@tinycloud/sdk-core 3.0.0-beta.6 → 3.0.0-beta.8

package/dist/index.cjs

@@ -64,6 +64,7 @@ __export(index_exports, {
   CREDENTIAL_CONTRACT_VERSION: () => CREDENTIAL_CONTRACT_VERSION,
   CREDENTIAL_ERROR_CODES: () => CREDENTIAL_ERROR_CODES,
   CREDENTIAL_FORMAT: () => CREDENTIAL_FORMAT,
+  CREDENTIAL_INVITATION_REQUEST_DOMAIN: () => CREDENTIAL_INVITATION_REQUEST_DOMAIN,
   CREDENTIAL_PROTOCOL: () => CREDENTIAL_ACQUISITION_PROTOCOL,
   CREDENTIAL_STEP_REGISTRY_VERSION: () => CREDENTIAL_STEP_REGISTRY_VERSION,
   CapabilityKeyRegistry: () => CapabilityKeyRegistry,
@@ -87,6 +88,7 @@ __export(index_exports, {
   DEFAULT_SIGNED_READ_URL_EXPIRY_MS: () => DEFAULT_SIGNED_READ_URL_EXPIRY_MS,
   DEFAULT_TINYCLOUD_FALLBACK_HOST: () => DEFAULT_TINYCLOUD_FALLBACK_HOST,
   DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL: () => DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL,
+  DELIVERY_ADMISSION_DOMAIN: () => DELIVERY_ADMISSION_DOMAIN,
   DUCKDB: () => import_bootstrap4.DUCKDB,
   DataVaultService: () => import_sdk_services8.DataVaultService,
   DatabaseHandle: () => import_sdk_services8.DatabaseHandle,
@@ -177,7 +179,6 @@ __export(index_exports, {
   SERVICE_LONG_TO_SHORT: () => SERVICE_LONG_TO_SHORT,
   SERVICE_SHORT_TO_LONG: () => SERVICE_SHORT_TO_LONG,
   SHARE_DELIVERY_AUTHORIZATION_DOMAIN: () => SHARE_DELIVERY_AUTHORIZATION_DOMAIN,
-  SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN: () => SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN,
   SPACE: () => import_bootstrap4.SPACE,
   SQL: () => import_bootstrap4.SQL,
   SQLAction: () => import_sdk_services8.SQLAction,
@@ -380,6 +381,7 @@ __export(index_exports, {
   parsePolicySessionUcan: () => parsePolicySessionUcan,
   parsePortableDelegation: () => parsePortableDelegation,
   parseRecapCapabilities: () => parseRecapCapabilities,
+  parseSecretCatalogKey: () => import_sdk_services8.parseSecretCatalogKey,
   parseShareArtifact: () => parseShareArtifact,
   parseShareUrl: () => parseShareUrl,
   parseSpaceUri: () => parseSpaceUri,
@@ -393,6 +395,7 @@ __export(index_exports, {
   projectUnifiedPolicyCapabilities: () => projectUnifiedPolicyCapabilities,
   projectUnifiedPolicyCapability: () => projectUnifiedPolicyCapability,
   recapCaveatsEqual: () => recapCaveatsEqual,
+  registerPolicyV3: () => registerPolicyV3,
   renewPolicyRootStatusV3: () => renewPolicyRootStatusV3,
   requestTinyCloudManageKeyScope: () => requestTinyCloudManageKeyScope,
   resolveCloudLocation: () => resolveCloudLocation,
@@ -3891,7 +3894,8 @@ var MAX_LEGACY_ENVELOPE_EXPIRES_AT = "2026-12-29T00:00:00Z";
 var LAST_V2_READ_AT = "2027-01-05T00:00:00Z";
 async function requestPolicyChallengeV3(input) {
   const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
-  const response = await fetchFn(new URL("/share/v3/policy/challenges", input.nodeOrigin), {
+  const policyRuntimePath = policyRuntimeBasePath(input.policyRuntimePath);
+  const response = await fetchFn(new URL(`${policyRuntimePath}/challenges`, input.nodeOrigin), {
     method: "POST",
     redirect: "error",
     signal: input.signal,
@@ -3904,6 +3908,13 @@ async function requestPolicyChallengeV3(input) {
     throw new Error("policy challenge binding is invalid");
   return value;
 }
+function policyRuntimeBasePath(value) {
+  const path = value ?? "/policy/v3";
+  if (!/^\/policy(?:\/[a-z0-9-]+)*$/.test(path)) {
+    throw new Error("policy runtime path is invalid");
+  }
+  return path;
+}
 function compactAttenuationForPolicyCapabilities(input) {
   const attenuation = {};
   for (const raw of input) {
@@ -3949,7 +3960,7 @@ function verifyPolicyRootStatusCheckpointV3(input) {
 }
 async function getPolicyRootStatusV3(input) {
   const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
-  const response = await fetchFn(new URL(`/share/v3/policy/status/${encodeURIComponent(input.rootCid)}`, input.nodeOrigin), {
+  const response = await fetchFn(new URL(`/policy/v3/status/${encodeURIComponent(input.rootCid)}`, input.nodeOrigin), {
     method: "GET",
     redirect: "error",
     headers: { accept: "application/json" }
@@ -4008,7 +4019,7 @@ async function renewPolicyRootStatusV3(input) {
   };
   const signature = await input.sign((0, import_sha256.sha256)(new TextEncoder().encode(ROOT_STATUS_RENEWAL_V1_DOMAIN + jcsCanonicalize(unsigned))));
   if (signature.length !== 64) throw new Error("policy root renewal signature must be Ed25519");
-  const response = await fetchFn(new URL("/share/v3/policy/status", input.nodeOrigin), {
+  const response = await fetchFn(new URL("/policy/v3/status", input.nodeOrigin), {
     method: "POST",
     redirect: "error",
     headers: { accept: "application/json", "content-type": "application/json" },
@@ -4263,6 +4274,133 @@ function contentSourceDigestHex(input) {
     )
   );
 }
+function exactObject(value, keys, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} is invalid`);
+  }
+  const record2 = value;
+  if (Object.keys(record2).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record2, key))) {
+    throw new Error(`${label} is invalid`);
+  }
+  return record2;
+}
+function didKeyEd25519PublicKey(value) {
+  const principal = value.split("#", 1)[0];
+  if (!principal.startsWith("did:key:")) {
+    throw new Error("policy enforcer binding signer is invalid");
+  }
+  const material = base58btc.decode(principal.slice("did:key:".length));
+  if (material.length !== 34 || material[0] !== 237 || material[1] !== 1) {
+    throw new Error("policy enforcer binding signer is invalid");
+  }
+  return material.slice(2);
+}
+async function registerPolicyV3(input) {
+  const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
+  const rootExpiresAt = new Date(input.rootExpiresAt);
+  const canonicalRootExpiresAt = new Date(
+    Math.floor(rootExpiresAt.getTime() / 1e3) * 1e3
+  ).toISOString().replace(/\.000Z$/, "Z");
+  if (!Number.isFinite(rootExpiresAt.getTime()) || canonicalRootExpiresAt !== input.rootExpiresAt || rootExpiresAt.getTime() <= Date.now()) {
+    throw new Error("policy root expiry is invalid");
+  }
+  const bindingResponse = await fetchFn(
+    new URL("/policy/v3/enforcer-bindings", input.nodeOrigin),
+    {
+      method: "POST",
+      redirect: "error",
+      signal: input.signal,
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({
+        rootExpiresAt: input.rootExpiresAt,
+        enforcerDid: input.enforcerDid
+      })
+    }
+  );
+  if (!bindingResponse.ok) {
+    throw new Error(`policy enforcer binding rejected (${bindingResponse.status})`);
+  }
+  const binding = exactObject(
+    await bindingResponse.json(),
+    [
+      "schema",
+      "enforcerDid",
+      "nodeAudience",
+      "attestationBindingDigestHex",
+      "issuedAt",
+      "expiresAt",
+      "signature"
+    ],
+    "policy enforcer binding"
+  );
+  const signature = exactObject(
+    binding.signature,
+    ["suite", "signerDid", "value"],
+    "policy enforcer binding signature"
+  );
+  const expectedBindingDigestHex = hex(
+    (0, import_sha256.sha256)(
+      new TextEncoder().encode(
+        jcsCanonicalize({
+          enforcerDid: input.enforcerDid,
+          nodeAudience: input.expectedNodeAudience
+        })
+      )
+    )
+  );
+  if (binding.schema !== ATTESTED_ENFORCER_BINDING_V2_SCHEMA || binding.enforcerDid !== input.enforcerDid || binding.nodeAudience !== input.expectedNodeAudience || binding.attestationBindingDigestHex !== expectedBindingDigestHex || binding.expiresAt !== input.rootExpiresAt || typeof binding.issuedAt !== "string" || Date.parse(binding.issuedAt) > Date.now() || signature.suite !== "Ed25519" || signature.signerDid !== input.expectedNodeAudience || typeof signature.value !== "string") {
+    throw new Error("policy enforcer binding is invalid");
+  }
+  const { signature: _signature, ...unsignedBinding } = binding;
+  const signedBinding = (0, import_sha256.sha256)(
+    new TextEncoder().encode(
+      `xyz.tinycloud.policy/AttestedEnforcerBinding/v2\0${jcsCanonicalize(unsignedBinding)}`
+    )
+  );
+  if (!import_ed255193.ed25519.verify(
+    decodeBase64Url2(signature.value),
+    signedBinding,
+    didKeyEd25519PublicKey(input.expectedNodeAudience),
+    { zip215: false }
+  )) {
+    throw new Error("policy enforcer binding signature is invalid");
+  }
+  const response = await fetchFn(
+    new URL("/policy/v3/policies", input.nodeOrigin),
+    {
+      method: "POST",
+      redirect: "error",
+      signal: input.signal,
+      headers: { accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({
+        policyCid: input.policyCid,
+        policy: input.policy,
+        policyRoot: input.policyRoot.authorization.replace(/^Bearer\s+/i, ""),
+        enforcementRoot: input.enforcementRoot.authorization.replace(/^Bearer\s+/i, ""),
+        contentSourceDigestHex: input.contentSourceDigestHex,
+        nativeProjectionHashHex: input.nativeProjectionHashHex,
+        attestedEnforcerBinding: binding
+      })
+    }
+  );
+  if (!response.ok) {
+    throw new Error(`policy registration rejected (${response.status})`);
+  }
+  const receipt = exactObject(
+    await response.json(),
+    ["policyCid", "policyRootCid", "enforcementRootCid"],
+    "policy registration response"
+  );
+  if (receipt.policyCid !== input.policyCid || receipt.policyRootCid !== input.policyRoot.cid || receipt.enforcementRootCid !== input.enforcementRoot.cid) {
+    throw new Error("policy registration response binding is invalid");
+  }
+  return {
+    policyCid: input.policyCid,
+    policyRootCid: input.policyRoot.cid,
+    enforcementRootCid: input.enforcementRoot.cid,
+    attestedEnforcerBinding: binding
+  };
+}
 function policyDigestHex(policy) {
   const canonicalPolicy = {
     ...policy,
@@ -4879,6 +5017,7 @@ async function admitPolicyCredentialV3(input) {
   const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
   const challenge = await requestPolicyChallengeV3({
     nodeOrigin,
+    policyRuntimePath: input.policyRuntimePath,
     policyCid: input.policyCid,
     recipientDid: input.credential.holderDid,
     requestedCapabilities: input.requestedCapabilities,
@@ -4891,7 +5030,7 @@ async function admitPolicyCredentialV3(input) {
     challenge
   });
   const response = await fetchFn(
-    new URL("/share/v3/policy/delegations", nodeOrigin),
+    new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin),
     {
       method: "POST",
       redirect: "error",
@@ -4936,6 +5075,7 @@ async function admitPolicyCredentialV4(input) {
   const fetchFn = input.fetch ?? globalThis.fetch.bind(globalThis);
   const challenge = await requestPolicyChallengeV3({
     nodeOrigin,
+    policyRuntimePath: input.policyRuntimePath,
     policyCid: input.policyCid,
     recipientDid: input.credential.holderDid,
     requestedCapabilities: input.requestedCapabilities,
@@ -4947,7 +5087,7 @@ async function admitPolicyCredentialV4(input) {
     policy,
     challenge
   });
-  const response = await fetchFn(new URL("/share/v3/policy/delegations", nodeOrigin), {
+  const response = await fetchFn(new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin), {
     method: "POST",
     redirect: "error",
     signal: input.signal,
@@ -4974,8 +5114,22 @@ async function admitPolicyCredentialV4(input) {
     enforcerDid: input.expectedEnforcerDid
   });
   if (session.cid !== value.sessionCid || session.aud !== input.credential.holderDid || session.fact.policyCid !== input.policyCid || session.fact.recipientDid !== input.credential.holderDid || session.fact.policyDelegationCid !== input.policyRootCid || session.fact.enforcementDelegationCid !== input.enforcementRootCid || jcsCanonicalize(session.att) !== jcsCanonicalize(expectedAttenuation)) throw new Error("policy delegation signed binding is invalid");
+  const importResponse = await fetchFn(new URL("/delegate", nodeOrigin), {
+    method: "POST",
+    redirect: "error",
+    signal: input.signal,
+    headers: { Authorization: session.authorization }
+  });
+  if (!importResponse.ok) throw new Error(`delegation import rejected (${importResponse.status})`);
   input.signal?.throwIfAborted();
-  return Object.freeze({ challenge, presentation, session });
+  return Object.freeze({ challenge, presentation, session, delegationImported: true });
+}
+function policyRuntimeBasePath2(value) {
+  const path = value ?? "/policy/v3";
+  if (!/^\/policy(?:\/[a-z0-9-]+)*$/.test(path)) {
+    throw new Error("policy runtime path is invalid");
+  }
+  return path;
 }
 
 // src/requester/index.ts
@@ -12161,41 +12315,12 @@ function shareDeliveryTrustedKid(publicKey) {
 
 // src/delegations/share-delivery-v3.ts
 var import_ed2551910 = require("@noble/curves/ed25519");
-var SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v3\0";
-var AUTHORIZATION_KEYS2 = [
-  "type",
-  "version",
-  "jti",
-  "shareCid",
-  "shareId",
-  "policyCid",
-  "policyRootCid",
-  "enforcementRootCid",
-  "nodeAudience",
-  "enforcerDid",
-  "targetOrigin",
-  "openCredentialsAudience",
-  "holder",
-  "recipientMatcher",
-  "deliveryEmail",
-  "shareUrl",
-  "returnOrigin",
-  "documentName",
-  "senderDid",
-  "senderTrust",
-  "contentSource",
-  "contentSourceDigestHex",
-  "shareExpiresAt",
-  "issuedAt",
-  "reportAbuseToken",
-  "actions",
-  "resource",
-  "requestBodyDigest",
-  "idempotencyKey",
-  "expiresAt",
-  "dataAuthority"
-];
-function exactObject(value, keys, label) {
+var import_sha2567 = require("@noble/hashes/sha256");
+var CREDENTIAL_INVITATION_REQUEST_DOMAIN = "xyz.tinycloud.credentials/invitation-request/v1\0";
+var DELIVERY_ADMISSION_DOMAIN = "xyz.tinycloud.policy/delivery-admission/v0\0";
+var REQUEST_KEYS = ["schema", "policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "audience", "issuedAt", "expiresAt", "nonce"];
+var ADMISSION_KEYS = ["schema", "policyId", "ownerDid", "recipient", "resource", "actions", "credentialType", "returnLink", "envelopeRef", "senderKeyDid", "audience", "issuedAt", "expiresAt", "nonce", "signature"];
+function exactObject2(value, keys, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
   const record2 = value;
   if (Object.keys(record2).length !== keys.length || keys.some((key) => !Object.prototype.hasOwnProperty.call(record2, key))) throw new Error(`${label} has unknown or missing fields`);
@@ -12214,6 +12339,12 @@ function object3(value, label) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${label} is invalid`);
   return value;
 }
+function didKeyBytes2(did) {
+  if (!did.startsWith("did:key:z") || /[#/?]/.test(did.slice("did:key:".length))) throw new Error("v3 delivery admission signer is invalid");
+  const decoded = base58btc.decode(did.slice("did:key:".length));
+  if (decoded.length !== 34 || decoded[0] !== 237 || decoded[1] !== 1) throw new Error("v3 delivery admission signer is invalid");
+  return decoded.slice(2);
+}
 function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
   let parsed;
   try {
@@ -12221,33 +12352,27 @@ function validateShareDeliveryAuthorizationV3Bytes(bytes2, expected) {
   } catch {
     throw new Error("v3 share delivery response is not valid UTF-8 JSON");
   }
-  const root = exactObject(parsed, ["authorization", "proof"], "v3 share delivery response");
-  const authorization = exactObject(root.authorization, AUTHORIZATION_KEYS2, "v3 share delivery authorization");
-  const proof = exactObject(root.proof, ["alg", "kid", "signature"], "v3 share delivery proof");
+  const root = exactObject2(parsed, ["request", "admission"], "v3 share delivery response");
+  const request = exactObject2(root.request, REQUEST_KEYS, "credential invitation request");
+  const admission = exactObject2(root.admission, ADMISSION_KEYS, "delivery admission");
+  const signature = exactObject2(admission.signature, ["suite", "signerDid", "value"], "delivery admission signature");
   const envelope = object3(expected.request.envelope, "v3 share envelope");
-  const policyRoot = object3(envelope.policyRoot, "v3 policy root");
-  const enforcementRoot = object3(envelope.enforcementRoot, "v3 enforcement root");
-  const target = object3(envelope.target, "v3 target");
-  const display = object3(envelope.display, "v3 display");
-  const resource = object3(envelope.resource, "v3 resource");
+  const policy = object3(envelope.policy, "v3 share policy");
+  const requirement = object3(policy.credentialRequirement, "v3 credential requirement");
+  const credentialType = object3(requirement.credentialType, "v3 credential type");
+  const contentSource = object3(envelope.contentSource, "v3 content source");
   const envelopeSignature = object3(envelope.signature, "v3 envelope signature");
-  const shareUrl = new URL(expected.request.shareUrl);
-  const targetOrigin = String(target.origin);
-  const targetUrl = new URL(targetOrigin);
-  const targetHost = targetUrl.hostname;
-  const expectedNodeAudience = `did:web:${targetHost}`;
-  if (authorization.type !== "TinyCloudShareDeliveryAuthorization" || authorization.version !== 3 || authorization.dataAuthority !== false || authorization.jti !== expected.request.jti || authorization.shareCid !== expected.request.shareCid || authorization.shareId !== envelope.shareId || authorization.policyCid !== envelope.policyCid || authorization.policyRootCid !== policyRoot.cid || authorization.enforcementRootCid !== enforcementRoot.cid || authorization.enforcerDid !== target.nodeAudience || authorization.targetOrigin !== target.origin || authorization.nodeAudience !== expectedNodeAudience || expected.nodeProof.kid.split("#", 1)[0] !== expectedNodeAudience || authorization.recipientMatcher === void 0 || canonicalizeSignedObjectUnsigned(authorization.recipientMatcher) !== canonicalizeSignedObjectUnsigned(envelope.recipientMatcher) || canonicalizeSignedObjectUnsigned(authorization.contentSource) !== canonicalizeSignedObjectUnsigned(envelope.contentSource) || authorization.contentSourceDigestHex !== envelope.contentSourceDigestHex || authorization.deliveryEmail !== expected.request.recipientEmail || authorization.shareUrl !== expected.request.shareUrl || authorization.documentName !== expected.request.documentName || authorization.documentName !== display.filename || authorization.senderDid !== envelopeSignature.signerDid || authorization.senderTrust !== "verified" || canonicalizeSignedObjectUnsigned(authorization.actions) !== canonicalizeSignedObjectUnsigned(envelope.actions) || authorization.resource !== resource.path || authorization.shareExpiresAt !== envelope.expiry || authorization.requestBodyDigest !== expected.request.requestBodyDigest || authorization.expiresAt !== expected.request.expiresAt || authorization.idempotencyKey !== expected.request.jti || authorization.reportAbuseToken !== expected.request.jti || authorization.returnOrigin !== shareUrl.origin || shareUrl.pathname !== `/s/${authorization.shareCid}` || shareUrl.hash !== `#k=${expected.request.envelopeKey}` || targetUrl.protocol !== "https:" || shareUrl.protocol !== "https:") throw new Error("v3 share delivery authorization is not bound to the submitted request");
-  if (typeof authorization.openCredentialsAudience !== "string" || authorization.openCredentialsAudience !== expected.credentialsAudience || authorization.openCredentialsAudience === authorization.nodeAudience || authorization.openCredentialsAudience === authorization.returnOrigin) throw new Error("v3 share delivery credentials audience is untrusted");
-  if (proof.alg !== "EdDSA" || proof.kid !== expected.nodeProof.kid || typeof proof.signature !== "string") throw new Error("v3 share delivery proof is invalid");
-  const issuedAt = Date.parse(String(authorization.issuedAt));
-  const expiresAt = Date.parse(String(authorization.expiresAt));
-  const shareExpiresAt = Date.parse(String(authorization.shareExpiresAt));
-  if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || !Number.isFinite(shareExpiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 5 * 6e4 || shareExpiresAt <= issuedAt || typeof authorization.holder !== "string" || !authorization.holder.startsWith("did:")) throw new Error("v3 share delivery authorization time or holder is invalid");
-  const publicKey = expected.nodeProof.publicKey.length === 34 ? expected.nodeProof.publicKey.slice(2) : expected.nodeProof.publicKey;
-  const signature = decodeBase64Url3(proof.signature);
-  const signed = new TextEncoder().encode(`${SHARE_DELIVERY_AUTHORIZATION_V3_DOMAIN}${canonicalizeSignedObjectUnsigned(authorization)}`);
-  if (publicKey.length !== 32 || signature.length !== 64 || !import_ed2551910.ed25519.verify(signature, signed, publicKey)) throw new Error("v3 share delivery proof signature is invalid");
-  return { authorization, proof };
+  const target = object3(envelope.target, "v3 target");
+  const fields = ["policyId", "recipient", "resource", "credentialType", "returnLink", "envelopeRef", "audience", "issuedAt", "expiresAt", "nonce"];
+  if (request.schema !== "xyz.tinycloud.credentials/invitation-request/v1" || admission.schema !== "xyz.tinycloud.policy/delivery-admission/v0" || fields.some((field) => request[field] !== admission[field]) || request.policyId !== envelope.policyCid || request.recipient !== expected.request.recipientEmail || request.resource !== contentSource.kvResource || request.credentialType !== credentialType.id || request.credentialType !== "opencredentials.email/v1" || request.returnLink !== expected.request.shareUrl || request.envelopeRef !== expected.request.shareCid || request.audience !== expected.credentialsAudience || request.expiresAt !== expected.request.expiresAt || request.nonce !== expected.request.jti || admission.ownerDid !== envelopeSignature.signerDid || admission.senderKeyDid !== expected.senderKeyDid || canonicalizeSignedObjectUnsigned(admission.actions) !== canonicalizeSignedObjectUnsigned(["tinycloud.kv/get"]) || signature.suite !== "eddsa-ed25519-sha256-jcs-v1" || signature.signerDid !== target.nodeAudience) throw new Error("v3 share delivery authorization is not bound to the submitted request");
+  const issuedAt = Date.parse(String(request.issuedAt));
+  const expiresAt = Date.parse(String(request.expiresAt));
+  if (!Number.isFinite(issuedAt) || !Number.isFinite(expiresAt) || expiresAt <= issuedAt || expiresAt - issuedAt > 15 * 6e4) throw new Error("v3 share delivery authorization time is invalid");
+  const admissionSignature = decodeBase64Url3(signature.value);
+  const { signature: _signature, ...unsignedAdmission } = admission;
+  const digest4 = (0, import_sha2567.sha256)(new TextEncoder().encode(`${DELIVERY_ADMISSION_DOMAIN}${canonicalizeSignedObjectUnsigned(unsignedAdmission)}`));
+  if (admissionSignature.length !== 64 || !import_ed2551910.ed25519.verify(admissionSignature, digest4, didKeyBytes2(String(signature.signerDid)))) throw new Error("v3 share delivery admission signature is invalid");
+  return { request, admission };
 }
 
 // src/delegations/sender-share-store.ts