@tinycloud/sdk-core 3.1.0-beta.9 → 3.1.0

package/dist/policy/index.d.cts

@@ -1,5 +1,5 @@
-import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-BxpkckU0.cjs';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, f as CompactPolicyDescendantInput, g as CompactPolicyInvocationInput, h as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, D as PolicyChallengeV3, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aI as createCompactPolicyDescendant, aJ as createCompactPolicyInvocation, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aN as mintPolicySessionV3, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as policyCidFromCanonicalBytes, aS as policyDigestHex, aT as policyIdForDigestHex, aU as policyV2DigestHex, aV as projectUnifiedPolicyCapabilities, aW as projectUnifiedPolicyCapability, aX as registerPolicyV3, aY as renewPolicyRootStatusV3, aZ as requestPolicyChallengeV3, a_ as revokePolicyRootV3, a$ as signCompactPolicyDescendant, b0 as signCompactUcanAuthorization, b1 as signCompactUcanRootAuthorization, b2 as signPolicyCredentialPresentationV4, b3 as signedObjectIdFor, b4 as toSignedObjectError, b5 as unifiedNativeProjectionHashHex, b6 as unifiedPolicyCapabilityContains, b7 as unifiedPolicyCapabilityDigestHex, b8 as unifiedPolicyCapabilityFromNative, b9 as validatePolicyCredentialRequirementV1, ba as validatePolicyEngineRecordSigned, bb as validatePolicyEngineRecordSignedShape, bc as validatePolicyEngineRecordUnsigned, bd as validatePolicySigned, be as validatePolicySignedShape, bf as validatePolicyStatusSigned, bg as validatePolicyStatusSignedShape, bh as validatePolicyStatusUnsigned, bi as validatePolicyUnsigned, bj as validateUnifiedPolicyV2, bk as verifyPolicy, bl as verifyPolicyEngineRecord, bm as verifyPolicyRootRevocationV3, bn as verifyPolicyRootStatusCheckpointV3, bo as verifyPolicyStatus, bp as verifySignedObject } from '../credential-admission-BxpkckU0.cjs';
+import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-ohx0XnQr.cjs';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, f as CompactPolicyDescendantInput, g as CompactPolicyInvocationInput, h as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, D as PolicyChallengeV3, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aI as createCompactPolicyDescendant, aJ as createCompactPolicyInvocation, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aN as mintPolicySessionV3, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as parseSignedCompactUcanAttenuation, aS as policyCidFromCanonicalBytes, aT as policyDigestHex, aU as policyIdForDigestHex, aV as policyV2DigestHex, aW as projectUnifiedPolicyCapabilities, aX as projectUnifiedPolicyCapability, aY as registerPolicyV3, aZ as renewPolicyRootStatusV3, a_ as requestPolicyChallengeV3, a$ as revokePolicyRootV3, b0 as signCompactPolicyDescendant, b1 as signCompactUcanAuthorization, b2 as signCompactUcanRootAuthorization, b3 as signPolicyCredentialPresentationV4, b4 as signedObjectIdFor, b5 as toSignedObjectError, b6 as unifiedNativeProjectionHashHex, b7 as unifiedPolicyCapabilityContains, b8 as unifiedPolicyCapabilityDigestHex, b9 as unifiedPolicyCapabilityFromNative, ba as validatePolicyCredentialRequirementV1, bb as validatePolicyEngineRecordSigned, bc as validatePolicyEngineRecordSignedShape, bd as validatePolicyEngineRecordUnsigned, be as validatePolicySigned, bf as validatePolicySignedShape, bg as validatePolicyStatusSigned, bh as validatePolicyStatusSignedShape, bi as validatePolicyStatusUnsigned, bj as validatePolicyUnsigned, bk as validateUnifiedPolicyV2, bl as verifyPolicy, bm as verifyPolicyEngineRecord, bn as verifyPolicyRootRevocationV3, bo as verifyPolicyRootStatusCheckpointV3, bp as verifyPolicyStatus, bq as verifySignedObject } from '../credential-admission-ohx0XnQr.cjs';
 import { J as JsonObject, P as PolicyCapabilityError } from '../capability-BjzXwtNw.cjs';
 export { a as JsonValue, b as PolicyCapability, c as PolicyCapabilityErrorCode, d as canonicalizePolicyCapability, j as jcsCanonicalize, n as normalizeJson, e as normalizePolicyCapability, p as policyCapabilityContains, f as policyCapabilityDigestHex, s as serializeJcsJson } from '../capability-BjzXwtNw.cjs';
 import 'zod';

package/dist/policy/index.d.ts

@@ -1,5 +1,5 @@
-import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-CO9WMtGs.js';
-export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, f as CompactPolicyDescendantInput, g as CompactPolicyInvocationInput, h as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, D as PolicyChallengeV3, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aI as createCompactPolicyDescendant, aJ as createCompactPolicyInvocation, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aN as mintPolicySessionV3, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as policyCidFromCanonicalBytes, aS as policyDigestHex, aT as policyIdForDigestHex, aU as policyV2DigestHex, aV as projectUnifiedPolicyCapabilities, aW as projectUnifiedPolicyCapability, aX as registerPolicyV3, aY as renewPolicyRootStatusV3, aZ as requestPolicyChallengeV3, a_ as revokePolicyRootV3, a$ as signCompactPolicyDescendant, b0 as signCompactUcanAuthorization, b1 as signCompactUcanRootAuthorization, b2 as signPolicyCredentialPresentationV4, b3 as signedObjectIdFor, b4 as toSignedObjectError, b5 as unifiedNativeProjectionHashHex, b6 as unifiedPolicyCapabilityContains, b7 as unifiedPolicyCapabilityDigestHex, b8 as unifiedPolicyCapabilityFromNative, b9 as validatePolicyCredentialRequirementV1, ba as validatePolicyEngineRecordSigned, bb as validatePolicyEngineRecordSignedShape, bc as validatePolicyEngineRecordUnsigned, bd as validatePolicySigned, be as validatePolicySignedShape, bf as validatePolicyStatusSigned, bg as validatePolicyStatusSignedShape, bh as validatePolicyStatusUnsigned, bi as validatePolicyUnsigned, bj as validateUnifiedPolicyV2, bk as verifyPolicy, bl as verifyPolicyEngineRecord, bm as verifyPolicyRootRevocationV3, bn as verifyPolicyRootStatusCheckpointV3, bo as verifyPolicyStatus, bp as verifySignedObject } from '../credential-admission-CO9WMtGs.js';
+import { P as PolicyEngineRecord, S as SignedObjectSigner, a as Policy, U as UnsignedPolicyEngineRecord } from '../credential-admission-BaP4pdpy.js';
+export { A as ATTESTED_ENFORCER_BINDING_V2_SCHEMA, b as AdmitPolicyCredentialV3Input, c as AdmitPolicyCredentialV4Input, d as AttestedEnforcerBindingV2, B as BuildPolicyCredentialPresentationV3Input, e as BuildPolicyCredentialPresentationV4Input, C as CONTENT_SOURCE_V1_DOMAIN, f as CompactPolicyDescendantInput, g as CompactPolicyInvocationInput, h as CompactUcanAuthorizationV1, E as ED25519_JCS_SIGNATURE_SUITE, i as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, L as LAST_V2_CREATE_AT, j as LAST_V2_READ_AT, M as MAX_LEGACY_ENVELOPE_EXPIRES_AT, N as NATIVE_PROJECTION_V1_DOMAIN, k as POLICY_CAPABILITY_V1_DOMAIN, l as POLICY_CAPABILITY_V1_SCHEMA, m as POLICY_CREDENTIAL_REQUIREMENT_V1_TYPE, n as POLICY_ENFORCEMENT_DELEGATION_V2_SCHEMA, o as POLICY_ENGINE_RECORD_SCHEMA, p as POLICY_PRESENTATION_V3_DOMAIN, q as POLICY_PRESENTATION_V3_SCHEMA, r as POLICY_PRESENTATION_V4_DOMAIN, s as POLICY_PRESENTATION_V4_SCHEMA, t as POLICY_SCHEMA, u as POLICY_SESSION_UCAN_V1_PROFILE, v as POLICY_STATUS_SCHEMA, w as POLICY_V1_DOMAIN, x as POLICY_V1_SCHEMA, y as POLICY_V2_DOMAIN, z as POLICY_V2_SCHEMA, D as PolicyChallengeV3, F as PolicyCredentialAdmissionV3, G as PolicyCredentialAdmissionV4, H as PolicyCredentialPresentationV3, I as PolicyCredentialPresentationV4, K as PolicyCredentialRequirementV1, O as PolicyRootStatusV3, Q as PolicyRootV3, R as PolicySessionUcanFactV1, T as PolicySessionUcanV1, V as PolicyStatus, W as ROOT_REVOCATION_V1_DOMAIN, X as ROOT_REVOCATION_V1_SCHEMA, Y as ROOT_STATUS_CHECKPOINT_V1_SCHEMA, Z as ROOT_STATUS_RENEWAL_V1_DOMAIN, _ as ROOT_STATUS_V1_DOMAIN, $ as RegisterPolicyV3Input, a0 as RegisterPolicyV3Receipt, a1 as SignCompactUcanAuthorizationInput, a2 as SignCompactUcanRootAuthorizationInput, a3 as SignatureMaterialError, a4 as SignatureSuite, a5 as SignatureVerificationError, a6 as SignedObjectCanonicalizationError, a7 as SignedObjectDigestError, a8 as SignedObjectErrorCode, a9 as SignedObjectIdError, aa as SignedObjectKind, ab as SignedObjectMaterial, ac as SignedObjectProfileError, ad as SignedObjectSchemaError, ae as SignedObjectSignature, af as SignedObjectVerificationResult, ag as SignedPolicyObject, ah as SigningKeyBindingError, ai as UnifiedContentSource, aj as UnifiedEncryptionCapability, ak as UnifiedKvCapability, al as UnifiedNativeCapability, am as UnifiedPolicyCapability, an as UnifiedPolicyV1, ao as UnifiedPolicyV2, ap as UnifiedResourceSelector, aq as UnsignedPolicy, ar as UnsignedPolicyCredentialPresentationV4, as as UnsignedPolicyObject, at as UnsignedPolicyStatus, au as UnsignedUnifiedPolicyV2, av as UnsupportedSignatureSuiteError, aw as admitPolicyCredentialV3, ax as admitPolicyCredentialV4, ay as buildPolicyCredentialPresentationV3, az as buildPolicyCredentialPresentationV4, aA as canonicalizeSignedObjectUnsigned, aB as canonicalizeUnifiedPolicyCapability, aC as compactAttenuationContains, aD as contentSourceDigestHex, aE as createAndSignPolicy, aF as createAndSignPolicyEngineRecord, aG as createAndSignPolicyStatus, aH as createAndSignSignedObject, aI as createCompactPolicyDescendant, aJ as createCompactPolicyInvocation, aK as deriveSignedObjectMaterial, aL as getPolicyRootStatusV3, aM as issuedCredentialEnvelopeFromVerified, aN as mintPolicySessionV3, aO as normalizeUnifiedPolicyCapability, aP as parseCompactUcanAuthorization, aQ as parsePolicySessionUcan, aR as parseSignedCompactUcanAttenuation, aS as policyCidFromCanonicalBytes, aT as policyDigestHex, aU as policyIdForDigestHex, aV as policyV2DigestHex, aW as projectUnifiedPolicyCapabilities, aX as projectUnifiedPolicyCapability, aY as registerPolicyV3, aZ as renewPolicyRootStatusV3, a_ as requestPolicyChallengeV3, a$ as revokePolicyRootV3, b0 as signCompactPolicyDescendant, b1 as signCompactUcanAuthorization, b2 as signCompactUcanRootAuthorization, b3 as signPolicyCredentialPresentationV4, b4 as signedObjectIdFor, b5 as toSignedObjectError, b6 as unifiedNativeProjectionHashHex, b7 as unifiedPolicyCapabilityContains, b8 as unifiedPolicyCapabilityDigestHex, b9 as unifiedPolicyCapabilityFromNative, ba as validatePolicyCredentialRequirementV1, bb as validatePolicyEngineRecordSigned, bc as validatePolicyEngineRecordSignedShape, bd as validatePolicyEngineRecordUnsigned, be as validatePolicySigned, bf as validatePolicySignedShape, bg as validatePolicyStatusSigned, bh as validatePolicyStatusSignedShape, bi as validatePolicyStatusUnsigned, bj as validatePolicyUnsigned, bk as validateUnifiedPolicyV2, bl as verifyPolicy, bm as verifyPolicyEngineRecord, bn as verifyPolicyRootRevocationV3, bo as verifyPolicyRootStatusCheckpointV3, bp as verifyPolicyStatus, bq as verifySignedObject } from '../credential-admission-BaP4pdpy.js';
 import { J as JsonObject, P as PolicyCapabilityError } from '../capability-BjzXwtNw.js';
 export { a as JsonValue, b as PolicyCapability, c as PolicyCapabilityErrorCode, d as canonicalizePolicyCapability, j as jcsCanonicalize, n as normalizeJson, e as normalizePolicyCapability, p as policyCapabilityContains, f as policyCapabilityDigestHex, s as serializeJcsJson } from '../capability-BjzXwtNw.js';
 import 'zod';

package/dist/policy/index.js

@@ -3974,6 +3974,32 @@ function parseCompactUcanAuthorization(input, expectedCid) {
     throw new Error("compact UCAN CID does not match exact Authorization bytes");
   return { authorization: input, cid, header, payload };
 }
+var SignedCompactAttenuationSchema = z.record(z.record(z.array(z.unknown()).min(1)));
+function parseSignedCompactUcanAttenuation(input, expectedCid) {
+  if (typeof input !== "string" || /\s/.test(input))
+    throw new Error("Authorization must be compact UCAN bytes");
+  const segments = input.split(".");
+  if (segments.length !== 3 || segments.some((segment) => segment.length === 0))
+    throw new Error("Authorization must have three compact segments");
+  const [headerSegment, payloadSegment, signatureSegment] = segments;
+  const headerValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url(headerSegment)));
+  const payloadValue = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(decodeBase64Url(payloadSegment)));
+  if (!isRecordValue(headerValue) || !isRecordValue(headerValue.jwk) || headerValue.alg !== "EdDSA" || headerValue.typ !== "JWT" || headerValue.ucv !== "0.10.0" || headerValue.jwk.kty !== "OKP" || headerValue.jwk.crv !== "Ed25519" || !isRecordValue(payloadValue) || typeof payloadValue.iss !== "string")
+    throw new Error("Authorization has an invalid signed UCAN header or issuer");
+  const att = SignedCompactAttenuationSchema.parse(payloadValue.att);
+  const principal = payloadValue.iss.split("#", 1)[0];
+  const didMaterial = principal.startsWith("did:key:") ? base58btc.decode(principal.slice("did:key:".length)) : new Uint8Array();
+  const publicKey = didMaterial.length === 34 && didMaterial[0] === 237 && didMaterial[1] === 1 ? didMaterial.slice(2) : new Uint8Array();
+  const jwkKey = typeof headerValue.jwk.x === "string" ? decodeBase64Url(headerValue.jwk.x) : new Uint8Array();
+  if (publicKey.length !== 32 || !equalBytes(publicKey, jwkKey))
+    throw new Error("compact UCAN JWK does not bind issuer");
+  const signature = decodeBase64Url(signatureSegment);
+  if (!ed255192.verify(signature, new TextEncoder().encode(`${headerSegment}.${payloadSegment}`), publicKey))
+    throw new Error("compact UCAN signature is invalid");
+  const cid = CID.createV1(85, create(30, blake3(new TextEncoder().encode(input)))).toString();
+  if (expectedCid !== void 0 && cid !== expectedCid) throw new Error("compact UCAN CID does not match exact Authorization bytes");
+  return { cid, payload: { att } };
+}
 function parsePolicySessionUcan(authorization, expectedProofs) {
   const parsed = parseCompactUcanAuthorization(authorization);
   const fact = parsed.payload.fct[0];
@@ -4677,6 +4703,7 @@ export {
   normalizeUnifiedPolicyCapability,
   parseCompactUcanAuthorization,
   parsePolicySessionUcan,
+  parseSignedCompactUcanAttenuation,
   policyCapabilityContains,
   policyCapabilityDigestHex,
   policyCidFromCanonicalBytes,