@tinycloud/sdk-core 2.11.0-beta.0 → 2.11.0-beta.10

package/dist/{recipient-types.schema-B2wH53_t.d.cts → recipient-types.schema-D5pDlIqn.d.cts}

@@ -2259,6 +2259,9 @@ type ShareRecipientTarget = {
 } | {
     readonly kind: "emailDomain";
     readonly value: string;
+} | {
+    readonly kind: "recipientDid";
+    readonly value: string;
 } | {
     readonly kind: "bearer";
 };
@@ -2536,6 +2539,19 @@ interface ShareRecipientClientOptions {
         readonly envelope: ShareEnvelopeV2;
         readonly presentation?: unknown;
     }) => Promise<SharePolicySession>;
+    /** Direct DID authorization is explicit and may return a resumable device step. */
+    readonly establishRecipientDidSession?: (input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly recipientDid: string;
+    }) => Promise<SharePolicySession | {
+        readonly state: "authorization-required";
+        readonly method: "openkey-device";
+        readonly continueUrl?: string;
+        readonly resumeToken: string;
+    } | {
+        readonly state: "denied";
+        readonly reason: string;
+    }>;
     /**
      * Builds the holder presentation/session request after Node returns a
      * fresh challenge.  The callback is deliberately invoked only after the
@@ -2740,7 +2756,8 @@ declare class ShareConflict extends Error {
 }
 declare class ShareAccessError extends Error {
     readonly code: string;
-    constructor(code: string, message?: string);
+    readonly details?: unknown;
+    constructor(code: string, message?: string, details?: unknown);
 }
 interface ShareAccessV2 {
     readonly kind: "share-v2";
@@ -3229,22 +3246,52 @@ interface OwnerDelegationReceipt {
         readonly actions: readonly string[];
         readonly expiry: Date;
     };
+    /** Exact service-scoped capabilities encoded in the signed owner delegation. */
+    readonly permissions: readonly OwnerDelegationPermission[];
 }
-interface CreateOwnerDelegationParams {
-    readonly delegateDid: string;
-    readonly spaceId: string;
+interface OwnerDelegationPermission {
+    /** Canonical long-form service name, for example `tinycloud.kv`. */
+    readonly service: string;
+    /** Exact service resource path. Encryption permissions use a network URN. */
     readonly path: string;
+    /** Canonical full action URNs belonging to `service`. */
     readonly actions: readonly string[];
+}
+interface CreateOwnerDelegationBase {
+    readonly delegateDid: string;
+    readonly spaceId: string;
     readonly expiresAt: Date;
 }
+/**
+ * A wallet-rooted owner delegation accepts either the historical single-path
+ * shape or an exact list of service-scoped permissions. The two forms are
+ * mutually exclusive so callers cannot sign authority from one field while
+ * displaying or persisting a contradictory second field.
+ */
+type CreateOwnerDelegationParams = CreateOwnerDelegationBase & ({
+    readonly path: string;
+    readonly actions: readonly string[];
+    readonly permissions?: never;
+} | {
+    readonly permissions: readonly OwnerDelegationPermission[];
+    readonly path?: never;
+    readonly actions?: never;
+});
 declare const MAX_CONTENT_BYTES: number;
 type OwnerShareAction = "tinycloud.kv/get" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.kv/put";
+interface OwnerShareDecryption {
+    readonly networkId: string;
+    readonly action: "tinycloud.encryption/decrypt";
+}
 type OwnerShareMatcher = {
     readonly kind: "exactEmail";
     readonly value: string;
 } | {
     readonly kind: "emailDomain";
     readonly value: string;
+} | {
+    readonly kind: "recipientDid";
+    readonly value: string;
 };
 interface OwnerSharePolicyV2 {
     readonly type: "TinyCloudSharePolicy";
@@ -3264,6 +3311,7 @@ interface OwnerSharePolicyV2 {
         readonly path: string;
     };
     readonly actions: readonly OwnerShareAction[];
+    readonly decryption?: OwnerShareDecryption;
     readonly contentSource: {
         readonly kind: "kv";
         readonly space: string;
@@ -3331,6 +3379,7 @@ interface OwnerSharePolicyRegistration {
         readonly path: string;
     };
     readonly actions: readonly OwnerShareAction[];
+    readonly decryption?: OwnerShareDecryption;
     readonly contentSource: {
         readonly kind: "kv";
         readonly space: string;
@@ -3374,6 +3423,7 @@ declare function createPolicyEnforcementDelegation(input: {
     readonly nodeAudience: string;
     readonly path: string;
     readonly actions: readonly OwnerShareAction[];
+    readonly decryption?: OwnerShareDecryption;
     readonly contentSourceDigest: string;
     readonly expiresAt: string;
 }): Promise<SignedDelegation>;
@@ -3402,6 +3452,7 @@ interface ShareDeliveryAuthorizationRequest {
     readonly shareUrl: string;
     readonly documentName: string;
     readonly jti: string;
+    readonly idempotencyKey: string;
     readonly expiresAt: string;
     readonly requestBodyDigest: string;
 }
@@ -3612,6 +3663,15 @@ declare const ShareRecipientTargetSchema: z.ZodDiscriminatedUnion<"kind", [z.Zod
 }, {
     value: string;
     kind: "emailDomain";
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"recipientDid">;
+    value: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    value: string;
+    kind: "recipientDid";
+}, {
+    value: string;
+    kind: "recipientDid";
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"bearer">;
 }, "strict", z.ZodTypeAny, {
@@ -3658,6 +3718,15 @@ declare const ShareRecipientPolicySchema: z.ZodObject<{
     }, {
         value: string;
         kind: "emailDomain";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"recipientDid">;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        kind: "recipientDid";
+    }, {
+        value: string;
+        kind: "recipientDid";
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"bearer">;
     }, "strict", z.ZodTypeAny, {
@@ -3704,6 +3773,9 @@ declare const ShareRecipientPolicySchema: z.ZodObject<{
     } | {
         value: string;
         kind: "emailDomain";
+    } | {
+        value: string;
+        kind: "recipientDid";
     } | {
         kind: "bearer";
     };
@@ -3724,6 +3796,9 @@ declare const ShareRecipientPolicySchema: z.ZodObject<{
     } | {
         value: string;
         kind: "emailDomain";
+    } | {
+        value: string;
+        kind: "recipientDid";
     } | {
         kind: "bearer";
     };
@@ -3770,6 +3845,15 @@ declare const ShareAddressedDelegationRequestV2Schema: z.ZodObject<{
     }, {
         value: string;
         kind: "emailDomain";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"recipientDid">;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        kind: "recipientDid";
+    }, {
+        value: string;
+        kind: "recipientDid";
     }>]>;
     targetOrigin: z.ZodString;
     nodeAudience: z.ZodString;
@@ -3851,6 +3935,9 @@ declare const ShareAddressedDelegationRequestV2Schema: z.ZodObject<{
     } | {
         value: string;
         kind: "emailDomain";
+    } | {
+        value: string;
+        kind: "recipientDid";
     };
     nodeAudience: string;
     contentSource: {
@@ -3893,6 +3980,9 @@ declare const ShareAddressedDelegationRequestV2Schema: z.ZodObject<{
     } | {
         value: string;
         kind: "emailDomain";
+    } | {
+        value: string;
+        kind: "recipientDid";
     };
     nodeAudience: string;
     contentSource: {
@@ -3944,6 +4034,15 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
         }, {
             value: string;
             kind: "emailDomain";
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"recipientDid">;
+            value: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            value: string;
+            kind: "recipientDid";
+        }, {
+            value: string;
+            kind: "recipientDid";
         }>]>;
         targetOrigin: z.ZodString;
         nodeAudience: z.ZodString;
@@ -4025,6 +4124,9 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
         } | {
             value: string;
             kind: "emailDomain";
+        } | {
+            value: string;
+            kind: "recipientDid";
         };
         nodeAudience: string;
         contentSource: {
@@ -4067,6 +4169,9 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
         } | {
             value: string;
             kind: "emailDomain";
+        } | {
+            value: string;
+            kind: "recipientDid";
         };
         nodeAudience: string;
         contentSource: {
@@ -4124,6 +4229,9 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
         } | {
             value: string;
             kind: "emailDomain";
+        } | {
+            value: string;
+            kind: "recipientDid";
         };
         nodeAudience: string;
         contentSource: {
@@ -4173,6 +4281,9 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
         } | {
             value: string;
             kind: "emailDomain";
+        } | {
+            value: string;
+            kind: "recipientDid";
         };
         nodeAudience: string;
         contentSource: {
@@ -4404,4 +4515,4 @@ declare const ShareNativeResponseSchema: z.ZodDiscriminatedUnion<"action", [z.Zo
 }>]>;
 type ShareNativeResponse = z.infer<typeof ShareNativeResponseSchema>;
 
-export { type SenderShareKeyStorage as $, type AccountDelegationPage as A, type KeyProvider as B, type CapabilityEntry as C, DelegationManager as D, type EncodedShareData as E, type KeyType as F, type GenerateShareParams as G, MAX_SEALED_SHARE_CONTENT_BYTES as H, type ICapabilityKeyRegistry as I, type JWK as J, type KeyInfo as K, MAX_SHARE_ARTIFACT_BYTES as L, MAX_CONTENT_BYTES as M, MAX_SHARE_CONTENT_BYTES as N, MemorySenderShareKeyStorage as O, MemorySenderShareRecordStorage as P, MemoryShareCache as Q, type Result as R, type OwnerDelegationReceipt as S, type OwnerShareAction as T, type OwnerShareMatcher as U, type OwnerSharePolicyRegistration as V, type OwnerSharePolicyRegistrationReceipt as W, type OwnerSharePolicyV2 as X, type ReceiveOptions as Y, type RegisterOwnerSharePolicyParams as Z, SHARE_DELIVERY_AUTHORIZATION_DOMAIN as _, type DelegationError as a, type ShareResource as a$, type SenderShareRecord as a0, type SenderShareRecordStorage as a1, type SenderShareRevocationScope as a2, SenderShareStore as a3, type ShareAccess as a4, ShareAccessError as a5, type ShareAccessV2 as a6, type ShareAction as a7, ShareActionSchema as a8, type ShareAddressedDelegationEnvelopeV2 as a9, type ShareLinkData as aA, type ShareLinkLocation as aB, type ShareListEntry as aC, type ShareListResult as aD, type ShareNativeAction as aE, type ShareNativeInvokeEnvelopeV1 as aF, type ShareNativeInvokeErrorResult as aG, type ShareNativeInvokeInput as aH, type ShareNativeInvokeResult as aI, type ShareNativeInvokeSuccessResult as aJ, type ShareNativeResponse as aK, ShareNativeResponseSchema as aL, type SharePolicy as aM, type SharePolicyBinding as aN, type SharePolicySession as aO, type SharePolicySessionV1 as aP, type SharePolicySessionWireV1 as aQ, type ShareReadInvocationV1 as aR, type ShareReadResult as aS, ShareRecipientClient as aT, type ShareRecipientClientOptions as aU, ShareRecipientClientOptionsSchema as aV, type ShareRecipientPolicy as aW, ShareRecipientPolicySchema as aX, type ShareRecipientResult as aY, type ShareRecipientTarget as aZ, ShareRecipientTargetSchema as a_, ShareAddressedDelegationEnvelopeV2Schema as aa, type ShareAddressedDelegationRequestV2 as ab, ShareAddressedDelegationRequestV2Schema as ac, type ShareAddressedDelegationResponseV2 as ad, ShareAddressedDelegationResponseV2Schema as ae, type ShareAddressedRecipientMatcher as af, type ShareArtifactInput as ag, type ShareArtifactResult as ah, type ShareArtifactV2 as ai, type ShareCache as aj, type ShareCacheEntry as ak, type ShareCacheKey as al, type ShareCacheMetadata as am, type ShareCapabilityLike as an, ShareConflict as ao, type ShareContentMetadata as ap, type ShareContentSource as aq, type ShareDeliveryAuthorization as ar, type ShareDeliveryAuthorizationReceipt as as, type ShareDeliveryAuthorizationRequest as at, type ShareDetachedProof as au, ShareEnvelopeError as av, type ShareEnvelopeV2 as aw, type ShareExpiryBounds as ax, type ShareKvContentSource as ay, type ShareLink as az, type AccountDelegationQueryOptions as b, ShareResourceSchema as b0, type ShareSaveOptions as b1, type ShareSchema as b2, type ShareSqlContentSource as b3, type ShareWireAction as b4, SharingService as b5, type SharingServiceConfig as b6, type SignedDelegation as b7, type SpaceInfo as b8, type SpaceOwnership as b9, shareDeliveryTrustedKid as bA, signShareEnvelope as bB, validateOwnerSharePolicyRegistration as bC, validateOwnerSharePolicyRegistrationBytes as bD, validateShareDeliveryAuthorizationBytes as bE, verifyShareCid as bF, verifyShareEnvelope as bG, CapabilityKeyRegistry as bH, type CapabilityKeyRegistryErrorCode as bI, CapabilityKeyRegistryErrorCodes as bJ, type StoredDelegationChain as bK, createCapabilityKeyRegistry as bL, type ValidateShareDeliveryAuthorizationExpected as ba, type VerifyShareEnvelopeOptions as bb, canonicalOwnerSharePolicy as bc, computeOwnerShareRegistrationCid as bd, computeShareCid as be, createDelegatedShareKey as bf, createPolicyEnforcementDelegation as bg, createShareArtifact as bh, createShareArtifactAsync as bi, createSharePolicy as bj, createSharingService as bk, decryptShareBytesAsync as bl, encodeInlineShareUrl as bm, encodeShareArtifact as bn, encodeShareUrl as bo, encryptShareBytes as bp, encryptShareBytesAsync as bq, intersectShareCapabilities as br, isV2ShareLink as bs, normalizeShareActions as bt, normalizeShareRecipientTarget as bu, normalizeShareResource as bv, parseShareArtifact as bw, parseShareUrl as bx, restoreDelegatedShareKey as by, shareCapabilityAllows as bz, type AccountDelegationRecord as c, type AccountDelegationResource as d, type CreateDelegationParams as e, type CreateDelegationWasmParams as f, type CreateDelegationWasmResult as g, type CreateOwnerDelegationParams as h, type DelegateReceivedShareParams as i, type DelegatedResource as j, type DelegatedShareAccess as k, type DelegatedShareKey as l, type Delegation as m, type DelegationApiResponse as n, type DelegationChain as o, type DelegationChainV2 as p, type DelegationDirection as q, type DelegationErrorCode as r, DelegationErrorCodes as s, type DelegationFilters as t, type DelegationManagerConfig as u, type DelegationRecord as v, type DelegationRevocationReceipt as w, type DelegationStatus as x, type ISharingService as y, type IngestOptions as z };
+export { type RegisterOwnerSharePolicyParams as $, type AccountDelegationPage as A, type KeyProvider as B, type CapabilityEntry as C, DelegationManager as D, type EncodedShareData as E, type KeyType as F, type GenerateShareParams as G, MAX_SEALED_SHARE_CONTENT_BYTES as H, type ICapabilityKeyRegistry as I, type JWK as J, type KeyInfo as K, MAX_SHARE_ARTIFACT_BYTES as L, MAX_CONTENT_BYTES as M, MAX_SHARE_CONTENT_BYTES as N, MemorySenderShareKeyStorage as O, MemorySenderShareRecordStorage as P, MemoryShareCache as Q, type Result as R, type OwnerDelegationPermission as S, type OwnerDelegationReceipt as T, type OwnerShareAction as U, type OwnerShareDecryption as V, type OwnerShareMatcher as W, type OwnerSharePolicyRegistration as X, type OwnerSharePolicyRegistrationReceipt as Y, type OwnerSharePolicyV2 as Z, type ReceiveOptions as _, type DelegationError as a, type ShareRecipientTarget as a$, SHARE_DELIVERY_AUTHORIZATION_DOMAIN as a0, type SenderShareKeyStorage as a1, type SenderShareRecord as a2, type SenderShareRecordStorage as a3, type SenderShareRevocationScope as a4, SenderShareStore as a5, type ShareAccess as a6, ShareAccessError as a7, type ShareAccessV2 as a8, type ShareAction as a9, type ShareKvContentSource as aA, type ShareLink as aB, type ShareLinkData as aC, type ShareLinkLocation as aD, type ShareListEntry as aE, type ShareListResult as aF, type ShareNativeAction as aG, type ShareNativeInvokeEnvelopeV1 as aH, type ShareNativeInvokeErrorResult as aI, type ShareNativeInvokeInput as aJ, type ShareNativeInvokeResult as aK, type ShareNativeInvokeSuccessResult as aL, type ShareNativeResponse as aM, ShareNativeResponseSchema as aN, type SharePolicy as aO, type SharePolicyBinding as aP, type SharePolicySession as aQ, type SharePolicySessionV1 as aR, type SharePolicySessionWireV1 as aS, type ShareReadInvocationV1 as aT, type ShareReadResult as aU, ShareRecipientClient as aV, type ShareRecipientClientOptions as aW, ShareRecipientClientOptionsSchema as aX, type ShareRecipientPolicy as aY, ShareRecipientPolicySchema as aZ, type ShareRecipientResult as a_, ShareActionSchema as aa, type ShareAddressedDelegationEnvelopeV2 as ab, ShareAddressedDelegationEnvelopeV2Schema as ac, type ShareAddressedDelegationRequestV2 as ad, ShareAddressedDelegationRequestV2Schema as ae, type ShareAddressedDelegationResponseV2 as af, ShareAddressedDelegationResponseV2Schema as ag, type ShareAddressedRecipientMatcher as ah, type ShareArtifactInput as ai, type ShareArtifactResult as aj, type ShareArtifactV2 as ak, type ShareCache as al, type ShareCacheEntry as am, type ShareCacheKey as an, type ShareCacheMetadata as ao, type ShareCapabilityLike as ap, ShareConflict as aq, type ShareContentMetadata as ar, type ShareContentSource as as, type ShareDeliveryAuthorization as at, type ShareDeliveryAuthorizationReceipt as au, type ShareDeliveryAuthorizationRequest as av, type ShareDetachedProof as aw, ShareEnvelopeError as ax, type ShareEnvelopeV2 as ay, type ShareExpiryBounds as az, type AccountDelegationQueryOptions as b, ShareRecipientTargetSchema as b0, type ShareResource as b1, ShareResourceSchema as b2, type ShareSaveOptions as b3, type ShareSchema as b4, type ShareSqlContentSource as b5, type ShareWireAction as b6, SharingService as b7, type SharingServiceConfig as b8, type SignedDelegation as b9, restoreDelegatedShareKey as bA, shareCapabilityAllows as bB, shareDeliveryTrustedKid as bC, signShareEnvelope as bD, validateOwnerSharePolicyRegistration as bE, validateOwnerSharePolicyRegistrationBytes as bF, validateShareDeliveryAuthorizationBytes as bG, verifyShareCid as bH, verifyShareEnvelope as bI, CapabilityKeyRegistry as bJ, type CapabilityKeyRegistryErrorCode as bK, CapabilityKeyRegistryErrorCodes as bL, type StoredDelegationChain as bM, createCapabilityKeyRegistry as bN, type SpaceInfo as ba, type SpaceOwnership as bb, type ValidateShareDeliveryAuthorizationExpected as bc, type VerifyShareEnvelopeOptions as bd, canonicalOwnerSharePolicy as be, computeOwnerShareRegistrationCid as bf, computeShareCid as bg, createDelegatedShareKey as bh, createPolicyEnforcementDelegation as bi, createShareArtifact as bj, createShareArtifactAsync as bk, createSharePolicy as bl, createSharingService as bm, decryptShareBytesAsync as bn, encodeInlineShareUrl as bo, encodeShareArtifact as bp, encodeShareUrl as bq, encryptShareBytes as br, encryptShareBytesAsync as bs, intersectShareCapabilities as bt, isV2ShareLink as bu, normalizeShareActions as bv, normalizeShareRecipientTarget as bw, normalizeShareResource as bx, parseShareArtifact as by, parseShareUrl as bz, type AccountDelegationRecord as c, type AccountDelegationResource as d, type CreateDelegationParams as e, type CreateDelegationWasmParams as f, type CreateDelegationWasmResult as g, type CreateOwnerDelegationParams as h, type DelegateReceivedShareParams as i, type DelegatedResource as j, type DelegatedShareAccess as k, type DelegatedShareKey as l, type Delegation as m, type DelegationApiResponse as n, type DelegationChain as o, type DelegationChainV2 as p, type DelegationDirection as q, type DelegationErrorCode as r, DelegationErrorCodes as s, type DelegationFilters as t, type DelegationManagerConfig as u, type DelegationRecord as v, type DelegationRevocationReceipt as w, type DelegationStatus as x, type ISharingService as y, type IngestOptions as z };

package/dist/{recipient-types.schema-B2wH53_t.d.ts → recipient-types.schema-D5pDlIqn.d.ts}

@@ -2259,6 +2259,9 @@ type ShareRecipientTarget = {
 } | {
     readonly kind: "emailDomain";
     readonly value: string;
+} | {
+    readonly kind: "recipientDid";
+    readonly value: string;
 } | {
     readonly kind: "bearer";
 };
@@ -2536,6 +2539,19 @@ interface ShareRecipientClientOptions {
         readonly envelope: ShareEnvelopeV2;
         readonly presentation?: unknown;
     }) => Promise<SharePolicySession>;
+    /** Direct DID authorization is explicit and may return a resumable device step. */
+    readonly establishRecipientDidSession?: (input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly recipientDid: string;
+    }) => Promise<SharePolicySession | {
+        readonly state: "authorization-required";
+        readonly method: "openkey-device";
+        readonly continueUrl?: string;
+        readonly resumeToken: string;
+    } | {
+        readonly state: "denied";
+        readonly reason: string;
+    }>;
     /**
      * Builds the holder presentation/session request after Node returns a
      * fresh challenge.  The callback is deliberately invoked only after the
@@ -2740,7 +2756,8 @@ declare class ShareConflict extends Error {
 }
 declare class ShareAccessError extends Error {
     readonly code: string;
-    constructor(code: string, message?: string);
+    readonly details?: unknown;
+    constructor(code: string, message?: string, details?: unknown);
 }
 interface ShareAccessV2 {
     readonly kind: "share-v2";
@@ -3229,22 +3246,52 @@ interface OwnerDelegationReceipt {
         readonly actions: readonly string[];
         readonly expiry: Date;
     };
+    /** Exact service-scoped capabilities encoded in the signed owner delegation. */
+    readonly permissions: readonly OwnerDelegationPermission[];
 }
-interface CreateOwnerDelegationParams {
-    readonly delegateDid: string;
-    readonly spaceId: string;
+interface OwnerDelegationPermission {
+    /** Canonical long-form service name, for example `tinycloud.kv`. */
+    readonly service: string;
+    /** Exact service resource path. Encryption permissions use a network URN. */
     readonly path: string;
+    /** Canonical full action URNs belonging to `service`. */
     readonly actions: readonly string[];
+}
+interface CreateOwnerDelegationBase {
+    readonly delegateDid: string;
+    readonly spaceId: string;
     readonly expiresAt: Date;
 }
+/**
+ * A wallet-rooted owner delegation accepts either the historical single-path
+ * shape or an exact list of service-scoped permissions. The two forms are
+ * mutually exclusive so callers cannot sign authority from one field while
+ * displaying or persisting a contradictory second field.
+ */
+type CreateOwnerDelegationParams = CreateOwnerDelegationBase & ({
+    readonly path: string;
+    readonly actions: readonly string[];
+    readonly permissions?: never;
+} | {
+    readonly permissions: readonly OwnerDelegationPermission[];
+    readonly path?: never;
+    readonly actions?: never;
+});
 declare const MAX_CONTENT_BYTES: number;
 type OwnerShareAction = "tinycloud.kv/get" | "tinycloud.kv/list" | "tinycloud.kv/metadata" | "tinycloud.kv/put";
+interface OwnerShareDecryption {
+    readonly networkId: string;
+    readonly action: "tinycloud.encryption/decrypt";
+}
 type OwnerShareMatcher = {
     readonly kind: "exactEmail";
     readonly value: string;
 } | {
     readonly kind: "emailDomain";
     readonly value: string;
+} | {
+    readonly kind: "recipientDid";
+    readonly value: string;
 };
 interface OwnerSharePolicyV2 {
     readonly type: "TinyCloudSharePolicy";
@@ -3264,6 +3311,7 @@ interface OwnerSharePolicyV2 {
         readonly path: string;
     };
     readonly actions: readonly OwnerShareAction[];
+    readonly decryption?: OwnerShareDecryption;
     readonly contentSource: {
         readonly kind: "kv";
         readonly space: string;
@@ -3331,6 +3379,7 @@ interface OwnerSharePolicyRegistration {
         readonly path: string;
     };
     readonly actions: readonly OwnerShareAction[];
+    readonly decryption?: OwnerShareDecryption;
     readonly contentSource: {
         readonly kind: "kv";
         readonly space: string;
@@ -3374,6 +3423,7 @@ declare function createPolicyEnforcementDelegation(input: {
     readonly nodeAudience: string;
     readonly path: string;
     readonly actions: readonly OwnerShareAction[];
+    readonly decryption?: OwnerShareDecryption;
     readonly contentSourceDigest: string;
     readonly expiresAt: string;
 }): Promise<SignedDelegation>;
@@ -3402,6 +3452,7 @@ interface ShareDeliveryAuthorizationRequest {
     readonly shareUrl: string;
     readonly documentName: string;
     readonly jti: string;
+    readonly idempotencyKey: string;
     readonly expiresAt: string;
     readonly requestBodyDigest: string;
 }
@@ -3612,6 +3663,15 @@ declare const ShareRecipientTargetSchema: z.ZodDiscriminatedUnion<"kind", [z.Zod
 }, {
     value: string;
     kind: "emailDomain";
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"recipientDid">;
+    value: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    value: string;
+    kind: "recipientDid";
+}, {
+    value: string;
+    kind: "recipientDid";
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"bearer">;
 }, "strict", z.ZodTypeAny, {
@@ -3658,6 +3718,15 @@ declare const ShareRecipientPolicySchema: z.ZodObject<{
     }, {
         value: string;
         kind: "emailDomain";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"recipientDid">;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        kind: "recipientDid";
+    }, {
+        value: string;
+        kind: "recipientDid";
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"bearer">;
     }, "strict", z.ZodTypeAny, {
@@ -3704,6 +3773,9 @@ declare const ShareRecipientPolicySchema: z.ZodObject<{
     } | {
         value: string;
         kind: "emailDomain";
+    } | {
+        value: string;
+        kind: "recipientDid";
     } | {
         kind: "bearer";
     };
@@ -3724,6 +3796,9 @@ declare const ShareRecipientPolicySchema: z.ZodObject<{
     } | {
         value: string;
         kind: "emailDomain";
+    } | {
+        value: string;
+        kind: "recipientDid";
     } | {
         kind: "bearer";
     };
@@ -3770,6 +3845,15 @@ declare const ShareAddressedDelegationRequestV2Schema: z.ZodObject<{
     }, {
         value: string;
         kind: "emailDomain";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"recipientDid">;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        kind: "recipientDid";
+    }, {
+        value: string;
+        kind: "recipientDid";
     }>]>;
     targetOrigin: z.ZodString;
     nodeAudience: z.ZodString;
@@ -3851,6 +3935,9 @@ declare const ShareAddressedDelegationRequestV2Schema: z.ZodObject<{
     } | {
         value: string;
         kind: "emailDomain";
+    } | {
+        value: string;
+        kind: "recipientDid";
     };
     nodeAudience: string;
     contentSource: {
@@ -3893,6 +3980,9 @@ declare const ShareAddressedDelegationRequestV2Schema: z.ZodObject<{
     } | {
         value: string;
         kind: "emailDomain";
+    } | {
+        value: string;
+        kind: "recipientDid";
     };
     nodeAudience: string;
     contentSource: {
@@ -3944,6 +4034,15 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
         }, {
             value: string;
             kind: "emailDomain";
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"recipientDid">;
+            value: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            value: string;
+            kind: "recipientDid";
+        }, {
+            value: string;
+            kind: "recipientDid";
         }>]>;
         targetOrigin: z.ZodString;
         nodeAudience: z.ZodString;
@@ -4025,6 +4124,9 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
         } | {
             value: string;
             kind: "emailDomain";
+        } | {
+            value: string;
+            kind: "recipientDid";
         };
         nodeAudience: string;
         contentSource: {
@@ -4067,6 +4169,9 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
         } | {
             value: string;
             kind: "emailDomain";
+        } | {
+            value: string;
+            kind: "recipientDid";
         };
         nodeAudience: string;
         contentSource: {
@@ -4124,6 +4229,9 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
         } | {
             value: string;
             kind: "emailDomain";
+        } | {
+            value: string;
+            kind: "recipientDid";
         };
         nodeAudience: string;
         contentSource: {
@@ -4173,6 +4281,9 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
         } | {
             value: string;
             kind: "emailDomain";
+        } | {
+            value: string;
+            kind: "recipientDid";
         };
         nodeAudience: string;
         contentSource: {
@@ -4404,4 +4515,4 @@ declare const ShareNativeResponseSchema: z.ZodDiscriminatedUnion<"action", [z.Zo
 }>]>;
 type ShareNativeResponse = z.infer<typeof ShareNativeResponseSchema>;
 
-export { type SenderShareKeyStorage as $, type AccountDelegationPage as A, type KeyProvider as B, type CapabilityEntry as C, DelegationManager as D, type EncodedShareData as E, type KeyType as F, type GenerateShareParams as G, MAX_SEALED_SHARE_CONTENT_BYTES as H, type ICapabilityKeyRegistry as I, type JWK as J, type KeyInfo as K, MAX_SHARE_ARTIFACT_BYTES as L, MAX_CONTENT_BYTES as M, MAX_SHARE_CONTENT_BYTES as N, MemorySenderShareKeyStorage as O, MemorySenderShareRecordStorage as P, MemoryShareCache as Q, type Result as R, type OwnerDelegationReceipt as S, type OwnerShareAction as T, type OwnerShareMatcher as U, type OwnerSharePolicyRegistration as V, type OwnerSharePolicyRegistrationReceipt as W, type OwnerSharePolicyV2 as X, type ReceiveOptions as Y, type RegisterOwnerSharePolicyParams as Z, SHARE_DELIVERY_AUTHORIZATION_DOMAIN as _, type DelegationError as a, type ShareResource as a$, type SenderShareRecord as a0, type SenderShareRecordStorage as a1, type SenderShareRevocationScope as a2, SenderShareStore as a3, type ShareAccess as a4, ShareAccessError as a5, type ShareAccessV2 as a6, type ShareAction as a7, ShareActionSchema as a8, type ShareAddressedDelegationEnvelopeV2 as a9, type ShareLinkData as aA, type ShareLinkLocation as aB, type ShareListEntry as aC, type ShareListResult as aD, type ShareNativeAction as aE, type ShareNativeInvokeEnvelopeV1 as aF, type ShareNativeInvokeErrorResult as aG, type ShareNativeInvokeInput as aH, type ShareNativeInvokeResult as aI, type ShareNativeInvokeSuccessResult as aJ, type ShareNativeResponse as aK, ShareNativeResponseSchema as aL, type SharePolicy as aM, type SharePolicyBinding as aN, type SharePolicySession as aO, type SharePolicySessionV1 as aP, type SharePolicySessionWireV1 as aQ, type ShareReadInvocationV1 as aR, type ShareReadResult as aS, ShareRecipientClient as aT, type ShareRecipientClientOptions as aU, ShareRecipientClientOptionsSchema as aV, type ShareRecipientPolicy as aW, ShareRecipientPolicySchema as aX, type ShareRecipientResult as aY, type ShareRecipientTarget as aZ, ShareRecipientTargetSchema as a_, ShareAddressedDelegationEnvelopeV2Schema as aa, type ShareAddressedDelegationRequestV2 as ab, ShareAddressedDelegationRequestV2Schema as ac, type ShareAddressedDelegationResponseV2 as ad, ShareAddressedDelegationResponseV2Schema as ae, type ShareAddressedRecipientMatcher as af, type ShareArtifactInput as ag, type ShareArtifactResult as ah, type ShareArtifactV2 as ai, type ShareCache as aj, type ShareCacheEntry as ak, type ShareCacheKey as al, type ShareCacheMetadata as am, type ShareCapabilityLike as an, ShareConflict as ao, type ShareContentMetadata as ap, type ShareContentSource as aq, type ShareDeliveryAuthorization as ar, type ShareDeliveryAuthorizationReceipt as as, type ShareDeliveryAuthorizationRequest as at, type ShareDetachedProof as au, ShareEnvelopeError as av, type ShareEnvelopeV2 as aw, type ShareExpiryBounds as ax, type ShareKvContentSource as ay, type ShareLink as az, type AccountDelegationQueryOptions as b, ShareResourceSchema as b0, type ShareSaveOptions as b1, type ShareSchema as b2, type ShareSqlContentSource as b3, type ShareWireAction as b4, SharingService as b5, type SharingServiceConfig as b6, type SignedDelegation as b7, type SpaceInfo as b8, type SpaceOwnership as b9, shareDeliveryTrustedKid as bA, signShareEnvelope as bB, validateOwnerSharePolicyRegistration as bC, validateOwnerSharePolicyRegistrationBytes as bD, validateShareDeliveryAuthorizationBytes as bE, verifyShareCid as bF, verifyShareEnvelope as bG, CapabilityKeyRegistry as bH, type CapabilityKeyRegistryErrorCode as bI, CapabilityKeyRegistryErrorCodes as bJ, type StoredDelegationChain as bK, createCapabilityKeyRegistry as bL, type ValidateShareDeliveryAuthorizationExpected as ba, type VerifyShareEnvelopeOptions as bb, canonicalOwnerSharePolicy as bc, computeOwnerShareRegistrationCid as bd, computeShareCid as be, createDelegatedShareKey as bf, createPolicyEnforcementDelegation as bg, createShareArtifact as bh, createShareArtifactAsync as bi, createSharePolicy as bj, createSharingService as bk, decryptShareBytesAsync as bl, encodeInlineShareUrl as bm, encodeShareArtifact as bn, encodeShareUrl as bo, encryptShareBytes as bp, encryptShareBytesAsync as bq, intersectShareCapabilities as br, isV2ShareLink as bs, normalizeShareActions as bt, normalizeShareRecipientTarget as bu, normalizeShareResource as bv, parseShareArtifact as bw, parseShareUrl as bx, restoreDelegatedShareKey as by, shareCapabilityAllows as bz, type AccountDelegationRecord as c, type AccountDelegationResource as d, type CreateDelegationParams as e, type CreateDelegationWasmParams as f, type CreateDelegationWasmResult as g, type CreateOwnerDelegationParams as h, type DelegateReceivedShareParams as i, type DelegatedResource as j, type DelegatedShareAccess as k, type DelegatedShareKey as l, type Delegation as m, type DelegationApiResponse as n, type DelegationChain as o, type DelegationChainV2 as p, type DelegationDirection as q, type DelegationErrorCode as r, DelegationErrorCodes as s, type DelegationFilters as t, type DelegationManagerConfig as u, type DelegationRecord as v, type DelegationRevocationReceipt as w, type DelegationStatus as x, type ISharingService as y, type IngestOptions as z };
+export { type RegisterOwnerSharePolicyParams as $, type AccountDelegationPage as A, type KeyProvider as B, type CapabilityEntry as C, DelegationManager as D, type EncodedShareData as E, type KeyType as F, type GenerateShareParams as G, MAX_SEALED_SHARE_CONTENT_BYTES as H, type ICapabilityKeyRegistry as I, type JWK as J, type KeyInfo as K, MAX_SHARE_ARTIFACT_BYTES as L, MAX_CONTENT_BYTES as M, MAX_SHARE_CONTENT_BYTES as N, MemorySenderShareKeyStorage as O, MemorySenderShareRecordStorage as P, MemoryShareCache as Q, type Result as R, type OwnerDelegationPermission as S, type OwnerDelegationReceipt as T, type OwnerShareAction as U, type OwnerShareDecryption as V, type OwnerShareMatcher as W, type OwnerSharePolicyRegistration as X, type OwnerSharePolicyRegistrationReceipt as Y, type OwnerSharePolicyV2 as Z, type ReceiveOptions as _, type DelegationError as a, type ShareRecipientTarget as a$, SHARE_DELIVERY_AUTHORIZATION_DOMAIN as a0, type SenderShareKeyStorage as a1, type SenderShareRecord as a2, type SenderShareRecordStorage as a3, type SenderShareRevocationScope as a4, SenderShareStore as a5, type ShareAccess as a6, ShareAccessError as a7, type ShareAccessV2 as a8, type ShareAction as a9, type ShareKvContentSource as aA, type ShareLink as aB, type ShareLinkData as aC, type ShareLinkLocation as aD, type ShareListEntry as aE, type ShareListResult as aF, type ShareNativeAction as aG, type ShareNativeInvokeEnvelopeV1 as aH, type ShareNativeInvokeErrorResult as aI, type ShareNativeInvokeInput as aJ, type ShareNativeInvokeResult as aK, type ShareNativeInvokeSuccessResult as aL, type ShareNativeResponse as aM, ShareNativeResponseSchema as aN, type SharePolicy as aO, type SharePolicyBinding as aP, type SharePolicySession as aQ, type SharePolicySessionV1 as aR, type SharePolicySessionWireV1 as aS, type ShareReadInvocationV1 as aT, type ShareReadResult as aU, ShareRecipientClient as aV, type ShareRecipientClientOptions as aW, ShareRecipientClientOptionsSchema as aX, type ShareRecipientPolicy as aY, ShareRecipientPolicySchema as aZ, type ShareRecipientResult as a_, ShareActionSchema as aa, type ShareAddressedDelegationEnvelopeV2 as ab, ShareAddressedDelegationEnvelopeV2Schema as ac, type ShareAddressedDelegationRequestV2 as ad, ShareAddressedDelegationRequestV2Schema as ae, type ShareAddressedDelegationResponseV2 as af, ShareAddressedDelegationResponseV2Schema as ag, type ShareAddressedRecipientMatcher as ah, type ShareArtifactInput as ai, type ShareArtifactResult as aj, type ShareArtifactV2 as ak, type ShareCache as al, type ShareCacheEntry as am, type ShareCacheKey as an, type ShareCacheMetadata as ao, type ShareCapabilityLike as ap, ShareConflict as aq, type ShareContentMetadata as ar, type ShareContentSource as as, type ShareDeliveryAuthorization as at, type ShareDeliveryAuthorizationReceipt as au, type ShareDeliveryAuthorizationRequest as av, type ShareDetachedProof as aw, ShareEnvelopeError as ax, type ShareEnvelopeV2 as ay, type ShareExpiryBounds as az, type AccountDelegationQueryOptions as b, ShareRecipientTargetSchema as b0, type ShareResource as b1, ShareResourceSchema as b2, type ShareSaveOptions as b3, type ShareSchema as b4, type ShareSqlContentSource as b5, type ShareWireAction as b6, SharingService as b7, type SharingServiceConfig as b8, type SignedDelegation as b9, restoreDelegatedShareKey as bA, shareCapabilityAllows as bB, shareDeliveryTrustedKid as bC, signShareEnvelope as bD, validateOwnerSharePolicyRegistration as bE, validateOwnerSharePolicyRegistrationBytes as bF, validateShareDeliveryAuthorizationBytes as bG, verifyShareCid as bH, verifyShareEnvelope as bI, CapabilityKeyRegistry as bJ, type CapabilityKeyRegistryErrorCode as bK, CapabilityKeyRegistryErrorCodes as bL, type StoredDelegationChain as bM, createCapabilityKeyRegistry as bN, type SpaceInfo as ba, type SpaceOwnership as bb, type ValidateShareDeliveryAuthorizationExpected as bc, type VerifyShareEnvelopeOptions as bd, canonicalOwnerSharePolicy as be, computeOwnerShareRegistrationCid as bf, computeShareCid as bg, createDelegatedShareKey as bh, createPolicyEnforcementDelegation as bi, createShareArtifact as bj, createShareArtifactAsync as bk, createSharePolicy as bl, createSharingService as bm, decryptShareBytesAsync as bn, encodeInlineShareUrl as bo, encodeShareArtifact as bp, encodeShareUrl as bq, encryptShareBytes as br, encryptShareBytesAsync as bs, intersectShareCapabilities as bt, isV2ShareLink as bu, normalizeShareActions as bv, normalizeShareRecipientTarget as bw, normalizeShareResource as bx, parseShareArtifact as by, parseShareUrl as bz, type AccountDelegationRecord as c, type AccountDelegationResource as d, type CreateDelegationParams as e, type CreateDelegationWasmParams as f, type CreateDelegationWasmResult as g, type CreateOwnerDelegationParams as h, type DelegateReceivedShareParams as i, type DelegatedResource as j, type DelegatedShareAccess as k, type DelegatedShareKey as l, type Delegation as m, type DelegationApiResponse as n, type DelegationChain as o, type DelegationChainV2 as p, type DelegationDirection as q, type DelegationErrorCode as r, DelegationErrorCodes as s, type DelegationFilters as t, type DelegationManagerConfig as u, type DelegationRecord as v, type DelegationRevocationReceipt as w, type DelegationStatus as x, type ISharingService as y, type IngestOptions as z };