@tinycloud/sdk-core 3.0.0-beta.6 → 3.0.0-beta.8

package/dist/{credential-admission-BVUC6kdw.d.cts → credential-admission-CFjUChF8.d.cts}

@@ -445,6 +445,43 @@ interface UnifiedPolicyV1 {
         readonly value: string;
     };
 }
+interface PolicyRootV3 {
+    readonly cid: string;
+    readonly authorization: string;
+}
+interface RegisterPolicyV3Input {
+    readonly nodeOrigin: string;
+    readonly policyCid: string;
+    readonly policy: Readonly<Record<string, unknown>>;
+    readonly policyRoot: PolicyRootV3;
+    readonly enforcementRoot: PolicyRootV3;
+    readonly contentSourceDigestHex: string;
+    readonly nativeProjectionHashHex: string;
+    readonly rootExpiresAt: string;
+    readonly enforcerDid: string;
+    readonly expectedNodeAudience: string;
+    readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
+}
+interface AttestedEnforcerBindingV2 {
+    readonly schema: "xyz.tinycloud.policy/attested-enforcer/v2";
+    readonly enforcerDid: string;
+    readonly nodeAudience: string;
+    readonly attestationBindingDigestHex: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly signature: {
+        readonly suite: "Ed25519";
+        readonly signerDid: string;
+        readonly value: string;
+    };
+}
+interface RegisterPolicyV3Receipt {
+    readonly policyCid: string;
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+    readonly attestedEnforcerBinding: AttestedEnforcerBindingV2;
+}
 type PolicySessionUcanFactV1 = Readonly<Record<string, unknown>> & {
     /** Present only on accountless PolicyCredentialPresentation/v4 admissions. */
     readonly credentialIdAuditDigestHex?: string;
@@ -474,6 +511,12 @@ interface PolicyChallengeV3 {
 }
 declare function requestPolicyChallengeV3(input: {
     readonly nodeOrigin: string;
+    /**
+     * Policy control routes are part of the recipient's TinyCloud Node.  This is
+     * deliberately a path, not a second origin: applications must not send a
+     * credential presentation to a separately discovered policy service.
+     */
+    readonly policyRuntimePath?: string;
     readonly policyCid: string;
     readonly recipientDid: string;
     readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
@@ -551,6 +594,12 @@ declare function projectUnifiedPolicyCapabilities(input: readonly unknown[]): Un
 declare function unifiedNativeProjectionHashHex(input: readonly unknown[]): string;
 declare function unifiedPolicyCapabilityFromNative(input: unknown): UnifiedPolicyCapability;
 declare function contentSourceDigestHex(input: UnifiedContentSource): string;
+/**
+ * Register a signed policy and its sibling roots with the embedded Node
+ * Policy/v3 runtime. This is intentionally application-neutral: callers
+ * supply policy material, while Node owns both transport endpoints.
+ */
+declare function registerPolicyV3(input: RegisterPolicyV3Input): Promise<RegisterPolicyV3Receipt>;
 declare function policyDigestHex(policy: Omit<UnifiedPolicyV1, "policyId" | "signature">): string;
 declare function policyIdForDigestHex(digestHex: string): string;
 declare function policyCidFromCanonicalBytes(bytes: Uint8Array): string;
@@ -809,6 +858,8 @@ interface AdmitPolicyCredentialV3Input extends Omit<BuildPolicyCredentialPresent
     readonly policyRootCid: string;
     readonly enforcementRootCid: string;
     readonly nodeOrigin: string;
+    /** Path to the embedded Node policy runtime. Defaults to `/policy/v3`. */
+    readonly policyRuntimePath?: string;
     /** Root authorization CID of the recipient's active TinyCloud account session. */
     readonly accountAuthorizationCid: string;
     /** Recipient-owned `credentials` space covered by the account authorization. */
@@ -832,6 +883,8 @@ interface AdmitPolicyCredentialV4Input extends Omit<BuildPolicyCredentialPresent
     readonly expectedNodeAudience: string;
     readonly expectedEnforcerDid: string;
     readonly nodeOrigin: string;
+    /** Path to the embedded Node policy runtime. Defaults to `/policy/v3`. */
+    readonly policyRuntimePath?: string;
     readonly fetch?: typeof fetch;
     readonly signal?: AbortSignal;
 }
@@ -839,8 +892,10 @@ interface PolicyCredentialAdmissionV4 {
     readonly challenge: PolicyChallengeV3;
     readonly presentation: PolicyCredentialPresentationV4;
     readonly session: PolicySessionUcanV1;
+    /** The ordinary delegation has been activated using Node's generic `/delegate`. */
+    readonly delegationImported: true;
 }
 /** Accountless admission. The request deliberately has no account custody fields. */
 declare function admitPolicyCredentialV4(input: AdmitPolicyCredentialV4Input): Promise<PolicyCredentialAdmissionV4>;
 
-export { type SignatureSuite as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyCredentialAdmissionV4 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialPresentationV3 as F, type PolicyCredentialPresentationV4 as G, type PolicyCredentialRequirementV1 as H, type PolicyRootStatusV3 as I, type JsonObject as J, type PolicySessionUcanFactV1 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicySessionUcanV1 as O, type PolicyEngineRecord as P, type PolicyStatus as Q, ROOT_REVOCATION_V1_DOMAIN as R, type SignedObjectSigner as S, ROOT_REVOCATION_V1_SCHEMA as T, type UnsignedPolicyEngineRecord as U, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as V, ROOT_STATUS_RENEWAL_V1_DOMAIN as W, ROOT_STATUS_V1_DOMAIN as X, type SignCompactUcanAuthorizationInput as Y, type SignCompactUcanRootAuthorizationInput as Z, SignatureMaterialError as _, type Policy as a, unifiedPolicyCapabilityContains as a$, SignatureVerificationError as a0, SignedObjectCanonicalizationError as a1, SignedObjectDigestError as a2, type SignedObjectErrorCode as a3, SignedObjectIdError as a4, type SignedObjectKind as a5, type SignedObjectMaterial as a6, SignedObjectProfileError as a7, SignedObjectSchemaError as a8, type SignedObjectSignature as a9, createAndSignPolicyEngineRecord as aA, createAndSignPolicyStatus as aB, createAndSignSignedObject as aC, createCompactPolicyDescendant as aD, createCompactPolicyInvocation as aE, deriveSignedObjectMaterial as aF, getPolicyRootStatusV3 as aG, issuedCredentialEnvelopeFromVerified as aH, mintPolicySessionV3 as aI, normalizeUnifiedPolicyCapability as aJ, parseCompactUcanAuthorization as aK, parsePolicySessionUcan as aL, policyCidFromCanonicalBytes as aM, policyDigestHex as aN, policyIdForDigestHex as aO, policyV2DigestHex as aP, projectUnifiedPolicyCapabilities as aQ, projectUnifiedPolicyCapability as aR, renewPolicyRootStatusV3 as aS, requestPolicyChallengeV3 as aT, revokePolicyRootV3 as aU, signCompactUcanAuthorization as aV, signCompactUcanRootAuthorization as aW, signPolicyCredentialPresentationV4 as aX, signedObjectIdFor as aY, toSignedObjectError as aZ, unifiedNativeProjectionHashHex as a_, type SignedObjectVerificationResult as aa, type SignedPolicyObject as ab, SigningKeyBindingError as ac, type UnifiedContentSource as ad, type UnifiedEncryptionCapability as ae, type UnifiedKvCapability as af, type UnifiedNativeCapability as ag, type UnifiedPolicyCapability as ah, type UnifiedPolicyV1 as ai, type UnifiedPolicyV2 as aj, type UnifiedResourceSelector as ak, type UnsignedPolicy as al, type UnsignedPolicyCredentialPresentationV4 as am, type UnsignedPolicyObject as an, type UnsignedPolicyStatus as ao, type UnsignedUnifiedPolicyV2 as ap, UnsupportedSignatureSuiteError as aq, admitPolicyCredentialV3 as ar, admitPolicyCredentialV4 as as, buildPolicyCredentialPresentationV3 as at, buildPolicyCredentialPresentationV4 as au, canonicalizeSignedObjectUnsigned as av, canonicalizeUnifiedPolicyCapability as aw, compactAttenuationContains as ax, contentSourceDigestHex as ay, createAndSignPolicy as az, type AdmitPolicyCredentialV3Input as b, unifiedPolicyCapabilityDigestHex as b0, unifiedPolicyCapabilityFromNative as b1, validatePolicyCredentialRequirementV1 as b2, validatePolicyEngineRecordSigned as b3, validatePolicyEngineRecordSignedShape as b4, validatePolicyEngineRecordUnsigned as b5, validatePolicySigned as b6, validatePolicySignedShape as b7, validatePolicyStatusSigned as b8, validatePolicyStatusSignedShape as b9, type CredentialStepType as bA, type CredentialUxState as bB, HOLDER_BINDING_DOMAIN as bC, type IssuerVerificationKey as bD, validatePolicyStatusUnsigned as ba, validatePolicyUnsigned as bb, validateUnifiedPolicyV2 as bc, verifyPolicy as bd, verifyPolicyEngineRecord as be, verifyPolicyRootRevocationV3 as bf, verifyPolicyRootStatusCheckpointV3 as bg, verifyPolicyStatus as bh, verifySignedObject as bi, type CredentialHolderBinding as bj, type CredentialFlowDescriptor as bk, type CredentialRequirement as bl, type StoredCredentialRecord as bm, type VerifiedCredential as bn, type CredentialStorageReceipt as bo, type IssuedCredentialEnvelope as bp, type CredentialIssuerMetadata as bq, CREDENTIAL_ACQUISITION_PROTOCOL as br, CREDENTIAL_CONTRACT_VERSION as bs, CREDENTIAL_FORMAT as bt, CREDENTIAL_STEP_REGISTRY_VERSION as bu, type CredentialClaimDescriptor as bv, type CredentialEndpointId as bw, type CredentialInputDescriptor as bx, type CredentialProgressEvent as by, type CredentialStepDescriptor as bz, type AdmitPolicyCredentialV4Input as c, type BuildPolicyCredentialPresentationV4Input as d, type CompactPolicyInvocationInput as e, type CompactUcanAuthorizationV1 as f, EIP191_JCS_SIGNATURE_SUITE as g, LAST_V2_READ_AT as h, POLICY_CAPABILITY_V1_DOMAIN as i, POLICY_CAPABILITY_V1_SCHEMA as j, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as k, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as l, POLICY_ENGINE_RECORD_SCHEMA as m, POLICY_PRESENTATION_V3_DOMAIN as n, POLICY_PRESENTATION_V3_SCHEMA as o, POLICY_PRESENTATION_V4_DOMAIN as p, POLICY_PRESENTATION_V4_SCHEMA as q, POLICY_SCHEMA as r, POLICY_SESSION_UCAN_V1_PROFILE as s, POLICY_STATUS_SCHEMA as t, POLICY_V1_DOMAIN as u, POLICY_V1_SCHEMA as v, POLICY_V2_DOMAIN as w, POLICY_V2_SCHEMA as x, type PolicyChallengeV3 as y, type PolicyCredentialAdmissionV3 as z };
+export { type RegisterPolicyV3Receipt as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyCredentialAdmissionV3 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialAdmissionV4 as F, type PolicyCredentialPresentationV3 as G, type PolicyCredentialPresentationV4 as H, type PolicyCredentialRequirementV1 as I, type JsonObject as J, type PolicyRootStatusV3 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicyRootV3 as O, type PolicyEngineRecord as P, type PolicySessionUcanFactV1 as Q, type PolicySessionUcanV1 as R, type SignedObjectSigner as S, type PolicyStatus as T, type UnsignedPolicyEngineRecord as U, ROOT_REVOCATION_V1_DOMAIN as V, ROOT_REVOCATION_V1_SCHEMA as W, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as X, ROOT_STATUS_RENEWAL_V1_DOMAIN as Y, ROOT_STATUS_V1_DOMAIN as Z, type RegisterPolicyV3Input as _, type Policy as a, signCompactUcanRootAuthorization as a$, type SignCompactUcanAuthorizationInput as a0, type SignCompactUcanRootAuthorizationInput as a1, SignatureMaterialError as a2, type SignatureSuite as a3, SignatureVerificationError as a4, SignedObjectCanonicalizationError as a5, SignedObjectDigestError as a6, type SignedObjectErrorCode as a7, SignedObjectIdError as a8, type SignedObjectKind as a9, canonicalizeUnifiedPolicyCapability as aA, compactAttenuationContains as aB, contentSourceDigestHex as aC, createAndSignPolicy as aD, createAndSignPolicyEngineRecord as aE, createAndSignPolicyStatus as aF, createAndSignSignedObject as aG, createCompactPolicyDescendant as aH, createCompactPolicyInvocation as aI, deriveSignedObjectMaterial as aJ, getPolicyRootStatusV3 as aK, issuedCredentialEnvelopeFromVerified as aL, mintPolicySessionV3 as aM, normalizeUnifiedPolicyCapability as aN, parseCompactUcanAuthorization as aO, parsePolicySessionUcan as aP, policyCidFromCanonicalBytes as aQ, policyDigestHex as aR, policyIdForDigestHex as aS, policyV2DigestHex as aT, projectUnifiedPolicyCapabilities as aU, projectUnifiedPolicyCapability as aV, registerPolicyV3 as aW, renewPolicyRootStatusV3 as aX, requestPolicyChallengeV3 as aY, revokePolicyRootV3 as aZ, signCompactUcanAuthorization as a_, type SignedObjectMaterial as aa, SignedObjectProfileError as ab, SignedObjectSchemaError as ac, type SignedObjectSignature as ad, type SignedObjectVerificationResult as ae, type SignedPolicyObject as af, SigningKeyBindingError as ag, type UnifiedContentSource as ah, type UnifiedEncryptionCapability as ai, type UnifiedKvCapability as aj, type UnifiedNativeCapability as ak, type UnifiedPolicyCapability as al, type UnifiedPolicyV1 as am, type UnifiedPolicyV2 as an, type UnifiedResourceSelector as ao, type UnsignedPolicy as ap, type UnsignedPolicyCredentialPresentationV4 as aq, type UnsignedPolicyObject as ar, type UnsignedPolicyStatus as as, type UnsignedUnifiedPolicyV2 as at, UnsupportedSignatureSuiteError as au, admitPolicyCredentialV3 as av, admitPolicyCredentialV4 as aw, buildPolicyCredentialPresentationV3 as ax, buildPolicyCredentialPresentationV4 as ay, canonicalizeSignedObjectUnsigned as az, type AdmitPolicyCredentialV3Input as b, signPolicyCredentialPresentationV4 as b0, signedObjectIdFor as b1, toSignedObjectError as b2, unifiedNativeProjectionHashHex as b3, unifiedPolicyCapabilityContains as b4, unifiedPolicyCapabilityDigestHex as b5, unifiedPolicyCapabilityFromNative as b6, validatePolicyCredentialRequirementV1 as b7, validatePolicyEngineRecordSigned as b8, validatePolicyEngineRecordSignedShape as b9, type CredentialClaimDescriptor as bA, type CredentialEndpointId as bB, type CredentialInputDescriptor as bC, type CredentialProgressEvent as bD, type CredentialStepDescriptor as bE, type CredentialStepType as bF, type CredentialUxState as bG, HOLDER_BINDING_DOMAIN as bH, type IssuerVerificationKey as bI, validatePolicyEngineRecordUnsigned as ba, validatePolicySigned as bb, validatePolicySignedShape as bc, validatePolicyStatusSigned as bd, validatePolicyStatusSignedShape as be, validatePolicyStatusUnsigned as bf, validatePolicyUnsigned as bg, validateUnifiedPolicyV2 as bh, verifyPolicy as bi, verifyPolicyEngineRecord as bj, verifyPolicyRootRevocationV3 as bk, verifyPolicyRootStatusCheckpointV3 as bl, verifyPolicyStatus as bm, verifySignedObject as bn, type CredentialHolderBinding as bo, type CredentialFlowDescriptor as bp, type CredentialRequirement as bq, type StoredCredentialRecord as br, type VerifiedCredential as bs, type CredentialStorageReceipt as bt, type IssuedCredentialEnvelope as bu, type CredentialIssuerMetadata as bv, CREDENTIAL_ACQUISITION_PROTOCOL as bw, CREDENTIAL_CONTRACT_VERSION as bx, CREDENTIAL_FORMAT as by, CREDENTIAL_STEP_REGISTRY_VERSION as bz, type AdmitPolicyCredentialV4Input as c, type AttestedEnforcerBindingV2 as d, type BuildPolicyCredentialPresentationV4Input as e, type CompactPolicyInvocationInput as f, type CompactUcanAuthorizationV1 as g, EIP191_JCS_SIGNATURE_SUITE as h, LAST_V2_READ_AT as i, POLICY_CAPABILITY_V1_DOMAIN as j, POLICY_CAPABILITY_V1_SCHEMA as k, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as l, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as m, POLICY_ENGINE_RECORD_SCHEMA as n, POLICY_PRESENTATION_V3_DOMAIN as o, POLICY_PRESENTATION_V3_SCHEMA as p, POLICY_PRESENTATION_V4_DOMAIN as q, POLICY_PRESENTATION_V4_SCHEMA as r, POLICY_SCHEMA as s, POLICY_SESSION_UCAN_V1_PROFILE as t, POLICY_STATUS_SCHEMA as u, POLICY_V1_DOMAIN as v, POLICY_V1_SCHEMA as w, POLICY_V2_DOMAIN as x, POLICY_V2_SCHEMA as y, type PolicyChallengeV3 as z };

package/dist/{credential-admission-BgvwOTIV.d.ts → credential-admission-DIEPgQ0o.d.ts}

@@ -445,6 +445,43 @@ interface UnifiedPolicyV1 {
         readonly value: string;
     };
 }
+interface PolicyRootV3 {
+    readonly cid: string;
+    readonly authorization: string;
+}
+interface RegisterPolicyV3Input {
+    readonly nodeOrigin: string;
+    readonly policyCid: string;
+    readonly policy: Readonly<Record<string, unknown>>;
+    readonly policyRoot: PolicyRootV3;
+    readonly enforcementRoot: PolicyRootV3;
+    readonly contentSourceDigestHex: string;
+    readonly nativeProjectionHashHex: string;
+    readonly rootExpiresAt: string;
+    readonly enforcerDid: string;
+    readonly expectedNodeAudience: string;
+    readonly fetch?: typeof fetch;
+    readonly signal?: AbortSignal;
+}
+interface AttestedEnforcerBindingV2 {
+    readonly schema: "xyz.tinycloud.policy/attested-enforcer/v2";
+    readonly enforcerDid: string;
+    readonly nodeAudience: string;
+    readonly attestationBindingDigestHex: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly signature: {
+        readonly suite: "Ed25519";
+        readonly signerDid: string;
+        readonly value: string;
+    };
+}
+interface RegisterPolicyV3Receipt {
+    readonly policyCid: string;
+    readonly policyRootCid: string;
+    readonly enforcementRootCid: string;
+    readonly attestedEnforcerBinding: AttestedEnforcerBindingV2;
+}
 type PolicySessionUcanFactV1 = Readonly<Record<string, unknown>> & {
     /** Present only on accountless PolicyCredentialPresentation/v4 admissions. */
     readonly credentialIdAuditDigestHex?: string;
@@ -474,6 +511,12 @@ interface PolicyChallengeV3 {
 }
 declare function requestPolicyChallengeV3(input: {
     readonly nodeOrigin: string;
+    /**
+     * Policy control routes are part of the recipient's TinyCloud Node.  This is
+     * deliberately a path, not a second origin: applications must not send a
+     * credential presentation to a separately discovered policy service.
+     */
+    readonly policyRuntimePath?: string;
     readonly policyCid: string;
     readonly recipientDid: string;
     readonly requestedCapabilities: readonly UnifiedPolicyCapability[];
@@ -551,6 +594,12 @@ declare function projectUnifiedPolicyCapabilities(input: readonly unknown[]): Un
 declare function unifiedNativeProjectionHashHex(input: readonly unknown[]): string;
 declare function unifiedPolicyCapabilityFromNative(input: unknown): UnifiedPolicyCapability;
 declare function contentSourceDigestHex(input: UnifiedContentSource): string;
+/**
+ * Register a signed policy and its sibling roots with the embedded Node
+ * Policy/v3 runtime. This is intentionally application-neutral: callers
+ * supply policy material, while Node owns both transport endpoints.
+ */
+declare function registerPolicyV3(input: RegisterPolicyV3Input): Promise<RegisterPolicyV3Receipt>;
 declare function policyDigestHex(policy: Omit<UnifiedPolicyV1, "policyId" | "signature">): string;
 declare function policyIdForDigestHex(digestHex: string): string;
 declare function policyCidFromCanonicalBytes(bytes: Uint8Array): string;
@@ -809,6 +858,8 @@ interface AdmitPolicyCredentialV3Input extends Omit<BuildPolicyCredentialPresent
     readonly policyRootCid: string;
     readonly enforcementRootCid: string;
     readonly nodeOrigin: string;
+    /** Path to the embedded Node policy runtime. Defaults to `/policy/v3`. */
+    readonly policyRuntimePath?: string;
     /** Root authorization CID of the recipient's active TinyCloud account session. */
     readonly accountAuthorizationCid: string;
     /** Recipient-owned `credentials` space covered by the account authorization. */
@@ -832,6 +883,8 @@ interface AdmitPolicyCredentialV4Input extends Omit<BuildPolicyCredentialPresent
     readonly expectedNodeAudience: string;
     readonly expectedEnforcerDid: string;
     readonly nodeOrigin: string;
+    /** Path to the embedded Node policy runtime. Defaults to `/policy/v3`. */
+    readonly policyRuntimePath?: string;
     readonly fetch?: typeof fetch;
     readonly signal?: AbortSignal;
 }
@@ -839,8 +892,10 @@ interface PolicyCredentialAdmissionV4 {
     readonly challenge: PolicyChallengeV3;
     readonly presentation: PolicyCredentialPresentationV4;
     readonly session: PolicySessionUcanV1;
+    /** The ordinary delegation has been activated using Node's generic `/delegate`. */
+    readonly delegationImported: true;
 }
 /** Accountless admission. The request deliberately has no account custody fields. */
 declare function admitPolicyCredentialV4(input: AdmitPolicyCredentialV4Input): Promise<PolicyCredentialAdmissionV4>;
 
-export { type SignatureSuite as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyCredentialAdmissionV4 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialPresentationV3 as F, type PolicyCredentialPresentationV4 as G, type PolicyCredentialRequirementV1 as H, type PolicyRootStatusV3 as I, type JsonObject as J, type PolicySessionUcanFactV1 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicySessionUcanV1 as O, type PolicyEngineRecord as P, type PolicyStatus as Q, ROOT_REVOCATION_V1_DOMAIN as R, type SignedObjectSigner as S, ROOT_REVOCATION_V1_SCHEMA as T, type UnsignedPolicyEngineRecord as U, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as V, ROOT_STATUS_RENEWAL_V1_DOMAIN as W, ROOT_STATUS_V1_DOMAIN as X, type SignCompactUcanAuthorizationInput as Y, type SignCompactUcanRootAuthorizationInput as Z, SignatureMaterialError as _, type Policy as a, unifiedPolicyCapabilityContains as a$, SignatureVerificationError as a0, SignedObjectCanonicalizationError as a1, SignedObjectDigestError as a2, type SignedObjectErrorCode as a3, SignedObjectIdError as a4, type SignedObjectKind as a5, type SignedObjectMaterial as a6, SignedObjectProfileError as a7, SignedObjectSchemaError as a8, type SignedObjectSignature as a9, createAndSignPolicyEngineRecord as aA, createAndSignPolicyStatus as aB, createAndSignSignedObject as aC, createCompactPolicyDescendant as aD, createCompactPolicyInvocation as aE, deriveSignedObjectMaterial as aF, getPolicyRootStatusV3 as aG, issuedCredentialEnvelopeFromVerified as aH, mintPolicySessionV3 as aI, normalizeUnifiedPolicyCapability as aJ, parseCompactUcanAuthorization as aK, parsePolicySessionUcan as aL, policyCidFromCanonicalBytes as aM, policyDigestHex as aN, policyIdForDigestHex as aO, policyV2DigestHex as aP, projectUnifiedPolicyCapabilities as aQ, projectUnifiedPolicyCapability as aR, renewPolicyRootStatusV3 as aS, requestPolicyChallengeV3 as aT, revokePolicyRootV3 as aU, signCompactUcanAuthorization as aV, signCompactUcanRootAuthorization as aW, signPolicyCredentialPresentationV4 as aX, signedObjectIdFor as aY, toSignedObjectError as aZ, unifiedNativeProjectionHashHex as a_, type SignedObjectVerificationResult as aa, type SignedPolicyObject as ab, SigningKeyBindingError as ac, type UnifiedContentSource as ad, type UnifiedEncryptionCapability as ae, type UnifiedKvCapability as af, type UnifiedNativeCapability as ag, type UnifiedPolicyCapability as ah, type UnifiedPolicyV1 as ai, type UnifiedPolicyV2 as aj, type UnifiedResourceSelector as ak, type UnsignedPolicy as al, type UnsignedPolicyCredentialPresentationV4 as am, type UnsignedPolicyObject as an, type UnsignedPolicyStatus as ao, type UnsignedUnifiedPolicyV2 as ap, UnsupportedSignatureSuiteError as aq, admitPolicyCredentialV3 as ar, admitPolicyCredentialV4 as as, buildPolicyCredentialPresentationV3 as at, buildPolicyCredentialPresentationV4 as au, canonicalizeSignedObjectUnsigned as av, canonicalizeUnifiedPolicyCapability as aw, compactAttenuationContains as ax, contentSourceDigestHex as ay, createAndSignPolicy as az, type AdmitPolicyCredentialV3Input as b, unifiedPolicyCapabilityDigestHex as b0, unifiedPolicyCapabilityFromNative as b1, validatePolicyCredentialRequirementV1 as b2, validatePolicyEngineRecordSigned as b3, validatePolicyEngineRecordSignedShape as b4, validatePolicyEngineRecordUnsigned as b5, validatePolicySigned as b6, validatePolicySignedShape as b7, validatePolicyStatusSigned as b8, validatePolicyStatusSignedShape as b9, type CredentialStepType as bA, type CredentialUxState as bB, HOLDER_BINDING_DOMAIN as bC, type IssuerVerificationKey as bD, validatePolicyStatusUnsigned as ba, validatePolicyUnsigned as bb, validateUnifiedPolicyV2 as bc, verifyPolicy as bd, verifyPolicyEngineRecord as be, verifyPolicyRootRevocationV3 as bf, verifyPolicyRootStatusCheckpointV3 as bg, verifyPolicyStatus as bh, verifySignedObject as bi, type CredentialHolderBinding as bj, type CredentialFlowDescriptor as bk, type CredentialRequirement as bl, type StoredCredentialRecord as bm, type VerifiedCredential as bn, type CredentialStorageReceipt as bo, type IssuedCredentialEnvelope as bp, type CredentialIssuerMetadata as bq, CREDENTIAL_ACQUISITION_PROTOCOL as br, CREDENTIAL_CONTRACT_VERSION as bs, CREDENTIAL_FORMAT as bt, CREDENTIAL_STEP_REGISTRY_VERSION as bu, type CredentialClaimDescriptor as bv, type CredentialEndpointId as bw, type CredentialInputDescriptor as bx, type CredentialProgressEvent as by, type CredentialStepDescriptor as bz, type AdmitPolicyCredentialV4Input as c, type BuildPolicyCredentialPresentationV4Input as d, type CompactPolicyInvocationInput as e, type CompactUcanAuthorizationV1 as f, EIP191_JCS_SIGNATURE_SUITE as g, LAST_V2_READ_AT as h, POLICY_CAPABILITY_V1_DOMAIN as i, POLICY_CAPABILITY_V1_SCHEMA as j, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as k, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as l, POLICY_ENGINE_RECORD_SCHEMA as m, POLICY_PRESENTATION_V3_DOMAIN as n, POLICY_PRESENTATION_V3_SCHEMA as o, POLICY_PRESENTATION_V4_DOMAIN as p, POLICY_PRESENTATION_V4_SCHEMA as q, POLICY_SCHEMA as r, POLICY_SESSION_UCAN_V1_PROFILE as s, POLICY_STATUS_SCHEMA as t, POLICY_V1_DOMAIN as u, POLICY_V1_SCHEMA as v, POLICY_V2_DOMAIN as w, POLICY_V2_SCHEMA as x, type PolicyChallengeV3 as y, type PolicyCredentialAdmissionV3 as z };
+export { type RegisterPolicyV3Receipt as $, ATTESTED_ENFORCER_BINDING_V2_SCHEMA as A, type BuildPolicyCredentialPresentationV3Input as B, CONTENT_SOURCE_V1_DOMAIN as C, type PolicyCredentialAdmissionV3 as D, ED25519_JCS_SIGNATURE_SUITE as E, type PolicyCredentialAdmissionV4 as F, type PolicyCredentialPresentationV3 as G, type PolicyCredentialPresentationV4 as H, type PolicyCredentialRequirementV1 as I, type JsonObject as J, type PolicyRootStatusV3 as K, LAST_V2_CREATE_AT as L, MAX_LEGACY_ENVELOPE_EXPIRES_AT as M, NATIVE_PROJECTION_V1_DOMAIN as N, type PolicyRootV3 as O, type PolicyEngineRecord as P, type PolicySessionUcanFactV1 as Q, type PolicySessionUcanV1 as R, type SignedObjectSigner as S, type PolicyStatus as T, type UnsignedPolicyEngineRecord as U, ROOT_REVOCATION_V1_DOMAIN as V, ROOT_REVOCATION_V1_SCHEMA as W, ROOT_STATUS_CHECKPOINT_V1_SCHEMA as X, ROOT_STATUS_RENEWAL_V1_DOMAIN as Y, ROOT_STATUS_V1_DOMAIN as Z, type RegisterPolicyV3Input as _, type Policy as a, signCompactUcanRootAuthorization as a$, type SignCompactUcanAuthorizationInput as a0, type SignCompactUcanRootAuthorizationInput as a1, SignatureMaterialError as a2, type SignatureSuite as a3, SignatureVerificationError as a4, SignedObjectCanonicalizationError as a5, SignedObjectDigestError as a6, type SignedObjectErrorCode as a7, SignedObjectIdError as a8, type SignedObjectKind as a9, canonicalizeUnifiedPolicyCapability as aA, compactAttenuationContains as aB, contentSourceDigestHex as aC, createAndSignPolicy as aD, createAndSignPolicyEngineRecord as aE, createAndSignPolicyStatus as aF, createAndSignSignedObject as aG, createCompactPolicyDescendant as aH, createCompactPolicyInvocation as aI, deriveSignedObjectMaterial as aJ, getPolicyRootStatusV3 as aK, issuedCredentialEnvelopeFromVerified as aL, mintPolicySessionV3 as aM, normalizeUnifiedPolicyCapability as aN, parseCompactUcanAuthorization as aO, parsePolicySessionUcan as aP, policyCidFromCanonicalBytes as aQ, policyDigestHex as aR, policyIdForDigestHex as aS, policyV2DigestHex as aT, projectUnifiedPolicyCapabilities as aU, projectUnifiedPolicyCapability as aV, registerPolicyV3 as aW, renewPolicyRootStatusV3 as aX, requestPolicyChallengeV3 as aY, revokePolicyRootV3 as aZ, signCompactUcanAuthorization as a_, type SignedObjectMaterial as aa, SignedObjectProfileError as ab, SignedObjectSchemaError as ac, type SignedObjectSignature as ad, type SignedObjectVerificationResult as ae, type SignedPolicyObject as af, SigningKeyBindingError as ag, type UnifiedContentSource as ah, type UnifiedEncryptionCapability as ai, type UnifiedKvCapability as aj, type UnifiedNativeCapability as ak, type UnifiedPolicyCapability as al, type UnifiedPolicyV1 as am, type UnifiedPolicyV2 as an, type UnifiedResourceSelector as ao, type UnsignedPolicy as ap, type UnsignedPolicyCredentialPresentationV4 as aq, type UnsignedPolicyObject as ar, type UnsignedPolicyStatus as as, type UnsignedUnifiedPolicyV2 as at, UnsupportedSignatureSuiteError as au, admitPolicyCredentialV3 as av, admitPolicyCredentialV4 as aw, buildPolicyCredentialPresentationV3 as ax, buildPolicyCredentialPresentationV4 as ay, canonicalizeSignedObjectUnsigned as az, type AdmitPolicyCredentialV3Input as b, signPolicyCredentialPresentationV4 as b0, signedObjectIdFor as b1, toSignedObjectError as b2, unifiedNativeProjectionHashHex as b3, unifiedPolicyCapabilityContains as b4, unifiedPolicyCapabilityDigestHex as b5, unifiedPolicyCapabilityFromNative as b6, validatePolicyCredentialRequirementV1 as b7, validatePolicyEngineRecordSigned as b8, validatePolicyEngineRecordSignedShape as b9, type CredentialClaimDescriptor as bA, type CredentialEndpointId as bB, type CredentialInputDescriptor as bC, type CredentialProgressEvent as bD, type CredentialStepDescriptor as bE, type CredentialStepType as bF, type CredentialUxState as bG, HOLDER_BINDING_DOMAIN as bH, type IssuerVerificationKey as bI, validatePolicyEngineRecordUnsigned as ba, validatePolicySigned as bb, validatePolicySignedShape as bc, validatePolicyStatusSigned as bd, validatePolicyStatusSignedShape as be, validatePolicyStatusUnsigned as bf, validatePolicyUnsigned as bg, validateUnifiedPolicyV2 as bh, verifyPolicy as bi, verifyPolicyEngineRecord as bj, verifyPolicyRootRevocationV3 as bk, verifyPolicyRootStatusCheckpointV3 as bl, verifyPolicyStatus as bm, verifySignedObject as bn, type CredentialHolderBinding as bo, type CredentialFlowDescriptor as bp, type CredentialRequirement as bq, type StoredCredentialRecord as br, type VerifiedCredential as bs, type CredentialStorageReceipt as bt, type IssuedCredentialEnvelope as bu, type CredentialIssuerMetadata as bv, CREDENTIAL_ACQUISITION_PROTOCOL as bw, CREDENTIAL_CONTRACT_VERSION as bx, CREDENTIAL_FORMAT as by, CREDENTIAL_STEP_REGISTRY_VERSION as bz, type AdmitPolicyCredentialV4Input as c, type AttestedEnforcerBindingV2 as d, type BuildPolicyCredentialPresentationV4Input as e, type CompactPolicyInvocationInput as f, type CompactUcanAuthorizationV1 as g, EIP191_JCS_SIGNATURE_SUITE as h, LAST_V2_READ_AT as i, POLICY_CAPABILITY_V1_DOMAIN as j, POLICY_CAPABILITY_V1_SCHEMA as k, POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE as l, POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA as m, POLICY_ENGINE_RECORD_SCHEMA as n, POLICY_PRESENTATION_V3_DOMAIN as o, POLICY_PRESENTATION_V3_SCHEMA as p, POLICY_PRESENTATION_V4_DOMAIN as q, POLICY_PRESENTATION_V4_SCHEMA as r, POLICY_SCHEMA as s, POLICY_SESSION_UCAN_V1_PROFILE as t, POLICY_STATUS_SCHEMA as u, POLICY_V1_DOMAIN as v, POLICY_V1_SCHEMA as w, POLICY_V2_DOMAIN as x, POLICY_V2_SCHEMA as y, type PolicyChallengeV3 as z };

package/dist/delegations/index.cjs

@@ -32,6 +32,8 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
 // src/delegations/index.ts
 var delegations_exports = {};
 __export(delegations_exports, {
+  CREDENTIAL_INVITATION_REQUEST_DOMAIN: () => CREDENTIAL_INVITATION_REQUEST_DOMAIN,
+  DELIVERY_ADMISSION_DOMAIN: () => DELIVERY_ADMISSION_DOMAIN,
   DelegationErrorCodes: () => DelegationErrorCodes,
   DelegationManager: () => DelegationManager,
   EncodedShareDataSchema: () => EncodedShareDataSchema,
@@ -46,7 +48,6 @@ __export(delegations_exports, {
   MemoryShareCache: () => MemoryShareCache,
   ReceiveOptionsSchema: () => ReceiveOptionsSchema,
   SHARE_DELIVERY_AUTHORIZATION_DOMAIN: () => SHARE_DELIVERY_AUTHORIZATION_DOMAIN,
-  SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN: () => SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN,
   SenderShareStore: () => SenderShareStore,
   ShareAccessError: () => ShareAccessError,
   ShareActionSchema: () => ShareActionSchema,
@@ -6809,40 +6810,11 @@ function shareDeliveryTrustedKid(publicKey) {
 
 // src/delegations/share-delivery-v3.ts
 var import_ed255198 = require("@noble/curves/ed25519");
-var SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v3\0";
-var AUTHORIZATION_KEYS2 = [
-  "type",
-  "version",
-  "jti",
-  "shareCid",
-  "shareId",
-  "policyCid",
-  "policyRootCid",
-  "enforcementRootCid",
-  "nodeAudience",
-  "enforcerDid",
-  "targetOrigin",
-  "openCredentialsAudience",
-  "holder",
-  "recipientMatcher",
-  "deliveryEmail",
-  "shareUrl",
-  "returnOrigin",
-  "documentName",
-  "senderDid",
-  "senderTrust",
-  "contentSource",
-  "contentSourceDigestHex",
-  "shareExpiresAt",
-  "issuedAt",
-  "reportAbuseToken",
-  "actions",
-  "resource",
-  "requestBodyDigest",
-  "idempotencyKey",
-  "expiresAt",
-  "dataAuthority"
-];
+var import_sha2566 = require("@noble/hashes/sha256");
+var CREDENTIAL_INVITATION_REQUEST_DOMAIN = "xyz.tinycloud.credentials/invitation-request/v1\0";
+var DELIVERY_ADMISSION_DOMAIN = "xyz.tinycloud.policy/delivery-admission/v0\0";
+var REQUEST_KEYS = ["schema", "policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "audience", "issuedAt", "expiresAt", "nonce"];
+var ADMISSION_KEYS = ["schema", "policyId", "ownerDid", "recipient", "resource", "actions", "credentialType", "returnLink", "envelopeRef", "senderKeyDid", "audience", "issuedAt", "expiresAt", "nonce", "signature"];
 function exactObject(value, keys, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
   const record = value;
@@ -6862,6 +6834,12 @@ function object(value, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
   return value;
 }
+function didKeyBytes(did) {
+  if (!did.startsWith("did:key:z") || /[#/?]/.test(did.slice("did:key:".length))) throw new Error("v3 delivery admission signer is invalid");
+  const decoded = base58btc.decode(did.slice("did:key:".length));
+  if (decoded.length !== 34 || decoded[0] !== 237 || decoded[1] !== 1) throw new Error("v3 delivery admission signer is invalid");
+  return decoded.slice(2);
+}
 function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
   let parsed;
   try {
@@ -6869,33 +6847,27 @@ function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
   } catch {
     throw new Error("v3 share delivery response is not valid UTF-8 JSON");
   }
-  const root = exactObject(parsed, ["authorization", "proof"], "v3 share delivery response");
-  const authorization = exactObject(root.authorization, AUTHORIZATION_KEYS2, "v3 share delivery authorization");
-  const proof = exactObject(root.proof, ["alg", "kid", "signature"], "v3 share delivery proof");
+  const root = exactObject(parsed, ["request", "admission"], "v3 share delivery response");
+  const request = exactObject(root.request, REQUEST_KEYS, "credential invitation request");
+  const admission = exactObject(root.admission, ADMISSION_KEYS, "delivery admission");
+  const signature = exactObject(admission.signature, ["suite", "signerDid", "value"], "delivery admission signature");
   const envelope = object(expected.request.envelope, "v3 share envelope");
-  const policyRoot = object(envelope.policyRoot, "v3 policy root");
-  const enforcementRoot = object(envelope.enforcementRoot, "v3 enforcement root");
-  const target = object(envelope.target, "v3 target");
-  const display = object(envelope.display, "v3 display");
-  const resource = object(envelope.resource, "v3 resource");
+  const policy = object(envelope.policy, "v3 share policy");
+  const requirement = object(policy.credentialRequirement, "v3 credential requirement");
+  const credentialType = object(requirement.credentialType, "v3 credential type");
+  const contentSource = object(envelope.contentSource, "v3 content source");
   const envelopeSignature = object(envelope.signature, "v3 envelope signature");
-  const shareUrl = new URL(expected.request.shareUrl);
-  const targetOrigin = String(target.origin);
-  const targetUrl = new URL(targetOrigin);
-  const targetHost = targetUrl.hostname;
-  const expectedNodeAudience = `did:web:${targetHost}`;
-  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 3 || authorization.dataAuthority !== false || authorization.jti !== expected.request.jti || authorization.shareCid !== expected.request.shareCid || authorization.shareId !== envelope.shareId || authorization.policyCid !== envelope.policyCid || authorization.policyRootCid !== policyRoot.cid || authorization.enforcementRootCid !== enforcementRoot.cid || authorization.enforcerDid !== target.nodeAudience || authorization.targetOrigin !== target.origin || authorization.nodeAudience !== expectedNodeAudience || expected.nodeProof.kid.split("#", 1)[0] !== expectedNodeAudience || authorization.recipientMatcher === void 0 || canonicalizeSignedObjectUnsigned(authorization.recipientMatcher) !== canonicalizeSignedObjectUnsigned(envelope.recipientMatcher) || canonicalizeSignedObjectUnsigned(authorization.contentSource) !== canonicalizeSignedObjectUnsigned(envelope.contentSource) || authorization.contentSourceDigestHex !== envelope.contentSourceDigestHex || authorization.deliveryEmail !== expected.request.recipientEmail || authorization.shareUrl !== expected.request.shareUrl || authorization.documentName !== expected.request.documentName || authorization.documentName !== display.filename || authorization.senderDid !== envelopeSignature.signerDid || authorization.senderTrust !== "verified" || canonicalizeSignedObjectUnsigned(authorization.actions) !== canonicalizeSignedObjectUnsigned(envelope.actions) || authorization.resource !== resource.path || authorization.shareExpiresAt !== envelope.expiry || authorization.requestBodyDigest !== expected.request.requestBodyDigest || authorization.expiresAt !== expected.request.expiresAt || authorization.idempotencyKey !== expected.request.jti || authorization.reportAbuseToken !== expected.request.jti || authorization.returnOrigin !== shareUrl.origin || shareUrl.pathname !== `/s/${authorization.shareCid}` || shareUrl.hash !== `#k=${expected.request.envelopeKey}` || targetUrl.protocol !== "https:" || shareUrl.protocol !== "https:") throw new Error("v3 share delivery authorization is not bound to the submitted request");
-  if (typeof authorization.openCredentialsAudience !== "string" || authorization.openCredentialsAudience !== expected.credentialsAudience || authorization.openCredentialsAudience === authorization.nodeAudience || authorization.openCredentialsAudience === authorization.returnOrigin) throw new Error("v3 share delivery credentials audience is untrusted");
-  if (proof.alg !== "EdDSA" || proof.kid !== expected.nodeProof.kid || typeof proof.signature !== "string") throw new Error("v3 share delivery proof is invalid");
-  const issuedAt = Date.parse(String(authorization.issuedAt));
-  const expiresAt = Date.parse(String(authorization.expiresAt));
-  const shareExpiresAt = Date.parse(String(authorization.shareExpiresAt));
-  if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || !Number.isFinite(shareExpiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 5 * 6e4 || shareExpiresAt <= issuedAt || typeof authorization.holder !== "string" || !authorization.holder.startsWith("did:")) throw new Error("v3 share delivery authorization time or holder is invalid");
-  const publicKey = expected.nodeProof.publicKey.length === 34 ? expected.nodeProof.publicKey.slice(2) : expected.nodeProof.publicKey;
-  const signature = decodeBase64Url2(proof.signature);
-  const signed = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN}${canonicalizeSignedObjectUnsigned(authorization)}`);
-  if (publicKey.length !== 32 || signature.length !== 64 || !import_ed255198.ed25519.verify(signature, signed, publicKey)) throw new Error("v3 share delivery proof signature is invalid");
-  return { authorization, proof };
+  const target = object(envelope.target, "v3 target");
+  const fields = ["policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "audience", "issuedAt", "expiresAt", "nonce"];
+  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v0" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.request.shareCid || request.audience !== expected.credentialsAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || signature.signerDid !== target.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
+  const issuedAt = Date.parse(String(request.issuedAt));
+  const expiresAt = Date.parse(String(request.expiresAt));
+  if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 15 * 6e4) throw new Error("v3 share delivery authorization time is invalid");
+  const admissionSignature = decodeBase64Url2(signature.value);
+  const { signature: _signature, ...unsignedAdmission } = admission;
+  const digest4 = (0, import_sha2566.sha256)(new TextEncoder().encode(`${DELIVERY_ADMISSION_DOMAIN}${canonicalizeSignedObjectUnsigned(unsignedAdmission)}`));
+  if (admissionSignature.length !== 64 || !import_ed255198.ed25519.verify(admissionSignature, digest4, didKeyBytes(String(signature.signerDid)))) throw new Error("v3 share delivery admission signature is invalid");
+  return { request, admission };
 }
 
 // src/delegations/sender-share-store.ts