 async function getPolicyRootStatusV3(input) {
   const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
-  const response = await fetchFn(new URL(`/share/v3/policy/status/${encodeURIComponent(input.rootCid)}`, input.nodeOrigin), {
+  const response = await fetchFn(new URL(`/policy/v3/status/${encodeURIComponent(input.rootCid)}`, input.nodeOrigin), {
     method: "GET",
     redirect: "error",
     headers: { accept: "application/json" }
@@ -4006,7 +4018,7 @@ async function renewPolicyRootStatusV3(input) {
   };
   const signature = await input.sign((0, import_sha256.sha256)(new TextEncoder().encode(ROOT_STATUS_RENEWAL_V1_DOMAIN + jcsCanonicalize(unsigned))));
   if (signature.length !== 64) throw new Error("policy root renewal signature must be Ed25519");
-  const response = await fetchFn(new URL("/share/v3/policy/status", input.nodeOrigin), {
+  const response = await fetchFn(new URL("/policy/v3/status", input.nodeOrigin), {
     method: "POST",
     redirect: "error",
     headers: { accept: "application/json", "content-type": "application/json" },
@@ -4261,6 +4273,133 @@ function contentSourceDigestHex(input) {
     )
   );
 }
+function exactObject(value, keys, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} is invalid`);
+  }
+  const record2 = value;
+  if (Object.keys(record2).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record2, key))) {
+    throw new Error(`${label} is invalid`);
+  }
+  return record2;
+}
+function didKeyEd25519PublicKey(value) {
+  const principal = value.split("#", 1)[0];
+  if (!principal.startsWith("did:key:")) {
+    throw new Error("policy enforcer binding signer is invalid");
+  }
+  const material = base58btc.decode(principal.slice("did:key:".length));
+  if (material.length !== 34 || material[0] !== 237 || material[1] !== 1) {
+    throw new Error("policy enforcer binding signer is invalid");
+  }
+  return material.slice(2);
+}
+async function registerPolicyV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const rootExpiresAt = new Date(input.rootExpiresAt);
+  const canonicalRootExpiresAt = new Date(
+    Math.floor(rootExpiresAt.getTime() / 1e3) * 1e3
+  ).toISOString().replace(/\.000Z$/, "Z");
+  if (!Number.isFinite(rootExpiresAt.getTime()) || canonicalRootExpiresAt !== input.rootExpiresAt || rootExpiresAt.getTime() <= Date.now()) {
+    throw new Error("policy root expiry is invalid");
+  }
+  const bindingResponse = await fetchFn(
+    new URL("/policy/v3/enforcer-bindings", input.nodeOrigin),
+    {
+      method: "POST",
+      redirect: "error",
+      signal: input.signal,
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({
+        rootExpiresAt: input.rootExpiresAt,
+        enforcerDid: input.enforcerDid
+      })
+    }
+  );
+  if (!bindingResponse.ok) {
+    throw new Error(`policy enforcer binding rejected (${bindingResponse.status})`);
+  }
+  const binding = exactObject(
+    await bindingResponse.json(),
+    [
+      "schema",
+      "enforcerDid",
+      "nodeAudience",
+      "attestationBindingDigestHex",
+      "issuedAt",
+      "expiresAt",
+      "signature"
+    ],
+    "policy enforcer binding"
+  );
+  const signature = exactObject(
+    binding.signature,
+    ["suite", "signerDid", "value"],
+    "policy enforcer binding signature"
+  );
+  const expectedBindingDigestHex = hex(
+    (0, import_sha256.sha256)(
+      new TextEncoder().encode(
+        jcsCanonicalize({
+          enforcerDid: input.enforcerDid,
+          nodeAudience: input.expectedNodeAudience
+        })
+      )
+    )
+  );
+  if (binding.schema !== ATTESTED_ENFORCER_BINDING_V2_SCHEMA || binding.enforcerDid !== input.enforcerDid || binding.nodeAudience !== input.expectedNodeAudience || binding.attestationBindingDigestHex !== expectedBindingDigestHex || binding.expiresAt !== input.rootExpiresAt || typeof binding.issuedAt !== "string" || Date.parse(binding.issuedAt) > Date.now() || signature.suite !== "Ed25519" || signature.signerDid !== input.expectedNodeAudience || typeof signature.value !== "string") {
+    throw new Error("policy enforcer binding is invalid");
+  }
+  const { signature: _signature, ...unsignedBinding } = binding;
+  const signedBinding = (0, import_sha256.sha256)(
+    new TextEncoder().encode(
+      `xyz.tinycloud.policy/AttestedEnforcerBinding/v2\0${jcsCanonicalize(unsignedBinding)}`
+    )
+  );
+  if (!import_ed255193.ed25519.verify(
+    decodeBase64Url2(signature.value),
+    signedBinding,
+    didKeyEd25519PublicKey(input.expectedNodeAudience),
+    { zip215: false }
+  )) {
+    throw new Error("policy enforcer binding signature is invalid");
+  }
+  const response = await fetchFn(
+    new URL("/policy/v3/policies", input.nodeOrigin),
+    {
+      method: "POST",
+      redirect: "error",
+      signal: input.signal,
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({
+        policyCid: input.policyCid,
+        policy: input.policy,
+        policyRoot: input.policyRoot.authorization.replace(/^Bearer\s+/i, ""),
+        enforcementRoot: input.enforcementRoot.authorization.replace(/^Bearer\s+/i, ""),
+        contentSourceDigestHex: input.contentSourceDigestHex,
+        nativeProjectionHashHex: input.nativeProjectionHashHex,
+        attestedEnforcerBinding: binding
+      })
+    }
+  );
+  if (!response.ok) {
+    throw new Error(`policy registration rejected (${response.status})`);
+  }
+  const receipt = exactObject(
+    await response.json(),
+    ["policyCid", "policyRootCid", "enforcementRootCid"],
+    "policy registration response"
+  );
+  if (receipt.policyCid !== input.policyCid || receipt.policyRootCid !== input.policyRoot.cid || receipt.enforcementRootCid !== input.enforcementRoot.cid) {
+    throw new Error("policy registration response binding is invalid");
+  }
+  return {
+    policyCid: input.policyCid,
+    policyRootCid: input.policyRoot.cid,
+    enforcementRootCid: input.enforcementRoot.cid,
+    attestedEnforcerBinding: binding
+  };
+}
 function policyDigestHex(policy) {
   const canonicalPolicy = {
     ...policy,
@@ -4877,6 +5016,7 @@ async function admitPolicyCredentialV3(input) {
   const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
   const challenge = await requestPolicyChallengeV3({
     nodeOrigin,
+    policyRuntimePath: input.policyRuntimePath,
     policyCid: input.policyCid,
     recipientDid: input.credential.holderDid,
     requestedCapabilities: input.requestedCapabilities,
@@ -4889,7 +5029,7 @@ async function admitPolicyCredentialV3(input) {
     challenge
   });
   const response = await fetchFn(
-    new URL("/share/v3/policy/delegations", nodeOrigin),
+    new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin),
     {
       method: "POST",
       redirect: "error",
@@ -4934,6 +5074,7 @@ async function admitPolicyCredentialV4(input) {
   const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
   const challenge = await requestPolicyChallengeV3({
     nodeOrigin,
+    policyRuntimePath: input.policyRuntimePath,
     policyCid: input.policyCid,
     recipientDid: input.credential.holderDid,
     requestedCapabilities: input.requestedCapabilities,
@@ -4945,7 +5086,7 @@ async function admitPolicyCredentialV4(input) {
     policy,
     challenge
   });
-  const response = await fetchFn(new URL("/share/v3/policy/delegations", nodeOrigin), {
+  const response = await fetchFn(new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin), {
     method: "POST",
     redirect: "error",
     signal: input.signal,
@@ -4972,8 +5113,22 @@ async function admitPolicyCredentialV4(input) {
     enforcerDid: input.expectedEnforcerDid
   });
   if (session.cid !== value.sessionCid || session.aud !== input.credential.holderDid || session.fact.policyCid !== input.policyCid || session.fact.recipientDid !== input.credential.holderDid || session.fact.policyDelegationCid !== input.policyRootCid || session.fact.enforcementDelegationCid !== input.enforcementRootCid || jcsCanonicalize(session.att) !== jcsCanonicalize(expectedAttenuation)) throw new Error("policy delegation signed binding is invalid");
+  const importResponse = await fetchFn(new URL("/delegate", nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    signal: input.signal,
+    headers: { Authorization: session.authorization }
+  });
+  if (!importResponse.ok) throw new Error(`delegation import rejected (${importResponse.status})`);
   input.signal?.throwIfAborted();
-  return Object.freeze({ challenge, presentation, session });
+  return Object.freeze({ challenge, presentation, session, delegationImported: true });
+}
+function policyRuntimeBasePath2(value) {
+  const path = value ?? "/policy/v3";
+  if (!/^\/policy(?:\/[a-z0-9-]+)*$/.test(path)) {
+    throw new Error("policy runtime path is invalid");
+  }
+  return path;
 }
 
 // src/requester/index.ts
@@ -8381,13 +8536,13 @@ function canonicalizeRecapCaveats(caveats) {
     }
     if (Array.isArray(value)) return `[${value.map(canonicalize).join(",")}]`;
     if (typeof value === "object") {
-      const object3 = value;
-      const prototype = Object.getPrototypeOf(object3);
+      const object4 = value;
+      const prototype = Object.getPrototypeOf(object4);
       if (prototype !== Object.prototype && prototype !== null) {
         throw new Error("ReCap caveats must contain only JSON values.");
       }
-      return `{${Object.keys(object3).sort().map(
-        (key) => `${JSON.stringify(key)}:${canonicalize(object3[key])}`
+      return `{${Object.keys(object4).sort().map(
+        (key) => `${JSON.stringify(key)}:${canonicalize(object4[key])}`
       ).join(",")}}`;
     }
     throw new Error("ReCap caveats must contain only JSON values.");
@@ -8518,8 +8673,8 @@ function canonicalJson(value) {
   }
   if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
   if (typeof value === "object") {
-    const object3 = value;
-    return `{${Object.keys(object3).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object3[key])}`).join(",")}}`;
+    const object4 = value;
+    return `{${Object.keys(object4).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(object4[key])}`).join(",")}}`;
   }
   throw new ShareEnvelopeError("invalid-envelope", "unsupported JSON value");
 }
@@ -9701,8 +9856,8 @@ function canonicalJsonForProof(value) {
   }
   if (Array.isArray(value)) return `[${value.map(canonicalJsonForProof).join(",")}]`;
   if (typeof value === "object") {
-    const object3 = value;
-    return `{${Object.keys(object3).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonForProof(object3[key])}`).join(",")}}`;
+    const object4 = value;
+    return `{${Object.keys(object4).sort().map((key) => `${JSON.stringify(key)}:${canonicalJsonForProof(object4[key])}`).join(",")}}`;
   }
   throw new ShareAccessError("SHARE_SESSION_INVALID");
 }
@@ -10411,12 +10566,12 @@ var ShareRecipientClient = class {
     this.assertDetachedProof(request.proof);
   }
   parseSessionCapability(value) {
-    const object3 = this.requireObject(value, "session capability");
-    if (typeof object3.spaceId !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability space is invalid");
-    if (!Array.isArray(object3.actions) || object3.actions.some((action) => !["read", "list", "edit"].includes(action))) throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability actions are invalid");
-    const resource = this.requireObject(object3.resource, "session capability resource");
+    const object4 = this.requireObject(value, "session capability");
+    if (typeof object4.spaceId !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability space is invalid");
+    if (!Array.isArray(object4.actions) || object4.actions.some((action) => !["read", "list", "edit"].includes(action))) throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability actions are invalid");
+    const resource = this.requireObject(object4.resource, "session capability resource");
     if (resource.kind !== "exact" && resource.kind !== "prefix" || typeof resource.path !== "string") throw new ShareAccessError("SHARE_SESSION_INVALID", "session capability resource is invalid");
-    return { spaceId: object3.spaceId, actions: [...new Set(object3.actions)], resource: { kind: resource.kind, path: resource.path } };
+    return { spaceId: object4.spaceId, actions: [...new Set(object4.actions)], resource: { kind: resource.kind, path: resource.path } };
   }
   assertProvidedPolicySession(session, envelope) {
     const sessionExpiry = dateValue(session.expiresAt);
@@ -12157,6 +12312,68 @@ function shareDeliveryTrustedKid(publicKey) {
   return `${did}#${did.slice("did:key:".length)}`;
 }
 
+// src/delegations/share-delivery-v3.ts
+var import_ed2551910 = require("@noble/curves/ed25519");
+var import_sha2567 = require("@noble/hashes/sha256");
+var CREDENTIAL_INVITATION_REQUEST_DOMAIN = "xyz.tinycloud.credentials/invitation-request/v1\0";
+var DELIVERY_ADMISSION_DOMAIN = "xyz.tinycloud.policy/delivery-admission/v0\0";
+var REQUEST_KEYS = ["schema", "policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "audience", "issuedAt", "expiresAt", "nonce"];
+var ADMISSION_KEYS = ["schema", "policyId", "ownerDid", "recipient", "resource", "actions", "credentialType", "returnLink", "envelopeRef", "senderKeyDid", "audience", "issuedAt", "expiresAt", "nonce", "signature"];
+function exactObject2(value, keys, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
+  const record2 = value;
+  if (Object.keys(record2).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record2, key))) throw new Error(`${label} has unknown or missing fields`);
+  return record2;
+}
+function decodeBase64Url3(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("share delivery value is not canonical base64url");
+  if (typeof atob === "function") {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
+    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+  }
+  if (typeof Buffer !== "undefined") return new Uint8Array(Buffer.from(value, "base64url"));
+  throw new Error("base64url decoding is unavailable");
+}
+function object3(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
+  return value;
+}
+function didKeyBytes2(did) {
+  if (!did.startsWith("did:key:z") || /[#/?]/.test(did.slice("did:key:".length))) throw new Error("v3 delivery admission signer is invalid");
+  const decoded = base58btc.decode(did.slice("did:key:".length));
+  if (decoded.length !== 34 || decoded[0] !== 237 || decoded[1] !== 1) throw new Error("v3 delivery admission signer is invalid");
+  return decoded.slice(2);
+}
+function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes2));
+  } catch {
+    throw new Error("v3 share delivery response is not valid UTF-8 JSON");
+  }
+  const root = exactObject2(parsed, ["request", "admission"], "v3 share delivery response");
+  const request = exactObject2(root.request, REQUEST_KEYS, "credential invitation request");
+  const admission = exactObject2(root.admission, ADMISSION_KEYS, "delivery admission");
+  const signature = exactObject2(admission.signature, ["suite", "signerDid", "value"], "delivery admission signature");
+  const envelope = object3(expected.request.envelope, "v3 share envelope");
+  const policy = object3(envelope.policy, "v3 share policy");
+  const requirement = object3(policy.credentialRequirement, "v3 credential requirement");
+  const credentialType = object3(requirement.credentialType, "v3 credential type");
+  const contentSource = object3(envelope.contentSource, "v3 content source");
+  const envelopeSignature = object3(envelope.signature, "v3 envelope signature");
+  const target = object3(envelope.target, "v3 target");
+  const fields = ["policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "audience", "issuedAt", "expiresAt", "nonce"];
+  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v0" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.request.shareCid || request.audience !== expected.credentialsAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || signature.signerDid !== target.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
+  const issuedAt = Date.parse(String(request.issuedAt));
+  const expiresAt = Date.parse(String(request.expiresAt));
+  if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 15 * 6e4) throw new Error("v3 share delivery authorization time is invalid");
+  const admissionSignature = decodeBase64Url3(signature.value);
+  const { signature: _signature, ...unsignedAdmission } = admission;
+  const digest4 = (0, import_sha2567.sha256)(new TextEncoder().encode(`${DELIVERY_ADMISSION_DOMAIN}${canonicalizeSignedObjectUnsigned(unsignedAdmission)}`));
+  if (admissionSignature.length !== 64 || !import_ed2551910.ed25519.verify(admissionSignature, digest4, didKeyBytes2(String(signature.signerDid)))) throw new Error("v3 share delivery admission signature is invalid");
+  return { request, admission };
+}
+
 // src/delegations/sender-share-store.ts
 var MemorySenderShareRecordStorage = class {
   constructor() {
@@ -14877,8 +15094,8 @@ function stableJson(value) {
   if (Array.isArray(value)) {
     return `[${value.map(stableJson).join(",")}]`;
   }
-  const object3 = value;
-  return `{${Object.keys(object3).sort().map((key) => `${JSON.stringify(key)}:${stableJson(object3[key])}`).join(",")}}`;
+  const object4 = value;
+  return `{${Object.keys(object4).sort().map((key) => `${JSON.stringify(key)}:${stableJson(object4[key])}`).join(",")}}`;
 }
 function indexedDelegationFromRow(row) {
   const [
@@ -17778,7 +17995,7 @@ function portForProtocol(protocol) {
 }
 
 // src/location.ts
-var import_ed2551910 = require("@noble/curves/ed25519");
+var import_ed2551911 = require("@noble/curves/ed25519");
 var import_viem5 = require("viem");
 var DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL = "https://registry.tinycloud.xyz";
 var DEFAULT_TINYCLOUD_FALLBACK_HOST = "https://node.tinycloud.xyz";
@@ -18344,13 +18561,13 @@ async function verifyPkhSignature(did, payload, signature) {
 }
 function verifyDidKeySignature(did, payload, signature) {
   const publicKey = ed25519PublicKeyFromDidKey2(did);
-  const signatureBytes = decodeBase64Url3(signature);
+  const signatureBytes = decodeBase64Url4(signature);
   if (signatureBytes.length !== 64) {
     throw new LocationRecordValidationError(
       "did:key signature must be a base64url Ed25519 signature"
     );
   }
-  return import_ed2551910.ed25519.verify(
+  return import_ed2551911.ed25519.verify(
     signatureBytes,
     new TextEncoder().encode(payload),
     publicKey
@@ -18358,7 +18575,7 @@ function verifyDidKeySignature(did, payload, signature) {
 }
 function verifyDidKeyEd25519Signature(did, payload, signature) {
   const publicKey = ed25519PublicKeyFromDidKey2(did);
-  return import_ed2551910.ed25519.verify(signature, payload, publicKey);
+  return import_ed2551911.ed25519.verify(signature, payload, publicKey);
 }
 function ed25519PublicKeyFromDidKey2(did) {
   const identifier = did.slice("did:key:".length);
@@ -18397,7 +18614,7 @@ function base64UrlEncode3(bytes2) {
   }
   return output;
 }
-function decodeBase64Url3(value) {
+function decodeBase64Url4(value) {
   const alphabet2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
   const bytes2 = [];
   let buffer = 0;