@tinycloud/sdk-core 1.0.0

package/dist/delegations/types.schema.d.ts

@@ -0,0 +1,1641 @@
+/**
+ * Zod schemas for delegation management types.
+ *
+ * These schemas provide runtime validation for delegation, capability key management,
+ * and sharing link functionality. Types are derived from schemas using z.infer<>.
+ *
+ * @packageDocumentation
+ */
+import { z } from "zod";
+import type { FetchFunction, InvokeFunction, ServiceSession } from "@tinycloud/sdk-services";
+/**
+ * Creates a Result schema for a given data type and error type.
+ * Result types provide explicit error handling instead of throwing.
+ */
+export declare function createResultSchema<T extends z.ZodTypeAny, E extends z.ZodTypeAny>(dataSchema: T, errorSchema: E): z.ZodDiscriminatedUnion<"ok", [z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    data: T;
+}, "strip", z.ZodTypeAny, z.objectUtil.addQuestionMarks<z.baseObjectOutputType<{
+    ok: z.ZodLiteral<true>;
+    data: T;
+}>, any> extends infer T_1 ? { [k in keyof T_1]: T_1[k]; } : never, z.baseObjectInputType<{
+    ok: z.ZodLiteral<true>;
+    data: T;
+}> extends infer T_2 ? { [k_1 in keyof T_2]: T_2[k_1]; } : never>, z.ZodObject<{
+    ok: z.ZodLiteral<false>;
+    error: E;
+}, "strip", z.ZodTypeAny, z.objectUtil.addQuestionMarks<z.baseObjectOutputType<{
+    ok: z.ZodLiteral<false>;
+    error: E;
+}>, any> extends infer T_3 ? { [k_2 in keyof T_3]: T_3[k_2]; } : never, z.baseObjectInputType<{
+    ok: z.ZodLiteral<false>;
+    error: E;
+}> extends infer T_4 ? { [k_3 in keyof T_4]: T_4[k_3]; } : never>]>;
+/**
+ * Result type pattern for delegation operations.
+ */
+export type Result<T, E = DelegationError> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    error: E;
+};
+/**
+ * JSON Web Key representation for cryptographic keys.
+ * Follows the JWK specification (RFC 7517).
+ */
+export declare const JWKSchema: z.ZodObject<{
+    /** Key type (e.g., "EC", "RSA", "OKP") */
+    kty: z.ZodString;
+    /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
+    crv: z.ZodOptional<z.ZodString>;
+    /** X coordinate for EC keys, public key for OKP */
+    x: z.ZodOptional<z.ZodString>;
+    /** Y coordinate for EC keys */
+    y: z.ZodOptional<z.ZodString>;
+    /** Private key value (d parameter) */
+    d: z.ZodOptional<z.ZodString>;
+    /** Public exponent for RSA keys */
+    e: z.ZodOptional<z.ZodString>;
+    /** Modulus for RSA keys */
+    n: z.ZodOptional<z.ZodString>;
+    /** Key ID */
+    kid: z.ZodOptional<z.ZodString>;
+    /** Algorithm */
+    alg: z.ZodOptional<z.ZodString>;
+    /** Key use (e.g., "sig", "enc") */
+    use: z.ZodOptional<z.ZodString>;
+    /** Key operations (e.g., ["sign", "verify"]) */
+    key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    kty: string;
+    crv?: string | undefined;
+    x?: string | undefined;
+    y?: string | undefined;
+    d?: string | undefined;
+    e?: string | undefined;
+    n?: string | undefined;
+    kid?: string | undefined;
+    alg?: string | undefined;
+    use?: string | undefined;
+    key_ops?: string[] | undefined;
+}, {
+    kty: string;
+    crv?: string | undefined;
+    x?: string | undefined;
+    y?: string | undefined;
+    d?: string | undefined;
+    e?: string | undefined;
+    n?: string | undefined;
+    kid?: string | undefined;
+    alg?: string | undefined;
+    use?: string | undefined;
+    key_ops?: string[] | undefined;
+}>;
+export type JWK = z.infer<typeof JWKSchema>;
+/**
+ * Type of key in the capability registry.
+ */
+export declare const KeyTypeSchema: z.ZodEnum<["main", "session", "ingested"]>;
+export type KeyType = z.infer<typeof KeyTypeSchema>;
+/**
+ * Information about a cryptographic key used for delegations.
+ */
+export declare const KeyInfoSchema: z.ZodObject<{
+    /** Unique identifier for this key */
+    id: z.ZodString;
+    /** DID associated with this key */
+    did: z.ZodString;
+    /** Type of key determining its authority level */
+    type: z.ZodEnum<["main", "session", "ingested"]>;
+    /** Private key in JWK format */
+    jwk: z.ZodOptional<z.ZodObject<{
+        /** Key type (e.g., "EC", "RSA", "OKP") */
+        kty: z.ZodString;
+        /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
+        crv: z.ZodOptional<z.ZodString>;
+        /** X coordinate for EC keys, public key for OKP */
+        x: z.ZodOptional<z.ZodString>;
+        /** Y coordinate for EC keys */
+        y: z.ZodOptional<z.ZodString>;
+        /** Private key value (d parameter) */
+        d: z.ZodOptional<z.ZodString>;
+        /** Public exponent for RSA keys */
+        e: z.ZodOptional<z.ZodString>;
+        /** Modulus for RSA keys */
+        n: z.ZodOptional<z.ZodString>;
+        /** Key ID */
+        kid: z.ZodOptional<z.ZodString>;
+        /** Algorithm */
+        alg: z.ZodOptional<z.ZodString>;
+        /** Key use (e.g., "sig", "enc") */
+        use: z.ZodOptional<z.ZodString>;
+        /** Key operations (e.g., ["sign", "verify"]) */
+        key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        kty: string;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        d?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        kid?: string | undefined;
+        alg?: string | undefined;
+        use?: string | undefined;
+        key_ops?: string[] | undefined;
+    }, {
+        kty: string;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        d?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        kid?: string | undefined;
+        alg?: string | undefined;
+        use?: string | undefined;
+        key_ops?: string[] | undefined;
+    }>>;
+    /** Priority for key selection (lower = higher priority) */
+    priority: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    type: "main" | "session" | "ingested";
+    id: string;
+    did: string;
+    priority: number;
+    jwk?: {
+        kty: string;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        d?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        kid?: string | undefined;
+        alg?: string | undefined;
+        use?: string | undefined;
+        key_ops?: string[] | undefined;
+    } | undefined;
+}, {
+    type: "main" | "session" | "ingested";
+    id: string;
+    did: string;
+    priority: number;
+    jwk?: {
+        kty: string;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        d?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        kid?: string | undefined;
+        alg?: string | undefined;
+        use?: string | undefined;
+        key_ops?: string[] | undefined;
+    } | undefined;
+}>;
+export type KeyInfo = z.infer<typeof KeyInfoSchema>;
+/**
+ * Error type for delegation operations.
+ */
+export declare const DelegationErrorSchema: z.ZodObject<{
+    /** Error code for programmatic handling */
+    code: z.ZodString;
+    /** Human-readable error message */
+    message: z.ZodString;
+    /** The service that produced the error */
+    service: z.ZodLiteral<"delegation">;
+    /** Original error if wrapping another error */
+    cause: z.ZodOptional<z.ZodType<Error, z.ZodTypeDef, Error>>;
+    /** Additional metadata about the error */
+    meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    message: string;
+    service: "delegation";
+    cause?: Error | undefined;
+    meta?: Record<string, unknown> | undefined;
+}, {
+    code: string;
+    message: string;
+    service: "delegation";
+    cause?: Error | undefined;
+    meta?: Record<string, unknown> | undefined;
+}>;
+export type DelegationError = z.infer<typeof DelegationErrorSchema>;
+/**
+ * Error codes for delegation operations.
+ */
+export declare const DelegationErrorCodes: {
+    readonly AUTH_REQUIRED: "AUTH_REQUIRED";
+    readonly AUTH_EXPIRED: "AUTH_EXPIRED";
+    readonly NOT_INITIALIZED: "NOT_INITIALIZED";
+    readonly NOT_FOUND: "NOT_FOUND";
+    readonly REVOKED: "REVOKED";
+    readonly NETWORK_ERROR: "NETWORK_ERROR";
+    readonly TIMEOUT: "TIMEOUT";
+    readonly ABORTED: "ABORTED";
+    readonly INVALID_INPUT: "INVALID_INPUT";
+    readonly PERMISSION_DENIED: "PERMISSION_DENIED";
+    readonly CREATION_FAILED: "CREATION_FAILED";
+    readonly REVOCATION_FAILED: "REVOCATION_FAILED";
+    readonly INVALID_TOKEN: "INVALID_TOKEN";
+    readonly KV_SERVICE_UNAVAILABLE: "KV_SERVICE_UNAVAILABLE";
+    readonly DATA_FETCH_FAILED: "DATA_FETCH_FAILED";
+    readonly VALIDATION_ERROR: "VALIDATION_ERROR";
+};
+export type DelegationErrorCode = (typeof DelegationErrorCodes)[keyof typeof DelegationErrorCodes];
+/**
+ * Represents a delegation from one DID to another.
+ */
+export declare const DelegationSchema: z.ZodObject<{
+    /** Content identifier (CID) of the delegation */
+    cid: z.ZodString;
+    /** DID of the delegate (the party receiving the delegation) */
+    delegateDID: z.ZodString;
+    /** Space ID this delegation applies to */
+    spaceId: z.ZodString;
+    /** Resource path this delegation grants access to */
+    path: z.ZodString;
+    /** Actions this delegation authorizes */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** When this delegation expires (accepts Date or ISO string from JSON) */
+    expiry: z.ZodDate;
+    /** Whether this delegation has been revoked */
+    isRevoked: z.ZodBoolean;
+    /** DID of the delegator (the party granting the delegation) */
+    delegatorDID: z.ZodOptional<z.ZodString>;
+    /** When this delegation was created (accepts Date or ISO string from JSON) */
+    createdAt: z.ZodOptional<z.ZodDate>;
+    /** Parent delegation CID if this is a sub-delegation */
+    parentCid: z.ZodOptional<z.ZodString>;
+    /** Whether sub-delegation is allowed */
+    allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+    /** Authorization header (UCAN bearer token) */
+    authHeader: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    cid: string;
+    delegateDID: string;
+    spaceId: string;
+    actions: string[];
+    expiry: Date;
+    isRevoked: boolean;
+    delegatorDID?: string | undefined;
+    createdAt?: Date | undefined;
+    parentCid?: string | undefined;
+    allowSubDelegation?: boolean | undefined;
+    authHeader?: string | undefined;
+}, {
+    path: string;
+    cid: string;
+    delegateDID: string;
+    spaceId: string;
+    actions: string[];
+    expiry: Date;
+    isRevoked: boolean;
+    delegatorDID?: string | undefined;
+    createdAt?: Date | undefined;
+    parentCid?: string | undefined;
+    allowSubDelegation?: boolean | undefined;
+    authHeader?: string | undefined;
+}>;
+export type Delegation = z.infer<typeof DelegationSchema>;
+/**
+ * Entry in the capability registry mapping a capability to available keys.
+ */
+export declare const CapabilityEntrySchema: z.ZodObject<{
+    /** Resource URI this capability applies to */
+    resource: z.ZodString;
+    /** Action this capability authorizes */
+    action: z.ZodString;
+    /** Keys that can exercise this capability, ordered by priority */
+    keys: z.ZodArray<z.ZodObject<{
+        /** Unique identifier for this key */
+        id: z.ZodString;
+        /** DID associated with this key */
+        did: z.ZodString;
+        /** Type of key determining its authority level */
+        type: z.ZodEnum<["main", "session", "ingested"]>;
+        /** Private key in JWK format */
+        jwk: z.ZodOptional<z.ZodObject<{
+            /** Key type (e.g., "EC", "RSA", "OKP") */
+            kty: z.ZodString;
+            /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
+            crv: z.ZodOptional<z.ZodString>;
+            /** X coordinate for EC keys, public key for OKP */
+            x: z.ZodOptional<z.ZodString>;
+            /** Y coordinate for EC keys */
+            y: z.ZodOptional<z.ZodString>;
+            /** Private key value (d parameter) */
+            d: z.ZodOptional<z.ZodString>;
+            /** Public exponent for RSA keys */
+            e: z.ZodOptional<z.ZodString>;
+            /** Modulus for RSA keys */
+            n: z.ZodOptional<z.ZodString>;
+            /** Key ID */
+            kid: z.ZodOptional<z.ZodString>;
+            /** Algorithm */
+            alg: z.ZodOptional<z.ZodString>;
+            /** Key use (e.g., "sig", "enc") */
+            use: z.ZodOptional<z.ZodString>;
+            /** Key operations (e.g., ["sign", "verify"]) */
+            key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            kty: string;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        }, {
+            kty: string;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        }>>;
+        /** Priority for key selection (lower = higher priority) */
+        priority: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        type: "main" | "session" | "ingested";
+        id: string;
+        did: string;
+        priority: number;
+        jwk?: {
+            kty: string;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        } | undefined;
+    }, {
+        type: "main" | "session" | "ingested";
+        id: string;
+        did: string;
+        priority: number;
+        jwk?: {
+            kty: string;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        } | undefined;
+    }>, "many">;
+    /** The delegation that grants this capability */
+    delegation: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+    /** When this capability expires (accepts Date or ISO string from JSON) */
+    expiresAt: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    keys: {
+        type: "main" | "session" | "ingested";
+        id: string;
+        did: string;
+        priority: number;
+        jwk?: {
+            kty: string;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        } | undefined;
+    }[];
+    delegation: {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    resource: string;
+    action: string;
+    expiresAt?: Date | undefined;
+}, {
+    keys: {
+        type: "main" | "session" | "ingested";
+        id: string;
+        did: string;
+        priority: number;
+        jwk?: {
+            kty: string;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        } | undefined;
+    }[];
+    delegation: {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    resource: string;
+    action: string;
+    expiresAt?: Date | undefined;
+}>;
+export type CapabilityEntry = z.infer<typeof CapabilityEntrySchema>;
+/**
+ * Persistent record of a delegation stored in the system.
+ */
+export declare const DelegationRecordSchema: z.ZodObject<{
+    /** Content identifier (CID) of the delegation */
+    cid: z.ZodString;
+    /** Space ID this delegation applies to */
+    spaceId: z.ZodString;
+    /** DID of the delegator (grantor) */
+    delegator: z.ZodString;
+    /** DID of the delegatee (recipient) */
+    delegatee: z.ZodString;
+    /** Key ID used to sign/exercise this delegation */
+    keyId: z.ZodOptional<z.ZodString>;
+    /** Resource path pattern this delegation grants access to */
+    path: z.ZodString;
+    /** Actions this delegation authorizes */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** When this delegation expires (accepts Date or ISO string from JSON) */
+    expiry: z.ZodOptional<z.ZodDate>;
+    /** When this delegation becomes valid (not before) (accepts Date or ISO string) */
+    notBefore: z.ZodOptional<z.ZodDate>;
+    /** Whether this delegation has been revoked */
+    isRevoked: z.ZodBoolean;
+    /** When this delegation was created (accepts Date or ISO string from JSON) */
+    createdAt: z.ZodDate;
+    /** Parent delegation CID if this is a sub-delegation */
+    parentCid: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    cid: string;
+    spaceId: string;
+    actions: string[];
+    isRevoked: boolean;
+    createdAt: Date;
+    delegator: string;
+    delegatee: string;
+    expiry?: Date | undefined;
+    parentCid?: string | undefined;
+    keyId?: string | undefined;
+    notBefore?: Date | undefined;
+}, {
+    path: string;
+    cid: string;
+    spaceId: string;
+    actions: string[];
+    isRevoked: boolean;
+    createdAt: Date;
+    delegator: string;
+    delegatee: string;
+    expiry?: Date | undefined;
+    parentCid?: string | undefined;
+    keyId?: string | undefined;
+    notBefore?: Date | undefined;
+}>;
+export type DelegationRecord = z.infer<typeof DelegationRecordSchema>;
+/**
+ * Parameters for creating a new delegation.
+ */
+export declare const CreateDelegationParamsSchema: z.ZodObject<{
+    /** DID of the delegate (the party receiving the delegation) */
+    delegateDID: z.ZodString;
+    /** Resource path this delegation grants access to */
+    path: z.ZodString;
+    /** Actions to authorize */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** When this delegation expires (accepts Date or ISO string) */
+    expiry: z.ZodOptional<z.ZodDate>;
+    /** Whether to disable sub-delegation */
+    disableSubDelegation: z.ZodOptional<z.ZodBoolean>;
+    /** Optional statement for the SIWE message */
+    statement: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    delegateDID: string;
+    actions: string[];
+    expiry?: Date | undefined;
+    disableSubDelegation?: boolean | undefined;
+    statement?: string | undefined;
+}, {
+    path: string;
+    delegateDID: string;
+    actions: string[];
+    expiry?: Date | undefined;
+    disableSubDelegation?: boolean | undefined;
+    statement?: string | undefined;
+}>;
+export type CreateDelegationParams = z.infer<typeof CreateDelegationParamsSchema>;
+/**
+ * A chain of delegations from root to leaf (array format).
+ */
+export declare const DelegationChainSchema: z.ZodArray<z.ZodObject<{
+    /** Content identifier (CID) of the delegation */
+    cid: z.ZodString;
+    /** DID of the delegate (the party receiving the delegation) */
+    delegateDID: z.ZodString;
+    /** Space ID this delegation applies to */
+    spaceId: z.ZodString;
+    /** Resource path this delegation grants access to */
+    path: z.ZodString;
+    /** Actions this delegation authorizes */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** When this delegation expires (accepts Date or ISO string from JSON) */
+    expiry: z.ZodDate;
+    /** Whether this delegation has been revoked */
+    isRevoked: z.ZodBoolean;
+    /** DID of the delegator (the party granting the delegation) */
+    delegatorDID: z.ZodOptional<z.ZodString>;
+    /** When this delegation was created (accepts Date or ISO string from JSON) */
+    createdAt: z.ZodOptional<z.ZodDate>;
+    /** Parent delegation CID if this is a sub-delegation */
+    parentCid: z.ZodOptional<z.ZodString>;
+    /** Whether sub-delegation is allowed */
+    allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+    /** Authorization header (UCAN bearer token) */
+    authHeader: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    cid: string;
+    delegateDID: string;
+    spaceId: string;
+    actions: string[];
+    expiry: Date;
+    isRevoked: boolean;
+    delegatorDID?: string | undefined;
+    createdAt?: Date | undefined;
+    parentCid?: string | undefined;
+    allowSubDelegation?: boolean | undefined;
+    authHeader?: string | undefined;
+}, {
+    path: string;
+    cid: string;
+    delegateDID: string;
+    spaceId: string;
+    actions: string[];
+    expiry: Date;
+    isRevoked: boolean;
+    delegatorDID?: string | undefined;
+    createdAt?: Date | undefined;
+    parentCid?: string | undefined;
+    allowSubDelegation?: boolean | undefined;
+    authHeader?: string | undefined;
+}>, "many">;
+export type DelegationChain = z.infer<typeof DelegationChainSchema>;
+/**
+ * Structured delegation chain (v2 spec).
+ */
+export declare const DelegationChainV2Schema: z.ZodObject<{
+    /** The root delegation from the original authority */
+    root: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+    /** Intermediate delegations in the chain (may be empty) */
+    chain: z.ZodArray<z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>, "many">;
+    /** The final delegation to the current user */
+    leaf: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    root: {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    chain: {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }[];
+    leaf: {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+}, {
+    root: {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    chain: {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }[];
+    leaf: {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+}>;
+export type DelegationChainV2 = z.infer<typeof DelegationChainV2Schema>;
+/**
+ * Direction of delegation to filter by.
+ */
+export declare const DelegationDirectionSchema: z.ZodEnum<["granted", "received", "all"]>;
+export type DelegationDirection = z.infer<typeof DelegationDirectionSchema>;
+/**
+ * Filters for listing delegations.
+ */
+export declare const DelegationFiltersSchema: z.ZodObject<{
+    /** Filter by delegation direction */
+    direction: z.ZodOptional<z.ZodEnum<["granted", "received", "all"]>>;
+    /** Filter by resource path pattern */
+    path: z.ZodOptional<z.ZodString>;
+    /** Filter by required actions */
+    actions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Include revoked delegations */
+    includeRevoked: z.ZodOptional<z.ZodBoolean>;
+    /** Filter by delegator DID */
+    delegator: z.ZodOptional<z.ZodString>;
+    /** Filter by delegatee DID */
+    delegatee: z.ZodOptional<z.ZodString>;
+    /** Only include delegations valid at this time */
+    validAt: z.ZodOptional<z.ZodDate>;
+    /** Maximum number of results to return */
+    limit: z.ZodOptional<z.ZodNumber>;
+    /** Cursor for pagination */
+    cursor: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path?: string | undefined;
+    actions?: string[] | undefined;
+    delegator?: string | undefined;
+    delegatee?: string | undefined;
+    direction?: "received" | "granted" | "all" | undefined;
+    includeRevoked?: boolean | undefined;
+    validAt?: Date | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}, {
+    path?: string | undefined;
+    actions?: string[] | undefined;
+    delegator?: string | undefined;
+    delegatee?: string | undefined;
+    direction?: "received" | "granted" | "all" | undefined;
+    includeRevoked?: boolean | undefined;
+    validAt?: Date | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}>;
+export type DelegationFilters = z.infer<typeof DelegationFiltersSchema>;
+/**
+ * Type of space ownership.
+ */
+export declare const SpaceOwnershipSchema: z.ZodEnum<["owned", "delegated"]>;
+export type SpaceOwnership = z.infer<typeof SpaceOwnershipSchema>;
+/**
+ * Information about a space the user has access to.
+ */
+export declare const SpaceInfoSchema: z.ZodObject<{
+    /** Space identifier */
+    id: z.ZodString;
+    /** Human-readable name for the space */
+    name: z.ZodOptional<z.ZodString>;
+    /** DID of the space owner */
+    owner: z.ZodString;
+    /** Whether user owns or has delegated access */
+    type: z.ZodEnum<["owned", "delegated"]>;
+    /** Permissions the user has in this space */
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** When the access expires (for delegated spaces) */
+    expiresAt: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    type: "owned" | "delegated";
+    id: string;
+    owner: string;
+    expiresAt?: Date | undefined;
+    name?: string | undefined;
+    permissions?: string[] | undefined;
+}, {
+    type: "owned" | "delegated";
+    id: string;
+    owner: string;
+    expiresAt?: Date | undefined;
+    name?: string | undefined;
+    permissions?: string[] | undefined;
+}>;
+export type SpaceInfo = z.infer<typeof SpaceInfoSchema>;
+/**
+ * Schema for encoding share link data.
+ */
+export declare const ShareSchemaSchema: z.ZodEnum<["base64", "compact", "ipfs"]>;
+export type ShareSchema = z.infer<typeof ShareSchemaSchema>;
+/**
+ * A shareable link containing delegation credentials.
+ */
+export declare const ShareLinkSchema: z.ZodObject<{
+    /** Unique token identifying this share link */
+    token: z.ZodString;
+    /** Full URL for sharing */
+    url: z.ZodString;
+    /** The delegation this link grants access to */
+    delegation: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+    /** Encoding schema used for the link */
+    schema: z.ZodEnum<["base64", "compact", "ipfs"]>;
+    /** When this share link expires */
+    expiresAt: z.ZodOptional<z.ZodDate>;
+    /** Human-readable description of what is being shared */
+    description: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    delegation: {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    token: string;
+    url: string;
+    schema: "base64" | "compact" | "ipfs";
+    expiresAt?: Date | undefined;
+    description?: string | undefined;
+}, {
+    delegation: {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    token: string;
+    url: string;
+    schema: "base64" | "compact" | "ipfs";
+    expiresAt?: Date | undefined;
+    description?: string | undefined;
+}>;
+export type ShareLink = z.infer<typeof ShareLinkSchema>;
+/**
+ * Data retrieved from a share link.
+ */
+export declare function createShareLinkDataSchema<T extends z.ZodTypeAny>(dataSchema: T): z.ZodObject<{
+    /** The retrieved data */
+    data: T;
+    /** The delegation that authorized this access */
+    delegation: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+    /** The space the data belongs to */
+    spaceId: z.ZodString;
+    /** The resource path that was accessed */
+    path: z.ZodString;
+}, "strip", z.ZodTypeAny, z.objectUtil.addQuestionMarks<z.baseObjectOutputType<{
+    /** The retrieved data */
+    data: T;
+    /** The delegation that authorized this access */
+    delegation: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+    /** The space the data belongs to */
+    spaceId: z.ZodString;
+    /** The resource path that was accessed */
+    path: z.ZodString;
+}>, any> extends infer T_1 ? { [k in keyof T_1]: T_1[k]; } : never, z.baseObjectInputType<{
+    /** The retrieved data */
+    data: T;
+    /** The delegation that authorized this access */
+    delegation: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+    /** The space the data belongs to */
+    spaceId: z.ZodString;
+    /** The resource path that was accessed */
+    path: z.ZodString;
+}> extends infer T_2 ? { [k_1 in keyof T_2]: T_2[k_1]; } : never>;
+export declare const ShareLinkDataSchema: z.ZodObject<{
+    /** The retrieved data */
+    data: z.ZodUnknown;
+    /** The delegation that authorized this access */
+    delegation: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+    /** The space the data belongs to */
+    spaceId: z.ZodString;
+    /** The resource path that was accessed */
+    path: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    delegation: {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    spaceId: string;
+    data?: unknown;
+}, {
+    path: string;
+    delegation: {
+        path: string;
+        cid: string;
+        delegateDID: string;
+        spaceId: string;
+        actions: string[];
+        expiry: Date;
+        isRevoked: boolean;
+        delegatorDID?: string | undefined;
+        createdAt?: Date | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    spaceId: string;
+    data?: unknown;
+}>;
+export type ShareLinkData<T = unknown> = {
+    data: T;
+    delegation: Delegation;
+    spaceId: string;
+    path: string;
+};
+/**
+ * Options for ingesting an external delegation.
+ */
+export declare const IngestOptionsSchema: z.ZodObject<{
+    /** Whether to persist the delegation to storage */
+    persist: z.ZodOptional<z.ZodBoolean>;
+    /** Whether to validate the full delegation chain */
+    validateChain: z.ZodOptional<z.ZodBoolean>;
+    /** Name for the ingested key */
+    keyName: z.ZodOptional<z.ZodString>;
+    /** Whether to create a session key for this delegation */
+    createSessionKey: z.ZodOptional<z.ZodBoolean>;
+    /** Override the priority for the ingested key */
+    priority: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    priority?: number | undefined;
+    persist?: boolean | undefined;
+    validateChain?: boolean | undefined;
+    keyName?: string | undefined;
+    createSessionKey?: boolean | undefined;
+}, {
+    priority?: number | undefined;
+    persist?: boolean | undefined;
+    validateChain?: boolean | undefined;
+    keyName?: string | undefined;
+    createSessionKey?: boolean | undefined;
+}>;
+export type IngestOptions = z.infer<typeof IngestOptionsSchema>;
+/**
+ * Parameters for generating a share link.
+ */
+export declare const GenerateShareParamsSchema: z.ZodObject<{
+    /** Resource path to share */
+    path: z.ZodString;
+    /** Actions to authorize */
+    actions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** When the share link expires */
+    expiry: z.ZodOptional<z.ZodDate>;
+    /** Encoding schema for the link */
+    schema: z.ZodOptional<z.ZodEnum<["base64", "compact", "ipfs"]>>;
+    /** Human-readable description */
+    description: z.ZodOptional<z.ZodString>;
+    /** Base URL for the share link */
+    baseUrl: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    actions?: string[] | undefined;
+    expiry?: Date | undefined;
+    schema?: "base64" | "compact" | "ipfs" | undefined;
+    description?: string | undefined;
+    baseUrl?: string | undefined;
+}, {
+    path: string;
+    actions?: string[] | undefined;
+    expiry?: Date | undefined;
+    schema?: "base64" | "compact" | "ipfs" | undefined;
+    description?: string | undefined;
+    baseUrl?: string | undefined;
+}>;
+export type GenerateShareParams = z.infer<typeof GenerateShareParamsSchema>;
+/**
+ * Configuration for DelegationManager.
+ * Note: ServiceSession, InvokeFunction, and FetchFunction are external types.
+ */
+export declare const DelegationManagerConfigSchema: z.ZodObject<{
+    /** TinyCloud host URLs */
+    hosts: z.ZodArray<z.ZodString, "many">;
+    /** Active session for authentication */
+    session: z.ZodEffects<z.ZodUnknown, ServiceSession, unknown>;
+    /** Platform-specific invoke function */
+    invoke: z.ZodEffects<z.ZodUnknown, InvokeFunction, unknown>;
+    /** Optional custom fetch implementation */
+    fetch: z.ZodOptional<z.ZodEffects<z.ZodUnknown, FetchFunction, unknown>>;
+}, "strip", z.ZodTypeAny, {
+    session: ServiceSession;
+    hosts: string[];
+    invoke: InvokeFunction;
+    fetch?: FetchFunction | undefined;
+}, {
+    hosts: string[];
+    session?: unknown;
+    invoke?: unknown;
+    fetch?: unknown;
+}>;
+export type DelegationManagerConfig = z.infer<typeof DelegationManagerConfigSchema>;
+/**
+ * Provider interface for cryptographic key operations.
+ */
+export declare const KeyProviderSchema: z.ZodObject<{
+    /** Generate a new session key, returns key ID */
+    createSessionKey: z.ZodEffects<z.ZodUnknown, (name: string) => Promise<string>, unknown>;
+    /** Get JWK for a key */
+    getJWK: z.ZodEffects<z.ZodUnknown, (keyId: string) => object, unknown>;
+    /** Get DID for a key */
+    getDID: z.ZodEffects<z.ZodUnknown, (keyId: string) => Promise<string>, unknown>;
+}, "strip", z.ZodTypeAny, {
+    createSessionKey: (name: string) => Promise<string>;
+    getJWK: (keyId: string) => object;
+    getDID: (keyId: string) => Promise<string>;
+}, {
+    createSessionKey?: unknown;
+    getJWK?: unknown;
+    getDID?: unknown;
+}>;
+export type KeyProvider = z.infer<typeof KeyProviderSchema>;
+/**
+ * Response from the delegation API.
+ */
+export declare const DelegationApiResponseSchema: z.ZodObject<{
+    /** SIWE message content */
+    siwe: z.ZodString;
+    /** Signature of the SIWE message */
+    signature: z.ZodString;
+    /** Delegation version */
+    version: z.ZodNumber;
+    /** CID of the created delegation */
+    cid: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    siwe: string;
+    signature: string;
+    version: number;
+    cid?: string | undefined;
+}, {
+    siwe: string;
+    signature: string;
+    version: number;
+    cid?: string | undefined;
+}>;
+export type DelegationApiResponse = z.infer<typeof DelegationApiResponseSchema>;
+/**
+ * Input parameters for the createDelegation WASM function.
+ */
+export declare const CreateDelegationWasmParamsSchema: z.ZodObject<{
+    /** The session containing delegation credentials */
+    session: z.ZodEffects<z.ZodUnknown, ServiceSession, unknown>;
+    /** DID of the delegate */
+    delegateDID: z.ZodString;
+    /** Space ID this delegation applies to */
+    spaceId: z.ZodString;
+    /** Resource path this delegation grants access to */
+    path: z.ZodString;
+    /** Actions to authorize */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** Expiration time in seconds since Unix epoch */
+    expirationSecs: z.ZodNumber;
+    /** Optional not-before time in seconds since Unix epoch */
+    notBeforeSecs: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    session: ServiceSession;
+    delegateDID: string;
+    spaceId: string;
+    actions: string[];
+    expirationSecs: number;
+    notBeforeSecs?: number | undefined;
+}, {
+    path: string;
+    delegateDID: string;
+    spaceId: string;
+    actions: string[];
+    expirationSecs: number;
+    session?: unknown;
+    notBeforeSecs?: number | undefined;
+}>;
+export type CreateDelegationWasmParams = z.infer<typeof CreateDelegationWasmParamsSchema>;
+/**
+ * Result from the createDelegation WASM function.
+ */
+export declare const CreateDelegationWasmResultSchema: z.ZodObject<{
+    /** Base64url-encoded UCAN delegation */
+    delegation: z.ZodString;
+    /** CID of the delegation */
+    cid: z.ZodString;
+    /** DID of the delegate */
+    delegateDID: z.ZodString;
+    /** Resource path the delegation grants access to */
+    path: z.ZodString;
+    /** Actions the delegation authorizes */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** Expiration time */
+    expiry: z.ZodDate;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    delegation: string;
+    cid: string;
+    delegateDID: string;
+    actions: string[];
+    expiry: Date;
+}, {
+    path: string;
+    delegation: string;
+    cid: string;
+    delegateDID: string;
+    actions: string[];
+    expiry: Date;
+}>;
+export type CreateDelegationWasmResult = z.infer<typeof CreateDelegationWasmResultSchema>;
+/**
+ * Validates a Delegation object and returns a Result.
+ */
+export declare function validateDelegation(data: unknown): Result<Delegation, DelegationError>;
+/**
+ * Validates a CreateDelegationParams object and returns a Result.
+ */
+export declare function validateCreateDelegationParams(data: unknown): Result<CreateDelegationParams, DelegationError>;
+/**
+ * Validates a DelegationFilters object and returns a Result.
+ */
+export declare function validateDelegationFilters(data: unknown): Result<DelegationFilters, DelegationError>;
+/**
+ * Validates a ShareLink object and returns a Result.
+ */
+export declare function validateShareLink(data: unknown): Result<ShareLink, DelegationError>;
+/**
+ * Generic validation function factory.
+ */
+export declare function createValidator<T>(schema: z.ZodType<T>): (data: unknown) => Result<T, DelegationError>;
+//# sourceMappingURL=types.schema.d.ts.map