@tinycloud/sdk-core 3.0.0-beta.6 → 3.0.0-beta.8

package/dist/policy/index.d.cts

@@ -1,5 +1,5 @@
-import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-BVUC6kdw.cjs';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, B as BuildPolicyCredentialPresentationV3Input, d as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, e as CompactPolicyInvocationInput, f as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, g as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, h as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, i as POLICY_CAPABILITY_V1_DOMAIN, j as POLICY_CAPABILITY_V1_SCHEMA, k as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, l as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, m as POLICY_ENGINE_RECORD_SCHEMA, n as POLICY_PRESENTATION_V3_DOMAIN, o as POLICY_PRESENTATION_V3_SCHEMA, p as POLICY_PRESENTATION_V4_DOMAIN, q as POLICY_PRESENTATION_V4_SCHEMA, r as POLICY_SCHEMA, s as POLICY_SESSION_UCAN_V1_PROFILE, t as POLICY_STATUS_SCHEMA, u as POLICY_V1_DOMAIN, v as POLICY_V1_SCHEMA, w as POLICY_V2_DOMAIN, x as POLICY_V2_SCHEMA, y as PolicyChallengeV3, z as PolicyCredentialAdmissionV3, D as PolicyCredentialAdmissionV4, F as PolicyCredentialPresentationV3, G as PolicyCredentialPresentationV4, H as PolicyCredentialRequirementV1, I as PolicyRootStatusV3, K as PolicySessionUcanFactV1, O as PolicySessionUcanV1, Q as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, T as ROOT_REVOCATION_V1_SCHEMA, V as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, W as ROOT_STATUS_RENEWAL_V1_DOMAIN, X as ROOT_STATUS_V1_DOMAIN, Y as SignCompactUcanAuthorizationInput, Z as SignCompactUcanRootAuthorizationInput, _ as SignatureMaterialError, $ as SignatureSuite, a0 as SignatureVerificationError, a1 as SignedObjectCanonicalizationError, a2 as SignedObjectDigestError, a3 as SignedObjectErrorCode, a4 as SignedObjectIdError, a5 as SignedObjectKind, a6 as SignedObjectMaterial, a7 as SignedObjectProfileError, a8 as SignedObjectSchemaError, a9 as SignedObjectSignature, aa as SignedObjectVerificationResult, ab as SignedPolicyObject, ac as SigningKeyBindingError, ad as UnifiedContentSource, ae as UnifiedEncryptionCapability, af as UnifiedKvCapability, ag as UnifiedNativeCapability, ah as UnifiedPolicyCapability, ai as UnifiedPolicyV1, aj as UnifiedPolicyV2, ak as UnifiedResourceSelector, al as UnsignedPolicy, am as UnsignedPolicyCredentialPresentationV4, an as UnsignedPolicyObject, ao as UnsignedPolicyStatus, ap as UnsignedUnifiedPolicyV2, aq as UnsupportedSignatureSuiteError, ar as admitPolicyCredentialV3, as as admitPolicyCredentialV4, at as buildPolicyCredentialPresentationV3, au as buildPolicyCredentialPresentationV4, av as canonicalizeSignedObjectUnsigned, aw as canonicalizeUnifiedPolicyCapability, ax as compactAttenuationContains, ay as contentSourceDigestHex, az as createAndSignPolicy, aA as createAndSignPolicyEngineRecord, aB as createAndSignPolicyStatus, aC as createAndSignSignedObject, aD as createCompactPolicyDescendant, aE as createCompactPolicyInvocation, aF as deriveSignedObjectMaterial, aG as getPolicyRootStatusV3, aH as issuedCredentialEnvelopeFromVerified, aI as mintPolicySessionV3, aJ as normalizeUnifiedPolicyCapability, aK as parseCompactUcanAuthorization, aL as parsePolicySessionUcan, aM as policyCidFromCanonicalBytes, aN as policyDigestHex, aO as policyIdForDigestHex, aP as policyV2DigestHex, aQ as projectUnifiedPolicyCapabilities, aR as projectUnifiedPolicyCapability, aS as renewPolicyRootStatusV3, aT as requestPolicyChallengeV3, aU as revokePolicyRootV3, aV as signCompactUcanAuthorization, aW as signCompactUcanRootAuthorization, aX as signPolicyCredentialPresentationV4, aY as signedObjectIdFor, aZ as toSignedObjectError, a_ as unifiedNativeProjectionHashHex, a$ as unifiedPolicyCapabilityContains, b0 as unifiedPolicyCapabilityDigestHex, b1 as unifiedPolicyCapabilityFromNative, b2 as validatePolicyCredentialRequirementV1, b3 as validatePolicyEngineRecordSigned, b4 as validatePolicyEngineRecordSignedShape, b5 as validatePolicyEngineRecordUnsigned, b6 as validatePolicySigned, b7 as validatePolicySignedShape, b8 as validatePolicyStatusSigned, b9 as validatePolicyStatusSignedShape, ba as validatePolicyStatusUnsigned, bb as validatePolicyUnsigned, bc as validateUnifiedPolicyV2, bd as verifyPolicy, be as verifyPolicyEngineRecord, bf as verifyPolicyRootRevocationV3, bg as verifyPolicyRootStatusCheckpointV3, bh as verifyPolicyStatus, bi as verifySignedObject } from '../credential-admission-BVUC6kdw.cjs';
+import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-CFjUChF8.cjs';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, f as CompactPolicyInvocationInput, g as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, h as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, i as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, j as POLICY_CAPABILITY_V1_DOMAIN, k as POLICY_CAPABILITY_V1_SCHEMA, l as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, m as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, n as POLICY_ENGINE_RECORD_SCHEMA, o as POLICY_PRESENTATION_V3_DOMAIN, p as POLICY_PRESENTATION_V3_SCHEMA, q as POLICY_PRESENTATION_V4_DOMAIN, r as POLICY_PRESENTATION_V4_SCHEMA, s as POLICY_SCHEMA, t as POLICY_SESSION_UCAN_V1_PROFILE, u as POLICY_STATUS_SCHEMA, v as POLICY_V1_DOMAIN, w as POLICY_V1_SCHEMA, x as POLICY_V2_DOMAIN, y as POLICY_V2_SCHEMA, z as PolicyChallengeV3, D as PolicyCredentialAdmissionV3, F as PolicyCredentialAdmissionV4, G as PolicyCredentialPresentationV3, H as PolicyCredentialPresentationV4, I as PolicyCredentialRequirementV1, K as PolicyRootStatusV3, O as PolicyRootV3, Q as PolicySessionUcanFactV1, R as PolicySessionUcanV1, T as PolicyStatus, V as ROOT_REVOCATION_V1_DOMAIN, W as ROOT_REVOCATION_V1_SCHEMA, X as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Y as ROOT_STATUS_RENEWAL_V1_DOMAIN, Z as ROOT_STATUS_V1_DOMAIN, _ as RegisterPolicyV3Input, $ as RegisterPolicyV3Receipt, a0 as SignCompactUcanAuthorizationInput, a1 as SignCompactUcanRootAuthorizationInput, a2 as SignatureMaterialError, a3 as SignatureSuite, a4 as SignatureVerificationError, a5 as SignedObjectCanonicalizationError, a6 as SignedObjectDigestError, a7 as SignedObjectErrorCode, a8 as SignedObjectIdError, a9 as SignedObjectKind, aa as SignedObjectMaterial, ab as SignedObjectProfileError, ac as SignedObjectSchemaError, ad as SignedObjectSignature, ae as SignedObjectVerificationResult, af as SignedPolicyObject, ag as SigningKeyBindingError, ah as UnifiedContentSource, ai as UnifiedEncryptionCapability, aj as UnifiedKvCapability, ak as UnifiedNativeCapability, al as UnifiedPolicyCapability, am as UnifiedPolicyV1, an as UnifiedPolicyV2, ao as UnifiedResourceSelector, ap as UnsignedPolicy, aq as UnsignedPolicyCredentialPresentationV4, ar as UnsignedPolicyObject, as as UnsignedPolicyStatus, at as UnsignedUnifiedPolicyV2, au as UnsupportedSignatureSuiteError, av as admitPolicyCredentialV3, aw as admitPolicyCredentialV4, ax as buildPolicyCredentialPresentationV3, ay as buildPolicyCredentialPresentationV4, az as canonicalizeSignedObjectUnsigned, aA as canonicalizeUnifiedPolicyCapability, aB as compactAttenuationContains, aC as contentSourceDigestHex, aD as createAndSignPolicy, aE as createAndSignPolicyEngineRecord, aF as createAndSignPolicyStatus, aG as createAndSignSignedObject, aH as createCompactPolicyDescendant, aI as createCompactPolicyInvocation, aJ as deriveSignedObjectMaterial, aK as getPolicyRootStatusV3, aL as issuedCredentialEnvelopeFromVerified, aM as mintPolicySessionV3, aN as normalizeUnifiedPolicyCapability, aO as parseCompactUcanAuthorization, aP as parsePolicySessionUcan, aQ as policyCidFromCanonicalBytes, aR as policyDigestHex, aS as policyIdForDigestHex, aT as policyV2DigestHex, aU as projectUnifiedPolicyCapabilities, aV as projectUnifiedPolicyCapability, aW as registerPolicyV3, aX as renewPolicyRootStatusV3, aY as requestPolicyChallengeV3, aZ as revokePolicyRootV3, a_ as signCompactUcanAuthorization, a$ as signCompactUcanRootAuthorization, b0 as signPolicyCredentialPresentationV4, b1 as signedObjectIdFor, b2 as toSignedObjectError, b3 as unifiedNativeProjectionHashHex, b4 as unifiedPolicyCapabilityContains, b5 as unifiedPolicyCapabilityDigestHex, b6 as unifiedPolicyCapabilityFromNative, b7 as validatePolicyCredentialRequirementV1, b8 as validatePolicyEngineRecordSigned, b9 as validatePolicyEngineRecordSignedShape, ba as validatePolicyEngineRecordUnsigned, bb as validatePolicySigned, bc as validatePolicySignedShape, bd as validatePolicyStatusSigned, be as validatePolicyStatusSignedShape, bf as validatePolicyStatusUnsigned, bg as validatePolicyUnsigned, bh as validateUnifiedPolicyV2, bi as verifyPolicy, bj as verifyPolicyEngineRecord, bk as verifyPolicyRootRevocationV3, bl as verifyPolicyRootStatusCheckpointV3, bm as verifyPolicyStatus, bn as verifySignedObject } from '../credential-admission-CFjUChF8.cjs';
 import { J as JsonObject, P as PolicyCapabilityError } from '../capability-BjzXwtNw.cjs';
 export { a as JsonValue, b as PolicyCapability, c as PolicyCapabilityErrorCode, d as canonicalizePolicyCapability, j as jcsCanonicalize, n as normalizeJson, e as normalizePolicyCapability, p as policyCapabilityContains, f as policyCapabilityDigestHex, s as serializeJcsJson } from '../capability-BjzXwtNw.cjs';
 import 'zod';

package/dist/policy/index.d.ts

@@ -1,5 +1,5 @@
-import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-BgvwOTIV.js';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, B as BuildPolicyCredentialPresentationV3Input, d as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, e as CompactPolicyInvocationInput, f as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, g as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, h as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, i as POLICY_CAPABILITY_V1_DOMAIN, j as POLICY_CAPABILITY_V1_SCHEMA, k as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, l as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, m as POLICY_ENGINE_RECORD_SCHEMA, n as POLICY_PRESENTATION_V3_DOMAIN, o as POLICY_PRESENTATION_V3_SCHEMA, p as POLICY_PRESENTATION_V4_DOMAIN, q as POLICY_PRESENTATION_V4_SCHEMA, r as POLICY_SCHEMA, s as POLICY_SESSION_UCAN_V1_PROFILE, t as POLICY_STATUS_SCHEMA, u as POLICY_V1_DOMAIN, v as POLICY_V1_SCHEMA, w as POLICY_V2_DOMAIN, x as POLICY_V2_SCHEMA, y as PolicyChallengeV3, z as PolicyCredentialAdmissionV3, D as PolicyCredentialAdmissionV4, F as PolicyCredentialPresentationV3, G as PolicyCredentialPresentationV4, H as PolicyCredentialRequirementV1, I as PolicyRootStatusV3, K as PolicySessionUcanFactV1, O as PolicySessionUcanV1, Q as PolicyStatus, R as ROOT_REVOCATION_V1_DOMAIN, T as ROOT_REVOCATION_V1_SCHEMA, V as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, W as ROOT_STATUS_RENEWAL_V1_DOMAIN, X as ROOT_STATUS_V1_DOMAIN, Y as SignCompactUcanAuthorizationInput, Z as SignCompactUcanRootAuthorizationInput, _ as SignatureMaterialError, $ as SignatureSuite, a0 as SignatureVerificationError, a1 as SignedObjectCanonicalizationError, a2 as SignedObjectDigestError, a3 as SignedObjectErrorCode, a4 as SignedObjectIdError, a5 as SignedObjectKind, a6 as SignedObjectMaterial, a7 as SignedObjectProfileError, a8 as SignedObjectSchemaError, a9 as SignedObjectSignature, aa as SignedObjectVerificationResult, ab as SignedPolicyObject, ac as SigningKeyBindingError, ad as UnifiedContentSource, ae as UnifiedEncryptionCapability, af as UnifiedKvCapability, ag as UnifiedNativeCapability, ah as UnifiedPolicyCapability, ai as UnifiedPolicyV1, aj as UnifiedPolicyV2, ak as UnifiedResourceSelector, al as UnsignedPolicy, am as UnsignedPolicyCredentialPresentationV4, an as UnsignedPolicyObject, ao as UnsignedPolicyStatus, ap as UnsignedUnifiedPolicyV2, aq as UnsupportedSignatureSuiteError, ar as admitPolicyCredentialV3, as as admitPolicyCredentialV4, at as buildPolicyCredentialPresentationV3, au as buildPolicyCredentialPresentationV4, av as canonicalizeSignedObjectUnsigned, aw as canonicalizeUnifiedPolicyCapability, ax as compactAttenuationContains, ay as contentSourceDigestHex, az as createAndSignPolicy, aA as createAndSignPolicyEngineRecord, aB as createAndSignPolicyStatus, aC as createAndSignSignedObject, aD as createCompactPolicyDescendant, aE as createCompactPolicyInvocation, aF as deriveSignedObjectMaterial, aG as getPolicyRootStatusV3, aH as issuedCredentialEnvelopeFromVerified, aI as mintPolicySessionV3, aJ as normalizeUnifiedPolicyCapability, aK as parseCompactUcanAuthorization, aL as parsePolicySessionUcan, aM as policyCidFromCanonicalBytes, aN as policyDigestHex, aO as policyIdForDigestHex, aP as policyV2DigestHex, aQ as projectUnifiedPolicyCapabilities, aR as projectUnifiedPolicyCapability, aS as renewPolicyRootStatusV3, aT as requestPolicyChallengeV3, aU as revokePolicyRootV3, aV as signCompactUcanAuthorization, aW as signCompactUcanRootAuthorization, aX as signPolicyCredentialPresentationV4, aY as signedObjectIdFor, aZ as toSignedObjectError, a_ as unifiedNativeProjectionHashHex, a$ as unifiedPolicyCapabilityContains, b0 as unifiedPolicyCapabilityDigestHex, b1 as unifiedPolicyCapabilityFromNative, b2 as validatePolicyCredentialRequirementV1, b3 as validatePolicyEngineRecordSigned, b4 as validatePolicyEngineRecordSignedShape, b5 as validatePolicyEngineRecordUnsigned, b6 as validatePolicySigned, b7 as validatePolicySignedShape, b8 as validatePolicyStatusSigned, b9 as validatePolicyStatusSignedShape, ba as validatePolicyStatusUnsigned, bb as validatePolicyUnsigned, bc as validateUnifiedPolicyV2, bd as verifyPolicy, be as verifyPolicyEngineRecord, bf as verifyPolicyRootRevocationV3, bg as verifyPolicyRootStatusCheckpointV3, bh as verifyPolicyStatus, bi as verifySignedObject } from '../credential-admission-BgvwOTIV.js';
+import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-DIEPgQ0o.js';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, f as CompactPolicyInvocationInput, g as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, h as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, i as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, j as POLICY_CAPABILITY_V1_DOMAIN, k as POLICY_CAPABILITY_V1_SCHEMA, l as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, m as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, n as POLICY_ENGINE_RECORD_SCHEMA, o as POLICY_PRESENTATION_V3_DOMAIN, p as POLICY_PRESENTATION_V3_SCHEMA, q as POLICY_PRESENTATION_V4_DOMAIN, r as POLICY_PRESENTATION_V4_SCHEMA, s as POLICY_SCHEMA, t as POLICY_SESSION_UCAN_V1_PROFILE, u as POLICY_STATUS_SCHEMA, v as POLICY_V1_DOMAIN, w as POLICY_V1_SCHEMA, x as POLICY_V2_DOMAIN, y as POLICY_V2_SCHEMA, z as PolicyChallengeV3, D as PolicyCredentialAdmissionV3, F as PolicyCredentialAdmissionV4, G as PolicyCredentialPresentationV3, H as PolicyCredentialPresentationV4, I as PolicyCredentialRequirementV1, K as PolicyRootStatusV3, O as PolicyRootV3, Q as PolicySessionUcanFactV1, R as PolicySessionUcanV1, T as PolicyStatus, V as ROOT_REVOCATION_V1_DOMAIN, W as ROOT_REVOCATION_V1_SCHEMA, X as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Y as ROOT_STATUS_RENEWAL_V1_DOMAIN, Z as ROOT_STATUS_V1_DOMAIN, _ as RegisterPolicyV3Input, $ as RegisterPolicyV3Receipt, a0 as SignCompactUcanAuthorizationInput, a1 as SignCompactUcanRootAuthorizationInput, a2 as SignatureMaterialError, a3 as SignatureSuite, a4 as SignatureVerificationError, a5 as SignedObjectCanonicalizationError, a6 as SignedObjectDigestError, a7 as SignedObjectErrorCode, a8 as SignedObjectIdError, a9 as SignedObjectKind, aa as SignedObjectMaterial, ab as SignedObjectProfileError, ac as SignedObjectSchemaError, ad as SignedObjectSignature, ae as SignedObjectVerificationResult, af as SignedPolicyObject, ag as SigningKeyBindingError, ah as UnifiedContentSource, ai as UnifiedEncryptionCapability, aj as UnifiedKvCapability, ak as UnifiedNativeCapability, al as UnifiedPolicyCapability, am as UnifiedPolicyV1, an as UnifiedPolicyV2, ao as UnifiedResourceSelector, ap as UnsignedPolicy, aq as UnsignedPolicyCredentialPresentationV4, ar as UnsignedPolicyObject, as as UnsignedPolicyStatus, at as UnsignedUnifiedPolicyV2, au as UnsupportedSignatureSuiteError, av as admitPolicyCredentialV3, aw as admitPolicyCredentialV4, ax as buildPolicyCredentialPresentationV3, ay as buildPolicyCredentialPresentationV4, az as canonicalizeSignedObjectUnsigned, aA as canonicalizeUnifiedPolicyCapability, aB as compactAttenuationContains, aC as contentSourceDigestHex, aD as createAndSignPolicy, aE as createAndSignPolicyEngineRecord, aF as createAndSignPolicyStatus, aG as createAndSignSignedObject, aH as createCompactPolicyDescendant, aI as createCompactPolicyInvocation, aJ as deriveSignedObjectMaterial, aK as getPolicyRootStatusV3, aL as issuedCredentialEnvelopeFromVerified, aM as mintPolicySessionV3, aN as normalizeUnifiedPolicyCapability, aO as parseCompactUcanAuthorization, aP as parsePolicySessionUcan, aQ as policyCidFromCanonicalBytes, aR as policyDigestHex, aS as policyIdForDigestHex, aT as policyV2DigestHex, aU as projectUnifiedPolicyCapabilities, aV as projectUnifiedPolicyCapability, aW as registerPolicyV3, aX as renewPolicyRootStatusV3, aY as requestPolicyChallengeV3, aZ as revokePolicyRootV3, a_ as signCompactUcanAuthorization, a$ as signCompactUcanRootAuthorization, b0 as signPolicyCredentialPresentationV4, b1 as signedObjectIdFor, b2 as toSignedObjectError, b3 as unifiedNativeProjectionHashHex, b4 as unifiedPolicyCapabilityContains, b5 as unifiedPolicyCapabilityDigestHex, b6 as unifiedPolicyCapabilityFromNative, b7 as validatePolicyCredentialRequirementV1, b8 as validatePolicyEngineRecordSigned, b9 as validatePolicyEngineRecordSignedShape, ba as validatePolicyEngineRecordUnsigned, bb as validatePolicySigned, bc as validatePolicySignedShape, bd as validatePolicyStatusSigned, be as validatePolicyStatusSignedShape, bf as validatePolicyStatusUnsigned, bg as validatePolicyUnsigned, bh as validateUnifiedPolicyV2, bi as verifyPolicy, bj as verifyPolicyEngineRecord, bk as verifyPolicyRootRevocationV3, bl as verifyPolicyRootStatusCheckpointV3, bm as verifyPolicyStatus, bn as verifySignedObject } from '../credential-admission-DIEPgQ0o.js';
 import { J as JsonObject, P as PolicyCapabilityError } from '../capability-BjzXwtNw.js';
 export { a as JsonValue, b as PolicyCapability, c as PolicyCapabilityErrorCode, d as canonicalizePolicyCapability, j as jcsCanonicalize, n as normalizeJson, e as normalizePolicyCapability, p as policyCapabilityContains, f as policyCapabilityDigestHex, s as serializeJcsJson } from '../capability-BjzXwtNw.js';
 import 'zod';

package/dist/policy/index.js

@@ -3210,7 +3210,8 @@ var MAX_LEGACY_ENVELOPE_EXPIRES_AT = "2026-12-29T00:00:00Z";
 var LAST_V2_READ_AT = "2027-01-05T00:00:00Z";
 async function requestPolicyChallengeV3(input) {
   const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
-  const response = await fetchFn(new URL("/share/v3/policy/challenges", input.nodeOrigin), {
+  const policyRuntimePath = policyRuntimeBasePath(input.policyRuntimePath);
+  const response = await fetchFn(new URL(`${policyRuntimePath}/challenges`, input.nodeOrigin), {
     method: "POST",
     redirect: "error",
     signal: input.signal,
@@ -3223,12 +3224,19 @@ async function requestPolicyChallengeV3(input) {
     throw new Error("policy challenge binding is invalid");
   return value;
 }
+function policyRuntimeBasePath(value) {
+  const path = value ?? "/policy/v3";
+  if (!/^\/policy(?:\/[a-z0-9-]+)*$/.test(path)) {
+    throw new Error("policy runtime path is invalid");
+  }
+  return path;
+}
 async function mintPolicySessionV3(input) {
   const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
   const challenge = input.challenge ?? await requestPolicyChallengeV3(input);
   if (challenge.policyCid !== input.policyCid || challenge.recipientDid !== input.recipientDid)
     throw new Error("policy challenge binding is invalid");
-  const response = await fetchFn(new URL("/share/v3/policy/delegations", input.nodeOrigin), {
+  const response = await fetchFn(new URL("/policy/v3/delegations", input.nodeOrigin), {
     method: "POST",
     redirect: "error",
     signal: input.signal,
@@ -3290,7 +3298,7 @@ function verifyPolicyRootStatusCheckpointV3(input) {
 }
 async function getPolicyRootStatusV3(input) {
   const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
-  const response = await fetchFn(new URL(`/share/v3/policy/status/${encodeURIComponent(input.rootCid)}`, input.nodeOrigin), {
+  const response = await fetchFn(new URL(`/policy/v3/status/${encodeURIComponent(input.rootCid)}`, input.nodeOrigin), {
     method: "GET",
     redirect: "error",
     headers: { accept: "application/json" }
@@ -3349,7 +3357,7 @@ async function renewPolicyRootStatusV3(input) {
   };
   const signature = await input.sign(sha2564(new TextEncoder().encode(ROOT_STATUS_RENEWAL_V1_DOMAIN + jcsCanonicalize(unsigned))));
   if (signature.length !== 64) throw new Error("policy root renewal signature must be Ed25519");
-  const response = await fetchFn(new URL("/share/v3/policy/status", input.nodeOrigin), {
+  const response = await fetchFn(new URL("/policy/v3/status", input.nodeOrigin), {
     method: "POST",
     redirect: "error",
     headers: { accept: "application/json", "content-type": "application/json" },
@@ -3604,6 +3612,133 @@ function contentSourceDigestHex(input) {
     )
   );
 }
+function exactObject(value, keys, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} is invalid`);
+  }
+  const record2 = value;
+  if (Object.keys(record2).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record2, key))) {
+    throw new Error(`${label} is invalid`);
+  }
+  return record2;
+}
+function didKeyEd25519PublicKey(value) {
+  const principal = value.split("#", 1)[0];
+  if (!principal.startsWith("did:key:")) {
+    throw new Error("policy enforcer binding signer is invalid");
+  }
+  const material = base58btc.decode(principal.slice("did:key:".length));
+  if (material.length !== 34 || material[0] !== 237 || material[1] !== 1) {
+    throw new Error("policy enforcer binding signer is invalid");
+  }
+  return material.slice(2);
+}
+async function registerPolicyV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const rootExpiresAt = new Date(input.rootExpiresAt);
+  const canonicalRootExpiresAt = new Date(
+    Math.floor(rootExpiresAt.getTime() / 1e3) * 1e3
+  ).toISOString().replace(/\.000Z$/, "Z");
+  if (!Number.isFinite(rootExpiresAt.getTime()) || canonicalRootExpiresAt !== input.rootExpiresAt || rootExpiresAt.getTime() <= Date.now()) {
+    throw new Error("policy root expiry is invalid");
+  }
+  const bindingResponse = await fetchFn(
+    new URL("/policy/v3/enforcer-bindings", input.nodeOrigin),
+    {
+      method: "POST",
+      redirect: "error",
+      signal: input.signal,
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({
+        rootExpiresAt: input.rootExpiresAt,
+        enforcerDid: input.enforcerDid
+      })
+    }
+  );
+  if (!bindingResponse.ok) {
+    throw new Error(`policy enforcer binding rejected (${bindingResponse.status})`);
+  }
+  const binding = exactObject(
+    await bindingResponse.json(),
+    [
+      "schema",
+      "enforcerDid",
+      "nodeAudience",
+      "attestationBindingDigestHex",
+      "issuedAt",
+      "expiresAt",
+      "signature"
+    ],
+    "policy enforcer binding"
+  );
+  const signature = exactObject(
+    binding.signature,
+    ["suite", "signerDid", "value"],
+    "policy enforcer binding signature"
+  );
+  const expectedBindingDigestHex = hex(
+    sha2564(
+      new TextEncoder().encode(
+        jcsCanonicalize({
+          enforcerDid: input.enforcerDid,
+          nodeAudience: input.expectedNodeAudience
+        })
+      )
+    )
+  );
+  if (binding.schema !== ATTESTED_ENFORCER_BINDING_V2_SCHEMA || binding.enforcerDid !== input.enforcerDid || binding.nodeAudience !== input.expectedNodeAudience || binding.attestationBindingDigestHex !== expectedBindingDigestHex || binding.expiresAt !== input.rootExpiresAt || typeof binding.issuedAt !== "string" || Date.parse(binding.issuedAt) > Date.now() || signature.suite !== "Ed25519" || signature.signerDid !== input.expectedNodeAudience || typeof signature.value !== "string") {
+    throw new Error("policy enforcer binding is invalid");
+  }
+  const { signature: _signature, ...unsignedBinding } = binding;
+  const signedBinding = sha2564(
+    new TextEncoder().encode(
+      `xyz.tinycloud.policy/AttestedEnforcerBinding/v2\0${jcsCanonicalize(unsignedBinding)}`
+    )
+  );
+  if (!ed255192.verify(
+    decodeBase64Url(signature.value),
+    signedBinding,
+    didKeyEd25519PublicKey(input.expectedNodeAudience),
+    { zip215: false }
+  )) {
+    throw new Error("policy enforcer binding signature is invalid");
+  }
+  const response = await fetchFn(
+    new URL("/policy/v3/policies", input.nodeOrigin),
+    {
+      method: "POST",
+      redirect: "error",
+      signal: input.signal,
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({
+        policyCid: input.policyCid,
+        policy: input.policy,
+        policyRoot: input.policyRoot.authorization.replace(/^Bearer\s+/i, ""),
+        enforcementRoot: input.enforcementRoot.authorization.replace(/^Bearer\s+/i, ""),
+        contentSourceDigestHex: input.contentSourceDigestHex,
+        nativeProjectionHashHex: input.nativeProjectionHashHex,
+        attestedEnforcerBinding: binding
+      })
+    }
+  );
+  if (!response.ok) {
+    throw new Error(`policy registration rejected (${response.status})`);
+  }
+  const receipt = exactObject(
+    await response.json(),
+    ["policyCid", "policyRootCid", "enforcementRootCid"],
+    "policy registration response"
+  );
+  if (receipt.policyCid !== input.policyCid || receipt.policyRootCid !== input.policyRoot.cid || receipt.enforcementRootCid !== input.enforcementRoot.cid) {
+    throw new Error("policy registration response binding is invalid");
+  }
+  return {
+    policyCid: input.policyCid,
+    policyRootCid: input.policyRoot.cid,
+    enforcementRootCid: input.enforcementRoot.cid,
+    attestedEnforcerBinding: binding
+  };
+}
 function policyDigestHex(policy) {
   const canonicalPolicy = {
     ...policy,
@@ -4289,6 +4424,7 @@ async function admitPolicyCredentialV3(input) {
   const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
   const challenge = await requestPolicyChallengeV3({
     nodeOrigin,
+    policyRuntimePath: input.policyRuntimePath,
     policyCid: input.policyCid,
     recipientDid: input.credential.holderDid,
     requestedCapabilities: input.requestedCapabilities,
@@ -4301,7 +4437,7 @@ async function admitPolicyCredentialV3(input) {
     challenge
   });
   const response = await fetchFn(
-    new URL("/share/v3/policy/delegations", nodeOrigin),
+    new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin),
     {
       method: "POST",
       redirect: "error",
@@ -4346,6 +4482,7 @@ async function admitPolicyCredentialV4(input) {
   const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
   const challenge = await requestPolicyChallengeV3({
     nodeOrigin,
+    policyRuntimePath: input.policyRuntimePath,
     policyCid: input.policyCid,
     recipientDid: input.credential.holderDid,
     requestedCapabilities: input.requestedCapabilities,
@@ -4357,7 +4494,7 @@ async function admitPolicyCredentialV4(input) {
     policy,
     challenge
   });
-  const response = await fetchFn(new URL("/share/v3/policy/delegations", nodeOrigin), {
+  const response = await fetchFn(new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin), {
     method: "POST",
     redirect: "error",
     signal: input.signal,
@@ -4384,8 +4521,22 @@ async function admitPolicyCredentialV4(input) {
     enforcerDid: input.expectedEnforcerDid
   });
   if (session.cid !== value.sessionCid || session.aud !== input.credential.holderDid || session.fact.policyCid !== input.policyCid || session.fact.recipientDid !== input.credential.holderDid || session.fact.policyDelegationCid !== input.policyRootCid || session.fact.enforcementDelegationCid !== input.enforcementRootCid || jcsCanonicalize(session.att) !== jcsCanonicalize(expectedAttenuation)) throw new Error("policy delegation signed binding is invalid");
+  const importResponse = await fetchFn(new URL("/delegate", nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    signal: input.signal,
+    headers: { Authorization: session.authorization }
+  });
+  if (!importResponse.ok) throw new Error(`delegation import rejected (${importResponse.status})`);
   input.signal?.throwIfAborted();
-  return Object.freeze({ challenge, presentation, session });
+  return Object.freeze({ challenge, presentation, session, delegationImported: true });
+}
+function policyRuntimeBasePath2(value) {
+  const path = value ?? "/policy/v3";
+  if (!/^\/policy(?:\/[a-z0-9-]+)*$/.test(path)) {
+    throw new Error("policy runtime path is invalid");
+  }
+  return path;
 }
 export {
   ATTESTED_ENFORCER_BINDING_V2_SCHEMA,
@@ -4469,6 +4620,7 @@ export {
   policyV2DigestHex,
   projectUnifiedPolicyCapabilities,
   projectUnifiedPolicyCapability,
+  registerPolicyV3,
   renewPolicyRootStatusV3,
   requestPolicyChallengeV3,
   revokePolicyRootV3,