@tinycloud/sdk-core 3.0.0-beta.8 → 3.0.0

package/dist/policy/index.d.cts

@@ -1,5 +1,5 @@
-import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-CFjUChF8.cjs';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, f as CompactPolicyInvocationInput, g as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, h as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, i as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, j as POLICY_CAPABILITY_V1_DOMAIN, k as POLICY_CAPABILITY_V1_SCHEMA, l as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, m as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, n as POLICY_ENGINE_RECORD_SCHEMA, o as POLICY_PRESENTATION_V3_DOMAIN, p as POLICY_PRESENTATION_V3_SCHEMA, q as POLICY_PRESENTATION_V4_DOMAIN, r as POLICY_PRESENTATION_V4_SCHEMA, s as POLICY_SCHEMA, t as POLICY_SESSION_UCAN_V1_PROFILE, u as POLICY_STATUS_SCHEMA, v as POLICY_V1_DOMAIN, w as POLICY_V1_SCHEMA, x as POLICY_V2_DOMAIN, y as POLICY_V2_SCHEMA, z as PolicyChallengeV3, D as PolicyCredentialAdmissionV3, F as PolicyCredentialAdmissionV4, G as PolicyCredentialPresentationV3, H as PolicyCredentialPresentationV4, I as PolicyCredentialRequirementV1, K as PolicyRootStatusV3, O as PolicyRootV3, Q as PolicySessionUcanFactV1, R as PolicySessionUcanV1, T as PolicyStatus, V as ROOT_REVOCATION_V1_DOMAIN, W as ROOT_REVOCATION_V1_SCHEMA, X as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Y as ROOT_STATUS_RENEWAL_V1_DOMAIN, Z as ROOT_STATUS_V1_DOMAIN, _ as RegisterPolicyV3Input, $ as RegisterPolicyV3Receipt, a0 as SignCompactUcanAuthorizationInput, a1 as SignCompactUcanRootAuthorizationInput, a2 as SignatureMaterialError, a3 as SignatureSuite, a4 as SignatureVerificationError, a5 as SignedObjectCanonicalizationError, a6 as SignedObjectDigestError, a7 as SignedObjectErrorCode, a8 as SignedObjectIdError, a9 as SignedObjectKind, aa as SignedObjectMaterial, ab as SignedObjectProfileError, ac as SignedObjectSchemaError, ad as SignedObjectSignature, ae as SignedObjectVerificationResult, af as SignedPolicyObject, ag as SigningKeyBindingError, ah as UnifiedContentSource, ai as UnifiedEncryptionCapability, aj as UnifiedKvCapability, ak as UnifiedNativeCapability, al as UnifiedPolicyCapability, am as UnifiedPolicyV1, an as UnifiedPolicyV2, ao as UnifiedResourceSelector, ap as UnsignedPolicy, aq as UnsignedPolicyCredentialPresentationV4, ar as UnsignedPolicyObject, as as UnsignedPolicyStatus, at as UnsignedUnifiedPolicyV2, au as UnsupportedSignatureSuiteError, av as admitPolicyCredentialV3, aw as admitPolicyCredentialV4, ax as buildPolicyCredentialPresentationV3, ay as buildPolicyCredentialPresentationV4, az as canonicalizeSignedObjectUnsigned, aA as canonicalizeUnifiedPolicyCapability, aB as compactAttenuationContains, aC as contentSourceDigestHex, aD as createAndSignPolicy, aE as createAndSignPolicyEngineRecord, aF as createAndSignPolicyStatus, aG as createAndSignSignedObject, aH as createCompactPolicyDescendant, aI as createCompactPolicyInvocation, aJ as deriveSignedObjectMaterial, aK as getPolicyRootStatusV3, aL as issuedCredentialEnvelopeFromVerified, aM as mintPolicySessionV3, aN as normalizeUnifiedPolicyCapability, aO as parseCompactUcanAuthorization, aP as parsePolicySessionUcan, aQ as policyCidFromCanonicalBytes, aR as policyDigestHex, aS as policyIdForDigestHex, aT as policyV2DigestHex, aU as projectUnifiedPolicyCapabilities, aV as projectUnifiedPolicyCapability, aW as registerPolicyV3, aX as renewPolicyRootStatusV3, aY as requestPolicyChallengeV3, aZ as revokePolicyRootV3, a_ as signCompactUcanAuthorization, a$ as signCompactUcanRootAuthorization, b0 as signPolicyCredentialPresentationV4, b1 as signedObjectIdFor, b2 as toSignedObjectError, b3 as unifiedNativeProjectionHashHex, b4 as unifiedPolicyCapabilityContains, b5 as unifiedPolicyCapabilityDigestHex, b6 as unifiedPolicyCapabilityFromNative, b7 as validatePolicyCredentialRequirementV1, b8 as validatePolicyEngineRecordSigned, b9 as validatePolicyEngineRecordSignedShape, ba as validatePolicyEngineRecordUnsigned, bb as validatePolicySigned, bc as validatePolicySignedShape, bd as validatePolicyStatusSigned, be as validatePolicyStatusSignedShape, bf as validatePolicyStatusUnsigned, bg as validatePolicyUnsigned, bh as validateUnifiedPolicyV2, bi as verifyPolicy, bj as verifyPolicyEngineRecord, bk as verifyPolicyRootRevocationV3, bl as verifyPolicyRootStatusCheckpointV3, bm as verifyPolicyStatus, bn as verifySignedObject } from '../credential-admission-CFjUChF8.cjs';
+import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-BxpkckU0.cjs';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, f as CompactPolicyDescendantInput, g as CompactPolicyInvocationInput, h as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, D as PolicyChallengeV3, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aI as createCompactPolicyDescendant, aJ as createCompactPolicyInvocation, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aN as mintPolicySessionV3, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as policyCidFromCanonicalBytes, aS as policyDigestHex, aT as policyIdForDigestHex, aU as policyV2DigestHex, aV as projectUnifiedPolicyCapabilities, aW as projectUnifiedPolicyCapability, aX as registerPolicyV3, aY as renewPolicyRootStatusV3, aZ as requestPolicyChallengeV3, a_ as revokePolicyRootV3, a$ as signCompactPolicyDescendant, b0 as signCompactUcanAuthorization, b1 as signCompactUcanRootAuthorization, b2 as signPolicyCredentialPresentationV4, b3 as signedObjectIdFor, b4 as toSignedObjectError, b5 as unifiedNativeProjectionHashHex, b6 as unifiedPolicyCapabilityContains, b7 as unifiedPolicyCapabilityDigestHex, b8 as unifiedPolicyCapabilityFromNative, b9 as validatePolicyCredentialRequirementV1, ba as validatePolicyEngineRecordSigned, bb as validatePolicyEngineRecordSignedShape, bc as validatePolicyEngineRecordUnsigned, bd as validatePolicySigned, be as validatePolicySignedShape, bf as validatePolicyStatusSigned, bg as validatePolicyStatusSignedShape, bh as validatePolicyStatusUnsigned, bi as validatePolicyUnsigned, bj as validateUnifiedPolicyV2, bk as verifyPolicy, bl as verifyPolicyEngineRecord, bm as verifyPolicyRootRevocationV3, bn as verifyPolicyRootStatusCheckpointV3, bo as verifyPolicyStatus, bp as verifySignedObject } from '../credential-admission-BxpkckU0.cjs';
 import { J as JsonObject, P as PolicyCapabilityError } from '../capability-BjzXwtNw.cjs';
 export { a as JsonValue, b as PolicyCapability, c as PolicyCapabilityErrorCode, d as canonicalizePolicyCapability, j as jcsCanonicalize, n as normalizeJson, e as normalizePolicyCapability, p as policyCapabilityContains, f as policyCapabilityDigestHex, s as serializeJcsJson } from '../capability-BjzXwtNw.cjs';
 import 'zod';

package/dist/policy/index.d.ts

@@ -1,5 +1,5 @@
-import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-DIEPgQ0o.js';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, f as CompactPolicyInvocationInput, g as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, h as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, i as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, j as POLICY_CAPABILITY_V1_DOMAIN, k as POLICY_CAPABILITY_V1_SCHEMA, l as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, m as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, n as POLICY_ENGINE_RECORD_SCHEMA, o as POLICY_PRESENTATION_V3_DOMAIN, p as POLICY_PRESENTATION_V3_SCHEMA, q as POLICY_PRESENTATION_V4_DOMAIN, r as POLICY_PRESENTATION_V4_SCHEMA, s as POLICY_SCHEMA, t as POLICY_SESSION_UCAN_V1_PROFILE, u as POLICY_STATUS_SCHEMA, v as POLICY_V1_DOMAIN, w as POLICY_V1_SCHEMA, x as POLICY_V2_DOMAIN, y as POLICY_V2_SCHEMA, z as PolicyChallengeV3, D as PolicyCredentialAdmissionV3, F as PolicyCredentialAdmissionV4, G as PolicyCredentialPresentationV3, H as PolicyCredentialPresentationV4, I as PolicyCredentialRequirementV1, K as PolicyRootStatusV3, O as PolicyRootV3, Q as PolicySessionUcanFactV1, R as PolicySessionUcanV1, T as PolicyStatus, V as ROOT_REVOCATION_V1_DOMAIN, W as ROOT_REVOCATION_V1_SCHEMA, X as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Y as ROOT_STATUS_RENEWAL_V1_DOMAIN, Z as ROOT_STATUS_V1_DOMAIN, _ as RegisterPolicyV3Input, $ as RegisterPolicyV3Receipt, a0 as SignCompactUcanAuthorizationInput, a1 as SignCompactUcanRootAuthorizationInput, a2 as SignatureMaterialError, a3 as SignatureSuite, a4 as SignatureVerificationError, a5 as SignedObjectCanonicalizationError, a6 as SignedObjectDigestError, a7 as SignedObjectErrorCode, a8 as SignedObjectIdError, a9 as SignedObjectKind, aa as SignedObjectMaterial, ab as SignedObjectProfileError, ac as SignedObjectSchemaError, ad as SignedObjectSignature, ae as SignedObjectVerificationResult, af as SignedPolicyObject, ag as SigningKeyBindingError, ah as UnifiedContentSource, ai as UnifiedEncryptionCapability, aj as UnifiedKvCapability, ak as UnifiedNativeCapability, al as UnifiedPolicyCapability, am as UnifiedPolicyV1, an as UnifiedPolicyV2, ao as UnifiedResourceSelector, ap as UnsignedPolicy, aq as UnsignedPolicyCredentialPresentationV4, ar as UnsignedPolicyObject, as as UnsignedPolicyStatus, at as UnsignedUnifiedPolicyV2, au as UnsupportedSignatureSuiteError, av as admitPolicyCredentialV3, aw as admitPolicyCredentialV4, ax as buildPolicyCredentialPresentationV3, ay as buildPolicyCredentialPresentationV4, az as canonicalizeSignedObjectUnsigned, aA as canonicalizeUnifiedPolicyCapability, aB as compactAttenuationContains, aC as contentSourceDigestHex, aD as createAndSignPolicy, aE as createAndSignPolicyEngineRecord, aF as createAndSignPolicyStatus, aG as createAndSignSignedObject, aH as createCompactPolicyDescendant, aI as createCompactPolicyInvocation, aJ as deriveSignedObjectMaterial, aK as getPolicyRootStatusV3, aL as issuedCredentialEnvelopeFromVerified, aM as mintPolicySessionV3, aN as normalizeUnifiedPolicyCapability, aO as parseCompactUcanAuthorization, aP as parsePolicySessionUcan, aQ as policyCidFromCanonicalBytes, aR as policyDigestHex, aS as policyIdForDigestHex, aT as policyV2DigestHex, aU as projectUnifiedPolicyCapabilities, aV as projectUnifiedPolicyCapability, aW as registerPolicyV3, aX as renewPolicyRootStatusV3, aY as requestPolicyChallengeV3, aZ as revokePolicyRootV3, a_ as signCompactUcanAuthorization, a$ as signCompactUcanRootAuthorization, b0 as signPolicyCredentialPresentationV4, b1 as signedObjectIdFor, b2 as toSignedObjectError, b3 as unifiedNativeProjectionHashHex, b4 as unifiedPolicyCapabilityContains, b5 as unifiedPolicyCapabilityDigestHex, b6 as unifiedPolicyCapabilityFromNative, b7 as validatePolicyCredentialRequirementV1, b8 as validatePolicyEngineRecordSigned, b9 as validatePolicyEngineRecordSignedShape, ba as validatePolicyEngineRecordUnsigned, bb as validatePolicySigned, bc as validatePolicySignedShape, bd as validatePolicyStatusSigned, be as validatePolicyStatusSignedShape, bf as validatePolicyStatusUnsigned, bg as validatePolicyUnsigned, bh as validateUnifiedPolicyV2, bi as verifyPolicy, bj as verifyPolicyEngineRecord, bk as verifyPolicyRootRevocationV3, bl as verifyPolicyRootStatusCheckpointV3, bm as verifyPolicyStatus, bn as verifySignedObject } from '../credential-admission-DIEPgQ0o.js';
+import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-CO9WMtGs.js';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, f as CompactPolicyDescendantInput, g as CompactPolicyInvocationInput, h as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, D as PolicyChallengeV3, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aI as createCompactPolicyDescendant, aJ as createCompactPolicyInvocation, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aN as mintPolicySessionV3, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as policyCidFromCanonicalBytes, aS as policyDigestHex, aT as policyIdForDigestHex, aU as policyV2DigestHex, aV as projectUnifiedPolicyCapabilities, aW as projectUnifiedPolicyCapability, aX as registerPolicyV3, aY as renewPolicyRootStatusV3, aZ as requestPolicyChallengeV3, a_ as revokePolicyRootV3, a$ as signCompactPolicyDescendant, b0 as signCompactUcanAuthorization, b1 as signCompactUcanRootAuthorization, b2 as signPolicyCredentialPresentationV4, b3 as signedObjectIdFor, b4 as toSignedObjectError, b5 as unifiedNativeProjectionHashHex, b6 as unifiedPolicyCapabilityContains, b7 as unifiedPolicyCapabilityDigestHex, b8 as unifiedPolicyCapabilityFromNative, b9 as validatePolicyCredentialRequirementV1, ba as validatePolicyEngineRecordSigned, bb as validatePolicyEngineRecordSignedShape, bc as validatePolicyEngineRecordUnsigned, bd as validatePolicySigned, be as validatePolicySignedShape, bf as validatePolicyStatusSigned, bg as validatePolicyStatusSignedShape, bh as validatePolicyStatusUnsigned, bi as validatePolicyUnsigned, bj as validateUnifiedPolicyV2, bk as verifyPolicy, bl as verifyPolicyEngineRecord, bm as verifyPolicyRootRevocationV3, bn as verifyPolicyRootStatusCheckpointV3, bo as verifyPolicyStatus, bp as verifySignedObject } from '../credential-admission-CO9WMtGs.js';
 import { J as JsonObject, P as PolicyCapabilityError } from '../capability-BjzXwtNw.js';
 export { a as JsonValue, b as PolicyCapability, c as PolicyCapabilityErrorCode, d as canonicalizePolicyCapability, j as jcsCanonicalize, n as normalizeJson, e as normalizePolicyCapability, p as policyCapabilityContains, f as policyCapabilityDigestHex, s as serializeJcsJson } from '../capability-BjzXwtNw.js';
 import 'zod';

package/dist/policy/index.js

@@ -3807,8 +3807,9 @@ async function signCompactUcanAuthorization(input) {
     throw new Error("compact invocation lifetime must be between one and 60 seconds");
   return signCompactUcan(input);
 }
+var MAX_POLICY_ROOT_SECONDS = 31 * 24 * 60 * 60;
 async function signCompactUcanRootAuthorization(input) {
-  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > 31 * 24 * 60 * 60)
+  if (input.notBefore >= input.expiresAt || input.expiresAt - input.notBefore > MAX_POLICY_ROOT_SECONDS)
     throw new Error("compact policy root lifetime must be between one second and 31 days");
   return signCompactUcan({ ...input, proofs: [] });
 }
@@ -3843,7 +3844,7 @@ function createCompactPolicyInvocation(input) {
   const signature = ed255192.sign(signingInput, input.privateKey);
   return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
 }
-function createCompactPolicyDescendant(input) {
+function compactPolicyDescendantClaims(input) {
   const parent = parseCompactUcanAuthorization(input.parentAuthorization, input.parentCid);
   if (parent.payload.aud !== input.issuerDid) throw new Error("policy descendant issuer is not the parent audience");
   const parentFact = parent.payload.fct[0];
@@ -3851,29 +3852,53 @@ function createCompactPolicyDescendant(input) {
   if (!Number.isInteger(depth) || depth <= 0) throw new Error("policy descendant depth is exhausted");
   if (!compactAttenuationContains(parent.payload.att, input.attenuation))
     throw new Error("policy descendant exceeds the parent attenuation");
+  const now = Math.max(input.now ?? parent.payload.nbf + 1, parent.payload.nbf + 1);
+  const exp = Math.min(input.expiresAt ?? parent.payload.exp - 1, parent.payload.exp - 1);
+  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
+  return {
+    parentCid: parent.cid,
+    fact: { ...parentFact, remainingRedelegationDepth: depth - 1 },
+    notBefore: now,
+    expiresAt: exp,
+    nonce: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16)))
+  };
+}
+function createCompactPolicyDescendant(input) {
+  const claims = compactPolicyDescendantClaims(input);
   const principal = input.issuerDid.split("#", 1)[0];
   const didMaterial = base58btc.decode(principal.slice("did:key:".length));
   const publicKey = ed255192.getPublicKey(input.privateKey);
   if (didMaterial.length !== 34 || !equalBytes(publicKey, didMaterial.slice(2))) throw new Error("policy descendant signer does not bind issuer DID");
-  const now = Math.max(input.now ?? Math.floor(Date.now() / 1e3), parent.payload.nbf + 1);
-  const exp = Math.min(input.expiresAt ?? now + 60, now + 60, parent.payload.exp - 1);
-  if (exp <= now) throw new Error("policy parent has no strictly narrower validity window");
   const header = { alg: "EdDSA", jwk: { alg: "EdDSA", crv: "Ed25519", kty: "OKP", x: encodeBase64Url(publicKey) }, typ: "JWT", ucv: "0.10.0" };
   const payload = {
     att: input.attenuation,
     aud: input.audienceDid,
-    exp,
-    fct: [{ ...parentFact, remainingRedelegationDepth: depth - 1 }],
+    exp: claims.expiresAt,
+    fct: [claims.fact],
     iss: input.issuerDid.includes("#") ? input.issuerDid : `${principal}#${principal.slice("did:key:".length)}`,
-    nbf: now,
-    nnc: input.nonce ?? encodeBase64Url(crypto.getRandomValues(new Uint8Array(16))),
-    prf: [parent.cid]
+    nbf: claims.notBefore,
+    nnc: claims.nonce,
+    prf: [claims.parentCid]
   };
   const protectedSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(header)));
   const payloadSegment = encodeBase64Url(new TextEncoder().encode(jcsCanonicalize(payload)));
   const signature = ed255192.sign(new TextEncoder().encode(`${protectedSegment}.${payloadSegment}`), input.privateKey);
   return parseCompactUcanAuthorization(`${protectedSegment}.${payloadSegment}.${encodeBase64Url(signature)}`);
 }
+async function signCompactPolicyDescendant(input) {
+  const claims = compactPolicyDescendantClaims(input);
+  return signCompactUcan({
+    issuerDid: input.issuerDid,
+    audienceDid: input.audienceDid,
+    attenuation: input.attenuation,
+    facts: [claims.fact],
+    proofs: [claims.parentCid],
+    notBefore: claims.notBefore,
+    expiresAt: claims.expiresAt,
+    nonce: claims.nonce,
+    sign: input.sign
+  });
+}
 function compactAttenuationContains(parent, child) {
   const selector = (value) => {
     if (value.length !== 1 || !isRecordValue(value[0])) return void 0;
@@ -3943,7 +3968,7 @@ function parsePolicySessionUcan(authorization, expectedProofs) {
     throw new Error("policy session UCAN fact is incomplete");
   if (hasV4AuditFactShape && (!LOWER_SHA256_HEX.test(fact.credentialIdAuditDigestHex) || !LOWER_SHA256_HEX.test(fact.presentationJtiAuditDigestHex)))
     throw new Error("policy session UCAN v4 audit facts are invalid");
-  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > 60 || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
+  if (fact.profile !== POLICY_SESSION_UCAN_V1_PROFILE || typeof fact.remainingRedelegationDepth !== "number" || !Number.isInteger(fact.remainingRedelegationDepth) || fact.remainingRedelegationDepth < 0 || fact.remainingRedelegationDepth > 8 || parsed.payload.exp - parsed.payload.nbf > MAX_POLICY_ROOT_SECONDS || parsed.payload.iss.split("#", 1)[0] !== fact.nodeAudience || parsed.payload.aud !== fact.recipientDid)
     throw new Error("policy session UCAN fact is invalid");
   return {
     authorization,
@@ -4024,6 +4049,7 @@ var RECOVERABLE = /* @__PURE__ */ new Set([
   "ISSUER_UNREADY",
   "OFFLINE",
   "POPUP_BLOCKED",
+  "PROOF_REJECTED",
   "REQUEST_EXPIRED",
   "SIGNATURE_REJECTED",
   "UNSUPPORTED_PROFILE",
@@ -4042,6 +4068,7 @@ var CredentialError = class extends Error {
 
 // src/credentials/requirement.ts
 var ID = /^[a-z0-9][a-z0-9._-]{0,127}(?:\/v1)?$/;
+var CLAIM_NAME = /^[a-z0-9][A-Za-z0-9._-]{0,127}$/;
 function validateCredentialRequirement(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential requirement is invalid");
   const raw = value;
@@ -4055,7 +4082,7 @@ function validateCredentialRequirement(value) {
   if (typeof raw.claims !== "object" || raw.claims === null || Array.isArray(raw.claims)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claims are invalid");
   const claims = {};
   for (const [key, value2] of Object.entries(raw.claims).sort(([a], [b]) => a.localeCompare(b))) {
-    if (!ID.test(key) || typeof value2 !== "string" || value2.length === 0 || value2.length > 4096) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claim is invalid");
+    if (!CLAIM_NAME.test(key) || typeof value2 !== "string" || value2.length === 0 || value2.length > 4096) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential claim is invalid");
     claims[key] = value2;
   }
   if (raw.maxAgeSeconds !== void 0 && (!Number.isSafeInteger(raw.maxAgeSeconds) || raw.maxAgeSeconds < 1)) throw new CredentialError("UNSUPPORTED_PROFILE", "Credential freshness is invalid");
@@ -4436,24 +4463,21 @@ async function admitPolicyCredentialV3(input) {
     policy,
     challenge
   });
-  const response = await fetchFn(
+  const response = await postPolicyDelegation(
+    fetchFn,
     new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin),
     {
-      method: "POST",
-      redirect: "error",
-      signal: input.signal,
-      headers: { accept: "application/json", "content-type": "application/json" },
-      body: JSON.stringify({
-        policyCid: input.policyCid,
-        challengeId: challenge.challengeId,
-        nonce: challenge.nonce,
-        requirement: validateCredentialRequirement(input.requirement),
-        credential: envelopeFromVerified(input.credential),
-        accountAuthorizationCid,
-        credentialSpaceId,
-        presentation
-      })
-    }
+      policyCid: input.policyCid,
+      challengeId: challenge.challengeId,
+      nonce: challenge.nonce,
+      requirement: validateCredentialRequirement(input.requirement),
+      credential: envelopeFromVerified(input.credential),
+      accountAuthorizationCid,
+      credentialSpaceId,
+      presentation
+    },
+    requestedSessionExpiry(input.requestedExpiresAt, policy),
+    input.signal
   );
   if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
   const value = record(await response.json(), "policy delegation");
@@ -4494,20 +4518,20 @@ async function admitPolicyCredentialV4(input) {
     policy,
     challenge
   });
-  const response = await fetchFn(new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin), {
-    method: "POST",
-    redirect: "error",
-    signal: input.signal,
-    headers: { accept: "application/json", "content-type": "application/json" },
-    body: JSON.stringify({
+  const response = await postPolicyDelegation(
+    fetchFn,
+    new URL(`${policyRuntimeBasePath2(input.policyRuntimePath)}/delegations`, nodeOrigin),
+    {
       policyCid: input.policyCid,
       challengeId: challenge.challengeId,
       nonce: challenge.nonce,
       requirement: validateCredentialRequirement(input.requirement),
       credential: envelopeFromVerified(input.credential),
       presentation
-    })
-  });
+    },
+    requestedSessionExpiry(input.requestedExpiresAt, policy),
+    input.signal
+  );
   if (!response.ok) throw new Error(`policy delegation rejected (${response.status})`);
   const value = record(await response.json(), "policy delegation");
   if (value.admitted !== true || typeof value.sessionCid !== "string" || typeof value.authorization !== "string") throw new Error("policy delegation response is invalid");
@@ -4531,6 +4555,27 @@ async function admitPolicyCredentialV4(input) {
   input.signal?.throwIfAborted();
   return Object.freeze({ challenge, presentation, session, delegationImported: true });
 }
+function requestedSessionExpiry(requested, policy) {
+  const value = requested === void 0 ? policy.expiresAt : requested;
+  if (value === null || value === void 0) return void 0;
+  const seconds = Math.floor(Date.parse(value) / 1e3);
+  if (!Number.isFinite(seconds) || seconds <= Math.floor(Date.now() / 1e3) + 60) return void 0;
+  return new Date(seconds * 1e3).toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+async function postPolicyDelegation(fetchFn, url, body, requestedExpiresAt, signal) {
+  const send = (payload) => fetchFn(url, {
+    method: "POST",
+    redirect: "error",
+    signal,
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify(payload)
+  });
+  if (requestedExpiresAt === void 0) return send(body);
+  const response = await send({ ...body, requestedExpiresAt });
+  if (response.status !== 422) return response;
+  await response.body?.cancel().catch(() => void 0);
+  return send(body);
+}
 function policyRuntimeBasePath2(value) {
   const path = value ?? "/policy/v3";
   if (!/^\/policy(?:\/[a-z0-9-]+)*$/.test(path)) {
@@ -4625,6 +4670,7 @@ export {
   requestPolicyChallengeV3,
   revokePolicyRootV3,
   serialize as serializeJcsJson,
+  signCompactPolicyDescendant,
   signCompactUcanAuthorization,
   signCompactUcanRootAuthorization,
   signPolicyCredentialPresentationV4,