@tinycloud/sdk-core 2.10.0-beta.0 → 2.10.0

package/dist/recipient-types.schema-B2wH53_t.d.cts

@@ -0,0 +1,4407 @@
+import { ServiceSession, InvokeFunction, InvokeAnyFunction, FetchFunction, Result as Result$1, ServiceError, IKVService, ServiceHeaders } from '@tinycloud/sdk-services';
+import { z } from 'zod';
+
+/**
+ * Zod schemas for delegation management types.
+ *
+ * These schemas provide runtime validation for delegation, capability key management,
+ * and sharing link functionality. Types are derived from schemas using z.infer<>.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Result type pattern for delegation operations.
+ */
+type Result<T, E = DelegationError> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    error: E;
+};
+/**
+ * JSON Web Key representation for cryptographic keys.
+ * Follows the JWK specification (RFC 7517).
+ */
+declare const JWKSchema: z.ZodObject<{
+    /** Key type (e.g., "EC", "RSA", "OKP") */
+    kty: z.ZodString;
+    /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
+    crv: z.ZodOptional<z.ZodString>;
+    /** X coordinate for EC keys, public key for OKP */
+    x: z.ZodOptional<z.ZodString>;
+    /** Y coordinate for EC keys */
+    y: z.ZodOptional<z.ZodString>;
+    /** Private key value (d parameter) */
+    d: z.ZodOptional<z.ZodString>;
+    /** Public exponent for RSA keys */
+    e: z.ZodOptional<z.ZodString>;
+    /** Modulus for RSA keys */
+    n: z.ZodOptional<z.ZodString>;
+    /** Key ID */
+    kid: z.ZodOptional<z.ZodString>;
+    /** Algorithm */
+    alg: z.ZodOptional<z.ZodString>;
+    /** Key use (e.g., "sig", "enc") */
+    use: z.ZodOptional<z.ZodString>;
+    /** Key operations (e.g., ["sign", "verify"]) */
+    key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    kty: string;
+    crv?: string | undefined;
+    x?: string | undefined;
+    y?: string | undefined;
+    d?: string | undefined;
+    e?: string | undefined;
+    n?: string | undefined;
+    kid?: string | undefined;
+    alg?: string | undefined;
+    use?: string | undefined;
+    key_ops?: string[] | undefined;
+}, {
+    kty: string;
+    crv?: string | undefined;
+    x?: string | undefined;
+    y?: string | undefined;
+    d?: string | undefined;
+    e?: string | undefined;
+    n?: string | undefined;
+    kid?: string | undefined;
+    alg?: string | undefined;
+    use?: string | undefined;
+    key_ops?: string[] | undefined;
+}>;
+type JWK = z.infer<typeof JWKSchema>;
+/**
+ * Type of key in the capability registry.
+ */
+declare const KeyTypeSchema: z.ZodEnum<["main", "session", "ingested"]>;
+type KeyType = z.infer<typeof KeyTypeSchema>;
+/**
+ * Information about a cryptographic key used for delegations.
+ */
+declare const KeyInfoSchema: z.ZodObject<{
+    /** Unique identifier for this key */
+    id: z.ZodString;
+    /** DID associated with this key */
+    did: z.ZodString;
+    /** Type of key determining its authority level */
+    type: z.ZodEnum<["main", "session", "ingested"]>;
+    /** Private key in JWK format */
+    jwk: z.ZodOptional<z.ZodObject<{
+        /** Key type (e.g., "EC", "RSA", "OKP") */
+        kty: z.ZodString;
+        /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
+        crv: z.ZodOptional<z.ZodString>;
+        /** X coordinate for EC keys, public key for OKP */
+        x: z.ZodOptional<z.ZodString>;
+        /** Y coordinate for EC keys */
+        y: z.ZodOptional<z.ZodString>;
+        /** Private key value (d parameter) */
+        d: z.ZodOptional<z.ZodString>;
+        /** Public exponent for RSA keys */
+        e: z.ZodOptional<z.ZodString>;
+        /** Modulus for RSA keys */
+        n: z.ZodOptional<z.ZodString>;
+        /** Key ID */
+        kid: z.ZodOptional<z.ZodString>;
+        /** Algorithm */
+        alg: z.ZodOptional<z.ZodString>;
+        /** Key use (e.g., "sig", "enc") */
+        use: z.ZodOptional<z.ZodString>;
+        /** Key operations (e.g., ["sign", "verify"]) */
+        key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        kty: string;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        d?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        kid?: string | undefined;
+        alg?: string | undefined;
+        use?: string | undefined;
+        key_ops?: string[] | undefined;
+    }, {
+        kty: string;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        d?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        kid?: string | undefined;
+        alg?: string | undefined;
+        use?: string | undefined;
+        key_ops?: string[] | undefined;
+    }>>;
+    /** Priority for key selection (lower = higher priority) */
+    priority: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    type: "main" | "session" | "ingested";
+    did: string;
+    id: string;
+    priority: number;
+    jwk?: {
+        kty: string;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        d?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        kid?: string | undefined;
+        alg?: string | undefined;
+        use?: string | undefined;
+        key_ops?: string[] | undefined;
+    } | undefined;
+}, {
+    type: "main" | "session" | "ingested";
+    did: string;
+    id: string;
+    priority: number;
+    jwk?: {
+        kty: string;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        d?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        kid?: string | undefined;
+        alg?: string | undefined;
+        use?: string | undefined;
+        key_ops?: string[] | undefined;
+    } | undefined;
+}>;
+type KeyInfo = z.infer<typeof KeyInfoSchema>;
+/**
+ * Error type for delegation operations.
+ */
+declare const DelegationErrorSchema: z.ZodObject<{
+    /** Error code for programmatic handling */
+    code: z.ZodString;
+    /** Human-readable error message */
+    message: z.ZodString;
+    /** The service that produced the error */
+    service: z.ZodLiteral<"delegation">;
+    /** Original error if wrapping another error */
+    cause: z.ZodOptional<z.ZodType<Error, z.ZodTypeDef, Error>>;
+    /** Additional metadata about the error */
+    meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    message: string;
+    service: "delegation";
+    cause?: Error | undefined;
+    meta?: Record<string, unknown> | undefined;
+}, {
+    code: string;
+    message: string;
+    service: "delegation";
+    cause?: Error | undefined;
+    meta?: Record<string, unknown> | undefined;
+}>;
+type DelegationError = z.infer<typeof DelegationErrorSchema>;
+/**
+ * Error codes for delegation operations.
+ */
+declare const DelegationErrorCodes: {
+    readonly AUTH_REQUIRED: "AUTH_REQUIRED";
+    readonly AUTH_EXPIRED: "AUTH_EXPIRED";
+    readonly NOT_INITIALIZED: "NOT_INITIALIZED";
+    readonly NOT_FOUND: "NOT_FOUND";
+    readonly REVOKED: "REVOKED";
+    readonly NETWORK_ERROR: "NETWORK_ERROR";
+    readonly TIMEOUT: "TIMEOUT";
+    readonly ABORTED: "ABORTED";
+    readonly INVALID_INPUT: "INVALID_INPUT";
+    readonly PERMISSION_DENIED: "PERMISSION_DENIED";
+    readonly CREATION_FAILED: "CREATION_FAILED";
+    readonly REVOCATION_FAILED: "REVOCATION_FAILED";
+    readonly INVALID_TOKEN: "INVALID_TOKEN";
+    readonly KV_SERVICE_UNAVAILABLE: "KV_SERVICE_UNAVAILABLE";
+    readonly DATA_FETCH_FAILED: "DATA_FETCH_FAILED";
+    readonly VALIDATION_ERROR: "VALIDATION_ERROR";
+};
+type DelegationErrorCode = (typeof DelegationErrorCodes)[keyof typeof DelegationErrorCodes];
+/**
+ * Represents a delegation from one DID to another.
+ */
+declare const DelegationSchema: z.ZodObject<{
+    /** Content identifier (CID) of the delegation */
+    cid: z.ZodString;
+    /** DID of the delegate (the party receiving the delegation) */
+    delegateDID: z.ZodString;
+    /** Space ID this delegation applies to */
+    spaceId: z.ZodString;
+    /** Resource path this delegation grants access to */
+    path: z.ZodString;
+    /** Actions this delegation authorizes */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** Exact ReCap caveats that constrain every action in this scope. */
+    caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+    /** When this delegation expires (accepts Date or ISO string from JSON) */
+    expiry: z.ZodDate;
+    /** Whether this delegation has been revoked */
+    isRevoked: z.ZodBoolean;
+    /** DID of the delegator (the party granting the delegation) */
+    delegatorDID: z.ZodOptional<z.ZodString>;
+    /** When this delegation was created (accepts Date or ISO string from JSON) */
+    createdAt: z.ZodOptional<z.ZodDate>;
+    /** Parent delegation CID if this is a sub-delegation */
+    parentCid: z.ZodOptional<z.ZodString>;
+    /** Whether sub-delegation is allowed */
+    allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+    /** Authorization header (UCAN bearer token) */
+    authHeader: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    expiry: Date;
+    actions: string[];
+    spaceId: string;
+    cid: string;
+    delegateDID: string;
+    isRevoked: boolean;
+    caveats?: Record<string, unknown>[] | undefined;
+    createdAt?: Date | undefined;
+    delegatorDID?: string | undefined;
+    parentCid?: string | undefined;
+    allowSubDelegation?: boolean | undefined;
+    authHeader?: string | undefined;
+}, {
+    path: string;
+    expiry: Date;
+    actions: string[];
+    spaceId: string;
+    cid: string;
+    delegateDID: string;
+    isRevoked: boolean;
+    caveats?: Record<string, unknown>[] | undefined;
+    createdAt?: Date | undefined;
+    delegatorDID?: string | undefined;
+    parentCid?: string | undefined;
+    allowSubDelegation?: boolean | undefined;
+    authHeader?: string | undefined;
+}>;
+type Delegation = z.infer<typeof DelegationSchema>;
+/** Node-confirmed lifecycle state for one delegation. */
+declare const DelegationStatusSchema: z.ZodEffects<z.ZodObject<{
+    cid: z.ZodString;
+    status: z.ZodEnum<["active", "revoked", "expired", "unavailable", "not_found"]>;
+    exists: z.ZodBoolean;
+    active: z.ZodBoolean;
+    revoked: z.ZodBoolean;
+    expired: z.ZodBoolean;
+}, "strict", z.ZodTypeAny, {
+    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
+    active: boolean;
+    revoked: boolean;
+    cid: string;
+    expired: boolean;
+    exists: boolean;
+}, {
+    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
+    active: boolean;
+    revoked: boolean;
+    cid: string;
+    expired: boolean;
+    exists: boolean;
+}>, {
+    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
+    active: boolean;
+    revoked: boolean;
+    cid: string;
+    expired: boolean;
+    exists: boolean;
+}, {
+    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
+    active: boolean;
+    revoked: boolean;
+    cid: string;
+    expired: boolean;
+    exists: boolean;
+}>;
+type DelegationStatus = z.infer<typeof DelegationStatusSchema>;
+declare const DelegationRevocationReceiptSchema: z.ZodObject<{
+    revoked: z.ZodLiteral<true>;
+    cid: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    revoked: true;
+    cid: string;
+}, {
+    revoked: true;
+    cid: string;
+}>;
+type DelegationRevocationReceipt = z.infer<typeof DelegationRevocationReceiptSchema>;
+declare const AccountDelegationResourceSchema: z.ZodObject<{
+    resource: z.ZodString;
+    actions: z.ZodArray<z.ZodString, "many">;
+    caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+}, "strict", z.ZodTypeAny, {
+    actions: string[];
+    caveats: Record<string, unknown>[];
+    resource: string;
+}, {
+    actions: string[];
+    caveats: Record<string, unknown>[];
+    resource: string;
+}>;
+declare const AccountDelegationRecordSchema: z.ZodObject<{
+    cid: z.ZodString;
+    direction: z.ZodEnum<["granted", "received"]>;
+    delegatorDid: z.ZodString;
+    delegateDid: z.ZodString;
+    resources: z.ZodArray<z.ZodObject<{
+        resource: z.ZodString;
+        actions: z.ZodArray<z.ZodString, "many">;
+        caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }, {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }>, "many">;
+    parents: z.ZodArray<z.ZodString, "many">;
+    issuedAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    notBefore: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    expiresAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    status: z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>;
+    revokedAt: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>>;
+    revokedBy: z.ZodOptional<z.ZodString>;
+    revokedAncestorCid: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+    notBefore: Date | null;
+    resources: {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }[];
+    expiresAt: Date | null;
+    issuedAt: Date | null;
+    cid: string;
+    direction: "received" | "granted";
+    delegatorDid: string;
+    delegateDid: string;
+    parents: string[];
+    revokedAt?: Date | null | undefined;
+    revokedBy?: string | undefined;
+    revokedAncestorCid?: string | undefined;
+}, {
+    status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+    notBefore: string | null;
+    resources: {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }[];
+    expiresAt: string | null;
+    issuedAt: string | null;
+    cid: string;
+    direction: "received" | "granted";
+    delegatorDid: string;
+    delegateDid: string;
+    parents: string[];
+    revokedAt?: string | null | undefined;
+    revokedBy?: string | undefined;
+    revokedAncestorCid?: string | undefined;
+}>;
+declare const AccountDelegationPageSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    items: z.ZodArray<z.ZodObject<{
+        cid: z.ZodString;
+        direction: z.ZodEnum<["granted", "received"]>;
+        delegatorDid: z.ZodString;
+        delegateDid: z.ZodString;
+        resources: z.ZodArray<z.ZodObject<{
+            resource: z.ZodString;
+            actions: z.ZodArray<z.ZodString, "many">;
+            caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+        }, "strict", z.ZodTypeAny, {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }, {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }>, "many">;
+        parents: z.ZodArray<z.ZodString, "many">;
+        issuedAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        notBefore: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        expiresAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        status: z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>;
+        revokedAt: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>>;
+        revokedBy: z.ZodOptional<z.ZodString>;
+        revokedAncestorCid: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: Date | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: Date | null;
+        issuedAt: Date | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: Date | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }, {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: string | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: string | null;
+        issuedAt: string | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: string | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }>, "many">;
+    nextCursor: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: 2;
+    items: {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: Date | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: Date | null;
+        issuedAt: Date | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: Date | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }[];
+    nextCursor?: string | undefined;
+}, {
+    schemaVersion: 2;
+    items: {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: string | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: string | null;
+        issuedAt: string | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: string | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }[];
+    nextCursor?: string | undefined;
+}>;
+type AccountDelegationResource = z.infer<typeof AccountDelegationResourceSchema>;
+type AccountDelegationRecord = z.infer<typeof AccountDelegationRecordSchema>;
+type AccountDelegationPage = z.infer<typeof AccountDelegationPageSchema>;
+declare const AccountDelegationQueryOptionsSchema: z.ZodObject<{
+    direction: z.ZodOptional<z.ZodEnum<["granted", "received", "all"]>>;
+    status: z.ZodOptional<z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>>;
+    space: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status?: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked" | undefined;
+    space?: string | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}, {
+    status?: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked" | undefined;
+    space?: string | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}>;
+type AccountDelegationQueryOptions = z.infer<typeof AccountDelegationQueryOptionsSchema>;
+/**
+ * Entry in the capability registry mapping a capability to available keys.
+ */
+declare const CapabilityEntrySchema: z.ZodObject<{
+    /** Resource URI this capability applies to */
+    resource: z.ZodString;
+    /** Action this capability authorizes */
+    action: z.ZodString;
+    /** Keys that can exercise this capability, ordered by priority */
+    keys: z.ZodArray<z.ZodObject<{
+        /** Unique identifier for this key */
+        id: z.ZodString;
+        /** DID associated with this key */
+        did: z.ZodString;
+        /** Type of key determining its authority level */
+        type: z.ZodEnum<["main", "session", "ingested"]>;
+        /** Private key in JWK format */
+        jwk: z.ZodOptional<z.ZodObject<{
+            /** Key type (e.g., "EC", "RSA", "OKP") */
+            kty: z.ZodString;
+            /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
+            crv: z.ZodOptional<z.ZodString>;
+            /** X coordinate for EC keys, public key for OKP */
+            x: z.ZodOptional<z.ZodString>;
+            /** Y coordinate for EC keys */
+            y: z.ZodOptional<z.ZodString>;
+            /** Private key value (d parameter) */
+            d: z.ZodOptional<z.ZodString>;
+            /** Public exponent for RSA keys */
+            e: z.ZodOptional<z.ZodString>;
+            /** Modulus for RSA keys */
+            n: z.ZodOptional<z.ZodString>;
+            /** Key ID */
+            kid: z.ZodOptional<z.ZodString>;
+            /** Algorithm */
+            alg: z.ZodOptional<z.ZodString>;
+            /** Key use (e.g., "sig", "enc") */
+            use: z.ZodOptional<z.ZodString>;
+            /** Key operations (e.g., ["sign", "verify"]) */
+            key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            kty: string;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        }, {
+            kty: string;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        }>>;
+        /** Priority for key selection (lower = higher priority) */
+        priority: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        type: "main" | "session" | "ingested";
+        did: string;
+        id: string;
+        priority: number;
+        jwk?: {
+            kty: string;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        } | undefined;
+    }, {
+        type: "main" | "session" | "ingested";
+        did: string;
+        id: string;
+        priority: number;
+        jwk?: {
+            kty: string;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        } | undefined;
+    }>, "many">;
+    /** The delegation that grants this capability */
+    delegation: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+    /** When this capability expires (accepts Date or ISO string from JSON) */
+    expiresAt: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    keys: {
+        type: "main" | "session" | "ingested";
+        did: string;
+        id: string;
+        priority: number;
+        jwk?: {
+            kty: string;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        } | undefined;
+    }[];
+    delegation: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    resource: string;
+    action: string;
+    expiresAt?: Date | undefined;
+}, {
+    keys: {
+        type: "main" | "session" | "ingested";
+        did: string;
+        id: string;
+        priority: number;
+        jwk?: {
+            kty: string;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        } | undefined;
+    }[];
+    delegation: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    resource: string;
+    action: string;
+    expiresAt?: Date | undefined;
+}>;
+type CapabilityEntry = z.infer<typeof CapabilityEntrySchema>;
+/**
+ * Persistent record of a delegation stored in the system.
+ */
+declare const DelegationRecordSchema: z.ZodObject<{
+    /** Content identifier (CID) of the delegation */
+    cid: z.ZodString;
+    /** Space ID this delegation applies to */
+    spaceId: z.ZodString;
+    /** DID of the delegator (grantor) */
+    delegator: z.ZodString;
+    /** DID of the delegatee (recipient) */
+    delegatee: z.ZodString;
+    /** Key ID used to sign/exercise this delegation */
+    keyId: z.ZodOptional<z.ZodString>;
+    /** Resource path pattern this delegation grants access to */
+    path: z.ZodString;
+    /** Actions this delegation authorizes */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** When this delegation expires (accepts Date or ISO string from JSON) */
+    expiry: z.ZodOptional<z.ZodDate>;
+    /** When this delegation becomes valid (not before) (accepts Date or ISO string) */
+    notBefore: z.ZodOptional<z.ZodDate>;
+    /** Whether this delegation has been revoked */
+    isRevoked: z.ZodBoolean;
+    /** When this delegation was created (accepts Date or ISO string from JSON) */
+    createdAt: z.ZodDate;
+    /** Parent delegation CID if this is a sub-delegation */
+    parentCid: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    actions: string[];
+    createdAt: Date;
+    spaceId: string;
+    cid: string;
+    isRevoked: boolean;
+    delegator: string;
+    delegatee: string;
+    notBefore?: Date | undefined;
+    expiry?: Date | undefined;
+    parentCid?: string | undefined;
+    keyId?: string | undefined;
+}, {
+    path: string;
+    actions: string[];
+    createdAt: Date;
+    spaceId: string;
+    cid: string;
+    isRevoked: boolean;
+    delegator: string;
+    delegatee: string;
+    notBefore?: Date | undefined;
+    expiry?: Date | undefined;
+    parentCid?: string | undefined;
+    keyId?: string | undefined;
+}>;
+type DelegationRecord = z.infer<typeof DelegationRecordSchema>;
+/**
+ * Parameters for creating a new delegation.
+ */
+declare const CreateDelegationParamsSchema: z.ZodObject<{
+    /** DID of the delegate (the party receiving the delegation) */
+    delegateDID: z.ZodString;
+    /** Resource path this delegation grants access to */
+    path: z.ZodString;
+    /** Actions to authorize */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** When this delegation expires (accepts Date or ISO string) */
+    expiry: z.ZodOptional<z.ZodDate>;
+    /** Whether to disable sub-delegation */
+    disableSubDelegation: z.ZodOptional<z.ZodBoolean>;
+    /** Optional statement for the SIWE message */
+    statement: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    actions: string[];
+    delegateDID: string;
+    statement?: string | undefined;
+    expiry?: Date | undefined;
+    disableSubDelegation?: boolean | undefined;
+}, {
+    path: string;
+    actions: string[];
+    delegateDID: string;
+    statement?: string | undefined;
+    expiry?: Date | undefined;
+    disableSubDelegation?: boolean | undefined;
+}>;
+type CreateDelegationParams = z.infer<typeof CreateDelegationParamsSchema>;
+/**
+ * A chain of delegations from root to leaf (array format).
+ */
+declare const DelegationChainSchema: z.ZodArray<z.ZodObject<{
+    /** Content identifier (CID) of the delegation */
+    cid: z.ZodString;
+    /** DID of the delegate (the party receiving the delegation) */
+    delegateDID: z.ZodString;
+    /** Space ID this delegation applies to */
+    spaceId: z.ZodString;
+    /** Resource path this delegation grants access to */
+    path: z.ZodString;
+    /** Actions this delegation authorizes */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** Exact ReCap caveats that constrain every action in this scope. */
+    caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+    /** When this delegation expires (accepts Date or ISO string from JSON) */
+    expiry: z.ZodDate;
+    /** Whether this delegation has been revoked */
+    isRevoked: z.ZodBoolean;
+    /** DID of the delegator (the party granting the delegation) */
+    delegatorDID: z.ZodOptional<z.ZodString>;
+    /** When this delegation was created (accepts Date or ISO string from JSON) */
+    createdAt: z.ZodOptional<z.ZodDate>;
+    /** Parent delegation CID if this is a sub-delegation */
+    parentCid: z.ZodOptional<z.ZodString>;
+    /** Whether sub-delegation is allowed */
+    allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+    /** Authorization header (UCAN bearer token) */
+    authHeader: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    expiry: Date;
+    actions: string[];
+    spaceId: string;
+    cid: string;
+    delegateDID: string;
+    isRevoked: boolean;
+    caveats?: Record<string, unknown>[] | undefined;
+    createdAt?: Date | undefined;
+    delegatorDID?: string | undefined;
+    parentCid?: string | undefined;
+    allowSubDelegation?: boolean | undefined;
+    authHeader?: string | undefined;
+}, {
+    path: string;
+    expiry: Date;
+    actions: string[];
+    spaceId: string;
+    cid: string;
+    delegateDID: string;
+    isRevoked: boolean;
+    caveats?: Record<string, unknown>[] | undefined;
+    createdAt?: Date | undefined;
+    delegatorDID?: string | undefined;
+    parentCid?: string | undefined;
+    allowSubDelegation?: boolean | undefined;
+    authHeader?: string | undefined;
+}>, "many">;
+type DelegationChain = z.infer<typeof DelegationChainSchema>;
+/**
+ * Structured delegation chain (v2 spec).
+ */
+declare const DelegationChainV2Schema: z.ZodObject<{
+    /** The root delegation from the original authority */
+    root: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+    /** Intermediate delegations in the chain (may be empty) */
+    chain: z.ZodArray<z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>, "many">;
+    /** The final delegation to the current user */
+    leaf: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    root: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    chain: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }[];
+    leaf: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+}, {
+    root: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    chain: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }[];
+    leaf: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+}>;
+type DelegationChainV2 = z.infer<typeof DelegationChainV2Schema>;
+/**
+ * Direction of delegation to filter by.
+ */
+declare const DelegationDirectionSchema: z.ZodEnum<["granted", "received", "all"]>;
+type DelegationDirection = z.infer<typeof DelegationDirectionSchema>;
+/**
+ * Filters for listing delegations.
+ */
+declare const DelegationFiltersSchema: z.ZodObject<{
+    /** Filter by delegation direction */
+    direction: z.ZodOptional<z.ZodEnum<["granted", "received", "all"]>>;
+    /** Filter by resource path pattern */
+    path: z.ZodOptional<z.ZodString>;
+    /** Filter by required actions */
+    actions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Include revoked delegations */
+    includeRevoked: z.ZodOptional<z.ZodBoolean>;
+    /** Filter by delegator DID */
+    delegator: z.ZodOptional<z.ZodString>;
+    /** Filter by delegatee DID */
+    delegatee: z.ZodOptional<z.ZodString>;
+    /** Only include delegations valid at this time */
+    validAt: z.ZodOptional<z.ZodDate>;
+    /** Maximum number of results to return */
+    limit: z.ZodOptional<z.ZodNumber>;
+    /** Cursor for pagination */
+    cursor: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path?: string | undefined;
+    actions?: string[] | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+    delegator?: string | undefined;
+    delegatee?: string | undefined;
+    includeRevoked?: boolean | undefined;
+    validAt?: Date | undefined;
+}, {
+    path?: string | undefined;
+    actions?: string[] | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+    delegator?: string | undefined;
+    delegatee?: string | undefined;
+    includeRevoked?: boolean | undefined;
+    validAt?: Date | undefined;
+}>;
+type DelegationFilters = z.infer<typeof DelegationFiltersSchema>;
+/**
+ * Type of space ownership.
+ */
+declare const SpaceOwnershipSchema: z.ZodEnum<["owned", "delegated"]>;
+type SpaceOwnership = z.infer<typeof SpaceOwnershipSchema>;
+/**
+ * Information about a space the user has access to.
+ */
+declare const SpaceInfoSchema: z.ZodObject<{
+    /** Space identifier */
+    id: z.ZodString;
+    /** Human-readable name for the space */
+    name: z.ZodOptional<z.ZodString>;
+    /** DID of the space owner */
+    owner: z.ZodString;
+    /** Whether user owns or has delegated access */
+    type: z.ZodEnum<["owned", "delegated"]>;
+    /** Permissions the user has in this space */
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** When the access expires (for delegated spaces) */
+    expiresAt: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    type: "owned" | "delegated";
+    id: string;
+    owner: string;
+    name?: string | undefined;
+    expiresAt?: Date | undefined;
+    permissions?: string[] | undefined;
+}, {
+    type: "owned" | "delegated";
+    id: string;
+    owner: string;
+    name?: string | undefined;
+    expiresAt?: Date | undefined;
+    permissions?: string[] | undefined;
+}>;
+type SpaceInfo = z.infer<typeof SpaceInfoSchema>;
+/**
+ * Schema for encoding share link data.
+ */
+declare const ShareSchemaSchema: z.ZodEnum<["base64", "compact", "ipfs"]>;
+type ShareSchema = z.infer<typeof ShareSchemaSchema>;
+/**
+ * A shareable link containing delegation credentials.
+ */
+declare const ShareLinkSchema: z.ZodObject<{
+    /** Unique token identifying this share link */
+    token: z.ZodString;
+    /** Full URL for sharing */
+    url: z.ZodString;
+    /** The delegation this link grants access to */
+    delegation: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+    /** Encoding schema used for the link */
+    schema: z.ZodEnum<["base64", "compact", "ipfs"]>;
+    /** When this share link expires */
+    expiresAt: z.ZodOptional<z.ZodDate>;
+    /** Human-readable description of what is being shared */
+    description: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    delegation: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    schema: "base64" | "compact" | "ipfs";
+    token: string;
+    url: string;
+    description?: string | undefined;
+    expiresAt?: Date | undefined;
+}, {
+    delegation: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    schema: "base64" | "compact" | "ipfs";
+    token: string;
+    url: string;
+    description?: string | undefined;
+    expiresAt?: Date | undefined;
+}>;
+type ShareLink = z.infer<typeof ShareLinkSchema>;
+type ShareLinkData<T = unknown> = {
+    data: T;
+    delegation: Delegation;
+    spaceId: string;
+    path: string;
+};
+/**
+ * Options for ingesting an external delegation.
+ */
+declare const IngestOptionsSchema: z.ZodObject<{
+    /** Whether to persist the delegation to storage */
+    persist: z.ZodOptional<z.ZodBoolean>;
+    /** Whether to validate the full delegation chain */
+    validateChain: z.ZodOptional<z.ZodBoolean>;
+    /** Name for the ingested key */
+    keyName: z.ZodOptional<z.ZodString>;
+    /** Whether to create a session key for this delegation */
+    createSessionKey: z.ZodOptional<z.ZodBoolean>;
+    /** Override the priority for the ingested key */
+    priority: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    priority?: number | undefined;
+    persist?: boolean | undefined;
+    validateChain?: boolean | undefined;
+    keyName?: string | undefined;
+    createSessionKey?: boolean | undefined;
+}, {
+    priority?: number | undefined;
+    persist?: boolean | undefined;
+    validateChain?: boolean | undefined;
+    keyName?: string | undefined;
+    createSessionKey?: boolean | undefined;
+}>;
+type IngestOptions = z.infer<typeof IngestOptionsSchema>;
+/**
+ * Parameters for generating a share link.
+ */
+declare const GenerateShareParamsSchema: z.ZodObject<{
+    /** Resource path to share */
+    path: z.ZodString;
+    /** Actions to authorize */
+    actions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** When the share link expires */
+    expiry: z.ZodOptional<z.ZodDate>;
+    /** Encoding schema for the link */
+    schema: z.ZodOptional<z.ZodEnum<["base64", "compact", "ipfs"]>>;
+    /** Human-readable description */
+    description: z.ZodOptional<z.ZodString>;
+    /** Base URL for the share link */
+    baseUrl: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    schema?: "base64" | "compact" | "ipfs" | undefined;
+    expiry?: Date | undefined;
+    description?: string | undefined;
+    actions?: string[] | undefined;
+    baseUrl?: string | undefined;
+}, {
+    path: string;
+    schema?: "base64" | "compact" | "ipfs" | undefined;
+    expiry?: Date | undefined;
+    description?: string | undefined;
+    actions?: string[] | undefined;
+    baseUrl?: string | undefined;
+}>;
+type GenerateShareParams = z.infer<typeof GenerateShareParamsSchema>;
+/**
+ * Configuration for DelegationManager.
+ * Note: ServiceSession, InvokeFunction, and FetchFunction are external types.
+ */
+declare const DelegationManagerConfigSchema: z.ZodObject<{
+    /** TinyCloud host URLs */
+    hosts: z.ZodArray<z.ZodString, "many">;
+    /** Account space used by account-wide delegation history queries */
+    accountSpaceId: z.ZodOptional<z.ZodString>;
+    /** Active session for authentication */
+    session: z.ZodEffects<z.ZodUnknown, ServiceSession, unknown>;
+    /** Platform-specific invoke function */
+    invoke: z.ZodEffects<z.ZodUnknown, InvokeFunction, unknown>;
+    /** Platform-specific invoke function for raw resource URIs */
+    invokeAny: z.ZodOptional<z.ZodEffects<z.ZodUnknown, InvokeAnyFunction, unknown>>;
+    /** Optional custom fetch implementation */
+    fetch: z.ZodOptional<z.ZodEffects<z.ZodUnknown, FetchFunction, unknown>>;
+}, "strip", z.ZodTypeAny, {
+    session: ServiceSession;
+    hosts: string[];
+    invoke: InvokeFunction;
+    invokeAny?: InvokeAnyFunction | undefined;
+    accountSpaceId?: string | undefined;
+    fetch?: FetchFunction | undefined;
+}, {
+    hosts: string[];
+    invokeAny?: unknown;
+    session?: unknown;
+    accountSpaceId?: string | undefined;
+    invoke?: unknown;
+    fetch?: unknown;
+}>;
+type DelegationManagerConfig = z.infer<typeof DelegationManagerConfigSchema>;
+/**
+ * Provider interface for cryptographic key operations.
+ */
+declare const KeyProviderSchema: z.ZodObject<{
+    /** Generate a new session key, returns key ID */
+    createSessionKey: z.ZodEffects<z.ZodUnknown, (name: string) => Promise<string>, unknown>;
+    /** Get JWK for a key */
+    getJWK: z.ZodEffects<z.ZodUnknown, (keyId: string) => object, unknown>;
+    /** Get DID for a key */
+    getDID: z.ZodEffects<z.ZodUnknown, (keyId: string) => Promise<string>, unknown>;
+}, "strip", z.ZodTypeAny, {
+    createSessionKey: (name: string) => Promise<string>;
+    getJWK: (keyId: string) => object;
+    getDID: (keyId: string) => Promise<string>;
+}, {
+    createSessionKey?: unknown;
+    getJWK?: unknown;
+    getDID?: unknown;
+}>;
+type KeyProvider = z.infer<typeof KeyProviderSchema>;
+/**
+ * Response from the delegation API.
+ */
+declare const DelegationApiResponseSchema: z.ZodObject<{
+    /** SIWE message content */
+    siwe: z.ZodString;
+    /** Signature of the SIWE message */
+    signature: z.ZodString;
+    /** Delegation version */
+    version: z.ZodNumber;
+    /** CID of the created delegation */
+    cid: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    siwe: string;
+    signature: string;
+    version: number;
+    cid?: string | undefined;
+}, {
+    siwe: string;
+    signature: string;
+    version: number;
+    cid?: string | undefined;
+}>;
+type DelegationApiResponse = z.infer<typeof DelegationApiResponseSchema>;
+/**
+ * A single (service, space, path, actions) entry inside a
+ * createDelegation WASM result.
+ *
+ * Mirrors the Rust `DelegatedResource` struct in
+ * `tinycloud-sdk-wasm/src/session.rs`. Field names match the manifest
+ * {@link PermissionEntry} shape so callers can reconstruct what they sent
+ * without having to re-parse the UCAN.
+ *
+ * `service` is the short form (e.g. `"kv"`, `"sql"`) as returned by the
+ * Rust layer. The SDK layer translates to the long form
+ * (`"tinycloud.kv"`) when comparing against manifests.
+ */
+declare const DelegatedResourceSchema: z.ZodObject<{
+    /** Short-form service name, e.g. "kv", "sql", "duckdb", "capabilities", "hooks". */
+    service: z.ZodString;
+    /** Full space id string, e.g. "tinycloud:pkh:eip155:1:0x....:default". */
+    space: z.ZodString;
+    /** Resource path; empty string when the resource URI had no path segment. */
+    path: z.ZodString;
+    /** Full-URN ability strings, e.g. ["tinycloud.kv/get", "tinycloud.kv/put"]. */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** Exact ReCap caveats that constrain every action in this scope. */
+    caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    actions: string[];
+    space: string;
+    service: string;
+    caveats?: Record<string, unknown>[] | undefined;
+}, {
+    path: string;
+    actions: string[];
+    space: string;
+    service: string;
+    caveats?: Record<string, unknown>[] | undefined;
+}>;
+type DelegatedResource = z.infer<typeof DelegatedResourceSchema>;
+/**
+ * Input parameters for the createDelegation WASM function.
+ *
+ * A single call may encode multiple `(service, path, actions)` entries
+ * via the `abilities` map — the underlying UCAN will contain one
+ * attenuation entry per `(service, path)` pair, all signed by the same
+ * session key in one blob.
+ *
+ * The `abilities` shape is identical to what `prepareSession` accepts
+ * (`Record<shortService, Record<path, actionURNs[]>>`), so manifest
+ * resolution can feed both sides from one data structure.
+ */
+declare const CreateDelegationWasmParamsSchema: z.ZodObject<{
+    /** The session containing delegation credentials */
+    session: z.ZodEffects<z.ZodUnknown, ServiceSession, unknown>;
+    /** DID of the delegate */
+    delegateDID: z.ZodString;
+    /** Space ID this delegation applies to */
+    spaceId: z.ZodString;
+    /**
+     * Multi-resource abilities map: short-service → path → full-URN actions.
+     * Matches the shape accepted by `prepareSession`.
+     *
+     * Example:
+     * ```
+     * {
+     *   kv: {
+     *     "com.listen.app/": ["tinycloud.kv/get", "tinycloud.kv/put"]
+     *   },
+     *   sql: {
+     *     "com.listen.app/data.sqlite": ["tinycloud.sql/read"]
+     *   }
+     * }
+     * ```
+     */
+    abilities: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+    /** Expiration time in seconds since Unix epoch */
+    expirationSecs: z.ZodNumber;
+    /** Optional not-before time in seconds since Unix epoch */
+    notBeforeSecs: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    spaceId: string;
+    session: ServiceSession;
+    delegateDID: string;
+    abilities: Record<string, Record<string, string[]>>;
+    expirationSecs: number;
+    notBeforeSecs?: number | undefined;
+}, {
+    spaceId: string;
+    delegateDID: string;
+    abilities: Record<string, Record<string, string[]>>;
+    expirationSecs: number;
+    session?: unknown;
+    notBeforeSecs?: number | undefined;
+}>;
+type CreateDelegationWasmParams = z.infer<typeof CreateDelegationWasmParamsSchema>;
+/**
+ * Result from the createDelegation WASM function.
+ *
+ * A single UCAN may cover multiple resources. The `resources` array
+ * describes every `(service, space, path, actions)` entry granted, in
+ * deterministic (service, path) lexicographic order (the Rust side sorts
+ * the HashMap entries before signing).
+ */
+declare const CreateDelegationWasmResultSchema: z.ZodObject<{
+    /** Base64url-encoded UCAN delegation */
+    delegation: z.ZodString;
+    /** CID of the delegation */
+    cid: z.ZodString;
+    /** DID of the delegate */
+    delegateDID: z.ZodString;
+    /** Expiration time */
+    expiry: z.ZodDate;
+    /**
+     * All (service, space, path, actions) entries granted by this delegation.
+     * Always non-empty on success.
+     */
+    resources: z.ZodArray<z.ZodObject<{
+        /** Short-form service name, e.g. "kv", "sql", "duckdb", "capabilities", "hooks". */
+        service: z.ZodString;
+        /** Full space id string, e.g. "tinycloud:pkh:eip155:1:0x....:default". */
+        space: z.ZodString;
+        /** Resource path; empty string when the resource URI had no path segment. */
+        path: z.ZodString;
+        /** Full-URN ability strings, e.g. ["tinycloud.kv/get", "tinycloud.kv/put"]. */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        actions: string[];
+        space: string;
+        service: string;
+        caveats?: Record<string, unknown>[] | undefined;
+    }, {
+        path: string;
+        actions: string[];
+        space: string;
+        service: string;
+        caveats?: Record<string, unknown>[] | undefined;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    resources: {
+        path: string;
+        actions: string[];
+        space: string;
+        service: string;
+        caveats?: Record<string, unknown>[] | undefined;
+    }[];
+    delegation: string;
+    expiry: Date;
+    cid: string;
+    delegateDID: string;
+}, {
+    resources: {
+        path: string;
+        actions: string[];
+        space: string;
+        service: string;
+        caveats?: Record<string, unknown>[] | undefined;
+    }[];
+    delegation: string;
+    expiry: Date;
+    cid: string;
+    delegateDID: string;
+}>;
+type CreateDelegationWasmResult = z.infer<typeof CreateDelegationWasmResultSchema>;
+
+/**
+ * DelegationManager - Handles delegation CRUD operations.
+ *
+ * This class manages the creation, revocation, listing, and querying
+ * of delegations within TinyCloud. It extracts and improves upon the
+ * delegation functionality previously in ITinyCloudStorage.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * DelegationManager handles all delegation-related operations.
+ *
+ * @example
+ * ```typescript
+ * import { DelegationManager } from "@tinycloud/sdk-core/delegations";
+ *
+ * const delegations = new DelegationManager({
+ *   hosts: ["https://node.tinycloud.xyz"],
+ *   session,
+ *   invoke,
+ * });
+ *
+ * // Create a delegation
+ * const result = await delegations.create({
+ *   delegateDID: "did:pkh:eip155:1:0x...",
+ *   path: "shared/",
+ *   actions: ["tinycloud.kv/get", "tinycloud.kv/list"],
+ *   expiry: new Date(Date.now() + 24 * 60 * 60 * 1000), // 24 hours
+ * });
+ *
+ * if (result.ok) {
+ *   console.log("Created delegation:", result.data.cid);
+ * }
+ * ```
+ */
+declare class DelegationManager {
+    private hosts;
+    private session;
+    private invoke;
+    private invokeAny?;
+    private fetchFn;
+    private accountSpaceId?;
+    /**
+     * Creates a new DelegationManager instance.
+     *
+     * @param config - Configuration including hosts, session, and invoke function
+     */
+    constructor(config: DelegationManagerConfig);
+    /**
+     * Updates the session (e.g., after re-authentication).
+     *
+     * @param session - New session to use for operations
+     */
+    updateSession(session: ServiceSession): void;
+    /**
+     * Gets the primary host URL.
+     */
+    private get host();
+    /**
+     * Executes an invoke operation against the delegation API.
+     */
+    private invokeOperation;
+    /**
+     * Creates a new delegation.
+     *
+     * Delegates specific permissions to another DID for a given path.
+     * The delegatee can then use these permissions to access resources
+     * within the specified scope.
+     *
+     * @param params - Parameters for the delegation
+     * @returns Result containing the created Delegation or an error
+     *
+     * @example
+     * ```typescript
+     * const result = await manager.create({
+     *   delegateDID: bob.did,
+     *   path: "documents/shared/",
+     *   actions: ["tinycloud.kv/get", "tinycloud.kv/put"],
+     *   expiry: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), // 7 days
+     * });
+     * ```
+     */
+    create(params: CreateDelegationParams): Promise<Result<Delegation>>;
+    /**
+     * Revokes an existing delegation.
+     *
+     * Once revoked, the delegation can no longer be used to access resources.
+     * This also invalidates any sub-delegations derived from this delegation.
+     *
+     * @param cid - The CID of the delegation to revoke
+     * @returns Result indicating success or an error
+     *
+     * @example
+     * ```typescript
+     * const result = await manager.revoke("bafy...");
+     * if (result.ok) {
+     *   console.log("Delegation revoked successfully");
+     * }
+     * ```
+     */
+    revoke(cid: string): Promise<Result<DelegationRevocationReceipt>>;
+    /**
+     * Reads the node-confirmed lifecycle state of one delegation without
+     * exposing delegation metadata.
+     */
+    status(cid: string): Promise<Result<DelegationStatus>>;
+    /** Query lifecycle-complete delegation history for the authenticated account. */
+    query(options?: AccountDelegationQueryOptions): Promise<Result<AccountDelegationPage>>;
+    /**
+     * Lists all delegations for the current session's space.
+     *
+     * Returns both delegations created by the current user (as delegator)
+     * and delegations granted to the current user (as delegatee).
+     *
+     * @returns Result containing an array of Delegations or an error
+     *
+     * @example
+     * ```typescript
+     * const result = await manager.list();
+     * if (result.ok) {
+     *   for (const delegation of result.data) {
+     *     console.log(`${delegation.cid}: ${delegation.path} -> ${delegation.delegateDID}`);
+     *   }
+     * }
+     * ```
+     */
+    list(): Promise<Result<Delegation[]>>;
+    /**
+     * Gets the full delegation chain for a given delegation.
+     *
+     * Returns the chain of delegations from the root (original delegator)
+     * to the specified delegation, including all intermediate sub-delegations.
+     *
+     * @param cid - The CID of the delegation to get the chain for
+     * @returns Result containing the DelegationChain or an error
+     *
+     * @example
+     * ```typescript
+     * const result = await manager.getChain("bafy...");
+     * if (result.ok) {
+     *   console.log("Chain length:", result.data.length);
+     *   for (const delegation of result.data) {
+     *     console.log(`- ${delegation.delegatorDID} -> ${delegation.delegateDID}`);
+     *   }
+     * }
+     * ```
+     */
+    getChain(cid: string): Promise<Result<DelegationChain>>;
+    /**
+     * Checks if the current session has permission for a given path and action.
+     *
+     * This can be used to verify permissions before attempting an operation,
+     * or to implement custom access control logic.
+     *
+     * @param path - The resource path to check
+     * @param action - The action to check (e.g., "tinycloud.kv/get")
+     * @returns Result containing a boolean indicating permission or an error
+     *
+     * @example
+     * ```typescript
+     * const result = await manager.checkPermission("documents/private/", "tinycloud.kv/put");
+     * if (result.ok && result.data) {
+     *   console.log("Permission granted");
+     * } else {
+     *   console.log("Permission denied");
+     * }
+     * ```
+     */
+    checkPermission(path: string, action: string): Promise<Result<boolean>>;
+}
+
+/**
+ * CapabilityKeyRegistry - Tracks keys and their capabilities for automatic key selection.
+ *
+ * The registry maintains mappings between:
+ * - Keys and their associated delegations
+ * - Capabilities (resource/action pairs) and the keys that can exercise them
+ *
+ * This enables automatic key selection when performing operations, choosing
+ * the most appropriate key based on priority and validity.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Error codes specific to CapabilityKeyRegistry operations.
+ */
+declare const CapabilityKeyRegistryErrorCodes: {
+    /** Key not found in registry */
+    readonly KEY_NOT_FOUND: "KEY_NOT_FOUND";
+    /** No key available for the requested capability */
+    readonly NO_CAPABLE_KEY: "NO_CAPABLE_KEY";
+    /** Delegation has expired */
+    readonly DELEGATION_EXPIRED: "DELEGATION_EXPIRED";
+    /** Delegation has been revoked */
+    readonly DELEGATION_REVOKED: "DELEGATION_REVOKED";
+    /** Invalid delegation data */
+    readonly INVALID_DELEGATION: "INVALID_DELEGATION";
+    /** Key already registered */
+    readonly KEY_EXISTS: "KEY_EXISTS";
+};
+type CapabilityKeyRegistryErrorCode = (typeof CapabilityKeyRegistryErrorCodes)[keyof typeof CapabilityKeyRegistryErrorCodes];
+/**
+ * Stored delegation with chain information.
+ */
+interface StoredDelegationChain {
+    /** The delegation itself */
+    delegation: Delegation;
+    /** Parent delegation CID if this is a sub-delegation */
+    parentCid?: string;
+    /** Key ID used to sign/exercise this delegation */
+    keyId: string;
+    /** When this was stored */
+    storedAt: Date;
+}
+/**
+ * Interface for the CapabilityKeyRegistry.
+ *
+ * Tracks keys and their capabilities for automatic key selection.
+ */
+interface ICapabilityKeyRegistry {
+    /**
+     * Register a key with its associated delegations.
+     *
+     * @param key - Key information
+     * @param delegations - Delegations granted to this key
+     */
+    registerKey(key: KeyInfo, delegations: Delegation[]): void;
+    /**
+     * Remove a key and all its associated delegations.
+     *
+     * @param keyId - The key ID to remove
+     */
+    removeKey(keyId: string): void;
+    /**
+     * Get a key that can exercise the specified capability.
+     *
+     * Uses the key selection algorithm:
+     * 1. Filter keys that have the required capability
+     * 2. Check delegation validity (not expired, not revoked)
+     * 3. Sort by priority (session=0, main=1, ingested=2)
+     * 4. Return highest priority valid key
+     *
+     * @param resource - Resource URI (e.g., "tinycloud://space-id/kv/my-data")
+     * @param action - Action to perform (e.g., "tinycloud.kv/get")
+     * @returns The best matching key, or null if none available
+     */
+    getKeyForCapability(resource: string, action: string): KeyInfo | null;
+    /**
+     * Get all registered capabilities.
+     *
+     * @returns All capability entries in the registry
+     */
+    getAllCapabilities(): CapabilityEntry[];
+    /**
+     * Get all delegations for a specific key.
+     *
+     * @param keyId - The key ID
+     * @returns Array of delegations for this key
+     */
+    getDelegationsForKey(keyId: string): Delegation[];
+    /**
+     * Ingest a key and delegation from an external source (e.g., sharing link).
+     *
+     * @param key - Key information to ingest
+     * @param delegation - Delegation to associate with the key
+     * @param options - Ingestion options
+     */
+    ingestKey(key: KeyInfo, delegation: Delegation, options?: IngestOptions): void;
+    /**
+     * Check if a delegation is currently valid.
+     *
+     * @param delegation - The delegation to check
+     * @returns true if valid, false if expired or revoked
+     */
+    isDelegationValid(delegation: Delegation): boolean;
+    /**
+     * Get a key by its ID.
+     *
+     * @param keyId - The key ID
+     * @returns The key info, or undefined if not found
+     */
+    getKey(keyId: string): KeyInfo | undefined;
+    /**
+     * Get all registered keys.
+     *
+     * @returns Array of all registered keys
+     */
+    getAllKeys(): KeyInfo[];
+    /**
+     * Clear all registered keys and delegations.
+     */
+    clear(): void;
+    /**
+     * Revoke a delegation by CID.
+     *
+     * @param cid - The delegation CID to revoke
+     * @returns Result indicating success or failure
+     */
+    revokeDelegation(cid: string): Result$1<void, ServiceError>;
+    /**
+     * Find capabilities that match a resource path pattern.
+     *
+     * @param resourcePattern - Resource pattern (supports wildcards)
+     * @param action - Optional action filter
+     * @returns Matching capability entries
+     */
+    findCapabilities(resourcePattern: string, action?: string): CapabilityEntry[];
+}
+/**
+ * CapabilityKeyRegistry - Tracks keys and their capabilities for automatic key selection.
+ *
+ * @example
+ * ```typescript
+ * const registry = new CapabilityKeyRegistry();
+ *
+ * // Register a session key with its delegations
+ * registry.registerKey(sessionKey, [rootDelegation]);
+ *
+ * // Get the best key for an operation
+ * const key = registry.getKeyForCapability(
+ *   "tinycloud://my-space/kv/data",
+ *   "tinycloud.kv/get"
+ * );
+ *
+ * if (key) {
+ *   // Use this key for the operation
+ *   console.log("Using key:", key.id);
+ * }
+ * ```
+ */
+declare class CapabilityKeyRegistry implements ICapabilityKeyRegistry {
+    /**
+     * Registry of all keys indexed by ID.
+     */
+    private keys;
+    /**
+     * Delegation storage.
+     */
+    private store;
+    /**
+     * Register a key with its associated delegations.
+     *
+     * @param key - Key information
+     * @param delegations - Delegations granted to this key
+     */
+    registerKey(key: KeyInfo, delegations: Delegation[]): void;
+    /**
+     * Remove a key and all its associated delegations.
+     *
+     * @param keyId - The key ID to remove
+     */
+    removeKey(keyId: string): void;
+    /**
+     * Get a key that can exercise the specified capability.
+     *
+     * Key selection algorithm:
+     * 1. Filter keys that have the required capability
+     * 2. Check delegation validity (not expired, not revoked)
+     * 3. Sort by priority (session=0, main=1, ingested=2)
+     * 4. Return highest priority valid key
+     *
+     * @param resource - Resource URI
+     * @param action - Action to perform
+     * @returns The best matching key, or null if none available
+     */
+    getKeyForCapability(resource: string, action: string): KeyInfo | null;
+    /**
+     * Get all registered capabilities.
+     *
+     * @returns All capability entries in the registry
+     */
+    getAllCapabilities(): CapabilityEntry[];
+    /**
+     * Get all delegations for a specific key.
+     *
+     * @param keyId - The key ID
+     * @returns Array of delegations for this key
+     */
+    getDelegationsForKey(keyId: string): Delegation[];
+    /**
+     * Ingest a key and delegation from an external source.
+     *
+     * @param key - Key information to ingest
+     * @param delegation - Delegation to associate with the key
+     * @param options - Ingestion options
+     */
+    ingestKey(key: KeyInfo, delegation: Delegation, options?: IngestOptions): void;
+    /**
+     * Check if a delegation is currently valid.
+     *
+     * @param delegation - The delegation to check
+     * @returns true if valid, false if expired or revoked
+     */
+    isDelegationValid(delegation: Delegation): boolean;
+    /**
+     * Get a key by its ID.
+     *
+     * @param keyId - The key ID
+     * @returns The key info, or undefined if not found
+     */
+    getKey(keyId: string): KeyInfo | undefined;
+    /**
+     * Get all registered keys.
+     *
+     * @returns Array of all registered keys
+     */
+    getAllKeys(): KeyInfo[];
+    /**
+     * Clear all registered keys and delegations.
+     */
+    clear(): void;
+    /**
+     * Revoke a delegation by CID.
+     *
+     * @param cid - The delegation CID to revoke
+     * @returns Result indicating success or failure
+     */
+    revokeDelegation(cid: string): Result$1<void, ServiceError>;
+    /**
+     * Find capabilities that match a resource path pattern.
+     *
+     * @param resourcePattern - Resource pattern (supports wildcards)
+     * @param action - Optional action filter
+     * @returns Matching capability entries
+     */
+    findCapabilities(resourcePattern: string, action?: string): CapabilityEntry[];
+    /**
+     * Add a delegation to the store.
+     *
+     * @param key - The key associated with this delegation
+     * @param delegation - The delegation to add
+     */
+    private addDelegation;
+    /**
+     * Create a capability key for indexing.
+     *
+     * @param resource - Resource path
+     * @param action - Action
+     * @returns Combined key string
+     */
+    private makeCapabilityKey;
+    private sameDelegationScope;
+    /**
+     * Find capability entries that match a resource and action.
+     *
+     * @param resource - Resource to match
+     * @param action - Action to match
+     * @returns Matching entries
+     */
+    private findMatchingEntries;
+    /**
+     * Check if an action pattern matches a specific action.
+     *
+     * @param pattern - Action pattern (may include wildcard like "tinycloud.kv/*")
+     * @param action - Specific action to check
+     * @returns true if pattern matches action
+     */
+    private actionMatches;
+    /**
+     * Check if a resource matches a pattern.
+     *
+     * Patterns support:
+     * - Exact match: "/kv/data" matches "/kv/data"
+     * - Wildcard suffix: "/kv/*" matches "/kv/anything"
+     * - Double wildcard: "/kv/**" matches "/kv/any/nested/path"
+     *
+     * @param resource - The specific resource being accessed
+     * @param pattern - The pattern from the delegation
+     * @returns true if resource matches pattern
+     */
+    private resourceMatchesPattern;
+    /**
+     * Check if a specific resource matches a resource pattern for searching.
+     *
+     * @param entryResource - The resource from a capability entry
+     * @param searchPattern - The pattern to search for
+     * @returns true if entry resource matches search pattern
+     */
+    private matchesResourcePattern;
+}
+/**
+ * Create a new CapabilityKeyRegistry instance.
+ *
+ * @returns A new registry instance
+ */
+declare function createCapabilityKeyRegistry(): ICapabilityKeyRegistry;
+
+interface ShareCacheKey {
+    readonly cid: string;
+    readonly expiresAt: string;
+}
+interface ShareCacheMetadata {
+    readonly contentType: string;
+    readonly size: number;
+    readonly encrypted: boolean;
+}
+interface ShareCacheEntry {
+    readonly key: ShareCacheKey;
+    readonly bytes: Uint8Array;
+    readonly digest: Uint8Array;
+    readonly metadata: ShareCacheMetadata;
+}
+interface ShareCache {
+    get(key: ShareCacheKey, now?: Date): Promise<Uint8Array | undefined>;
+    /** Retrieve a valid entry without a process-local expiry index. */
+    getByCid?(cid: string, now?: Date): Promise<ShareCacheEntry | undefined>;
+    set(key: ShareCacheKey, bytes: Uint8Array, metadata: ShareCacheMetadata): Promise<void>;
+    delete(key: ShareCacheKey): Promise<void>;
+    clear(): Promise<void>;
+}
+/**
+ * A deliberately memory-only cache. It stores verified artifact bytes and
+ * non-secret metadata only; fragment keys, presentations, sessions, and
+ * decrypted content never cross this boundary.
+ */
+declare class MemoryShareCache implements ShareCache {
+    private readonly now;
+    private readonly entries;
+    constructor(now?: () => Date);
+    get(key: ShareCacheKey, now?: Date): Promise<Uint8Array | undefined>;
+    getByCid(cid: string, now?: Date): Promise<ShareCacheEntry | undefined>;
+    set(key: ShareCacheKey, bytes: Uint8Array, metadata: ShareCacheMetadata): Promise<void>;
+    delete(key: ShareCacheKey): Promise<void>;
+    clear(): Promise<void>;
+}
+
+declare const ENVELOPE_SCHEMA: "xyz.tinycloud.share/envelope";
+declare const MAX_SHARE_CONTENT_BYTES: number;
+/** AES-GCM plus the published version byte, IV, and authentication tag. */
+declare const MAX_SEALED_SHARE_CONTENT_BYTES: number;
+/** Canonical JSON is independently bounded from plaintext and sealed bytes. */
+declare const MAX_SHARE_ARTIFACT_BYTES: number;
+type ShareRecipientTarget = {
+    readonly kind: "exactEmail";
+    readonly value: string;
+} | {
+    readonly kind: "emailDomain";
+    readonly value: string;
+} | {
+    readonly kind: "bearer";
+};
+type ShareResource = {
+    readonly kind: "exact";
+    readonly path: string;
+} | {
+    readonly kind: "prefix";
+    readonly path: string;
+};
+type ShareAction = "read" | "list" | "edit";
+interface SharePolicy {
+    readonly matcher: ShareRecipientTarget;
+    readonly spaceId: string;
+    readonly resource: ShareResource;
+    readonly actions: readonly ShareAction[];
+    readonly expiresAt: string;
+}
+interface ShareContentMetadata {
+    readonly mimeType: string;
+    readonly size: number;
+    readonly digest: string;
+    readonly charset?: "utf-8";
+}
+interface ShareEnvelopeV2 {
+    readonly schema: typeof ENVELOPE_SCHEMA;
+    readonly version: 2;
+    readonly origin: string;
+    readonly spaceId: string;
+    readonly recipient?: ShareRecipientTarget;
+    /** Public routing discriminator. Matcher values are never serialized here. */
+    readonly recipientKind?: ShareRecipientTarget["kind"];
+    readonly resource: ShareResource;
+    readonly actions: readonly ShareAction[];
+    readonly content: ShareContentMetadata;
+    readonly encrypted: boolean;
+    readonly expiresAt: string;
+    readonly signer: {
+        readonly did: string;
+        readonly publicKey: string;
+    };
+    readonly signature: string;
+    /** Internal marker for the published Share-v2 adapter; never serialized by legacy artifacts. */
+    readonly authorizationTargetKind?: string;
+}
+interface ShareArtifactV2 {
+    readonly envelope: ShareEnvelopeV2;
+    /** Canonical base64url bytes. For an encrypted artifact these are ciphertext. */
+    readonly content: string;
+}
+interface ShareLinkLocation {
+    readonly kind: "compact" | "inline";
+    readonly origin: string;
+    readonly cid?: string;
+    readonly key?: Uint8Array;
+    readonly artifact?: ShareArtifactV2;
+    readonly url: string;
+    /** Canonical Share envelope links use the published SHA-256/sealed-blob wire format. */
+    readonly protocol?: "legacy" | "share-envelope-v2";
+}
+interface VerifyShareEnvelopeOptions {
+    readonly now?: Date;
+    readonly expectedOrigin?: string;
+    readonly expectedCid?: string;
+    readonly maxArtifactBytes?: number;
+    readonly maxContentBytes?: number;
+    readonly maxSealedContentBytes?: number;
+    /** Trusted signer DIDs for addressed policy artifacts. */
+    readonly trustedSignerDids?: readonly string[];
+}
+interface ShareArtifactInput {
+    readonly origin: string;
+    readonly spaceId: string;
+    readonly recipient?: ShareRecipientTarget;
+    readonly resource: ShareResource;
+    readonly actions: readonly ShareAction[];
+    readonly mimeType: string;
+    readonly bytes: Uint8Array;
+    readonly expiresAt: Date;
+    readonly signerDid: string;
+    readonly signerPrivateKey: Uint8Array;
+    readonly encryptionKey?: Uint8Array;
+    readonly maxContentBytes?: number;
+    /** Required acknowledgement for the intentionally content-free policy-only plaintext form. */
+    readonly plaintextPolicyOnly?: boolean;
+    readonly plaintextWarningAcknowledged?: boolean;
+}
+interface ShareArtifactResult {
+    readonly artifact: ShareArtifactV2;
+    readonly bytes: Uint8Array;
+    readonly cid: string;
+    readonly key?: Uint8Array;
+}
+declare class ShareEnvelopeError extends Error {
+    readonly code: "invalid-link" | "invalid-envelope" | "expired" | "signature-invalid" | "cid-mismatch" | "origin-mismatch" | "content-too-large" | "encryption-required" | "unsafe-plaintext";
+    constructor(code: ShareEnvelopeError["code"], message: string);
+}
+declare function normalizeShareRecipientTarget(recipient: ShareRecipientTarget): ShareRecipientTarget;
+declare function normalizeShareResource(resource: ShareResource): ShareResource;
+declare function normalizeShareActions(actions: readonly ShareAction[]): ShareAction[];
+declare function createSharePolicy(input: Omit<SharePolicy, "expiresAt"> & {
+    readonly expiresAt: Date;
+}): SharePolicy;
+declare function computeShareCid(bytes: Uint8Array): string;
+declare function verifyShareCid(cid: string, bytes: Uint8Array): boolean;
+declare function signShareEnvelope(input: Omit<ShareEnvelopeV2, "signature" | "signer"> & {
+    signerDid: string;
+    signerPrivateKey: Uint8Array;
+}): ShareEnvelopeV2;
+declare function verifyShareEnvelope(envelope: ShareEnvelopeV2, options?: VerifyShareEnvelopeOptions): ShareEnvelopeV2;
+declare function encodeShareArtifact(artifact: ShareArtifactV2): Uint8Array;
+declare function parseShareArtifact(bytes: Uint8Array, options?: VerifyShareEnvelopeOptions & {
+    readonly verify?: boolean;
+}): ShareArtifactV2;
+declare function encodeShareUrl(input: {
+    readonly origin: string;
+    readonly cid: string;
+    readonly key?: Uint8Array;
+}): string;
+declare function encodeInlineShareUrl(input: {
+    readonly origin: string;
+    readonly artifact: ShareArtifactV2;
+    readonly key?: Uint8Array;
+    readonly maxInlineBytes?: number;
+}): string;
+declare function parseShareUrl(link: string, options?: {
+    readonly trustedOrigins?: readonly string[];
+    readonly maxInlineBytes?: number;
+}): ShareLinkLocation;
+declare function isV2ShareLink(link: string): boolean;
+declare function encryptShareBytes(bytes: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+declare function encryptShareBytesAsync(bytes: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+declare function decryptShareBytesAsync(bytes: Uint8Array, key: Uint8Array): Promise<Uint8Array>;
+declare function createShareArtifact(input: ShareArtifactInput): ShareArtifactResult;
+declare function createShareArtifactAsync(input: ShareArtifactInput): Promise<ShareArtifactResult>;
+declare function intersectShareCapabilities(granted: ShareCapabilityLike, requested: ShareCapabilityLike): ShareCapabilityLike | undefined;
+interface ShareCapabilityLike {
+    readonly spaceId: string;
+    readonly resource: ShareResource;
+    readonly actions: readonly ShareAction[];
+}
+declare function shareCapabilityAllows(capability: ShareCapabilityLike, action: ShareAction, path: string): boolean;
+
+/** Native action names used by the addressed Node data plane. */
+type ShareNativeAction = "tinycloud.kv/get" | "tinycloud.kv/metadata" | "tinycloud.kv/list" | "tinycloud.kv/put";
+type ShareWireAction = ShareNativeAction | "tinycloud.sql/read";
+type ShareAddressedRecipientMatcher = Exclude<ShareRecipientTarget, {
+    readonly kind: "bearer";
+}>;
+/** The closed v2 content-source union emitted by Node. */
+interface ShareKvContentSource {
+    readonly kind: "kv";
+    readonly action: ShareNativeAction;
+    readonly space: string;
+    readonly path: string;
+}
+interface ShareSqlContentSource {
+    readonly kind: "sql";
+    readonly action: "tinycloud.sql/read";
+    readonly space: string;
+    readonly database: string;
+    readonly path: string;
+    readonly statement: string;
+    readonly arguments: Readonly<Record<string, number>>;
+    readonly argumentsDigest: string;
+}
+type ShareContentSource = ShareKvContentSource | ShareSqlContentSource;
+/** Inclusive expiry interval resolved by Node for an addressed policy. */
+interface ShareExpiryBounds {
+    readonly expiryMin?: string;
+    readonly expiryMax?: string;
+}
+/** Node's closed addressed-authoring v2 request. */
+interface ShareAddressedDelegationRequestV2 {
+    readonly version: 2;
+    readonly nonce: string;
+    readonly jti: string;
+    readonly senderDid: string;
+    readonly recipientMatcher: ShareAddressedRecipientMatcher;
+    readonly targetOrigin: string;
+    readonly nodeAudience: string;
+    readonly shareCid: string;
+    readonly shareId: string;
+    readonly delegationCid: string;
+    readonly authorityMaterialHandle: string;
+    readonly authorityMaterialDigest: string;
+    readonly contentSource: ShareContentSource;
+    readonly contentSourceDigest: string;
+    readonly actions: readonly ShareWireAction[];
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+        readonly value: string;
+    };
+    readonly expiresAt: string;
+    readonly requestBodyDigest: string;
+}
+interface ShareAddressedDelegationEnvelopeV2 {
+    readonly request: ShareAddressedDelegationRequestV2;
+    readonly proof: ShareDetachedProof;
+}
+interface ShareAddressedDelegationResponseV2 {
+    readonly type: "TinyCloudShareAddressedDelegation";
+    readonly version: 2;
+    readonly nonce: string;
+    readonly jti: string;
+    readonly policyCid: string;
+    readonly policyBytes: string;
+    readonly policyDigest: string;
+    readonly delegationCid: string;
+    readonly delegationBytes: string;
+    readonly delegationDigest: string;
+    readonly authorityMaterialHandle: string;
+    readonly authorityMaterialDigest: string;
+    readonly actions: readonly ShareWireAction[];
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+        readonly value: string;
+    };
+    readonly expiresAt: string;
+    readonly proof: ShareDetachedProof;
+}
+/** Closed v1 policy-session response emitted by Node's compatibility route. */
+interface SharePolicySessionWireV1 {
+    readonly type: "TinyCloudSharePolicySession";
+    readonly version: 1;
+    readonly sessionId: string;
+    readonly shareCid: string;
+    readonly shareId: string;
+    readonly delegationCid: string;
+    readonly authorityMaterialHandle: string;
+    readonly authorityMaterialDigest: string;
+    readonly policyCid: string;
+    readonly contentSource: ShareContentSource;
+    readonly contentSourceDigest: string;
+    readonly holderDid: string;
+    readonly targetOrigin: string;
+    readonly nodeAudience: string;
+    readonly action: ShareWireAction;
+    readonly actions?: readonly ShareWireAction[];
+    readonly resource: string;
+    readonly credentialDigest: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+}
+/** Explicit v1 wire names retained for callers using the legacy read path. */
+type SharePolicySessionV1 = SharePolicySession;
+type ShareReadInvocationV1 = ShareNativeInvokeInput;
+interface ShareRecipientPolicy {
+    readonly recipientMatcher: ShareRecipientTarget;
+    readonly spaceId: string;
+    readonly resource: ShareResource;
+    readonly actions: readonly ShareAction[];
+    readonly expiresAt: Date;
+}
+interface ShareRecipientClientOptions {
+    readonly trustedOrigins: readonly string[];
+    readonly fetch?: FetchFunction;
+    readonly invoke?: InvokeFunction;
+    readonly createKVService?: (config: {
+        hosts: string[];
+        session: ServiceSession;
+        invoke: InvokeFunction;
+        fetch?: FetchFunction;
+        pathPrefix?: string;
+    }) => IKVService;
+    /** Raw publication endpoint. The default is the Share raw artifact route. */
+    readonly artifactUrl?: (input: {
+        readonly origin: string;
+        readonly cid: string;
+    }) => string;
+    /** Trusted signer DIDs for addressed policy artifacts. */
+    readonly trustedSignerDids?: readonly string[];
+    /** A verified Node policy session. It is intentionally not a bearer token. */
+    readonly establishPolicySession?: (input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly presentation?: unknown;
+    }) => Promise<SharePolicySession>;
+    /**
+     * Builds the holder presentation/session request after Node returns a
+     * fresh challenge.  The callback is deliberately invoked only after the
+     * challenge proof has been verified; callers cannot precompute a reusable
+     * nonce-bound session request.
+     */
+    readonly buildPolicySessionRequest?: (input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly challenge: Readonly<Record<string, unknown>>;
+        readonly challengeRequest: Readonly<Record<string, unknown>>;
+    }) => Promise<unknown> | unknown;
+    /**
+     * Authoritative Node policy tuple. This is supplied by the Share host after
+     * Node has created/persisted the policy; the recipient never invents it.
+     */
+    readonly policyBinding?: SharePolicyBinding;
+    /** Holder proof signer used for the strict Node session and /invoke wires. */
+    readonly holderSigner?: (input: {
+        readonly domain: string;
+        readonly message: Readonly<Record<string, unknown>>;
+    }) => Promise<ShareDetachedProof> | ShareDetachedProof;
+    /**
+     * Node's addressed-sharing data plane. Implementations must sign the
+     * application/vnd.tinycloud.share+json request with the holder proof and
+     * send it to Node /invoke; the SDK never turns a policy session into a
+     * generic KV bearer session.
+     */
+    readonly nativeInvoke?: (input: ShareNativeInvokeInput) => Promise<ShareNativeInvokeResult>;
+    /** Optional holder signer for the built-in addressed /invoke transport. */
+    readonly signNativeInvoke?: (input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly session: SharePolicySession;
+        readonly request: Readonly<Record<string, unknown>>;
+    }) => Promise<ServiceHeaders> | ServiceHeaders;
+    /** Optional route overrides for deployments that mount Share under a prefix. */
+    readonly policyRoutes?: {
+        readonly challenge?: string;
+        readonly session?: string;
+    };
+    readonly presentation?: unknown;
+    readonly bearerSession?: ServiceSession;
+    readonly cache?: ShareCache;
+    readonly now?: () => Date;
+    readonly maxInlineBytes?: number;
+    readonly maxArtifactBytes?: number;
+    readonly maxContentBytes?: number;
+    readonly maxSealedContentBytes?: number;
+}
+interface SharePolicySession {
+    readonly type?: "TinyCloudSharePolicySession";
+    readonly version?: 1 | 2;
+    readonly sessionId: string;
+    readonly envelopeCid?: string;
+    readonly registrationCid?: string;
+    readonly shareCid?: string;
+    readonly shareId?: string;
+    readonly policyCid?: string;
+    readonly enforcementDelegationCid?: string;
+    readonly runtimeDelegation?: unknown;
+    readonly holderDid: string;
+    readonly expiresAt: string;
+    readonly expiryMin?: string;
+    readonly expiryMax?: string;
+    readonly capability?: ShareCapabilityLike;
+    readonly delegationCid?: string;
+    readonly authorityMaterialHandle?: string;
+    readonly authorityMaterialDigest?: string;
+    readonly contentSource?: ShareContentSource;
+    readonly contentSourceDigest?: string;
+    readonly targetOrigin?: string;
+    readonly nodeAudience?: string;
+    readonly action?: ShareWireAction | ShareAction;
+    readonly actions?: readonly (ShareWireAction | ShareAction)[];
+    readonly resource?: ShareResource | string;
+    readonly credentialDigest?: string;
+    readonly credential?: string;
+    readonly holderBinding?: unknown;
+    readonly readSignerDid?: string;
+    readonly holderSigner?: ShareRecipientClientOptions["holderSigner"];
+    /** Legacy v1 transport fields retained for compatibility with Node sessions. */
+    readonly authorization?: string;
+    readonly delegationHeader?: {
+        readonly Authorization?: string;
+    };
+    readonly spaceId?: string;
+    readonly origin?: string;
+    readonly audience?: string;
+    readonly sourceDigest?: string;
+    readonly verificationMethod?: string;
+    readonly jwk?: Readonly<Record<string, unknown>>;
+}
+interface ShareDetachedProof {
+    readonly alg: "EdDSA";
+    readonly kid: string;
+    readonly signature: string;
+}
+/** Exact fields Node resolves from its persisted policy authority tuple. */
+interface SharePolicyBinding {
+    readonly envelopeCid?: string;
+    readonly shareCid: string;
+    readonly shareId: string;
+    readonly registrationCid?: string;
+    readonly delegationCid: string;
+    readonly authorityMaterialHandle: string;
+    readonly authorityMaterialDigest: string;
+    readonly policyCid: string;
+    readonly enforcementDelegationCid?: string;
+    readonly enforcementDelegation?: unknown;
+    readonly outerEnvelope?: unknown;
+    readonly contentSource: ShareContentSource;
+    readonly contentSourceDigest: string;
+    readonly holderDid?: string;
+    readonly targetOrigin: string;
+    readonly nodeAudience: string;
+    readonly action?: ShareWireAction | ShareAction;
+    readonly actions?: readonly (ShareWireAction | ShareAction)[];
+    readonly resource: ShareResource | string;
+    readonly expiryMin?: string;
+    readonly expiryMax?: string;
+    readonly expiresAt?: string;
+}
+interface ShareNativeInvokeInput {
+    readonly envelope: ShareEnvelopeV2;
+    readonly session: SharePolicySession;
+    /** Native Node data-plane verb, kept distinct from public envelope actions. */
+    readonly action: "get" | "metadata" | "list" | "put";
+    readonly resource: string;
+    readonly body?: Uint8Array;
+    /** Digest of the exact decoded body; holder signing must cover this value. */
+    readonly bodyDigest?: string;
+    readonly contentType?: string;
+    readonly ifMatch?: string;
+    readonly cursor?: string;
+    readonly limit?: number;
+    readonly mediaType: "application/vnd.tinycloud.share+json";
+}
+/** The legacy v1 /invoke wrapper remains named and closed for adapters. */
+interface ShareNativeInvokeEnvelopeV1 {
+    readonly request: Readonly<Record<string, unknown>>;
+    readonly limit?: number;
+    readonly cursor?: string;
+    readonly body?: string;
+    readonly bodyDigest?: string;
+    readonly ifMatch?: string;
+    readonly contentType?: string;
+}
+interface ShareNativeInvokeErrorResult {
+    readonly status: number;
+    readonly headers?: Readonly<Record<string, string | undefined>>;
+}
+interface ShareNativeInvokeSuccessResult {
+    readonly status: number;
+    readonly type: "TinyCloudShareInvokeResponse";
+    readonly version: 2;
+    readonly action: ShareNativeAction;
+    readonly resource: string;
+    readonly bytes?: Uint8Array;
+    readonly headers?: Readonly<Record<string, string | undefined>>;
+    readonly keys?: readonly string[];
+    readonly truncated?: boolean;
+    readonly nextCursor?: string;
+    readonly entries?: readonly ShareListEntry[];
+    /** Normalized header aliases accepted by native adapters. */
+    readonly etag?: string;
+    readonly contentType?: string;
+    readonly metadata?: Readonly<Record<string, string>>;
+    readonly content?: string;
+    readonly bodyDigest?: string;
+}
+type ShareNativeInvokeResult = ShareNativeInvokeErrorResult | ShareNativeInvokeSuccessResult;
+interface ShareListEntry {
+    readonly path: string;
+    readonly kind: "file" | "folder";
+}
+interface ShareReadResult {
+    readonly bytes: Uint8Array;
+    readonly etag?: string;
+    readonly contentType?: string;
+    readonly size: number;
+}
+interface ShareMetadataResult {
+    readonly metadata: Readonly<Record<string, string>>;
+    readonly etag?: string;
+    readonly contentType?: string;
+    readonly size?: number;
+}
+interface ShareListResult {
+    readonly keys: readonly string[];
+    readonly entries?: readonly ShareListEntry[];
+    readonly nextCursor?: string;
+    readonly truncated?: boolean;
+}
+interface ShareSaveOptions {
+    readonly etag: string;
+    readonly contentType?: string;
+}
+declare class ShareConflict extends Error {
+    readonly code: "SHARE_CONFLICT";
+    readonly path: string;
+    readonly etag?: string;
+    constructor(path: string, etag?: string);
+}
+declare class ShareAccessError extends Error {
+    readonly code: string;
+    constructor(code: string, message?: string);
+}
+interface ShareAccessV2 {
+    readonly kind: "share-v2";
+    readonly envelope: ShareEnvelopeV2;
+    readonly location: ShareLinkLocation;
+    readonly resource: ShareResource;
+    readonly actions: readonly ShareAction[];
+    readonly expiresAt: Date;
+    readonly kv?: IKVService;
+    readonly get: (path?: string) => Promise<ShareReadResult>;
+    readonly listChildren: (options?: {
+        readonly path?: string;
+        readonly limit?: number;
+        readonly cursor?: string;
+    }) => Promise<ShareListResult>;
+    readonly save: (path: string, bytes: Uint8Array, options: ShareSaveOptions) => Promise<{
+        readonly etag?: string;
+    }>;
+    readonly metadata: (path?: string) => Promise<ShareMetadataResult>;
+}
+type ShareRecipientResult<T> = Result$1<T, ServiceError | ShareAccessError | ShareConflict>;
+
+/**
+ * SharingService - v2 sharing link service with embedded private keys.
+ *
+ * This service implements the v2 sharing specification, which embeds private keys
+ * directly in sharing links. This allows recipients to exercise delegations
+ * without requiring prior session setup.
+ *
+ * Key differences from v1 SharingLinks:
+ * - Private keys are embedded in the link (not just tokens)
+ * - Recipients can optionally sub-delegate to their own session key
+ * - Pre-configured KV service returned for immediate use
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Data encoded in a sharing link.
+ */
+interface EncodedShareData {
+    /** Private key in JWK format (includes d parameter) */
+    key: JWK;
+    /** DID of the key */
+    keyDid: string;
+    /** The delegation granting access */
+    delegation: Delegation;
+    /** Resource path this link grants access to */
+    path: string;
+    /** TinyCloud host URL */
+    host: string;
+    /** Space ID */
+    spaceId: string;
+    /** Schema version */
+    version: 1;
+}
+/**
+ * Options for receiving a sharing link.
+ */
+interface ReceiveOptions {
+    /**
+     * Whether to automatically create a sub-delegation to the current session key.
+     * Default: true
+     */
+    autoSubdelegate?: boolean;
+    /**
+     * Whether to use the current session key for operations (requires autoSubdelegate).
+     * Default: true
+     */
+    useSessionKey?: boolean;
+    /**
+     * Ingestion options passed to CapabilityKeyRegistry.
+     */
+    ingestOptions?: IngestOptions;
+}
+/**
+ * Result of receiving a sharing link.
+ */
+interface ShareAccess {
+    /** The delegation that was received/created */
+    delegation: Delegation;
+    /** Key info for the received key */
+    key: KeyInfo;
+    /** Pre-configured KV service for the shared path */
+    kv: IKVService;
+    /** The space ID */
+    spaceId: string;
+    /** The path prefix for this share */
+    path: string;
+}
+/**
+ * Parameters for attenuating a received share to another principal.
+ *
+ * Omitted path/actions/expiry inherit the received share's exact values. Any
+ * supplied value must be equal to or an attenuated subset of the parent.
+ */
+interface DelegateReceivedShareParams {
+    /** DID that may exercise the child delegation. */
+    delegateDID: string;
+    /** Equal to or below the shared path. Defaults to the shared path. */
+    path?: string;
+    /** Subset of the shared actions. Defaults to all shared actions. */
+    actions?: string[];
+    /** No later than the sharing-link expiry. Defaults to the parent expiry. */
+    expiry?: Date;
+    /** Optional node origin that further narrows the configured-host allowlist. */
+    expectedHost?: string;
+}
+/**
+ * A transport-ready child delegation with non-secret source lineage.
+ *
+ * `delegation.delegationHeader` is a live bearer credential. Treat it like a
+ * secret: do not log it or persist it outside secure credential storage.
+ * Only `source` is safe to retain as non-secret lineage metadata.
+ */
+interface DelegatedShareAccess {
+    delegation: Delegation & {
+        delegationHeader: {
+            Authorization: string;
+        };
+        ownerAddress: string;
+        chainId: number;
+        host: string;
+        resources: Array<{
+            service: string;
+            space: string;
+            path: string;
+            actions: string[];
+        }>;
+        disableSubDelegation: boolean;
+    };
+    source: {
+        parentCid: string;
+        spaceId: string;
+        path: string;
+        host: string;
+        expiresAt: Date;
+    };
+}
+/**
+ * Configuration for SharingService.
+ */
+interface SharingServiceConfig {
+    /** TinyCloud host URLs */
+    hosts: string[];
+    /**
+     * Active session for authentication.
+     * Required for generate(), optional for receive().
+     */
+    session?: ServiceSession;
+    /** Platform-specific invoke function */
+    invoke: InvokeFunction;
+    /** Optional custom fetch implementation */
+    fetch?: FetchFunction;
+    /** Key provider for cryptographic operations */
+    keyProvider: KeyProvider;
+    /** Capability key registry for key/delegation management */
+    registry: ICapabilityKeyRegistry;
+    /**
+     * Delegation manager for creating delegations (used if createDelegation not provided).
+     * Required for generate(), optional for receive().
+     */
+    delegationManager?: DelegationManager;
+    /** Factory for creating KV service instances */
+    createKVService: (config: {
+        hosts: string[];
+        session: ServiceSession;
+        invoke: InvokeFunction;
+        fetch?: FetchFunction;
+        pathPrefix?: string;
+    }) => IKVService;
+    /** Base URL for sharing links (e.g., "https://share.myapp.com") */
+    baseUrl?: string;
+    /**
+     * Custom delegation creation function. When provided, this is used instead
+     * of delegationManager.create(). This allows platforms to use their own
+     * delegation creation logic (e.g., SIWE-based /delegate endpoint).
+     */
+    createDelegation?: (params: CreateDelegationParams) => Promise<Result<Delegation, DelegationError>>;
+    /**
+     * WASM function for client-side delegation creation.
+     * When provided, this is preferred over server-side creation (createDelegation/delegationManager).
+     * Creates UCAN delegations directly without requiring server roundtrip.
+     */
+    createDelegationWasm?: (params: CreateDelegationWasmParams) => CreateDelegationWasmResult;
+    /** Compute a CID for serialized delegation bytes. Required for share attenuation. */
+    computeCid?: (data: Uint8Array, codec: bigint) => string;
+    /**
+     * Path prefix for KV operations.
+     * When set, paths passed to generate() are prefixed with this value.
+     * This ensures the share path matches the session's authorized paths.
+     */
+    pathPrefix?: string;
+    /**
+     * Session expiry time.
+     * When set, sharing link expiry is clamped to not exceed this value
+     * unless onRootDelegationNeeded is provided and returns a new delegation.
+     */
+    sessionExpiry?: Date;
+    /**
+     * Callback to create a DIRECT delegation from the root (wallet) to a share key.
+     * This bypasses the session delegation chain, allowing share links with
+     * expiry longer than the current session.
+     *
+     * When provided and share expiry > session expiry:
+     * 1. SharingService creates the ephemeral share key
+     * 2. This callback is invoked with the share key DID
+     * 3. The callback signs a direct PKH -> share key delegation with the wallet
+     * 4. The returned delegation is used for the share link
+     *
+     * This is the CORRECT solution for long-lived share links because:
+     * - It creates a fresh delegation chain: PKH -> share key
+     * - Not constrained by session expiry (no sub-delegation from session key)
+     *
+     * @param params - Parameters for creating the root delegation
+     * @returns The delegation from wallet to share key, or undefined to fall back to session extension
+     */
+    onRootDelegationNeeded?: (params: {
+        /** DID of the share key to delegate to */
+        shareKeyDID: string;
+        /** Space ID */
+        spaceId: string;
+        /** Path to grant access to */
+        path: string;
+        /** Actions to grant */
+        actions: string[];
+        /** Requested expiry time */
+        requestedExpiry: Date;
+    }) => Promise<Delegation | undefined>;
+    /** Reject operations after the host session/service graph has been retired. */
+    assertActive?: () => void;
+}
+/**
+ * Interface for the SharingService.
+ */
+interface ISharingService {
+    /**
+     * Generate a sharing link with an embedded private key.
+     *
+     * This creates a new session key, delegates to it, and encodes
+     * the key and delegation into a shareable link.
+     */
+    generate(params: GenerateShareParams): Promise<Result<ShareLink, DelegationError>>;
+    /**
+     * Receive and activate a sharing link.
+     *
+     * Decodes the link, ingests the key into the registry, and optionally
+     * creates a sub-delegation to the current session key.
+     */
+    receive(link: string, options?: ReceiveOptions): Promise<Result<ShareAccess, DelegationError>>;
+    /** Receive a signed v2 envelope/link without changing the legacy tc1 API. */
+    receiveV2(link: string, options?: Omit<ShareRecipientClientOptions, "trustedOrigins" | "fetch" | "invoke" | "createKVService">): Promise<ShareAccessV2>;
+    /**
+     * Consume a sharing link locally and create an attenuated child delegation.
+     * The raw link and embedded private JWK are never returned. The returned
+     * child delegation is itself a sensitive bearer credential.
+     */
+    delegateReceivedShare(link: string, params: DelegateReceivedShareParams): Promise<Result<DelegatedShareAccess, DelegationError>>;
+    /**
+     * Encode sharing data into a link string.
+     */
+    encodeLink(data: EncodedShareData, schema?: ShareSchema): string;
+    /**
+     * Decode a link string into sharing data.
+     */
+    decodeLink(link: string): EncodedShareData;
+}
+/**
+ * SharingService - v2 sharing link service with embedded private keys.
+ *
+ * @example
+ * ```typescript
+ * import { SharingService } from "@tinycloud/sdk-core/delegations";
+ *
+ * const sharing = new SharingService({
+ *   hosts: ["https://node.tinycloud.xyz"],
+ *   session,
+ *   invoke,
+ *   keyProvider,
+ *   registry,
+ *   delegationManager,
+ *   createKVService,
+ *   baseUrl: "https://share.myapp.com"
+ * });
+ *
+ * // Generate a sharing link
+ * const result = await sharing.generate({
+ *   path: "/kv/documents/report.pdf",
+ *   actions: ["tinycloud.kv/get"],
+ *   expiry: new Date("2024-12-31")
+ * });
+ *
+ * if (result.ok) {
+ *   console.log("Share this URL:", result.data.url);
+ * }
+ *
+ * // Receive a sharing link
+ * const receiveResult = await sharing.receive(shareUrl);
+ * if (receiveResult.ok) {
+ *   // Use the pre-configured KV service
+ *   const data = await receiveResult.data.kv.get("report.pdf");
+ * }
+ * ```
+ */
+declare class SharingService implements ISharingService {
+    private hosts;
+    private session?;
+    private invoke;
+    private fetchFn;
+    private keyProvider;
+    private registry;
+    private delegationManager?;
+    private createKVService;
+    private baseUrl;
+    private createDelegationFn?;
+    private createDelegationWasmFn?;
+    private computeCidFn?;
+    private pathPrefix;
+    private sessionExpiry?;
+    private onRootDelegationNeeded?;
+    private assertActiveFn?;
+    /**
+     * Creates a new SharingService instance.
+     */
+    constructor(config: SharingServiceConfig);
+    /**
+     * Gets the primary host URL.
+     */
+    private get host();
+    /**
+     * Updates the session (e.g., after re-authentication).
+     */
+    updateSession(session: ServiceSession): void;
+    /**
+     * Updates the service configuration.
+     * Used to add full capabilities (session, delegationManager, createDelegation, createDelegationWasm) after signIn.
+     */
+    updateConfig(config: Partial<Pick<SharingServiceConfig, "session" | "delegationManager" | "createDelegation" | "createDelegationWasm" | "sessionExpiry" | "onRootDelegationNeeded" | "assertActive">>): void;
+    /**
+     * Generate a sharing link with an embedded private key.
+     *
+     * Flow:
+     * 1. Spawn new session key (unique per share)
+     * 2. Create delegation from current session to spawned key
+     * 3. Package: { key (with private!), delegation, path, host }
+     * 4. Encode based on schema (base64 for now)
+     * 5. Return link string
+     */
+    generate(params: GenerateShareParams): Promise<Result<ShareLink, DelegationError>>;
+    /**
+     * Check if any key in the registry can satisfy the delegation request.
+     * A key can satisfy if it has a delegation that:
+     * 1. Covers the required path (exact match or parent path)
+     * 2. Has all required actions
+     * 3. Has sufficient expiry (delegation.expiry >= requestedExpiry)
+     * 4. Allows sub-delegation
+     * @internal
+     */
+    private findSuitableKeyForDelegation;
+    private retiredGraphError;
+    /**
+     * Check if a delegation path matches/covers the requested path.
+     * A delegation path covers the request if:
+     * - It's an exact match
+     * - It's a parent path (e.g., delegation for "" covers "foo/bar")
+     * - It uses wildcards that match
+     * @internal
+     */
+    private pathMatches;
+    /**
+     * Create a delegation from the current session to a share key.
+     * This is the fallback path when root delegation is not available.
+     * @internal
+     */
+    private createSessionDelegation;
+    /**
+     * Receive and activate a sharing link.
+     *
+     * Flow:
+     * 1. Decode link -> extract { key, delegation, path, host }
+     * 2. Ingest key into CapabilityKeyRegistry
+     * 3. If autoSubdelegate (default true) + useSessionKey:
+     *    - Create sub-delegation from ingested key -> current session
+     *    - Register sub-delegation capabilities
+     * 4. Return ShareAccess with pre-configured KV service
+     */
+    receive(link: string, options?: ReceiveOptions): Promise<Result<ShareAccess, DelegationError>>;
+    receiveV2(link: string, options?: Omit<ShareRecipientClientOptions, "trustedOrigins" | "fetch" | "invoke" | "createKVService">): Promise<ShareAccessV2>;
+    /**
+     * Create a constrained child delegation from a received sharing link.
+     *
+     * This is the safe handoff for a browser delegating shared input to an
+     * agent or service: the bearer link is decoded and used only in this SDK
+     * instance, while the recipient receives a child UCAN without the embedded
+     * private key. The child UCAN is a sensitive bearer credential and must not
+     * be logged or stored insecurely.
+     */
+    delegateReceivedShare(link: string, params: DelegateReceivedShareParams): Promise<Result<DelegatedShareAccess, DelegationError>>;
+    /**
+     * The child-delegation WASM boundary accepts action-only abilities. Reject
+     * every constrained parent branch before that boundary can broaden it.
+     */
+    private assertDelegationCaveatsPreservable;
+    /**
+     * Encode sharing data into a link string.
+     *
+     * @param data - The share data to encode
+     * @param schema - The encoding schema (default: "base64")
+     * @returns Encoded link string
+     */
+    encodeLink(data: EncodedShareData, schema?: ShareSchema): string;
+    /**
+     * Decode a link string into sharing data.
+     *
+     * @param link - The encoded link string (may include URL prefix)
+     * @returns Decoded share data
+     * @throws Error if link format is invalid or data fails validation
+     */
+    decodeLink(link: string): EncodedShareData;
+    /**
+     * Decode and validate a link string into sharing data.
+     *
+     * Internal method that returns a Result instead of throwing.
+     * Used by receive() for proper error handling.
+     *
+     * @param link - The encoded link string (may include URL prefix)
+     * @returns Result with decoded share data or validation error
+     */
+    private decodeLinkWithValidation;
+}
+/**
+ * Create a new SharingService instance.
+ */
+declare function createSharingService(config: SharingServiceConfig): ISharingService;
+
+declare class ShareRecipientClient {
+    private readonly options;
+    private readonly fetchFn;
+    private readonly cache;
+    private readonly now;
+    constructor(options: ShareRecipientClientOptions);
+    open(link: string): Promise<ShareAccessV2>;
+    private createKV;
+    private nativeGet;
+    private nativeMetadata;
+    private nativeList;
+    private nativeSave;
+    private invokeNative;
+    private validateNativeResult;
+    private assertNativeListResult;
+    private assertDetachedProof;
+    private defaultNativeHeaders;
+    private digestMatches;
+    private assertNativeRequestBounds;
+    private verifyNativeResponse;
+    private establishPolicySession;
+    private buildChallengeRequest;
+    private assertStrictChallengeRequest;
+    private assertStrictSessionRequest;
+    private parseSessionCapability;
+    private assertProvidedPolicySession;
+    private assertExpiryBounds;
+    private assertServerActions;
+    private buildDefaultPolicySessionRequest;
+    private postJson;
+    private requireObject;
+    private requiredString;
+    private verifyNodeProof;
+    private assertChallengeRequestBinding;
+    private assertChallengeFresh;
+    private assertSessionBinding;
+    private assertAllowed;
+    private resolve;
+    private fetchArtifact;
+    private resolvePublished;
+    private base64ToBytes;
+}
+
+interface OwnerDelegationReceipt {
+    readonly delegationCid: string;
+    readonly signedDagCbor: Uint8Array;
+    readonly delegation: {
+        readonly delegateDID: string;
+        readonly spaceId: string;
+        readonly path: string;
+        readonly actions: readonly string[];
+        readonly expiry: Date;
+    };
+}
+interface CreateOwnerDelegationParams {
+    readonly delegateDid: string;
+    readonly spaceId: string;
+    readonly path: string;
+    readonly actions: readonly string[];
+    readonly expiresAt: Date;
+}
+declare const MAX_CONTENT_BYTES: number;
+type OwnerShareAction = "tinycloud.kv/get" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.kv/put";
+type OwnerShareMatcher = {
+    readonly kind: "exactEmail";
+    readonly value: string;
+} | {
+    readonly kind: "emailDomain";
+    readonly value: string;
+};
+interface OwnerSharePolicyV2 {
+    readonly type: "TinyCloudSharePolicy";
+    readonly version: 2;
+    readonly shareId: string;
+    readonly ownerDid: string;
+    readonly shareKeyDid: string;
+    readonly recipientMatcher: OwnerShareMatcher;
+    readonly target: {
+        readonly origin: string;
+        readonly nodeAudience: string;
+        readonly enforcerDid: string;
+        readonly spaceId: string;
+    };
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+        readonly path: string;
+    };
+    readonly actions: readonly OwnerShareAction[];
+    readonly contentSource: {
+        readonly kind: "kv";
+        readonly space: string;
+        readonly path: string;
+        readonly action: "tinycloud.kv/get";
+    };
+    readonly contentSourceDigest: string;
+    readonly ownerDelegationCid: string;
+    readonly expiresAt: string;
+}
+interface DelegatedShareKey {
+    readonly did: string;
+    readonly publicKey: Uint8Array;
+    readonly extractable: boolean;
+    readonly privateJwk?: Record<string, string>;
+    /**
+     * The underlying WebCrypto private key. Non-extractable keys are still
+     * structured-clonable, so this handle (not `privateJwk`) is what callers
+     * must persist (e.g. in IndexedDB) to recover signing across a reload.
+     */
+    readonly cryptoKey: CryptoKey;
+    sign(bytes: Uint8Array): Promise<Uint8Array>;
+    clear(): void;
+}
+interface SignedDelegation {
+    readonly cid: string;
+    readonly dagCbor: string;
+    readonly issuerDid: string;
+    readonly audienceDid: string;
+    readonly facts: Record<string, string | readonly string[]>;
+    readonly signature: string;
+}
+interface RegisterOwnerSharePolicyParams {
+    readonly policy: {
+        readonly bytes: Uint8Array;
+        readonly cid: string;
+        readonly proof: string;
+    };
+    readonly ownerDelegation: OwnerDelegationReceipt;
+    readonly enforcementDelegation: SignedDelegation;
+    readonly contentSourceDigest: string;
+    /** The enrolled receipt key from the node trust bundle. */
+    readonly nodeProof?: {
+        readonly kid: string;
+        readonly publicKey: Uint8Array;
+    };
+}
+interface OwnerSharePolicyRegistration {
+    readonly registrationCid: string;
+    readonly policyCid: string;
+    readonly ownerDelegationCid: string;
+    readonly enforcementDelegationCid: string;
+    readonly ownerDid: string;
+    readonly shareKeyDid: string;
+    readonly enforcerDid: string;
+    readonly shareId: string;
+    readonly recipientMatcher: OwnerShareMatcher;
+    readonly target: {
+        readonly origin: string;
+        readonly nodeAudience: string;
+        readonly spaceId: string;
+    };
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+        readonly path: string;
+    };
+    readonly actions: readonly OwnerShareAction[];
+    readonly contentSource: {
+        readonly kind: "kv";
+        readonly space: string;
+        readonly path: string;
+        readonly action: "tinycloud.kv/get";
+    };
+    readonly contentSourceDigest: string;
+    readonly registeredAt: string;
+    readonly expiresAt: string;
+}
+interface OwnerSharePolicyRegistrationReceipt {
+    readonly registration: OwnerSharePolicyRegistration;
+    readonly proof: {
+        readonly alg: "EdDSA";
+        readonly kid: string;
+        readonly signature: string;
+    };
+}
+declare function createDelegatedShareKey(options: {
+    readonly extractable: boolean;
+}): Promise<DelegatedShareKey>;
+/**
+ * Rehydrate a signer wrapper around a `DelegatedShareKey`'s private
+ * `CryptoKey` handle that was persisted (e.g. via IndexedDB structured
+ * clone) and recovered after a reload. `privateKey` must be the same
+ * non-extractable Ed25519 `CryptoKey` originally produced by
+ * {@link createDelegatedShareKey}.
+ */
+declare function restoreDelegatedShareKey(input: {
+    readonly privateKey: CryptoKey;
+    readonly publicKey: Uint8Array;
+    readonly extractable: boolean;
+}): DelegatedShareKey;
+declare function createPolicyEnforcementDelegation(input: {
+    readonly ownerDelegation: OwnerDelegationReceipt;
+    readonly shareKey: DelegatedShareKey;
+    readonly enforcerDid: string;
+    readonly policyCid: string;
+    readonly shareId: string;
+    readonly spaceId: string;
+    readonly nodeAudience: string;
+    readonly path: string;
+    readonly actions: readonly OwnerShareAction[];
+    readonly contentSourceDigest: string;
+    readonly expiresAt: string;
+}): Promise<SignedDelegation>;
+declare function canonicalOwnerSharePolicy(policy: OwnerSharePolicyV2): Promise<{
+    readonly bytes: Uint8Array;
+    readonly cid: string;
+    readonly digest: string;
+}>;
+declare function computeOwnerShareRegistrationCid(registration: Omit<OwnerSharePolicyRegistration, "registrationCid">): string;
+declare function validateOwnerSharePolicyRegistration(value: unknown, expected: RegisterOwnerSharePolicyParams): OwnerSharePolicyRegistrationReceipt;
+/** Validate the exact UTF-8 response bytes emitted by the registration route. */
+declare function validateOwnerSharePolicyRegistrationBytes(bytesValue: Uint8Array, expected: RegisterOwnerSharePolicyParams): OwnerSharePolicyRegistrationReceipt;
+
+/** Matches V2_DELIVERY_DOMAIN in tinycloud-node-server/src/share_v2.rs. */
+declare const SHARE_DELIVERY_AUTHORIZATION_DOMAIN = "xyz.tinycloud.share/delivery-authorization/v2\0";
+/** Exact camelCase mirror of the Rust `V2DeliveryRequest` wire struct. */
+interface ShareDeliveryAuthorizationRequest {
+    readonly envelopeCid: string;
+    readonly shareCid: string;
+    readonly shareId: string;
+    readonly registrationCid: string;
+    readonly policyCid: string;
+    readonly delegationCid: string;
+    readonly enforcementDelegationCid: string;
+    readonly recipientEmail: string;
+    readonly shareUrl: string;
+    readonly documentName: string;
+    readonly jti: string;
+    readonly expiresAt: string;
+    readonly requestBodyDigest: string;
+}
+/** Exact mirror of the `authorization` object the Node route signs and returns. */
+interface ShareDeliveryAuthorization {
+    readonly type: "TinyCloudShareDeliveryAuthorization";
+    readonly version: 2;
+    readonly jti: string;
+    readonly shareCid: string;
+    readonly shareId: string;
+    readonly registrationCid: string;
+    readonly delegationCid: string;
+    readonly enforcementDelegationCid: string;
+    readonly envelopeCid: string;
+    readonly policyCid: string;
+    readonly nodeAudience: string;
+    readonly targetOrigin: string;
+    /**
+     * The OpenCredentials witness this delivery is scoped to, sourced from
+     * Node's own trusted credentials origin. Deliberately distinct from
+     * `nodeAudience` (the node's own DID) and `returnOrigin` (Share's page
+     * origin) — conflating any of these three would let a party impersonate
+     * another's audience.
+     */
+    readonly openCredentialsAudience: string;
+    readonly holder: string;
+    readonly recipientMatcher: unknown;
+    readonly deliveryEmail: string;
+    readonly shareUrl: string;
+    readonly returnOrigin: string;
+    readonly documentName: string;
+    readonly senderDid: string;
+    readonly senderTrust: string;
+    readonly contentSource: unknown;
+    readonly contentSourceDigest: string;
+    readonly shareExpiresAt: string;
+    readonly issuedAt: string;
+    readonly reportAbuseToken: string;
+    readonly actions: readonly string[];
+    readonly resource: string;
+    readonly authorityMaterialHandle: string;
+    readonly authorityMaterialDigest: string;
+    readonly requestBodyDigest: string;
+    readonly idempotencyKey: string;
+    readonly expiresAt: string;
+    readonly dataAuthority: false;
+}
+interface ShareDeliveryAuthorizationReceipt {
+    readonly authorization: ShareDeliveryAuthorization;
+    readonly proof: {
+        readonly alg: "EdDSA";
+        readonly kid: string;
+        readonly signature: string;
+    };
+}
+interface ValidateShareDeliveryAuthorizationExpected {
+    readonly request: ShareDeliveryAuthorizationRequest;
+    /** The enrolled receipt key from the node trust bundle. */
+    readonly nodeProof: {
+        readonly kid: string;
+        readonly publicKey: Uint8Array;
+    };
+    /**
+     * The OpenCredentials witness origin the caller trusts, from the same
+     * trust bundle as `nodeProof`. Validated independently of the
+     * authorization's own `nodeAudience`/`returnOrigin` fields so a Node that
+     * mislabels or omits its credentials origin fails closed here rather than
+     * silently inheriting one of those unrelated identities.
+     */
+    readonly credentialsAudience: string;
+}
+/**
+ * Validate the exact UTF-8 response bytes emitted by
+ * `POST /share/v2/deliveries/authorize`, bind them to the submitted
+ * request, and verify the Node's detached EdDSA proof.
+ */
+declare function validateShareDeliveryAuthorizationBytes(bytesValue: Uint8Array, expected: ValidateShareDeliveryAuthorizationExpected): ShareDeliveryAuthorizationReceipt;
+/** Build the trusted-signer descriptor `did:key:...#z...` expects from a raw node signing key. */
+declare function shareDeliveryTrustedKid(publicKey: Uint8Array): string;
+
+/**
+ * The durable record a sender needs, after a reload, to display and manage
+ * a share it created. Every identity/CID here comes verbatim from the
+ * Node-verified {@link OwnerSharePolicyRegistrationReceipt}; nothing is
+ * re-derived or guessed.
+ */
+interface SenderShareRecord {
+    readonly shareId: string;
+    readonly registrationCid: string;
+    readonly policyCid: string;
+    readonly ownerDelegationCid: string;
+    readonly enforcementDelegationCid: string;
+    readonly shareKeyDid: string;
+    readonly ownerDid: string;
+    readonly enforcerDid: string;
+    readonly target: {
+        readonly origin: string;
+        readonly nodeAudience: string;
+        readonly spaceId: string;
+    };
+    readonly resource: {
+        readonly kind: "exact" | "prefix";
+        readonly path: string;
+    };
+    readonly actions: readonly OwnerShareAction[];
+    readonly recipientMatcher: OwnerShareMatcher;
+    readonly registeredAt: string;
+    readonly expiresAt: string;
+    readonly revokedAt?: string;
+}
+/**
+ * "direct" revokes only this share's enforcement delegation. "ancestor"
+ * revokes the owner delegation the share descends from, which transitively
+ * denies every share built on it (see `revocation_in_ancestry` in
+ * `tinycloud-node-server/src/share_v2.rs`). Both are existing CIDs that a
+ * caller passes to the node's generic `tinycloud.delegation/revoke`
+ * invocation (`DelegationManager.revoke` / `TinyCloudNode.revokeDelegation`)
+ * -- there is no share-v2-specific revoke route.
+ */
+type SenderShareRevocationScope = "direct" | "ancestor";
+interface SenderShareRecordStorage {
+    put(record: SenderShareRecord): Promise<void>;
+    list(): Promise<readonly SenderShareRecord[]>;
+    get(shareId: string): Promise<SenderShareRecord | undefined>;
+    delete(shareId: string): Promise<void>;
+}
+interface StoredSenderShareKey {
+    readonly cryptoKey: CryptoKey;
+    readonly publicKey: Uint8Array;
+    readonly extractable: boolean;
+}
+interface SenderShareKeyStorage {
+    put(shareId: string, key: StoredSenderShareKey): Promise<void>;
+    get(shareId: string): Promise<StoredSenderShareKey | undefined>;
+    delete(shareId: string): Promise<void>;
+}
+/** In-memory reference implementation. Real deployments back these with IndexedDB so the non-extractable `CryptoKey` survives a reload via structured clone. */
+declare class MemorySenderShareRecordStorage implements SenderShareRecordStorage {
+    private readonly records;
+    put(record: SenderShareRecord): Promise<void>;
+    list(): Promise<readonly SenderShareRecord[]>;
+    get(shareId: string): Promise<SenderShareRecord | undefined>;
+    delete(shareId: string): Promise<void>;
+}
+declare class MemorySenderShareKeyStorage implements SenderShareKeyStorage {
+    private readonly keys;
+    put(shareId: string, key: StoredSenderShareKey): Promise<void>;
+    get(shareId: string): Promise<StoredSenderShareKey | undefined>;
+    delete(shareId: string): Promise<void>;
+}
+interface SenderShareStoreOptions {
+    readonly records: SenderShareRecordStorage;
+    readonly keys: SenderShareKeyStorage;
+    readonly now?: () => Date;
+}
+/**
+ * Reload-safe sender-side management for shares created through
+ * {@link canonicalOwnerSharePolicy} / `registerOwnerSharePolicy`. Persists
+ * the registration receipt's canonical identity tuple plus the ephemeral
+ * share key's non-extractable `CryptoKey` handle, so a sender can list,
+ * inspect, and revoke shares it created in an earlier session -- without
+ * ever re-exporting private key material.
+ */
+declare class SenderShareStore {
+    private readonly records;
+    private readonly keys;
+    private readonly now;
+    constructor(options: SenderShareStoreOptions);
+    /** Persist a Node-verified registration receipt and its share key handle. */
+    save(receipt: OwnerSharePolicyRegistrationReceipt, key: DelegatedShareKey): Promise<SenderShareRecord>;
+    /** List shares created in any session, most recent first. */
+    list(options?: {
+        readonly includeRevoked?: boolean;
+        readonly includeExpired?: boolean;
+    }): Promise<readonly SenderShareRecord[]>;
+    get(shareId: string): Promise<SenderShareRecord | undefined>;
+    /** Recover a signer for the persisted share key after a reload. */
+    loadKey(shareId: string): Promise<DelegatedShareKey | undefined>;
+    /**
+     * The delegation CID to pass to the node's existing generic
+     * `tinycloud.delegation/revoke` invocation to revoke this share at the
+     * requested scope. Does not itself call the node -- callers invoke
+     * their own `revokeDelegation`/`DelegationManager.revoke` with the
+     * returned CID, then call {@link markRevoked} once that succeeds.
+     */
+    revocationTarget(shareId: string, scope: SenderShareRevocationScope): Promise<string>;
+    /** Mark a share revoked locally after the caller's node-side revoke call succeeds. */
+    markRevoked(shareId: string, revokedAt?: string): Promise<SenderShareRecord>;
+    /** Forget a share and clear its persisted key handle. */
+    remove(shareId: string): Promise<void>;
+}
+
+declare const ShareRecipientTargetSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"exactEmail">;
+    value: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    value: string;
+    kind: "exactEmail";
+}, {
+    value: string;
+    kind: "exactEmail";
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"emailDomain">;
+    value: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    value: string;
+    kind: "emailDomain";
+}, {
+    value: string;
+    kind: "emailDomain";
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"bearer">;
+}, "strict", z.ZodTypeAny, {
+    kind: "bearer";
+}, {
+    kind: "bearer";
+}>]>;
+declare const ShareResourceSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"exact">;
+    path: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    path: string;
+    kind: "exact";
+}, {
+    path: string;
+    kind: "exact";
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"prefix">;
+    path: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    path: string;
+    kind: "prefix";
+}, {
+    path: string;
+    kind: "prefix";
+}>]>;
+declare const ShareActionSchema: z.ZodEnum<["read", "list", "edit"]>;
+declare const ShareRecipientPolicySchema: z.ZodObject<{
+    recipientMatcher: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"exactEmail">;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        kind: "exactEmail";
+    }, {
+        value: string;
+        kind: "exactEmail";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"emailDomain">;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        kind: "emailDomain";
+    }, {
+        value: string;
+        kind: "emailDomain";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"bearer">;
+    }, "strict", z.ZodTypeAny, {
+        kind: "bearer";
+    }, {
+        kind: "bearer";
+    }>]>;
+    spaceId: z.ZodString;
+    resource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        path: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        path: string;
+        kind: "exact";
+    }, {
+        path: string;
+        kind: "exact";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"prefix">;
+        path: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        path: string;
+        kind: "prefix";
+    }, {
+        path: string;
+        kind: "prefix";
+    }>]>;
+    actions: z.ZodArray<z.ZodEnum<["read", "list", "edit"]>, "many">;
+    expiresAt: z.ZodDate;
+}, "strict", z.ZodTypeAny, {
+    actions: ("list" | "read" | "edit")[];
+    expiresAt: Date;
+    resource: {
+        path: string;
+        kind: "exact";
+    } | {
+        path: string;
+        kind: "prefix";
+    };
+    spaceId: string;
+    recipientMatcher: {
+        value: string;
+        kind: "exactEmail";
+    } | {
+        value: string;
+        kind: "emailDomain";
+    } | {
+        kind: "bearer";
+    };
+}, {
+    actions: ("list" | "read" | "edit")[];
+    expiresAt: Date;
+    resource: {
+        path: string;
+        kind: "exact";
+    } | {
+        path: string;
+        kind: "prefix";
+    };
+    spaceId: string;
+    recipientMatcher: {
+        value: string;
+        kind: "exactEmail";
+    } | {
+        value: string;
+        kind: "emailDomain";
+    } | {
+        kind: "bearer";
+    };
+}>;
+declare const ShareRecipientClientOptionsSchema: z.ZodObject<{
+    trustedOrigins: z.ZodArray<z.ZodString, "many">;
+    maxInlineBytes: z.ZodOptional<z.ZodNumber>;
+    maxArtifactBytes: z.ZodOptional<z.ZodNumber>;
+    maxContentBytes: z.ZodOptional<z.ZodNumber>;
+    maxSealedContentBytes: z.ZodOptional<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    trustedOrigins: string[];
+    maxContentBytes?: number | undefined;
+    maxInlineBytes?: number | undefined;
+    maxArtifactBytes?: number | undefined;
+    maxSealedContentBytes?: number | undefined;
+}, {
+    trustedOrigins: string[];
+    maxContentBytes?: number | undefined;
+    maxInlineBytes?: number | undefined;
+    maxArtifactBytes?: number | undefined;
+    maxSealedContentBytes?: number | undefined;
+}>;
+declare const ShareAddressedDelegationRequestV2Schema: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    nonce: z.ZodString;
+    jti: z.ZodString;
+    senderDid: z.ZodString;
+    recipientMatcher: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"exactEmail">;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        kind: "exactEmail";
+    }, {
+        value: string;
+        kind: "exactEmail";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"emailDomain">;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        kind: "emailDomain";
+    }, {
+        value: string;
+        kind: "emailDomain";
+    }>]>;
+    targetOrigin: z.ZodString;
+    nodeAudience: z.ZodString;
+    shareCid: z.ZodString;
+    shareId: z.ZodString;
+    delegationCid: z.ZodString;
+    authorityMaterialHandle: z.ZodString;
+    authorityMaterialDigest: z.ZodString;
+    contentSource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"kv">;
+        action: z.ZodEnum<["tinycloud.kv/get", "tinycloud.kv/metadata", "tinycloud.kv/list", "tinycloud.kv/put"]>;
+        space: z.ZodString;
+        path: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        path: string;
+        space: string;
+        action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
+        kind: "kv";
+    }, {
+        path: string;
+        space: string;
+        action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
+        kind: "kv";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"sql">;
+        action: z.ZodLiteral<"tinycloud.sql/read">;
+        space: z.ZodString;
+        database: z.ZodString;
+        path: z.ZodString;
+        statement: z.ZodString;
+        arguments: z.ZodRecord<z.ZodString, z.ZodNumber>;
+        argumentsDigest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        path: string;
+        statement: string;
+        space: string;
+        action: "tinycloud.sql/read";
+        kind: "sql";
+        database: string;
+        arguments: Record<string, number>;
+        argumentsDigest: string;
+    }, {
+        path: string;
+        statement: string;
+        space: string;
+        action: "tinycloud.sql/read";
+        kind: "sql";
+        database: string;
+        arguments: Record<string, number>;
+        argumentsDigest: string;
+    }>]>;
+    contentSourceDigest: z.ZodString;
+    actions: z.ZodEffects<z.ZodArray<z.ZodEnum<["tinycloud.kv/get", "tinycloud.kv/metadata", "tinycloud.kv/list", "tinycloud.kv/put", "tinycloud.sql/read"]>, "many">, ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[], ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[]>;
+    resource: z.ZodObject<{
+        kind: z.ZodEnum<["exact", "prefix"]>;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        kind: "exact" | "prefix";
+    }, {
+        value: string;
+        kind: "exact" | "prefix";
+    }>;
+    expiresAt: z.ZodString;
+    requestBodyDigest: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    nonce: string;
+    actions: ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[];
+    expiresAt: string;
+    resource: {
+        value: string;
+        kind: "exact" | "prefix";
+    };
+    version: 2;
+    shareId: string;
+    recipientMatcher: {
+        value: string;
+        kind: "exactEmail";
+    } | {
+        value: string;
+        kind: "emailDomain";
+    };
+    nodeAudience: string;
+    contentSource: {
+        path: string;
+        space: string;
+        action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
+        kind: "kv";
+    } | {
+        path: string;
+        statement: string;
+        space: string;
+        action: "tinycloud.sql/read";
+        kind: "sql";
+        database: string;
+        arguments: Record<string, number>;
+        argumentsDigest: string;
+    };
+    contentSourceDigest: string;
+    jti: string;
+    senderDid: string;
+    targetOrigin: string;
+    shareCid: string;
+    delegationCid: string;
+    authorityMaterialHandle: string;
+    authorityMaterialDigest: string;
+    requestBodyDigest: string;
+}, {
+    nonce: string;
+    actions: ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[];
+    expiresAt: string;
+    resource: {
+        value: string;
+        kind: "exact" | "prefix";
+    };
+    version: 2;
+    shareId: string;
+    recipientMatcher: {
+        value: string;
+        kind: "exactEmail";
+    } | {
+        value: string;
+        kind: "emailDomain";
+    };
+    nodeAudience: string;
+    contentSource: {
+        path: string;
+        space: string;
+        action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
+        kind: "kv";
+    } | {
+        path: string;
+        statement: string;
+        space: string;
+        action: "tinycloud.sql/read";
+        kind: "sql";
+        database: string;
+        arguments: Record<string, number>;
+        argumentsDigest: string;
+    };
+    contentSourceDigest: string;
+    jti: string;
+    senderDid: string;
+    targetOrigin: string;
+    shareCid: string;
+    delegationCid: string;
+    authorityMaterialHandle: string;
+    authorityMaterialDigest: string;
+    requestBodyDigest: string;
+}>;
+declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
+    request: z.ZodObject<{
+        version: z.ZodLiteral<2>;
+        nonce: z.ZodString;
+        jti: z.ZodString;
+        senderDid: z.ZodString;
+        recipientMatcher: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"exactEmail">;
+            value: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            value: string;
+            kind: "exactEmail";
+        }, {
+            value: string;
+            kind: "exactEmail";
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"emailDomain">;
+            value: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            value: string;
+            kind: "emailDomain";
+        }, {
+            value: string;
+            kind: "emailDomain";
+        }>]>;
+        targetOrigin: z.ZodString;
+        nodeAudience: z.ZodString;
+        shareCid: z.ZodString;
+        shareId: z.ZodString;
+        delegationCid: z.ZodString;
+        authorityMaterialHandle: z.ZodString;
+        authorityMaterialDigest: z.ZodString;
+        contentSource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"kv">;
+            action: z.ZodEnum<["tinycloud.kv/get", "tinycloud.kv/metadata", "tinycloud.kv/list", "tinycloud.kv/put"]>;
+            space: z.ZodString;
+            path: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            path: string;
+            space: string;
+            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
+            kind: "kv";
+        }, {
+            path: string;
+            space: string;
+            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
+            kind: "kv";
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"sql">;
+            action: z.ZodLiteral<"tinycloud.sql/read">;
+            space: z.ZodString;
+            database: z.ZodString;
+            path: z.ZodString;
+            statement: z.ZodString;
+            arguments: z.ZodRecord<z.ZodString, z.ZodNumber>;
+            argumentsDigest: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            path: string;
+            statement: string;
+            space: string;
+            action: "tinycloud.sql/read";
+            kind: "sql";
+            database: string;
+            arguments: Record<string, number>;
+            argumentsDigest: string;
+        }, {
+            path: string;
+            statement: string;
+            space: string;
+            action: "tinycloud.sql/read";
+            kind: "sql";
+            database: string;
+            arguments: Record<string, number>;
+            argumentsDigest: string;
+        }>]>;
+        contentSourceDigest: z.ZodString;
+        actions: z.ZodEffects<z.ZodArray<z.ZodEnum<["tinycloud.kv/get", "tinycloud.kv/metadata", "tinycloud.kv/list", "tinycloud.kv/put", "tinycloud.sql/read"]>, "many">, ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[], ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[]>;
+        resource: z.ZodObject<{
+            kind: z.ZodEnum<["exact", "prefix"]>;
+            value: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            value: string;
+            kind: "exact" | "prefix";
+        }, {
+            value: string;
+            kind: "exact" | "prefix";
+        }>;
+        expiresAt: z.ZodString;
+        requestBodyDigest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        nonce: string;
+        actions: ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[];
+        expiresAt: string;
+        resource: {
+            value: string;
+            kind: "exact" | "prefix";
+        };
+        version: 2;
+        shareId: string;
+        recipientMatcher: {
+            value: string;
+            kind: "exactEmail";
+        } | {
+            value: string;
+            kind: "emailDomain";
+        };
+        nodeAudience: string;
+        contentSource: {
+            path: string;
+            space: string;
+            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
+            kind: "kv";
+        } | {
+            path: string;
+            statement: string;
+            space: string;
+            action: "tinycloud.sql/read";
+            kind: "sql";
+            database: string;
+            arguments: Record<string, number>;
+            argumentsDigest: string;
+        };
+        contentSourceDigest: string;
+        jti: string;
+        senderDid: string;
+        targetOrigin: string;
+        shareCid: string;
+        delegationCid: string;
+        authorityMaterialHandle: string;
+        authorityMaterialDigest: string;
+        requestBodyDigest: string;
+    }, {
+        nonce: string;
+        actions: ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[];
+        expiresAt: string;
+        resource: {
+            value: string;
+            kind: "exact" | "prefix";
+        };
+        version: 2;
+        shareId: string;
+        recipientMatcher: {
+            value: string;
+            kind: "exactEmail";
+        } | {
+            value: string;
+            kind: "emailDomain";
+        };
+        nodeAudience: string;
+        contentSource: {
+            path: string;
+            space: string;
+            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
+            kind: "kv";
+        } | {
+            path: string;
+            statement: string;
+            space: string;
+            action: "tinycloud.sql/read";
+            kind: "sql";
+            database: string;
+            arguments: Record<string, number>;
+            argumentsDigest: string;
+        };
+        contentSourceDigest: string;
+        jti: string;
+        senderDid: string;
+        targetOrigin: string;
+        shareCid: string;
+        delegationCid: string;
+        authorityMaterialHandle: string;
+        authorityMaterialDigest: string;
+        requestBodyDigest: string;
+    }>;
+    proof: z.ZodObject<{
+        alg: z.ZodLiteral<"EdDSA">;
+        kid: z.ZodString;
+        signature: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        signature: string;
+        kid: string;
+        alg: "EdDSA";
+    }, {
+        signature: string;
+        kid: string;
+        alg: "EdDSA";
+    }>;
+}, "strict", z.ZodTypeAny, {
+    request: {
+        nonce: string;
+        actions: ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[];
+        expiresAt: string;
+        resource: {
+            value: string;
+            kind: "exact" | "prefix";
+        };
+        version: 2;
+        shareId: string;
+        recipientMatcher: {
+            value: string;
+            kind: "exactEmail";
+        } | {
+            value: string;
+            kind: "emailDomain";
+        };
+        nodeAudience: string;
+        contentSource: {
+            path: string;
+            space: string;
+            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
+            kind: "kv";
+        } | {
+            path: string;
+            statement: string;
+            space: string;
+            action: "tinycloud.sql/read";
+            kind: "sql";
+            database: string;
+            arguments: Record<string, number>;
+            argumentsDigest: string;
+        };
+        contentSourceDigest: string;
+        jti: string;
+        senderDid: string;
+        targetOrigin: string;
+        shareCid: string;
+        delegationCid: string;
+        authorityMaterialHandle: string;
+        authorityMaterialDigest: string;
+        requestBodyDigest: string;
+    };
+    proof: {
+        signature: string;
+        kid: string;
+        alg: "EdDSA";
+    };
+}, {
+    request: {
+        nonce: string;
+        actions: ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[];
+        expiresAt: string;
+        resource: {
+            value: string;
+            kind: "exact" | "prefix";
+        };
+        version: 2;
+        shareId: string;
+        recipientMatcher: {
+            value: string;
+            kind: "exactEmail";
+        } | {
+            value: string;
+            kind: "emailDomain";
+        };
+        nodeAudience: string;
+        contentSource: {
+            path: string;
+            space: string;
+            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
+            kind: "kv";
+        } | {
+            path: string;
+            statement: string;
+            space: string;
+            action: "tinycloud.sql/read";
+            kind: "sql";
+            database: string;
+            arguments: Record<string, number>;
+            argumentsDigest: string;
+        };
+        contentSourceDigest: string;
+        jti: string;
+        senderDid: string;
+        targetOrigin: string;
+        shareCid: string;
+        delegationCid: string;
+        authorityMaterialHandle: string;
+        authorityMaterialDigest: string;
+        requestBodyDigest: string;
+    };
+    proof: {
+        signature: string;
+        kid: string;
+        alg: "EdDSA";
+    };
+}>;
+declare const ShareAddressedDelegationResponseV2Schema: z.ZodObject<{
+    type: z.ZodLiteral<"TinyCloudShareAddressedDelegation">;
+    version: z.ZodLiteral<2>;
+    nonce: z.ZodString;
+    jti: z.ZodString;
+    policyCid: z.ZodString;
+    policyBytes: z.ZodString;
+    policyDigest: z.ZodString;
+    delegationCid: z.ZodString;
+    delegationBytes: z.ZodString;
+    delegationDigest: z.ZodString;
+    authorityMaterialHandle: z.ZodString;
+    authorityMaterialDigest: z.ZodString;
+    actions: z.ZodEffects<z.ZodArray<z.ZodEnum<["tinycloud.kv/get", "tinycloud.kv/metadata", "tinycloud.kv/list", "tinycloud.kv/put", "tinycloud.sql/read"]>, "many">, ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[], ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[]>;
+    resource: z.ZodObject<{
+        kind: z.ZodEnum<["exact", "prefix"]>;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        kind: "exact" | "prefix";
+    }, {
+        value: string;
+        kind: "exact" | "prefix";
+    }>;
+    expiresAt: z.ZodString;
+    proof: z.ZodObject<{
+        alg: z.ZodLiteral<"EdDSA">;
+        kid: z.ZodString;
+        signature: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        signature: string;
+        kid: string;
+        alg: "EdDSA";
+    }, {
+        signature: string;
+        kid: string;
+        alg: "EdDSA";
+    }>;
+}, "strict", z.ZodTypeAny, {
+    type: "TinyCloudShareAddressedDelegation";
+    nonce: string;
+    actions: ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[];
+    expiresAt: string;
+    resource: {
+        value: string;
+        kind: "exact" | "prefix";
+    };
+    version: 2;
+    policyCid: string;
+    policyBytes: string;
+    jti: string;
+    delegationCid: string;
+    authorityMaterialHandle: string;
+    authorityMaterialDigest: string;
+    proof: {
+        signature: string;
+        kid: string;
+        alg: "EdDSA";
+    };
+    policyDigest: string;
+    delegationBytes: string;
+    delegationDigest: string;
+}, {
+    type: "TinyCloudShareAddressedDelegation";
+    nonce: string;
+    actions: ("tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.sql/read")[];
+    expiresAt: string;
+    resource: {
+        value: string;
+        kind: "exact" | "prefix";
+    };
+    version: 2;
+    policyCid: string;
+    policyBytes: string;
+    jti: string;
+    delegationCid: string;
+    authorityMaterialHandle: string;
+    authorityMaterialDigest: string;
+    proof: {
+        signature: string;
+        kid: string;
+        alg: "EdDSA";
+    };
+    policyDigest: string;
+    delegationBytes: string;
+    delegationDigest: string;
+}>;
+declare const ShareNativeResponseSchema: z.ZodDiscriminatedUnion<"action", [z.ZodObject<{
+    action: z.ZodLiteral<"tinycloud.kv/metadata">;
+    metadata: z.ZodRecord<z.ZodString, z.ZodString>;
+    etag: z.ZodNullable<z.ZodString>;
+    type: z.ZodLiteral<"TinyCloudShareInvokeResponse">;
+    version: z.ZodLiteral<2>;
+    resource: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "TinyCloudShareInvokeResponse";
+    metadata: Record<string, string>;
+    resource: string;
+    action: "tinycloud.kv/metadata";
+    version: 2;
+    etag: string | null;
+}, {
+    type: "TinyCloudShareInvokeResponse";
+    metadata: Record<string, string>;
+    resource: string;
+    action: "tinycloud.kv/metadata";
+    version: 2;
+    etag: string | null;
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"tinycloud.kv/get">;
+    mediaType: z.ZodString;
+    content: z.ZodString;
+    bodyDigest: z.ZodString;
+    etag: z.ZodNullable<z.ZodString>;
+    type: z.ZodLiteral<"TinyCloudShareInvokeResponse">;
+    version: z.ZodLiteral<2>;
+    resource: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "TinyCloudShareInvokeResponse";
+    resource: string;
+    action: "tinycloud.kv/get";
+    version: 2;
+    content: string;
+    etag: string | null;
+    mediaType: string;
+    bodyDigest: string;
+}, {
+    type: "TinyCloudShareInvokeResponse";
+    resource: string;
+    action: "tinycloud.kv/get";
+    version: 2;
+    content: string;
+    etag: string | null;
+    mediaType: string;
+    bodyDigest: string;
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"tinycloud.kv/list">;
+    entries: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        kind: z.ZodEnum<["file", "folder"]>;
+    }, "strict", z.ZodTypeAny, {
+        path: string;
+        kind: "folder" | "file";
+    }, {
+        path: string;
+        kind: "folder" | "file";
+    }>, "many">;
+    nextCursor: z.ZodNullable<z.ZodString>;
+    type: z.ZodLiteral<"TinyCloudShareInvokeResponse">;
+    version: z.ZodLiteral<2>;
+    resource: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "TinyCloudShareInvokeResponse";
+    entries: {
+        path: string;
+        kind: "folder" | "file";
+    }[];
+    resource: string;
+    action: "tinycloud.kv/list";
+    nextCursor: string | null;
+    version: 2;
+}, {
+    type: "TinyCloudShareInvokeResponse";
+    entries: {
+        path: string;
+        kind: "folder" | "file";
+    }[];
+    resource: string;
+    action: "tinycloud.kv/list";
+    nextCursor: string | null;
+    version: 2;
+}>, z.ZodObject<{
+    action: z.ZodLiteral<"tinycloud.kv/put">;
+    etag: z.ZodString;
+    bodyDigest: z.ZodString;
+    contentType: z.ZodString;
+    type: z.ZodLiteral<"TinyCloudShareInvokeResponse">;
+    version: z.ZodLiteral<2>;
+    resource: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "TinyCloudShareInvokeResponse";
+    resource: string;
+    action: "tinycloud.kv/put";
+    version: 2;
+    etag: string;
+    bodyDigest: string;
+    contentType: string;
+}, {
+    type: "TinyCloudShareInvokeResponse";
+    resource: string;
+    action: "tinycloud.kv/put";
+    version: 2;
+    etag: string;
+    bodyDigest: string;
+    contentType: string;
+}>]>;
+type ShareNativeResponse = z.infer<typeof ShareNativeResponseSchema>;
+
+export { type SenderShareKeyStorage as $, type AccountDelegationPage as A, type KeyProvider as B, type CapabilityEntry as C, DelegationManager as D, type EncodedShareData as E, type KeyType as F, type GenerateShareParams as G, MAX_SEALED_SHARE_CONTENT_BYTES as H, type ICapabilityKeyRegistry as I, type JWK as J, type KeyInfo as K, MAX_SHARE_ARTIFACT_BYTES as L, MAX_CONTENT_BYTES as M, MAX_SHARE_CONTENT_BYTES as N, MemorySenderShareKeyStorage as O, MemorySenderShareRecordStorage as P, MemoryShareCache as Q, type Result as R, type OwnerDelegationReceipt as S, type OwnerShareAction as T, type OwnerShareMatcher as U, type OwnerSharePolicyRegistration as V, type OwnerSharePolicyRegistrationReceipt as W, type OwnerSharePolicyV2 as X, type ReceiveOptions as Y, type RegisterOwnerSharePolicyParams as Z, SHARE_DELIVERY_AUTHORIZATION_DOMAIN as _, type DelegationError as a, type ShareResource as a$, type SenderShareRecord as a0, type SenderShareRecordStorage as a1, type SenderShareRevocationScope as a2, SenderShareStore as a3, type ShareAccess as a4, ShareAccessError as a5, type ShareAccessV2 as a6, type ShareAction as a7, ShareActionSchema as a8, type ShareAddressedDelegationEnvelopeV2 as a9, type ShareLinkData as aA, type ShareLinkLocation as aB, type ShareListEntry as aC, type ShareListResult as aD, type ShareNativeAction as aE, type ShareNativeInvokeEnvelopeV1 as aF, type ShareNativeInvokeErrorResult as aG, type ShareNativeInvokeInput as aH, type ShareNativeInvokeResult as aI, type ShareNativeInvokeSuccessResult as aJ, type ShareNativeResponse as aK, ShareNativeResponseSchema as aL, type SharePolicy as aM, type SharePolicyBinding as aN, type SharePolicySession as aO, type SharePolicySessionV1 as aP, type SharePolicySessionWireV1 as aQ, type ShareReadInvocationV1 as aR, type ShareReadResult as aS, ShareRecipientClient as aT, type ShareRecipientClientOptions as aU, ShareRecipientClientOptionsSchema as aV, type ShareRecipientPolicy as aW, ShareRecipientPolicySchema as aX, type ShareRecipientResult as aY, type ShareRecipientTarget as aZ, ShareRecipientTargetSchema as a_, ShareAddressedDelegationEnvelopeV2Schema as aa, type ShareAddressedDelegationRequestV2 as ab, ShareAddressedDelegationRequestV2Schema as ac, type ShareAddressedDelegationResponseV2 as ad, ShareAddressedDelegationResponseV2Schema as ae, type ShareAddressedRecipientMatcher as af, type ShareArtifactInput as ag, type ShareArtifactResult as ah, type ShareArtifactV2 as ai, type ShareCache as aj, type ShareCacheEntry as ak, type ShareCacheKey as al, type ShareCacheMetadata as am, type ShareCapabilityLike as an, ShareConflict as ao, type ShareContentMetadata as ap, type ShareContentSource as aq, type ShareDeliveryAuthorization as ar, type ShareDeliveryAuthorizationReceipt as as, type ShareDeliveryAuthorizationRequest as at, type ShareDetachedProof as au, ShareEnvelopeError as av, type ShareEnvelopeV2 as aw, type ShareExpiryBounds as ax, type ShareKvContentSource as ay, type ShareLink as az, type AccountDelegationQueryOptions as b, ShareResourceSchema as b0, type ShareSaveOptions as b1, type ShareSchema as b2, type ShareSqlContentSource as b3, type ShareWireAction as b4, SharingService as b5, type SharingServiceConfig as b6, type SignedDelegation as b7, type SpaceInfo as b8, type SpaceOwnership as b9, shareDeliveryTrustedKid as bA, signShareEnvelope as bB, validateOwnerSharePolicyRegistration as bC, validateOwnerSharePolicyRegistrationBytes as bD, validateShareDeliveryAuthorizationBytes as bE, verifyShareCid as bF, verifyShareEnvelope as bG, CapabilityKeyRegistry as bH, type CapabilityKeyRegistryErrorCode as bI, CapabilityKeyRegistryErrorCodes as bJ, type StoredDelegationChain as bK, createCapabilityKeyRegistry as bL, type ValidateShareDeliveryAuthorizationExpected as ba, type VerifyShareEnvelopeOptions as bb, canonicalOwnerSharePolicy as bc, computeOwnerShareRegistrationCid as bd, computeShareCid as be, createDelegatedShareKey as bf, createPolicyEnforcementDelegation as bg, createShareArtifact as bh, createShareArtifactAsync as bi, createSharePolicy as bj, createSharingService as bk, decryptShareBytesAsync as bl, encodeInlineShareUrl as bm, encodeShareArtifact as bn, encodeShareUrl as bo, encryptShareBytes as bp, encryptShareBytesAsync as bq, intersectShareCapabilities as br, isV2ShareLink as bs, normalizeShareActions as bt, normalizeShareRecipientTarget as bu, normalizeShareResource as bv, parseShareArtifact as bw, parseShareUrl as bx, restoreDelegatedShareKey as by, shareCapabilityAllows as bz, type AccountDelegationRecord as c, type AccountDelegationResource as d, type CreateDelegationParams as e, type CreateDelegationWasmParams as f, type CreateDelegationWasmResult as g, type CreateOwnerDelegationParams as h, type DelegateReceivedShareParams as i, type DelegatedResource as j, type DelegatedShareAccess as k, type DelegatedShareKey as l, type Delegation as m, type DelegationApiResponse as n, type DelegationChain as o, type DelegationChainV2 as p, type DelegationDirection as q, type DelegationErrorCode as r, DelegationErrorCodes as s, type DelegationFilters as t, type DelegationManagerConfig as u, type DelegationRecord as v, type DelegationRevocationReceipt as w, type DelegationStatus as x, type ISharingService as y, type IngestOptions as z };