@tinycloud/sdk-core 2.7.0-beta.2 → 2.7.0-beta.4

package/dist/index.d.ts

@@ -1,10 +1,10 @@
 import { z } from 'zod';
 import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result as Result$1, ServiceSession, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
-export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
+export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.js';
 export { ACCOUNT_INDEX_SCHEMA, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
-export { E as ED25519_JCS_SIGNATURE_SUITE, b as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, c as POLICY_ENGINE_RECORD_SCHEMA, d as POLICY_SCHEMA, e as POLICY_STATUS_SCHEMA, a as Policy, P as PolicyEngineRecord, f as PolicyStatus, g as SignatureMaterialError, h as SignatureSuite, i as SignatureVerificationError, j as SignedObjectCanonicalizationError, k as SignedObjectDigestError, l as SignedObjectErrorCode, m as SignedObjectIdError, n as SignedObjectKind, o as SignedObjectMaterial, p as SignedObjectProfileError, q as SignedObjectSchemaError, r as SignedObjectSignature, S as SignedObjectSigner, s as SignedObjectVerificationResult, t as SignedPolicyObject, u as SigningKeyBindingError, v as UnsignedPolicy, U as UnsignedPolicyEngineRecord, w as UnsignedPolicyObject, x as UnsignedPolicyStatus, y as UnsupportedSignatureSuiteError, z as canonicalizeSignedObjectUnsigned, A as createAndSignPolicy, B as createAndSignPolicyEngineRecord, C as createAndSignPolicyStatus, D as createAndSignSignedObject, F as deriveSignedObjectMaterial, G as signedObjectIdFor, H as toSignedObjectError, I as validatePolicyEngineRecordSigned, K as validatePolicyEngineRecordSignedShape, L as validatePolicyEngineRecordUnsigned, M as validatePolicySigned, N as validatePolicySignedShape, O as validatePolicyStatusSigned, Q as validatePolicyStatusSignedShape, R as validatePolicyStatusUnsigned, T as validatePolicyUnsigned, V as verifyPolicy, W as verifyPolicyEngineRecord, X as verifyPolicyStatus, Y as verifySignedObject } from './signed-object-C9Gur3ZY.js';
-export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-Dbx-xqUh.js';
+export { E as ED25519_JCS_SIGNATURE_SUITE, b as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, c as POLICY_ENGINE_RECORD_SCHEMA, d as POLICY_SCHEMA, e as POLICY_STATUS_SCHEMA, a as Policy, P as PolicyEngineRecord, f as PolicyStatus, g as SignatureMaterialError, h as SignatureSuite, i as SignatureVerificationError, j as SignedObjectCanonicalizationError, k as SignedObjectDigestError, l as SignedObjectErrorCode, m as SignedObjectIdError, n as SignedObjectKind, o as SignedObjectMaterial, p as SignedObjectProfileError, q as SignedObjectSchemaError, r as SignedObjectSignature, S as SignedObjectSigner, s as SignedObjectVerificationResult, t as SignedPolicyObject, u as SigningKeyBindingError, v as UnsignedPolicy, U as UnsignedPolicyEngineRecord, w as UnsignedPolicyObject, x as UnsignedPolicyStatus, y as UnsupportedSignatureSuiteError, z as canonicalizeSignedObjectUnsigned, A as createAndSignPolicy, B as createAndSignPolicyEngineRecord, C as createAndSignPolicyStatus, D as createAndSignSignedObject, F as deriveSignedObjectMaterial, G as signedObjectIdFor, H as toSignedObjectError, I as validatePolicyEngineRecordSigned, K as validatePolicyEngineRecordSignedShape, L as validatePolicyEngineRecordUnsigned, M as validatePolicySigned, N as validatePolicySignedShape, O as validatePolicyStatusSigned, Q as validatePolicyStatusSignedShape, R as validatePolicyStatusUnsigned, T as validatePolicyUnsigned, V as verifyPolicy, W as verifyPolicyEngineRecord, X as verifyPolicyStatus, Y as verifySignedObject } from './signed-object-C6mWbTbB.js';
+export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.js';
 export { SiweMessage } from 'siwe';
 
 /**
@@ -227,6 +227,8 @@ interface PermissionEntry {
      * Already-expanded URNs are passed through unchanged.
      */
     actions: string[];
+    /** Exact ReCap caveat branches when this authority came from a signed ReCap. */
+    caveats?: Record<string, unknown>[];
     /** When true, the manifest prefix is NOT prepended to `path`. Default false. */
     skipPrefix?: boolean;
     /** Per-entry expiry override, ms-format. */
@@ -646,6 +648,17 @@ declare class SessionExpiredError extends Error {
     readonly expiredAt: Date;
     constructor(expiredAt: Date);
 }
+/**
+ * Thrown when the installed WASM delegation boundary cannot encode every
+ * constrained ReCap branch in a requested child delegation.
+ */
+declare class CaveatedDelegationUnsupportedError extends Error {
+    /** Stable machine-readable error code for fail-closed caveated delegation. */
+    code: "CAVEATED_DELEGATION_UNSUPPORTED";
+    /** Requested entries whose constrained ReCap branches cannot be preserved. */
+    entries: PermissionEntry[];
+    constructor(entries: PermissionEntry[]);
+}
 interface SubsetCheckResult {
     /** True when every requested entry is covered by a granted entry. */
     subset: boolean;
@@ -673,6 +686,23 @@ interface SubsetCheckResult {
  * or `expandActionShortNames` to normalize inputs first.
  */
 declare function isCapabilitySubset(requested: readonly PermissionEntry[], granted: readonly PermissionEntry[]): SubsetCheckResult;
+/**
+ * Compare ReCap caveat branch sets without losing signed branch structure.
+ *
+ * ReCap represents an unconstrained ability as `[{}]`, while SDK callers can
+ * represent that same authority as `undefined` or `[]`. Those three forms are
+ * equivalent. Every other branch, including an unconstrained branch mixed
+ * with a constrained one, remains part of the canonical comparison.
+ */
+declare function recapCaveatsEqual(left: readonly Record<string, unknown>[] | undefined, right: readonly Record<string, unknown>[] | undefined): boolean;
+/**
+ * Canonicalize a ReCap caveat branch set for exact equality checks.
+ *
+ * Object keys and branch order do not affect equality. A lone unconstrained
+ * branch is normalized to the SDK's empty-caveat representation, but an
+ * unconstrained branch in a mixed set is deliberately retained.
+ */
+declare function canonicalizeRecapCaveats(caveats: readonly Record<string, unknown>[] | undefined): string;
 /** Return whether a granted action pattern covers one requested action. */
 declare function actionContains(grantedAction: string, requestedAction: string): boolean;
 /**
@@ -688,6 +718,8 @@ interface WasmRecapEntry {
     space: string;
     path: string;
     actions: string[];
+    /** Exact ReCap caveats shared by every action in this entry. */
+    caveats?: Record<string, unknown>[];
 }
 /**
  * Signature of the WASM `parseRecapFromSiwe` export. Accepts the signed
@@ -724,6 +756,42 @@ declare function parseRecapCapabilities(parseWasm: ParseRecapFromSiwe, siwe: str
  * @packageDocumentation
  */
 
+/**
+ * The persisted authority material that must be verified as one unit before a
+ * restored session can use its ReCap or lifetime locally.
+ */
+interface PersistedSessionProof {
+    delegationHeader: {
+        Authorization: string;
+    };
+    delegationCid: string;
+    spaceId: string;
+    /** @deprecated Ignored by validation; capabilities come from the signed ReCap. */
+    spaces?: Record<string, string>;
+    jwk: object;
+    /** @deprecated Ignored by validation; the verification method is derived from `jwk`. */
+    verificationMethod?: string;
+    address: string;
+    chainId: number;
+    siwe: string;
+    signature: string;
+}
+/** Canonical facts produced by the WASM-side persisted-session verifier. */
+interface ValidatedPersistedSessionProof {
+    /** The SIWE expiration exactly as signed, when the SIWE contains one. */
+    expiresAt?: string;
+    /** @deprecated Legacy caveat-free witness; restore does not trust it. */
+    recap?: WasmRecapEntry[];
+    /**
+     * Exact, caveat-preserving ReCap reconstruction from a verifier that
+     * implements persisted-session validation v2. This remains optional so a
+     * pre-existing custom binding stays source-compatible, but restore rejects
+     * authenticated authority unless this witness is available.
+     */
+    verifiedRecap?: Array<WasmRecapEntry & {
+        caveats: Record<string, unknown>[];
+    }>;
+}
 /**
  * Platform-agnostic WASM bindings interface.
  *
@@ -757,6 +825,13 @@ interface IWasmBindings {
      * Returns an empty array when the SIWE has no recap resource.
      */
     parseRecapFromSiwe: (siweString: string) => WasmRecapEntry[];
+    /**
+     * Optional verifier-v2 parser that preserves ReCap caveats. Kept optional
+     * so existing custom bindings remain source-compatible.
+     */
+    parseVerifiedRecapFromSiwe?: (siweString: string) => Array<WasmRecapEntry & {
+        caveats: Record<string, unknown>[];
+    }>;
     /** Generate a host SIWE message for space activation */
     generateHostSIWEMessage: (params: any) => string;
     /** Convert a signed SIWE message to delegation headers */
@@ -775,6 +850,13 @@ interface IWasmBindings {
     vault_sha256: (data: Uint8Array) => Uint8Array;
     /** Factory for session managers */
     createSessionManager: () => ISessionManager;
+    /**
+     * Verify a persisted EIP-191 SIWE proof and bind it to its reconstructed
+     * Cacao header/CID, session DID, address, chain and ReCap spaces. Optional
+     * so pre-existing custom bindings remain type-compatible; restore rejects
+     * authenticated persisted data when the primitive is unavailable.
+     */
+    validatePersistedSession?: (proof: PersistedSessionProof) => ValidatedPersistedSessionProof;
     /** Ensure WASM module is initialized (optional — some bindings auto-init) */
     ensureInitialized?: () => Promise<void>;
 }
@@ -786,6 +868,13 @@ interface IWasmBindings {
 interface ISessionManager {
     /** Create a new session key with the given ID, returns the DID */
     createSessionKey(id: string): string;
+    /**
+     * Optional for custom bindings built before persisted-key restore.
+     * `restoreSession` detects support at runtime.
+     */
+    replaceSessionKey?(jwk: object, keyId: string): string;
+    /** List every live key so a primary-key replacement cannot discard shares. */
+    listSessionKeys?(): string[];
     /** Rename a session key ID */
     renameSessionKeyId(oldId: string, newId: string): void;
     /** Get the DID for a session key */
@@ -1422,6 +1511,8 @@ declare const DelegationSchema: z.ZodObject<{
     path: z.ZodString;
     /** Actions this delegation authorizes */
     actions: z.ZodArray<z.ZodString, "many">;
+    /** Exact ReCap caveats that constrain every action in this scope. */
+    caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
     /** When this delegation expires (accepts Date or ISO string from JSON) */
     expiry: z.ZodDate;
     /** Whether this delegation has been revoked */
@@ -1444,6 +1535,7 @@ declare const DelegationSchema: z.ZodObject<{
     cid: string;
     delegateDID: string;
     isRevoked: boolean;
+    caveats?: Record<string, unknown>[] | undefined;
     createdAt?: Date | undefined;
     delegatorDID?: string | undefined;
     parentCid?: string | undefined;
@@ -1457,6 +1549,7 @@ declare const DelegationSchema: z.ZodObject<{
     cid: string;
     delegateDID: string;
     isRevoked: boolean;
+    caveats?: Record<string, unknown>[] | undefined;
     createdAt?: Date | undefined;
     delegatorDID?: string | undefined;
     parentCid?: string | undefined;
@@ -1502,6 +1595,227 @@ declare const DelegationStatusSchema: z.ZodEffects<z.ZodObject<{
     exists: boolean;
 }>;
 type DelegationStatus = z.infer<typeof DelegationStatusSchema>;
+declare const DelegationRevocationReceiptSchema: z.ZodObject<{
+    revoked: z.ZodLiteral<true>;
+    cid: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    revoked: true;
+    cid: string;
+}, {
+    revoked: true;
+    cid: string;
+}>;
+type DelegationRevocationReceipt = z.infer<typeof DelegationRevocationReceiptSchema>;
+declare const AccountDelegationResourceSchema: z.ZodObject<{
+    resource: z.ZodString;
+    actions: z.ZodArray<z.ZodString, "many">;
+    caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+}, "strict", z.ZodTypeAny, {
+    actions: string[];
+    caveats: Record<string, unknown>[];
+    resource: string;
+}, {
+    actions: string[];
+    caveats: Record<string, unknown>[];
+    resource: string;
+}>;
+declare const AccountDelegationRecordSchema: z.ZodObject<{
+    cid: z.ZodString;
+    direction: z.ZodEnum<["granted", "received"]>;
+    delegatorDid: z.ZodString;
+    delegateDid: z.ZodString;
+    resources: z.ZodArray<z.ZodObject<{
+        resource: z.ZodString;
+        actions: z.ZodArray<z.ZodString, "many">;
+        caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }, {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }>, "many">;
+    parents: z.ZodArray<z.ZodString, "many">;
+    issuedAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    notBefore: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    expiresAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    status: z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>;
+    revokedAt: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>>;
+    revokedBy: z.ZodOptional<z.ZodString>;
+    revokedAncestorCid: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+    notBefore: Date | null;
+    resources: {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }[];
+    expiresAt: Date | null;
+    issuedAt: Date | null;
+    cid: string;
+    direction: "received" | "granted";
+    delegatorDid: string;
+    delegateDid: string;
+    parents: string[];
+    revokedAt?: Date | null | undefined;
+    revokedBy?: string | undefined;
+    revokedAncestorCid?: string | undefined;
+}, {
+    status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+    notBefore: string | null;
+    resources: {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }[];
+    expiresAt: string | null;
+    issuedAt: string | null;
+    cid: string;
+    direction: "received" | "granted";
+    delegatorDid: string;
+    delegateDid: string;
+    parents: string[];
+    revokedAt?: string | null | undefined;
+    revokedBy?: string | undefined;
+    revokedAncestorCid?: string | undefined;
+}>;
+declare const AccountDelegationPageSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    items: z.ZodArray<z.ZodObject<{
+        cid: z.ZodString;
+        direction: z.ZodEnum<["granted", "received"]>;
+        delegatorDid: z.ZodString;
+        delegateDid: z.ZodString;
+        resources: z.ZodArray<z.ZodObject<{
+            resource: z.ZodString;
+            actions: z.ZodArray<z.ZodString, "many">;
+            caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+        }, "strict", z.ZodTypeAny, {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }, {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }>, "many">;
+        parents: z.ZodArray<z.ZodString, "many">;
+        issuedAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        notBefore: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        expiresAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        status: z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>;
+        revokedAt: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>>;
+        revokedBy: z.ZodOptional<z.ZodString>;
+        revokedAncestorCid: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: Date | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: Date | null;
+        issuedAt: Date | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: Date | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }, {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: string | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: string | null;
+        issuedAt: string | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: string | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }>, "many">;
+    nextCursor: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: 2;
+    items: {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: Date | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: Date | null;
+        issuedAt: Date | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: Date | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }[];
+    nextCursor?: string | undefined;
+}, {
+    schemaVersion: 2;
+    items: {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: string | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        expiresAt: string | null;
+        issuedAt: string | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: string | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }[];
+    nextCursor?: string | undefined;
+}>;
+type AccountDelegationResource = z.infer<typeof AccountDelegationResourceSchema>;
+type AccountDelegationRecord = z.infer<typeof AccountDelegationRecordSchema>;
+type AccountDelegationPage = z.infer<typeof AccountDelegationPageSchema>;
+declare const AccountDelegationQueryOptionsSchema: z.ZodObject<{
+    direction: z.ZodOptional<z.ZodEnum<["granted", "received", "all"]>>;
+    status: z.ZodOptional<z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>>;
+    space: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status?: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked" | undefined;
+    space?: string | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}, {
+    status?: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked" | undefined;
+    space?: string | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}>;
+type AccountDelegationQueryOptions = z.infer<typeof AccountDelegationQueryOptionsSchema>;
 /**
  * Entry in the capability registry mapping a capability to available keys.
  */
@@ -1618,6 +1932,8 @@ declare const CapabilityEntrySchema: z.ZodObject<{
         path: z.ZodString;
         /** Actions this delegation authorizes */
         actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
         /** When this delegation expires (accepts Date or ISO string from JSON) */
         expiry: z.ZodDate;
         /** Whether this delegation has been revoked */
@@ -1640,6 +1956,7 @@ declare const CapabilityEntrySchema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -1653,6 +1970,7 @@ declare const CapabilityEntrySchema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -1689,6 +2007,7 @@ declare const CapabilityEntrySchema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -1726,6 +2045,7 @@ declare const CapabilityEntrySchema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -1839,6 +2159,8 @@ declare const DelegationChainSchema: z.ZodArray<z.ZodObject<{
     path: z.ZodString;
     /** Actions this delegation authorizes */
     actions: z.ZodArray<z.ZodString, "many">;
+    /** Exact ReCap caveats that constrain every action in this scope. */
+    caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
     /** When this delegation expires (accepts Date or ISO string from JSON) */
     expiry: z.ZodDate;
     /** Whether this delegation has been revoked */
@@ -1861,6 +2183,7 @@ declare const DelegationChainSchema: z.ZodArray<z.ZodObject<{
     cid: string;
     delegateDID: string;
     isRevoked: boolean;
+    caveats?: Record<string, unknown>[] | undefined;
     createdAt?: Date | undefined;
     delegatorDID?: string | undefined;
     parentCid?: string | undefined;
@@ -1874,6 +2197,7 @@ declare const DelegationChainSchema: z.ZodArray<z.ZodObject<{
     cid: string;
     delegateDID: string;
     isRevoked: boolean;
+    caveats?: Record<string, unknown>[] | undefined;
     createdAt?: Date | undefined;
     delegatorDID?: string | undefined;
     parentCid?: string | undefined;
@@ -1897,6 +2221,8 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         path: z.ZodString;
         /** Actions this delegation authorizes */
         actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
         /** When this delegation expires (accepts Date or ISO string from JSON) */
         expiry: z.ZodDate;
         /** Whether this delegation has been revoked */
@@ -1919,6 +2245,7 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -1932,6 +2259,7 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -1950,6 +2278,8 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         path: z.ZodString;
         /** Actions this delegation authorizes */
         actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
         /** When this delegation expires (accepts Date or ISO string from JSON) */
         expiry: z.ZodDate;
         /** Whether this delegation has been revoked */
@@ -1972,6 +2302,7 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -1985,6 +2316,7 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -2003,6 +2335,8 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         path: z.ZodString;
         /** Actions this delegation authorizes */
         actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
         /** When this delegation expires (accepts Date or ISO string from JSON) */
         expiry: z.ZodDate;
         /** Whether this delegation has been revoked */
@@ -2025,6 +2359,7 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -2038,6 +2373,7 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -2053,6 +2389,7 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -2067,6 +2404,7 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -2081,6 +2419,7 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -2096,6 +2435,7 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -2110,6 +2450,7 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -2124,6 +2465,7 @@ declare const DelegationChainV2Schema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -2162,23 +2504,23 @@ declare const DelegationFiltersSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     path?: string | undefined;
     actions?: string[] | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
     delegator?: string | undefined;
     delegatee?: string | undefined;
-    direction?: "received" | "all" | "granted" | undefined;
     includeRevoked?: boolean | undefined;
     validAt?: Date | undefined;
-    limit?: number | undefined;
-    cursor?: string | undefined;
 }, {
     path?: string | undefined;
     actions?: string[] | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
     delegator?: string | undefined;
     delegatee?: string | undefined;
-    direction?: "received" | "all" | "granted" | undefined;
     includeRevoked?: boolean | undefined;
     validAt?: Date | undefined;
-    limit?: number | undefined;
-    cursor?: string | undefined;
 }>;
 type DelegationFilters = z.infer<typeof DelegationFiltersSchema>;
 /**
@@ -2243,6 +2585,8 @@ declare const ShareLinkSchema: z.ZodObject<{
         path: z.ZodString;
         /** Actions this delegation authorizes */
         actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
         /** When this delegation expires (accepts Date or ISO string from JSON) */
         expiry: z.ZodDate;
         /** Whether this delegation has been revoked */
@@ -2265,6 +2609,7 @@ declare const ShareLinkSchema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -2278,6 +2623,7 @@ declare const ShareLinkSchema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -2299,6 +2645,7 @@ declare const ShareLinkSchema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -2319,6 +2666,7 @@ declare const ShareLinkSchema: z.ZodObject<{
         cid: string;
         delegateDID: string;
         isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
         createdAt?: Date | undefined;
         delegatorDID?: string | undefined;
         parentCid?: string | undefined;
@@ -2405,6 +2753,8 @@ type GenerateShareParams = z.infer<typeof GenerateShareParamsSchema>;
 declare const DelegationManagerConfigSchema: z.ZodObject<{
     /** TinyCloud host URLs */
     hosts: z.ZodArray<z.ZodString, "many">;
+    /** Account space used by account-wide delegation history queries */
+    accountSpaceId: z.ZodOptional<z.ZodString>;
     /** Active session for authentication */
     session: z.ZodEffects<z.ZodUnknown, ServiceSession, unknown>;
     /** Platform-specific invoke function */
@@ -2418,11 +2768,13 @@ declare const DelegationManagerConfigSchema: z.ZodObject<{
     hosts: string[];
     invoke: InvokeFunction;
     invokeAny?: InvokeAnyFunction | undefined;
+    accountSpaceId?: string | undefined;
     fetch?: FetchFunction | undefined;
 }, {
     hosts: string[];
     invokeAny?: unknown;
     session?: unknown;
+    accountSpaceId?: string | undefined;
     invoke?: unknown;
     fetch?: unknown;
 }>;
@@ -2493,16 +2845,20 @@ declare const DelegatedResourceSchema: z.ZodObject<{
     path: z.ZodString;
     /** Full-URN ability strings, e.g. ["tinycloud.kv/get", "tinycloud.kv/put"]. */
     actions: z.ZodArray<z.ZodString, "many">;
+    /** Exact ReCap caveats that constrain every action in this scope. */
+    caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
 }, "strip", z.ZodTypeAny, {
     path: string;
     actions: string[];
     space: string;
     service: string;
+    caveats?: Record<string, unknown>[] | undefined;
 }, {
     path: string;
     actions: string[];
     space: string;
     service: string;
+    caveats?: Record<string, unknown>[] | undefined;
 }>;
 type DelegatedResource = z.infer<typeof DelegatedResourceSchema>;
 /**
@@ -2591,16 +2947,20 @@ declare const CreateDelegationWasmResultSchema: z.ZodObject<{
         path: z.ZodString;
         /** Full-URN ability strings, e.g. ["tinycloud.kv/get", "tinycloud.kv/put"]. */
         actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
     }, "strip", z.ZodTypeAny, {
         path: string;
         actions: string[];
         space: string;
         service: string;
+        caveats?: Record<string, unknown>[] | undefined;
     }, {
         path: string;
         actions: string[];
         space: string;
         service: string;
+        caveats?: Record<string, unknown>[] | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     resources: {
@@ -2608,6 +2968,7 @@ declare const CreateDelegationWasmResultSchema: z.ZodObject<{
         actions: string[];
         space: string;
         service: string;
+        caveats?: Record<string, unknown>[] | undefined;
     }[];
     delegation: string;
     expiry: Date;
@@ -2619,6 +2980,7 @@ declare const CreateDelegationWasmResultSchema: z.ZodObject<{
         actions: string[];
         space: string;
         service: string;
+        caveats?: Record<string, unknown>[] | undefined;
     }[];
     delegation: string;
     expiry: Date;
@@ -2898,6 +3260,7 @@ declare class CapabilityKeyRegistry implements ICapabilityKeyRegistry {
      * @returns Combined key string
      */
     private makeCapabilityKey;
+    private sameDelegationScope;
     /**
      * Find capability entries that match a resource and action.
      *
@@ -3488,6 +3851,8 @@ declare class TinyCloud {
      * @throws Error if services are not initialized
      */
     get serviceContext(): IServiceContext;
+    /** @internal Retire this service graph after its owner replaces a session. */
+    retireServices(): void;
     /**
      * Get a registered service by name.
      *
@@ -3679,6 +4044,7 @@ declare class DelegationManager {
     private invoke;
     private invokeAny?;
     private fetchFn;
+    private accountSpaceId?;
     /**
      * Creates a new DelegationManager instance.
      *
@@ -3737,12 +4103,14 @@ declare class DelegationManager {
      * }
      * ```
      */
-    revoke(cid: string): Promise<Result<void>>;
+    revoke(cid: string): Promise<Result<DelegationRevocationReceipt>>;
     /**
      * Reads the node-confirmed lifecycle state of one delegation without
      * exposing delegation metadata.
      */
     status(cid: string): Promise<Result<DelegationStatus>>;
+    /** Query lifecycle-complete delegation history for the authenticated account. */
+    query(options?: AccountDelegationQueryOptions): Promise<Result<AccountDelegationPage>>;
     /**
      * Lists all delegations for the current session's space.
      *
@@ -4013,6 +4381,8 @@ interface SharingServiceConfig {
         /** Requested expiry time */
         requestedExpiry: Date;
     }) => Promise<Delegation | undefined>;
+    /** Reject operations after the host session/service graph has been retired. */
+    assertActive?: () => void;
 }
 /**
  * Interface for the SharingService.
@@ -4100,6 +4470,7 @@ declare class SharingService implements ISharingService {
     private pathPrefix;
     private sessionExpiry?;
     private onRootDelegationNeeded?;
+    private assertActiveFn?;
     /**
      * Creates a new SharingService instance.
      */
@@ -4116,7 +4487,7 @@ declare class SharingService implements ISharingService {
      * Updates the service configuration.
      * Used to add full capabilities (session, delegationManager, createDelegation, createDelegationWasm) after signIn.
      */
-    updateConfig(config: Partial<Pick<SharingServiceConfig, "session" | "delegationManager" | "createDelegation" | "createDelegationWasm" | "sessionExpiry" | "onRootDelegationNeeded">>): void;
+    updateConfig(config: Partial<Pick<SharingServiceConfig, "session" | "delegationManager" | "createDelegation" | "createDelegationWasm" | "sessionExpiry" | "onRootDelegationNeeded" | "assertActive">>): void;
     /**
      * Generate a sharing link with an embedded private key.
      *
@@ -4138,6 +4509,7 @@ declare class SharingService implements ISharingService {
      * @internal
      */
     private findSuitableKeyForDelegation;
+    private retiredGraphError;
     /**
      * Check if a delegation path matches/covers the requested path.
      * A delegation path covers the request if:
@@ -4147,11 +4519,6 @@ declare class SharingService implements ISharingService {
      * @internal
      */
     private pathMatches;
-    /**
-     * Handle fallback to session extension when root delegation is not available.
-     * @internal
-     */
-    private handleSessionExtensionFallback;
     /**
      * Create a delegation from the current session to a share key.
      * This is the fallback path when root delegation is not available.
@@ -4180,6 +4547,11 @@ declare class SharingService implements ISharingService {
      * be logged or stored insecurely.
      */
     delegateReceivedShare(link: string, params: DelegateReceivedShareParams): Promise<Result<DelegatedShareAccess, DelegationError>>;
+    /**
+     * The child-delegation WASM boundary accepts action-only abilities. Reject
+     * every constrained parent branch before that boundary can broaden it.
+     */
+    private assertDelegationCaveatsPreservable;
     /**
      * Encode sharing data into a link string.
      *
@@ -4783,6 +5155,7 @@ interface AccountServiceConfig {
     getPrimarySpaceId: () => string | undefined;
     getAccountSpaceId: () => string | undefined;
     getSpaces: () => ISpaceService;
+    getDelegationManager?: () => Pick<DelegationManager, "query" | "revoke">;
     getAccountDb?: () => IDatabaseHandle | undefined;
     ensureAccountSpaceHosted?: () => Promise<void>;
 }
@@ -4804,8 +5177,9 @@ declare class AccountService {
         remove: (spaceId: string) => Promise<Result$1<void>>;
     };
     readonly delegations: {
+        query: (options?: AccountDelegationQueryOptions) => Promise<Result$1<AccountDelegationPage>>;
         list: (options?: AccountDelegationListOptions) => Promise<Result$1<AccountDelegation[]>>;
-        revoke: (options: AccountDelegationRevokeOptions) => Promise<Result$1<void>>;
+        revoke: (input: string | AccountDelegationRevokeOptions) => Promise<Result$1<DelegationRevocationReceipt | void>>;
     };
     readonly index: {
         ensure: () => Promise<Result$1<AccountIndexEnsureResult>>;
@@ -5070,4 +5444,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountDelegation, type AccountDelegationListOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityEntry, CapabilityKeyRegistry, type CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, type CreateDelegationParams, type CreateDelegationWasmParams, type CreateDelegationWasmResult, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, type DelegateReceivedShareParams, type DelegatedResource, type DelegatedShareAccess, type Delegation, type DelegationApiResponse, type DelegationChain, type DelegationChainV2, type DelegationDirection, type DelegationError, type DelegationErrorCode, DelegationErrorCodes, type DelegationFilters, DelegationManager, type DelegationManagerConfig, type DelegationRecord, type Result as DelegationResult, type DelegationStatus, type DidCacheKeyOptions, type DidEqualsOptions, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EncodedShareData, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type GenerateShareParams, type ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, type ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type IngestOptions, type JWK, type KeyInfo, type KeyProvider, type KeyType, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ReceiveOptions, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, type ShareAccess, type ShareLink, type ShareLinkData, type ShareSchema, SharingService, type SharingServiceConfig, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, type SpaceInfo, type SpaceOwnership, SpaceService, type SpaceServiceConfig, type StoredDelegationChain, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidationError, VersionCheckError, type WasmRecapEntry, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountDelegation, type AccountDelegationListOptions, type AccountDelegationPage, type AccountDelegationQueryOptions, type AccountDelegationRecord, type AccountDelegationResource, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityEntry, CapabilityKeyRegistry, type CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, type CreateDelegationParams, type CreateDelegationWasmParams, type CreateDelegationWasmResult, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, type DelegateReceivedShareParams, type DelegatedResource, type DelegatedShareAccess, type Delegation, type DelegationApiResponse, type DelegationChain, type DelegationChainV2, type DelegationDirection, type DelegationError, type DelegationErrorCode, DelegationErrorCodes, type DelegationFilters, DelegationManager, type DelegationManagerConfig, type DelegationRecord, type Result as DelegationResult, type DelegationRevocationReceipt, type DelegationStatus, type DidCacheKeyOptions, type DidEqualsOptions, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EncodedShareData, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type GenerateShareParams, type ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, type ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type IngestOptions, type JWK, type KeyInfo, type KeyProvider, type KeyType, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ReceiveOptions, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, type ShareAccess, type ShareLink, type ShareLinkData, type ShareSchema, SharingService, type SharingServiceConfig, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, type SpaceInfo, type SpaceOwnership, SpaceService, type SpaceServiceConfig, type StoredDelegationChain, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VersionCheckError, type WasmRecapEntry, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };