@tinycloud/sdk-core 2.11.0-beta.1 → 2.11.0-beta.11

package/dist/{recipient-types.schema-CWIt63Qp.d.cts → recipient-types.schema-CuDpskPd.d.cts}

@@ -49,6 +49,7 @@ declare const JWKSchema: z.ZodObject<{
     key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     kty: string;
+    alg?: string | undefined;
     crv?: string | undefined;
     x?: string | undefined;
     y?: string | undefined;
@@ -56,11 +57,11 @@ declare const JWKSchema: z.ZodObject<{
     e?: string | undefined;
     n?: string | undefined;
     kid?: string | undefined;
-    alg?: string | undefined;
     use?: string | undefined;
     key_ops?: string[] | undefined;
 }, {
     kty: string;
+    alg?: string | undefined;
     crv?: string | undefined;
     x?: string | undefined;
     y?: string | undefined;
@@ -68,7 +69,6 @@ declare const JWKSchema: z.ZodObject<{
     e?: string | undefined;
     n?: string | undefined;
     kid?: string | undefined;
-    alg?: string | undefined;
     use?: string | undefined;
     key_ops?: string[] | undefined;
 }>;
@@ -114,6 +114,7 @@ declare const KeyInfoSchema: z.ZodObject<{
         key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
         kty: string;
+        alg?: string | undefined;
         crv?: string | undefined;
         x?: string | undefined;
         y?: string | undefined;
@@ -121,11 +122,11 @@ declare const KeyInfoSchema: z.ZodObject<{
         e?: string | undefined;
         n?: string | undefined;
         kid?: string | undefined;
-        alg?: string | undefined;
         use?: string | undefined;
         key_ops?: string[] | undefined;
     }, {
         kty: string;
+        alg?: string | undefined;
         crv?: string | undefined;
         x?: string | undefined;
         y?: string | undefined;
@@ -133,7 +134,6 @@ declare const KeyInfoSchema: z.ZodObject<{
         e?: string | undefined;
         n?: string | undefined;
         kid?: string | undefined;
-        alg?: string | undefined;
         use?: string | undefined;
         key_ops?: string[] | undefined;
     }>>;
@@ -146,6 +146,7 @@ declare const KeyInfoSchema: z.ZodObject<{
     priority: number;
     jwk?: {
         kty: string;
+        alg?: string | undefined;
         crv?: string | undefined;
         x?: string | undefined;
         y?: string | undefined;
@@ -153,7 +154,6 @@ declare const KeyInfoSchema: z.ZodObject<{
         e?: string | undefined;
         n?: string | undefined;
         kid?: string | undefined;
-        alg?: string | undefined;
         use?: string | undefined;
         key_ops?: string[] | undefined;
     } | undefined;
@@ -164,6 +164,7 @@ declare const KeyInfoSchema: z.ZodObject<{
     priority: number;
     jwk?: {
         kty: string;
+        alg?: string | undefined;
         crv?: string | undefined;
         x?: string | undefined;
         y?: string | undefined;
@@ -171,7 +172,6 @@ declare const KeyInfoSchema: z.ZodObject<{
         e?: string | undefined;
         n?: string | undefined;
         kid?: string | undefined;
-        alg?: string | undefined;
         use?: string | undefined;
         key_ops?: string[] | undefined;
     } | undefined;
@@ -588,6 +588,7 @@ declare const CapabilityEntrySchema: z.ZodObject<{
             key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         }, "strip", z.ZodTypeAny, {
             kty: string;
+            alg?: string | undefined;
             crv?: string | undefined;
             x?: string | undefined;
             y?: string | undefined;
@@ -595,11 +596,11 @@ declare const CapabilityEntrySchema: z.ZodObject<{
             e?: string | undefined;
             n?: string | undefined;
             kid?: string | undefined;
-            alg?: string | undefined;
             use?: string | undefined;
             key_ops?: string[] | undefined;
         }, {
             kty: string;
+            alg?: string | undefined;
             crv?: string | undefined;
             x?: string | undefined;
             y?: string | undefined;
@@ -607,7 +608,6 @@ declare const CapabilityEntrySchema: z.ZodObject<{
             e?: string | undefined;
             n?: string | undefined;
             kid?: string | undefined;
-            alg?: string | undefined;
             use?: string | undefined;
             key_ops?: string[] | undefined;
         }>>;
@@ -620,6 +620,7 @@ declare const CapabilityEntrySchema: z.ZodObject<{
         priority: number;
         jwk?: {
             kty: string;
+            alg?: string | undefined;
             crv?: string | undefined;
             x?: string | undefined;
             y?: string | undefined;
@@ -627,7 +628,6 @@ declare const CapabilityEntrySchema: z.ZodObject<{
             e?: string | undefined;
             n?: string | undefined;
             kid?: string | undefined;
-            alg?: string | undefined;
             use?: string | undefined;
             key_ops?: string[] | undefined;
         } | undefined;
@@ -638,6 +638,7 @@ declare const CapabilityEntrySchema: z.ZodObject<{
         priority: number;
         jwk?: {
             kty: string;
+            alg?: string | undefined;
             crv?: string | undefined;
             x?: string | undefined;
             y?: string | undefined;
@@ -645,7 +646,6 @@ declare const CapabilityEntrySchema: z.ZodObject<{
             e?: string | undefined;
             n?: string | undefined;
             kid?: string | undefined;
-            alg?: string | undefined;
             use?: string | undefined;
             key_ops?: string[] | undefined;
         } | undefined;
@@ -717,6 +717,7 @@ declare const CapabilityEntrySchema: z.ZodObject<{
         priority: number;
         jwk?: {
             kty: string;
+            alg?: string | undefined;
             crv?: string | undefined;
             x?: string | undefined;
             y?: string | undefined;
@@ -724,7 +725,6 @@ declare const CapabilityEntrySchema: z.ZodObject<{
             e?: string | undefined;
             n?: string | undefined;
             kid?: string | undefined;
-            alg?: string | undefined;
             use?: string | undefined;
             key_ops?: string[] | undefined;
         } | undefined;
@@ -755,6 +755,7 @@ declare const CapabilityEntrySchema: z.ZodObject<{
         priority: number;
         jwk?: {
             kty: string;
+            alg?: string | undefined;
             crv?: string | undefined;
             x?: string | undefined;
             y?: string | undefined;
@@ -762,7 +763,6 @@ declare const CapabilityEntrySchema: z.ZodObject<{
             e?: string | undefined;
             n?: string | undefined;
             kid?: string | undefined;
-            alg?: string | undefined;
             use?: string | undefined;
             key_ops?: string[] | undefined;
         } | undefined;
@@ -2259,6 +2259,9 @@ type ShareRecipientTarget = {
 } | {
     readonly kind: "emailDomain";
     readonly value: string;
+} | {
+    readonly kind: "recipientDid";
+    readonly value: string;
 } | {
     readonly kind: "bearer";
 };
@@ -2402,6 +2405,54 @@ interface ShareCapabilityLike {
 }
 declare function shareCapabilityAllows(capability: ShareCapabilityLike, action: ShareAction, path: string): boolean;
 
+/** Transport form shared by addressed-share recipients and normal agents. */
+interface PortableDelegation {
+    readonly cid: string;
+    readonly delegationHeader: {
+        readonly Authorization: string;
+    };
+    readonly ownerAddress: string;
+    readonly chainId: number;
+    readonly host?: string;
+    readonly spaceId: string;
+    readonly path: string;
+    readonly actions: readonly string[];
+    readonly caveats?: readonly Record<string, unknown>[];
+    readonly expiry: Date;
+    readonly delegateDID: string;
+    readonly delegatorDID?: string;
+    readonly parentCid?: string;
+    readonly disableSubDelegation?: boolean;
+    readonly resources?: readonly DelegatedResource[];
+}
+/** Validate a normal delegation received from a v3 claim/admission response. */
+declare function parsePortableDelegation(input: unknown): PortableDelegation;
+declare function serializePortableDelegation(delegation: PortableDelegation): string;
+interface PortableDelegationImportReceipt {
+    readonly activated?: readonly string[];
+    readonly skipped?: readonly string[];
+    readonly [key: string]: unknown;
+}
+/** Admit a normal delegation through POST /delegate. */
+declare function importPortableDelegation(fetchFn: FetchFunction, host: string, delegation: PortableDelegation): Promise<PortableDelegationImportReceipt>;
+/**
+ * Create and admit an ordinary protected descendant below a v3 policy
+ * session. This is the recipient-to-agent path; it deliberately bypasses the
+ * legacy `prepareSession`/`rawAbilities` builder because that builder cannot
+ * preserve the signed policy fact or the exact immediate-parent proof.
+ */
+declare function delegatePortablePolicySession(input: {
+    readonly fetch: FetchFunction;
+    readonly host: string;
+    readonly parent: PortableDelegation;
+    readonly issuerPrivateKey: Uint8Array;
+    readonly delegateDID: string;
+    readonly attenuation: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>;
+    readonly now?: number;
+    readonly expiresAt?: number;
+    readonly nonce?: string;
+}): Promise<PortableDelegation>;
+
 /** Native action names used by the addressed Node data plane. */
 type ShareNativeAction = "tinycloud.kv/get" | "tinycloud.kv/metadata" | "tinycloud.kv/list" | "tinycloud.kv/put";
 type ShareWireAction = ShareNativeAction | "tinycloud.sql/read";
@@ -2536,6 +2587,19 @@ interface ShareRecipientClientOptions {
         readonly envelope: ShareEnvelopeV2;
         readonly presentation?: unknown;
     }) => Promise<SharePolicySession>;
+    /** Direct DID authorization is explicit and may return a resumable device step. */
+    readonly establishRecipientDidSession?: (input: {
+        readonly envelope: ShareEnvelopeV2;
+        readonly recipientDid: string;
+    }) => Promise<SharePolicySession | {
+        readonly state: "authorization-required";
+        readonly method: "openkey-device";
+        readonly continueUrl?: string;
+        readonly resumeToken: string;
+    } | {
+        readonly state: "denied";
+        readonly reason: string;
+    }>;
     /**
      * Builds the holder presentation/session request after Node returns a
      * fresh challenge.  The callback is deliberately invoked only after the
@@ -2564,6 +2628,10 @@ interface ShareRecipientClientOptions {
      * generic KV bearer session.
      */
     readonly nativeInvoke?: (input: ShareNativeInvokeInput) => Promise<ShareNativeInvokeResult>;
+    /** Import a normal policy-session UCAN through the caller's delegation manager. */
+    readonly importDelegation?: (delegation: PortableDelegation) => Promise<void | PortableDelegation>;
+    /** Extractable Ed25519 recipient seed used only to sign fresh S0 descendants/invocations. */
+    readonly policySessionPrivateKey?: Uint8Array;
     /** Optional holder signer for the built-in addressed /invoke transport. */
     readonly signNativeInvoke?: (input: {
         readonly envelope: ShareEnvelopeV2;
@@ -2740,7 +2808,8 @@ declare class ShareConflict extends Error {
 }
 declare class ShareAccessError extends Error {
     readonly code: string;
-    constructor(code: string, message?: string);
+    readonly details?: unknown;
+    constructor(code: string, message?: string, details?: unknown);
 }
 interface ShareAccessV2 {
     readonly kind: "share-v2";
@@ -2749,6 +2818,8 @@ interface ShareAccessV2 {
     readonly resource: ShareResource;
     readonly actions: readonly ShareAction[];
     readonly expiresAt: Date;
+    /** The normal UCAN admitted for this recipient, when the link is v3. */
+    readonly portableDelegation?: PortableDelegation;
     readonly kv?: IKVService;
     readonly get: (path?: string) => Promise<ShareReadResult>;
     readonly listChildren: (options?: {
@@ -3183,6 +3254,9 @@ declare class ShareRecipientClient {
     private readonly now;
     constructor(options: ShareRecipientClientOptions);
     open(link: string): Promise<ShareAccessV2>;
+    private policySessionDelegation;
+    private policyInvocationSigner;
+    private policySessionProjection;
     private createKV;
     private nativeGet;
     private nativeMetadata;
@@ -3272,6 +3346,9 @@ type OwnerShareMatcher = {
 } | {
     readonly kind: "emailDomain";
     readonly value: string;
+} | {
+    readonly kind: "recipientDid";
+    readonly value: string;
 };
 interface OwnerSharePolicyV2 {
     readonly type: "TinyCloudSharePolicy";
@@ -3432,6 +3509,7 @@ interface ShareDeliveryAuthorizationRequest {
     readonly shareUrl: string;
     readonly documentName: string;
     readonly jti: string;
+    readonly idempotencyKey: string;
     readonly expiresAt: string;
     readonly requestBodyDigest: string;
 }
@@ -3642,6 +3720,15 @@ declare const ShareRecipientTargetSchema: z.ZodDiscriminatedUnion<"kind", [z.Zod
 }, {
     value: string;
     kind: "emailDomain";
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"recipientDid">;
+    value: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    value: string;
+    kind: "recipientDid";
+}, {
+    value: string;
+    kind: "recipientDid";
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"bearer">;
 }, "strict", z.ZodTypeAny, {
@@ -3688,6 +3775,15 @@ declare const ShareRecipientPolicySchema: z.ZodObject<{
     }, {
         value: string;
         kind: "emailDomain";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"recipientDid">;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        kind: "recipientDid";
+    }, {
+        value: string;
+        kind: "recipientDid";
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"bearer">;
     }, "strict", z.ZodTypeAny, {
@@ -3734,6 +3830,9 @@ declare const ShareRecipientPolicySchema: z.ZodObject<{
     } | {
         value: string;
         kind: "emailDomain";
+    } | {
+        value: string;
+        kind: "recipientDid";
     } | {
         kind: "bearer";
     };
@@ -3754,6 +3853,9 @@ declare const ShareRecipientPolicySchema: z.ZodObject<{
     } | {
         value: string;
         kind: "emailDomain";
+    } | {
+        value: string;
+        kind: "recipientDid";
     } | {
         kind: "bearer";
     };
@@ -3800,6 +3902,15 @@ declare const ShareAddressedDelegationRequestV2Schema: z.ZodObject<{
     }, {
         value: string;
         kind: "emailDomain";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"recipientDid">;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        kind: "recipientDid";
+    }, {
+        value: string;
+        kind: "recipientDid";
     }>]>;
     targetOrigin: z.ZodString;
     nodeAudience: z.ZodString;
@@ -3816,13 +3927,13 @@ declare const ShareAddressedDelegationRequestV2Schema: z.ZodObject<{
     }, "strict", z.ZodTypeAny, {
         path: string;
         space: string;
-        action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
         kind: "kv";
+        action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
     }, {
         path: string;
         space: string;
-        action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
         kind: "kv";
+        action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"sql">;
         action: z.ZodLiteral<"tinycloud.sql/read">;
@@ -3836,8 +3947,8 @@ declare const ShareAddressedDelegationRequestV2Schema: z.ZodObject<{
         path: string;
         statement: string;
         space: string;
-        action: "tinycloud.sql/read";
         kind: "sql";
+        action: "tinycloud.sql/read";
         database: string;
         arguments: Record<string, number>;
         argumentsDigest: string;
@@ -3845,8 +3956,8 @@ declare const ShareAddressedDelegationRequestV2Schema: z.ZodObject<{
         path: string;
         statement: string;
         space: string;
-        action: "tinycloud.sql/read";
         kind: "sql";
+        action: "tinycloud.sql/read";
         database: string;
         arguments: Record<string, number>;
         argumentsDigest: string;
@@ -3873,31 +3984,34 @@ declare const ShareAddressedDelegationRequestV2Schema: z.ZodObject<{
         value: string;
         kind: "exact" | "prefix";
     };
-    version: 2;
-    shareId: string;
-    recipientMatcher: {
-        value: string;
-        kind: "exactEmail";
-    } | {
-        value: string;
-        kind: "emailDomain";
-    };
     nodeAudience: string;
     contentSource: {
         path: string;
         space: string;
-        action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
         kind: "kv";
+        action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
     } | {
         path: string;
         statement: string;
         space: string;
-        action: "tinycloud.sql/read";
         kind: "sql";
+        action: "tinycloud.sql/read";
         database: string;
         arguments: Record<string, number>;
         argumentsDigest: string;
     };
+    version: 2;
+    shareId: string;
+    recipientMatcher: {
+        value: string;
+        kind: "exactEmail";
+    } | {
+        value: string;
+        kind: "emailDomain";
+    } | {
+        value: string;
+        kind: "recipientDid";
+    };
     contentSourceDigest: string;
     jti: string;
     senderDid: string;
@@ -3915,31 +4029,34 @@ declare const ShareAddressedDelegationRequestV2Schema: z.ZodObject<{
         value: string;
         kind: "exact" | "prefix";
     };
-    version: 2;
-    shareId: string;
-    recipientMatcher: {
-        value: string;
-        kind: "exactEmail";
-    } | {
-        value: string;
-        kind: "emailDomain";
-    };
     nodeAudience: string;
     contentSource: {
         path: string;
         space: string;
-        action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
         kind: "kv";
+        action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
     } | {
         path: string;
         statement: string;
         space: string;
-        action: "tinycloud.sql/read";
         kind: "sql";
+        action: "tinycloud.sql/read";
         database: string;
         arguments: Record<string, number>;
         argumentsDigest: string;
     };
+    version: 2;
+    shareId: string;
+    recipientMatcher: {
+        value: string;
+        kind: "exactEmail";
+    } | {
+        value: string;
+        kind: "emailDomain";
+    } | {
+        value: string;
+        kind: "recipientDid";
+    };
     contentSourceDigest: string;
     jti: string;
     senderDid: string;
@@ -3974,6 +4091,15 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
         }, {
             value: string;
             kind: "emailDomain";
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"recipientDid">;
+            value: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            value: string;
+            kind: "recipientDid";
+        }, {
+            value: string;
+            kind: "recipientDid";
         }>]>;
         targetOrigin: z.ZodString;
         nodeAudience: z.ZodString;
@@ -3990,13 +4116,13 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
         }, "strict", z.ZodTypeAny, {
             path: string;
             space: string;
-            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
             kind: "kv";
+            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
         }, {
             path: string;
             space: string;
-            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
             kind: "kv";
+            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
         }>, z.ZodObject<{
             kind: z.ZodLiteral<"sql">;
             action: z.ZodLiteral<"tinycloud.sql/read">;
@@ -4010,8 +4136,8 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
             path: string;
             statement: string;
             space: string;
-            action: "tinycloud.sql/read";
             kind: "sql";
+            action: "tinycloud.sql/read";
             database: string;
             arguments: Record<string, number>;
             argumentsDigest: string;
@@ -4019,8 +4145,8 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
             path: string;
             statement: string;
             space: string;
-            action: "tinycloud.sql/read";
             kind: "sql";
+            action: "tinycloud.sql/read";
             database: string;
             arguments: Record<string, number>;
             argumentsDigest: string;
@@ -4047,31 +4173,34 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
             value: string;
             kind: "exact" | "prefix";
         };
-        version: 2;
-        shareId: string;
-        recipientMatcher: {
-            value: string;
-            kind: "exactEmail";
-        } | {
-            value: string;
-            kind: "emailDomain";
-        };
         nodeAudience: string;
         contentSource: {
             path: string;
             space: string;
-            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
             kind: "kv";
+            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
         } | {
             path: string;
             statement: string;
             space: string;
-            action: "tinycloud.sql/read";
             kind: "sql";
+            action: "tinycloud.sql/read";
             database: string;
             arguments: Record<string, number>;
             argumentsDigest: string;
         };
+        version: 2;
+        shareId: string;
+        recipientMatcher: {
+            value: string;
+            kind: "exactEmail";
+        } | {
+            value: string;
+            kind: "emailDomain";
+        } | {
+            value: string;
+            kind: "recipientDid";
+        };
         contentSourceDigest: string;
         jti: string;
         senderDid: string;
@@ -4089,31 +4218,34 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
             value: string;
             kind: "exact" | "prefix";
         };
-        version: 2;
-        shareId: string;
-        recipientMatcher: {
-            value: string;
-            kind: "exactEmail";
-        } | {
-            value: string;
-            kind: "emailDomain";
-        };
         nodeAudience: string;
         contentSource: {
             path: string;
             space: string;
-            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
             kind: "kv";
+            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
         } | {
             path: string;
             statement: string;
             space: string;
-            action: "tinycloud.sql/read";
             kind: "sql";
+            action: "tinycloud.sql/read";
             database: string;
             arguments: Record<string, number>;
             argumentsDigest: string;
         };
+        version: 2;
+        shareId: string;
+        recipientMatcher: {
+            value: string;
+            kind: "exactEmail";
+        } | {
+            value: string;
+            kind: "emailDomain";
+        } | {
+            value: string;
+            kind: "recipientDid";
+        };
         contentSourceDigest: string;
         jti: string;
         senderDid: string;
@@ -4130,12 +4262,12 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
         signature: z.ZodString;
     }, "strict", z.ZodTypeAny, {
         signature: string;
-        kid: string;
         alg: "EdDSA";
+        kid: string;
     }, {
         signature: string;
-        kid: string;
         alg: "EdDSA";
+        kid: string;
     }>;
 }, "strict", z.ZodTypeAny, {
     request: {
@@ -4146,31 +4278,34 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
             value: string;
             kind: "exact" | "prefix";
         };
-        version: 2;
-        shareId: string;
-        recipientMatcher: {
-            value: string;
-            kind: "exactEmail";
-        } | {
-            value: string;
-            kind: "emailDomain";
-        };
         nodeAudience: string;
         contentSource: {
             path: string;
             space: string;
-            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
             kind: "kv";
+            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
         } | {
             path: string;
             statement: string;
             space: string;
-            action: "tinycloud.sql/read";
             kind: "sql";
+            action: "tinycloud.sql/read";
             database: string;
             arguments: Record<string, number>;
             argumentsDigest: string;
         };
+        version: 2;
+        shareId: string;
+        recipientMatcher: {
+            value: string;
+            kind: "exactEmail";
+        } | {
+            value: string;
+            kind: "emailDomain";
+        } | {
+            value: string;
+            kind: "recipientDid";
+        };
         contentSourceDigest: string;
         jti: string;
         senderDid: string;
@@ -4183,8 +4318,8 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
     };
     proof: {
         signature: string;
-        kid: string;
         alg: "EdDSA";
+        kid: string;
     };
 }, {
     request: {
@@ -4195,31 +4330,34 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
             value: string;
             kind: "exact" | "prefix";
         };
-        version: 2;
-        shareId: string;
-        recipientMatcher: {
-            value: string;
-            kind: "exactEmail";
-        } | {
-            value: string;
-            kind: "emailDomain";
-        };
         nodeAudience: string;
         contentSource: {
             path: string;
             space: string;
-            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
             kind: "kv";
+            action: "tinycloud.kv/get" | "tinycloud.kv/put" | "tinycloud.kv/list" | "tinycloud.kv/metadata";
         } | {
             path: string;
             statement: string;
             space: string;
-            action: "tinycloud.sql/read";
             kind: "sql";
+            action: "tinycloud.sql/read";
             database: string;
             arguments: Record<string, number>;
             argumentsDigest: string;
         };
+        version: 2;
+        shareId: string;
+        recipientMatcher: {
+            value: string;
+            kind: "exactEmail";
+        } | {
+            value: string;
+            kind: "emailDomain";
+        } | {
+            value: string;
+            kind: "recipientDid";
+        };
         contentSourceDigest: string;
         jti: string;
         senderDid: string;
@@ -4232,8 +4370,8 @@ declare const ShareAddressedDelegationEnvelopeV2Schema: z.ZodObject<{
     };
     proof: {
         signature: string;
-        kid: string;
         alg: "EdDSA";
+        kid: string;
     };
 }>;
 declare const ShareAddressedDelegationResponseV2Schema: z.ZodObject<{
@@ -4267,12 +4405,12 @@ declare const ShareAddressedDelegationResponseV2Schema: z.ZodObject<{
         signature: z.ZodString;
     }, "strict", z.ZodTypeAny, {
         signature: string;
-        kid: string;
         alg: "EdDSA";
+        kid: string;
     }, {
         signature: string;
-        kid: string;
         alg: "EdDSA";
+        kid: string;
     }>;
 }, "strict", z.ZodTypeAny, {
     type: "TinyCloudShareAddressedDelegation";
@@ -4283,8 +4421,8 @@ declare const ShareAddressedDelegationResponseV2Schema: z.ZodObject<{
         value: string;
         kind: "exact" | "prefix";
     };
-    version: 2;
     policyCid: string;
+    version: 2;
     policyBytes: string;
     jti: string;
     delegationCid: string;
@@ -4292,8 +4430,8 @@ declare const ShareAddressedDelegationResponseV2Schema: z.ZodObject<{
     authorityMaterialDigest: string;
     proof: {
         signature: string;
-        kid: string;
         alg: "EdDSA";
+        kid: string;
     };
     policyDigest: string;
     delegationBytes: string;
@@ -4307,8 +4445,8 @@ declare const ShareAddressedDelegationResponseV2Schema: z.ZodObject<{
         value: string;
         kind: "exact" | "prefix";
     };
-    version: 2;
     policyCid: string;
+    version: 2;
     policyBytes: string;
     jti: string;
     delegationCid: string;
@@ -4316,8 +4454,8 @@ declare const ShareAddressedDelegationResponseV2Schema: z.ZodObject<{
     authorityMaterialDigest: string;
     proof: {
         signature: string;
-        kid: string;
         alg: "EdDSA";
+        kid: string;
     };
     policyDigest: string;
     delegationBytes: string;
@@ -4434,4 +4572,4 @@ declare const ShareNativeResponseSchema: z.ZodDiscriminatedUnion<"action", [z.Zo
 }>]>;
 type ShareNativeResponse = z.infer<typeof ShareNativeResponseSchema>;
 
-export { type RegisterOwnerSharePolicyParams as $, type AccountDelegationPage as A, type KeyProvider as B, type CapabilityEntry as C, DelegationManager as D, type EncodedShareData as E, type KeyType as F, type GenerateShareParams as G, MAX_SEALED_SHARE_CONTENT_BYTES as H, type ICapabilityKeyRegistry as I, type JWK as J, type KeyInfo as K, MAX_SHARE_ARTIFACT_BYTES as L, MAX_CONTENT_BYTES as M, MAX_SHARE_CONTENT_BYTES as N, MemorySenderShareKeyStorage as O, MemorySenderShareRecordStorage as P, MemoryShareCache as Q, type Result as R, type OwnerDelegationPermission as S, type OwnerDelegationReceipt as T, type OwnerShareAction as U, type OwnerShareDecryption as V, type OwnerShareMatcher as W, type OwnerSharePolicyRegistration as X, type OwnerSharePolicyRegistrationReceipt as Y, type OwnerSharePolicyV2 as Z, type ReceiveOptions as _, type DelegationError as a, type ShareRecipientTarget as a$, SHARE_DELIVERY_AUTHORIZATION_DOMAIN as a0, type SenderShareKeyStorage as a1, type SenderShareRecord as a2, type SenderShareRecordStorage as a3, type SenderShareRevocationScope as a4, SenderShareStore as a5, type ShareAccess as a6, ShareAccessError as a7, type ShareAccessV2 as a8, type ShareAction as a9, type ShareKvContentSource as aA, type ShareLink as aB, type ShareLinkData as aC, type ShareLinkLocation as aD, type ShareListEntry as aE, type ShareListResult as aF, type ShareNativeAction as aG, type ShareNativeInvokeEnvelopeV1 as aH, type ShareNativeInvokeErrorResult as aI, type ShareNativeInvokeInput as aJ, type ShareNativeInvokeResult as aK, type ShareNativeInvokeSuccessResult as aL, type ShareNativeResponse as aM, ShareNativeResponseSchema as aN, type SharePolicy as aO, type SharePolicyBinding as aP, type SharePolicySession as aQ, type SharePolicySessionV1 as aR, type SharePolicySessionWireV1 as aS, type ShareReadInvocationV1 as aT, type ShareReadResult as aU, ShareRecipientClient as aV, type ShareRecipientClientOptions as aW, ShareRecipientClientOptionsSchema as aX, type ShareRecipientPolicy as aY, ShareRecipientPolicySchema as aZ, type ShareRecipientResult as a_, ShareActionSchema as aa, type ShareAddressedDelegationEnvelopeV2 as ab, ShareAddressedDelegationEnvelopeV2Schema as ac, type ShareAddressedDelegationRequestV2 as ad, ShareAddressedDelegationRequestV2Schema as ae, type ShareAddressedDelegationResponseV2 as af, ShareAddressedDelegationResponseV2Schema as ag, type ShareAddressedRecipientMatcher as ah, type ShareArtifactInput as ai, type ShareArtifactResult as aj, type ShareArtifactV2 as ak, type ShareCache as al, type ShareCacheEntry as am, type ShareCacheKey as an, type ShareCacheMetadata as ao, type ShareCapabilityLike as ap, ShareConflict as aq, type ShareContentMetadata as ar, type ShareContentSource as as, type ShareDeliveryAuthorization as at, type ShareDeliveryAuthorizationReceipt as au, type ShareDeliveryAuthorizationRequest as av, type ShareDetachedProof as aw, ShareEnvelopeError as ax, type ShareEnvelopeV2 as ay, type ShareExpiryBounds as az, type AccountDelegationQueryOptions as b, ShareRecipientTargetSchema as b0, type ShareResource as b1, ShareResourceSchema as b2, type ShareSaveOptions as b3, type ShareSchema as b4, type ShareSqlContentSource as b5, type ShareWireAction as b6, SharingService as b7, type SharingServiceConfig as b8, type SignedDelegation as b9, restoreDelegatedShareKey as bA, shareCapabilityAllows as bB, shareDeliveryTrustedKid as bC, signShareEnvelope as bD, validateOwnerSharePolicyRegistration as bE, validateOwnerSharePolicyRegistrationBytes as bF, validateShareDeliveryAuthorizationBytes as bG, verifyShareCid as bH, verifyShareEnvelope as bI, CapabilityKeyRegistry as bJ, type CapabilityKeyRegistryErrorCode as bK, CapabilityKeyRegistryErrorCodes as bL, type StoredDelegationChain as bM, createCapabilityKeyRegistry as bN, type SpaceInfo as ba, type SpaceOwnership as bb, type ValidateShareDeliveryAuthorizationExpected as bc, type VerifyShareEnvelopeOptions as bd, canonicalOwnerSharePolicy as be, computeOwnerShareRegistrationCid as bf, computeShareCid as bg, createDelegatedShareKey as bh, createPolicyEnforcementDelegation as bi, createShareArtifact as bj, createShareArtifactAsync as bk, createSharePolicy as bl, createSharingService as bm, decryptShareBytesAsync as bn, encodeInlineShareUrl as bo, encodeShareArtifact as bp, encodeShareUrl as bq, encryptShareBytes as br, encryptShareBytesAsync as bs, intersectShareCapabilities as bt, isV2ShareLink as bu, normalizeShareActions as bv, normalizeShareRecipientTarget as bw, normalizeShareResource as bx, parseShareArtifact as by, parseShareUrl as bz, type AccountDelegationRecord as c, type AccountDelegationResource as d, type CreateDelegationParams as e, type CreateDelegationWasmParams as f, type CreateDelegationWasmResult as g, type CreateOwnerDelegationParams as h, type DelegateReceivedShareParams as i, type DelegatedResource as j, type DelegatedShareAccess as k, type DelegatedShareKey as l, type Delegation as m, type DelegationApiResponse as n, type DelegationChain as o, type DelegationChainV2 as p, type DelegationDirection as q, type DelegationErrorCode as r, DelegationErrorCodes as s, type DelegationFilters as t, type DelegationManagerConfig as u, type DelegationRecord as v, type DelegationRevocationReceipt as w, type DelegationStatus as x, type ISharingService as y, type IngestOptions as z };
+export { type ReceiveOptions as $, type AccountDelegationPage as A, type KeyProvider as B, type CapabilityEntry as C, DelegationManager as D, type EncodedShareData as E, type KeyType as F, type GenerateShareParams as G, MAX_SEALED_SHARE_CONTENT_BYTES as H, type ICapabilityKeyRegistry as I, type JWK as J, type KeyInfo as K, MAX_SHARE_ARTIFACT_BYTES as L, MAX_CONTENT_BYTES as M, MAX_SHARE_CONTENT_BYTES as N, MemorySenderShareKeyStorage as O, MemorySenderShareRecordStorage as P, MemoryShareCache as Q, type Result as R, type OwnerDelegationPermission as S, type OwnerDelegationReceipt as T, type OwnerShareAction as U, type OwnerShareDecryption as V, type OwnerShareMatcher as W, type OwnerSharePolicyRegistration as X, type OwnerSharePolicyRegistrationReceipt as Y, type OwnerSharePolicyV2 as Z, type PortableDelegationImportReceipt as _, type DelegationError as a, ShareRecipientPolicySchema as a$, type RegisterOwnerSharePolicyParams as a0, SHARE_DELIVERY_AUTHORIZATION_DOMAIN as a1, type SenderShareKeyStorage as a2, type SenderShareRecord as a3, type SenderShareRecordStorage as a4, type SenderShareRevocationScope as a5, SenderShareStore as a6, type ShareAccess as a7, ShareAccessError as a8, type ShareAccessV2 as a9, type ShareExpiryBounds as aA, type ShareKvContentSource as aB, type ShareLink as aC, type ShareLinkData as aD, type ShareLinkLocation as aE, type ShareListEntry as aF, type ShareListResult as aG, type ShareNativeAction as aH, type ShareNativeInvokeEnvelopeV1 as aI, type ShareNativeInvokeErrorResult as aJ, type ShareNativeInvokeInput as aK, type ShareNativeInvokeResult as aL, type ShareNativeInvokeSuccessResult as aM, type ShareNativeResponse as aN, ShareNativeResponseSchema as aO, type SharePolicy as aP, type SharePolicyBinding as aQ, type SharePolicySession as aR, type SharePolicySessionV1 as aS, type SharePolicySessionWireV1 as aT, type PortableDelegation as aU, type ShareReadInvocationV1 as aV, type ShareReadResult as aW, ShareRecipientClient as aX, type ShareRecipientClientOptions as aY, ShareRecipientClientOptionsSchema as aZ, type ShareRecipientPolicy as a_, type ShareAction as aa, ShareActionSchema as ab, type ShareAddressedDelegationEnvelopeV2 as ac, ShareAddressedDelegationEnvelopeV2Schema as ad, type ShareAddressedDelegationRequestV2 as ae, ShareAddressedDelegationRequestV2Schema as af, type ShareAddressedDelegationResponseV2 as ag, ShareAddressedDelegationResponseV2Schema as ah, type ShareAddressedRecipientMatcher as ai, type ShareArtifactInput as aj, type ShareArtifactResult as ak, type ShareArtifactV2 as al, type ShareCache as am, type ShareCacheEntry as an, type ShareCacheKey as ao, type ShareCacheMetadata as ap, type ShareCapabilityLike as aq, ShareConflict as ar, type ShareContentMetadata as as, type ShareContentSource as at, type ShareDeliveryAuthorization as au, type ShareDeliveryAuthorizationReceipt as av, type ShareDeliveryAuthorizationRequest as aw, type ShareDetachedProof as ax, ShareEnvelopeError as ay, type ShareEnvelopeV2 as az, type AccountDelegationQueryOptions as b, type ShareRecipientResult as b0, type ShareRecipientTarget as b1, ShareRecipientTargetSchema as b2, type ShareResource as b3, ShareResourceSchema as b4, type ShareSaveOptions as b5, type ShareSchema as b6, type ShareSqlContentSource as b7, type ShareWireAction as b8, SharingService as b9, normalizeShareRecipientTarget as bA, normalizeShareResource as bB, parsePortableDelegation as bC, parseShareArtifact as bD, parseShareUrl as bE, restoreDelegatedShareKey as bF, serializePortableDelegation as bG, shareCapabilityAllows as bH, shareDeliveryTrustedKid as bI, signShareEnvelope as bJ, validateOwnerSharePolicyRegistration as bK, validateOwnerSharePolicyRegistrationBytes as bL, validateShareDeliveryAuthorizationBytes as bM, verifyShareCid as bN, verifyShareEnvelope as bO, CapabilityKeyRegistry as bP, type CapabilityKeyRegistryErrorCode as bQ, CapabilityKeyRegistryErrorCodes as bR, type StoredDelegationChain as bS, createCapabilityKeyRegistry as bT, type SharingServiceConfig as ba, type SignedDelegation as bb, type SpaceInfo as bc, type SpaceOwnership as bd, type ValidateShareDeliveryAuthorizationExpected as be, type VerifyShareEnvelopeOptions as bf, canonicalOwnerSharePolicy as bg, computeOwnerShareRegistrationCid as bh, computeShareCid as bi, createDelegatedShareKey as bj, createPolicyEnforcementDelegation as bk, createShareArtifact as bl, createShareArtifactAsync as bm, createSharePolicy as bn, createSharingService as bo, decryptShareBytesAsync as bp, delegatePortablePolicySession as bq, encodeInlineShareUrl as br, encodeShareArtifact as bs, encodeShareUrl as bt, encryptShareBytes as bu, encryptShareBytesAsync as bv, importPortableDelegation as bw, intersectShareCapabilities as bx, isV2ShareLink as by, normalizeShareActions as bz, type AccountDelegationRecord as c, type AccountDelegationResource as d, type CreateDelegationParams as e, type CreateDelegationWasmParams as f, type CreateDelegationWasmResult as g, type CreateOwnerDelegationParams as h, type DelegateReceivedShareParams as i, type DelegatedResource as j, type DelegatedShareAccess as k, type DelegatedShareKey as l, type Delegation as m, type DelegationApiResponse as n, type DelegationChain as o, type DelegationChainV2 as p, type DelegationDirection as q, type DelegationErrorCode as r, DelegationErrorCodes as s, type DelegationFilters as t, type DelegationManagerConfig as u, type DelegationRecord as v, type DelegationRevocationReceipt as w, type DelegationStatus as x, type ISharingService as y, type IngestOptions as z };