@tinycloud/sdk-core 2.9.0 → 2.10.0-beta.1

package/dist/index.d.cts

@@ -1,7 +1,9 @@
 import { z } from 'zod';
-import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result as Result$1, ServiceSession, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
-export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
+import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, ServiceSession, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
+export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DecryptTransportResponseError, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVBatchReadResponse, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultNetworkReadResult, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { HOLDER_KEY_BINDING_PRESENTATION_SCHEMA, HolderKeyBindingPresentation, LISTEN_SQL_STATEMENT_CATALOG, ListenSqlStatementName, POLICY_ENGINE_CHALLENGE_REQUEST_SCHEMA, POLICY_ENGINE_CHALLENGE_RESPONSE_SCHEMA, POLICY_ENGINE_DENIAL_SCHEMA, POLICY_ENGINE_GRANT_PRESENTATION_DENIAL_CODES, POLICY_ENGINE_RESOLVE_REQUEST_SCHEMA, PORTABLE_DELEGATION_SCHEMA, PolicyEngineGrantPresentationDenialCode, PortableDelegation, REQUESTER_ENGINE_RETRY_ATTEMPTS, REQUESTER_ENGINE_RETRY_MAX_DELAY_MS, REQUESTER_NEAR_EXPIRY_SECONDS, RequesterEndpointResolution, RequesterHttpRequest, RequesterHttpResponse, RequesterInvocationCapability, RequesterSigningCapability, RequesterTransport, TranscriptRequester, TranscriptRequesterError, TranscriptRequesterErrorCode, TranscriptRequesterErrorState, TranscriptRequesterOptions, TranscriptRequesterReadKvResult, TranscriptRequesterReadSqlResult, createTranscriptRequester, deriveDelegationCid, parseNodeNativePortableDelegation } from './requester/index.cjs';
+import { m as Delegation, e as CreateDelegationParams, G as GenerateShareParams, az as ShareLink, b8 as SpaceInfo, I as ICapabilityKeyRegistry, y as ISharingService, D as DelegationManager, b as AccountDelegationQueryOptions, A as AccountDelegationPage, w as DelegationRevocationReceipt } from './recipient-types.schema-B2wH53_t.cjs';
+export { c as AccountDelegationRecord, d as AccountDelegationResource, C as CapabilityEntry, bH as CapabilityKeyRegistry, bI as CapabilityKeyRegistryErrorCode, bJ as CapabilityKeyRegistryErrorCodes, f as CreateDelegationWasmParams, g as CreateDelegationWasmResult, h as CreateOwnerDelegationParams, i as DelegateReceivedShareParams, j as DelegatedResource, k as DelegatedShareAccess, l as DelegatedShareKey, n as DelegationApiResponse, o as DelegationChain, p as DelegationChainV2, q as DelegationDirection, a as DelegationError, r as DelegationErrorCode, s as DelegationErrorCodes, t as DelegationFilters, u as DelegationManagerConfig, v as DelegationRecord, R as DelegationResult, x as DelegationStatus, E as EncodedShareData, z as IngestOptions, J as JWK, K as KeyInfo, B as KeyProvider, F as KeyType, M as MAX_CONTENT_BYTES, H as MAX_SEALED_SHARE_CONTENT_BYTES, L as MAX_SHARE_ARTIFACT_BYTES, N as MAX_SHARE_CONTENT_BYTES, O as MemorySenderShareKeyStorage, P as MemorySenderShareRecordStorage, Q as MemoryShareCache, S as OwnerDelegationReceipt, T as OwnerShareAction, U as OwnerShareMatcher, V as OwnerSharePolicyRegistration, W as OwnerSharePolicyRegistrationReceipt, X as OwnerSharePolicyV2, Y as ReceiveOptions, Z as RegisterOwnerSharePolicyParams, _ as SHARE_DELIVERY_AUTHORIZATION_DOMAIN, $ as SenderShareKeyStorage, a0 as SenderShareRecord, a1 as SenderShareRecordStorage, a2 as SenderShareRevocationScope, a3 as SenderShareStore, a4 as ShareAccess, a5 as ShareAccessError, a6 as ShareAccessV2, a7 as ShareAction, a9 as ShareAddressedDelegationEnvelopeV2, aa as ShareAddressedDelegationEnvelopeV2Schema, ab as ShareAddressedDelegationRequestV2, ac as ShareAddressedDelegationRequestV2Schema, ad as ShareAddressedDelegationResponseV2, ae as ShareAddressedDelegationResponseV2Schema, af as ShareAddressedRecipientMatcher, ag as ShareArtifactInput, ah as ShareArtifactResult, ai as ShareArtifactV2, aj as ShareCache, ak as ShareCacheEntry, al as ShareCacheKey, am as ShareCacheMetadata, an as ShareCapabilityLike, ao as ShareConflict, ap as ShareContentMetadata, aq as ShareContentSource, ar as ShareDeliveryAuthorization, as as ShareDeliveryAuthorizationReceipt, at as ShareDeliveryAuthorizationRequest, au as ShareDetachedProof, av as ShareEnvelopeError, aw as ShareEnvelopeV2, ax as ShareExpiryBounds, ay as ShareKvContentSource, aA as ShareLinkData, aB as ShareLinkLocation, aC as ShareListEntry, aD as ShareListResult, aE as ShareNativeAction, aF as ShareNativeInvokeEnvelopeV1, aG as ShareNativeInvokeErrorResult, aH as ShareNativeInvokeInput, aI as ShareNativeInvokeResult, aJ as ShareNativeInvokeSuccessResult, aK as ShareNativeResponse, aL as ShareNativeResponseSchema, aM as SharePolicy, aN as SharePolicyBinding, aO as SharePolicySession, aP as SharePolicySessionV1, aQ as SharePolicySessionWireV1, aR as ShareReadInvocationV1, aS as ShareReadResult, aT as ShareRecipientClient, aU as ShareRecipientClientOptions, aW as ShareRecipientPolicy, aY as ShareRecipientResult, aZ as ShareRecipientTarget, a$ as ShareResource, b1 as ShareSaveOptions, b2 as ShareSchema, b3 as ShareSqlContentSource, b4 as ShareWireAction, b5 as SharingService, b6 as SharingServiceConfig, b7 as SignedDelegation, b9 as SpaceOwnership, bK as StoredDelegationChain, ba as ValidateShareDeliveryAuthorizationExpected, bb as VerifyShareEnvelopeOptions, bc as canonicalOwnerSharePolicy, bd as computeOwnerShareRegistrationCid, be as computeShareCid, bL as createCapabilityKeyRegistry, bf as createDelegatedShareKey, bg as createPolicyEnforcementDelegation, bh as createShareArtifact, bi as createShareArtifactAsync, bj as createSharePolicy, bk as createSharingService, bl as decryptShareBytesAsync, bm as encodeInlineShareUrl, bn as encodeShareArtifact, bo as encodeShareUrl, bp as encryptShareBytes, bq as encryptShareBytesAsync, br as intersectShareCapabilities, bs as isV2ShareLink, bt as normalizeShareActions, bu as normalizeShareRecipientTarget, bv as normalizeShareResource, bw as parseShareArtifact, bx as parseShareUrl, by as restoreDelegatedShareKey, bz as shareCapabilityAllows, bA as shareDeliveryTrustedKid, bB as signShareEnvelope, bC as validateOwnerSharePolicyRegistration, bD as validateOwnerSharePolicyRegistrationBytes, bE as validateShareDeliveryAuthorizationBytes, bF as verifyShareCid, bG as verifyShareEnvelope } from './recipient-types.schema-B2wH53_t.cjs';
 export { ACCOUNT_INDEX_SCHEMA, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, CAPABILITIES, CAPABILITY_REGISTRY, CapabilityRegistryEntry, CapabilityStatus, DUCKDB, ENCRYPTION, HOOKS, KV, SECRET_RECORDS_SCHEMA, SPACE, SQL, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { E as ED25519_JCS_SIGNATURE_SUITE, b as EIP191_JCS_SIGNATURE_SUITE, J as JsonObject, c as POLICY_ENGINE_RECORD_SCHEMA, d as POLICY_SCHEMA, e as POLICY_STATUS_SCHEMA, a as Policy, P as PolicyEngineRecord, f as PolicyStatus, g as SignatureMaterialError, h as SignatureSuite, i as SignatureVerificationError, j as SignedObjectCanonicalizationError, k as SignedObjectDigestError, l as SignedObjectErrorCode, m as SignedObjectIdError, n as SignedObjectKind, o as SignedObjectMaterial, p as SignedObjectProfileError, q as SignedObjectSchemaError, r as SignedObjectSignature, S as SignedObjectSigner, s as SignedObjectVerificationResult, t as SignedPolicyObject, u as SigningKeyBindingError, v as UnsignedPolicy, U as UnsignedPolicyEngineRecord, w as UnsignedPolicyObject, x as UnsignedPolicyStatus, y as UnsupportedSignatureSuiteError, z as canonicalizeSignedObjectUnsigned, A as createAndSignPolicy, B as createAndSignPolicyEngineRecord, C as createAndSignPolicyStatus, D as createAndSignSignedObject, F as deriveSignedObjectMaterial, G as signedObjectIdFor, H as toSignedObjectError, I as validatePolicyEngineRecordSigned, K as validatePolicyEngineRecordSignedShape, L as validatePolicyEngineRecordUnsigned, M as validatePolicySigned, N as validatePolicySignedShape, O as validatePolicyStatusSigned, Q as validatePolicyStatusSignedShape, R as validatePolicyStatusUnsigned, T as validatePolicyUnsigned, V as verifyPolicy, W as verifyPolicyEngineRecord, X as verifyPolicyStatus, Y as verifySignedObject } from './signed-object-IMAm5a32.cjs';
 export { a as JsonValue, j as jcsCanonicalize, n as normalizeJson, s as serializeJcsJson } from './capability-BjzXwtNw.cjs';
@@ -986,18 +988,18 @@ declare const PersistedTinyCloudSessionSchema: z.ZodObject<{
     verificationMethod: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     spaceId: string;
+    delegationCid: string;
     delegationHeader: {
         Authorization: string;
     };
-    delegationCid: string;
     verificationMethod: string;
     spaces?: Record<string, string> | undefined;
 }, {
     spaceId: string;
+    delegationCid: string;
     delegationHeader: {
         Authorization: string;
     };
-    delegationCid: string;
     verificationMethod: string;
     spaces?: Record<string, string> | undefined;
 }>;
@@ -1038,18 +1040,18 @@ declare const PersistedSessionDataSchema: z.ZodObject<{
         verificationMethod: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         spaceId: string;
+        delegationCid: string;
         delegationHeader: {
             Authorization: string;
         };
-        delegationCid: string;
         verificationMethod: string;
         spaces?: Record<string, string> | undefined;
     }, {
         spaceId: string;
+        delegationCid: string;
         delegationHeader: {
             Authorization: string;
         };
-        delegationCid: string;
         verificationMethod: string;
         spaces?: Record<string, string> | undefined;
     }>>;
@@ -1095,10 +1097,10 @@ declare const PersistedSessionDataSchema: z.ZodObject<{
     } | undefined;
     tinycloudSession?: {
         spaceId: string;
+        delegationCid: string;
         delegationHeader: {
             Authorization: string;
         };
-        delegationCid: string;
         verificationMethod: string;
         spaces?: Record<string, string> | undefined;
     } | undefined;
@@ -1118,10 +1120,10 @@ declare const PersistedSessionDataSchema: z.ZodObject<{
     } | undefined;
     tinycloudSession?: {
         spaceId: string;
+        delegationCid: string;
         delegationHeader: {
             Authorization: string;
         };
-        delegationCid: string;
         verificationMethod: string;
         spaces?: Record<string, string> | undefined;
     } | undefined;
@@ -1169,14 +1171,14 @@ declare const TinyCloudSessionSchema: z.ZodObject<{
     siwe: string;
     signature: string;
     spaceId: string;
+    jwk: {} & {
+        [k: string]: unknown;
+    };
+    delegationCid: string;
     delegationHeader: {
         Authorization: string;
     };
-    delegationCid: string;
     verificationMethod: string;
-    jwk: {} & {
-        [k: string]: unknown;
-    };
     spaces?: Record<string, string> | undefined;
 }, {
     chainId: number;
@@ -1185,14 +1187,14 @@ declare const TinyCloudSessionSchema: z.ZodObject<{
     siwe: string;
     signature: string;
     spaceId: string;
+    jwk: {} & {
+        [k: string]: unknown;
+    };
+    delegationCid: string;
     delegationHeader: {
         Authorization: string;
     };
-    delegationCid: string;
     verificationMethod: string;
-    jwk: {} & {
-        [k: string]: unknown;
-    };
     spaces?: Record<string, string> | undefined;
 }>;
 type TinyCloudSession = z.infer<typeof TinyCloudSessionSchema>;
@@ -1223,2088 +1225,53 @@ interface ValidationError extends ServiceError {
  * }
  * ```
  */
-declare function validatePersistedSessionData(data: unknown): Result$1<PersistedSessionData, ValidationError>;
+declare function validatePersistedSessionData(data: unknown): Result<PersistedSessionData, ValidationError>;
 
 /**
  * Session storage types and interfaces.
  *
  * Types are derived from Zod schemas in storage.schema.ts.
  *
- * @packageDocumentation
- */
-
-/**
- * Session storage interface.
- *
- * Abstracts how sessions are persisted across different platforms.
- * - Browser: localStorage
- * - Node.js: file system or memory
- */
-interface ISessionStorage {
-    /**
-     * Save a session for an address.
-     * @param address - Ethereum address (key for lookup)
-     * @param session - Session data to persist
-     */
-    save(address: string, session: PersistedSessionData): Promise<void>;
-    /**
-     * Load a session for an address.
-     * @param address - Ethereum address
-     * @returns Session data or null if not found
-     */
-    load(address: string): Promise<PersistedSessionData | null>;
-    /**
-     * Clear a session for an address.
-     * @param address - Ethereum address
-     */
-    clear(address: string): Promise<void>;
-    /**
-     * Check if a session exists for an address (synchronous check).
-     * @param address - Ethereum address
-     * @returns true if session exists
-     */
-    exists(address: string): boolean;
-    /**
-     * Check if the storage backend is available.
-     * @returns true if storage can be used
-     */
-    isAvailable(): boolean;
-}
-
-/**
- * Zod schemas for delegation management types.
- *
- * These schemas provide runtime validation for delegation, capability key management,
- * and sharing link functionality. Types are derived from schemas using z.infer<>.
- *
- * @packageDocumentation
- */
-
-/**
- * Result type pattern for delegation operations.
- */
-type Result<T, E = DelegationError> = {
-    ok: true;
-    data: T;
-} | {
-    ok: false;
-    error: E;
-};
-/**
- * JSON Web Key representation for cryptographic keys.
- * Follows the JWK specification (RFC 7517).
- */
-declare const JWKSchema: z.ZodObject<{
-    /** Key type (e.g., "EC", "RSA", "OKP") */
-    kty: z.ZodString;
-    /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
-    crv: z.ZodOptional<z.ZodString>;
-    /** X coordinate for EC keys, public key for OKP */
-    x: z.ZodOptional<z.ZodString>;
-    /** Y coordinate for EC keys */
-    y: z.ZodOptional<z.ZodString>;
-    /** Private key value (d parameter) */
-    d: z.ZodOptional<z.ZodString>;
-    /** Public exponent for RSA keys */
-    e: z.ZodOptional<z.ZodString>;
-    /** Modulus for RSA keys */
-    n: z.ZodOptional<z.ZodString>;
-    /** Key ID */
-    kid: z.ZodOptional<z.ZodString>;
-    /** Algorithm */
-    alg: z.ZodOptional<z.ZodString>;
-    /** Key use (e.g., "sig", "enc") */
-    use: z.ZodOptional<z.ZodString>;
-    /** Key operations (e.g., ["sign", "verify"]) */
-    key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-}, "strip", z.ZodTypeAny, {
-    kty: string;
-    crv?: string | undefined;
-    x?: string | undefined;
-    y?: string | undefined;
-    d?: string | undefined;
-    e?: string | undefined;
-    n?: string | undefined;
-    kid?: string | undefined;
-    alg?: string | undefined;
-    use?: string | undefined;
-    key_ops?: string[] | undefined;
-}, {
-    kty: string;
-    crv?: string | undefined;
-    x?: string | undefined;
-    y?: string | undefined;
-    d?: string | undefined;
-    e?: string | undefined;
-    n?: string | undefined;
-    kid?: string | undefined;
-    alg?: string | undefined;
-    use?: string | undefined;
-    key_ops?: string[] | undefined;
-}>;
-type JWK = z.infer<typeof JWKSchema>;
-/**
- * Type of key in the capability registry.
- */
-declare const KeyTypeSchema: z.ZodEnum<["main", "session", "ingested"]>;
-type KeyType = z.infer<typeof KeyTypeSchema>;
-/**
- * Information about a cryptographic key used for delegations.
- */
-declare const KeyInfoSchema: z.ZodObject<{
-    /** Unique identifier for this key */
-    id: z.ZodString;
-    /** DID associated with this key */
-    did: z.ZodString;
-    /** Type of key determining its authority level */
-    type: z.ZodEnum<["main", "session", "ingested"]>;
-    /** Private key in JWK format */
-    jwk: z.ZodOptional<z.ZodObject<{
-        /** Key type (e.g., "EC", "RSA", "OKP") */
-        kty: z.ZodString;
-        /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
-        crv: z.ZodOptional<z.ZodString>;
-        /** X coordinate for EC keys, public key for OKP */
-        x: z.ZodOptional<z.ZodString>;
-        /** Y coordinate for EC keys */
-        y: z.ZodOptional<z.ZodString>;
-        /** Private key value (d parameter) */
-        d: z.ZodOptional<z.ZodString>;
-        /** Public exponent for RSA keys */
-        e: z.ZodOptional<z.ZodString>;
-        /** Modulus for RSA keys */
-        n: z.ZodOptional<z.ZodString>;
-        /** Key ID */
-        kid: z.ZodOptional<z.ZodString>;
-        /** Algorithm */
-        alg: z.ZodOptional<z.ZodString>;
-        /** Key use (e.g., "sig", "enc") */
-        use: z.ZodOptional<z.ZodString>;
-        /** Key operations (e.g., ["sign", "verify"]) */
-        key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    }, "strip", z.ZodTypeAny, {
-        kty: string;
-        crv?: string | undefined;
-        x?: string | undefined;
-        y?: string | undefined;
-        d?: string | undefined;
-        e?: string | undefined;
-        n?: string | undefined;
-        kid?: string | undefined;
-        alg?: string | undefined;
-        use?: string | undefined;
-        key_ops?: string[] | undefined;
-    }, {
-        kty: string;
-        crv?: string | undefined;
-        x?: string | undefined;
-        y?: string | undefined;
-        d?: string | undefined;
-        e?: string | undefined;
-        n?: string | undefined;
-        kid?: string | undefined;
-        alg?: string | undefined;
-        use?: string | undefined;
-        key_ops?: string[] | undefined;
-    }>>;
-    /** Priority for key selection (lower = higher priority) */
-    priority: z.ZodNumber;
-}, "strip", z.ZodTypeAny, {
-    type: "session" | "main" | "ingested";
-    did: string;
-    id: string;
-    priority: number;
-    jwk?: {
-        kty: string;
-        crv?: string | undefined;
-        x?: string | undefined;
-        y?: string | undefined;
-        d?: string | undefined;
-        e?: string | undefined;
-        n?: string | undefined;
-        kid?: string | undefined;
-        alg?: string | undefined;
-        use?: string | undefined;
-        key_ops?: string[] | undefined;
-    } | undefined;
-}, {
-    type: "session" | "main" | "ingested";
-    did: string;
-    id: string;
-    priority: number;
-    jwk?: {
-        kty: string;
-        crv?: string | undefined;
-        x?: string | undefined;
-        y?: string | undefined;
-        d?: string | undefined;
-        e?: string | undefined;
-        n?: string | undefined;
-        kid?: string | undefined;
-        alg?: string | undefined;
-        use?: string | undefined;
-        key_ops?: string[] | undefined;
-    } | undefined;
-}>;
-type KeyInfo = z.infer<typeof KeyInfoSchema>;
-/**
- * Error type for delegation operations.
- */
-declare const DelegationErrorSchema: z.ZodObject<{
-    /** Error code for programmatic handling */
-    code: z.ZodString;
-    /** Human-readable error message */
-    message: z.ZodString;
-    /** The service that produced the error */
-    service: z.ZodLiteral<"delegation">;
-    /** Original error if wrapping another error */
-    cause: z.ZodOptional<z.ZodType<Error, z.ZodTypeDef, Error>>;
-    /** Additional metadata about the error */
-    meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-}, "strip", z.ZodTypeAny, {
-    code: string;
-    message: string;
-    service: "delegation";
-    cause?: Error | undefined;
-    meta?: Record<string, unknown> | undefined;
-}, {
-    code: string;
-    message: string;
-    service: "delegation";
-    cause?: Error | undefined;
-    meta?: Record<string, unknown> | undefined;
-}>;
-type DelegationError = z.infer<typeof DelegationErrorSchema>;
-/**
- * Error codes for delegation operations.
- */
-declare const DelegationErrorCodes: {
-    readonly AUTH_REQUIRED: "AUTH_REQUIRED";
-    readonly AUTH_EXPIRED: "AUTH_EXPIRED";
-    readonly NOT_INITIALIZED: "NOT_INITIALIZED";
-    readonly NOT_FOUND: "NOT_FOUND";
-    readonly REVOKED: "REVOKED";
-    readonly NETWORK_ERROR: "NETWORK_ERROR";
-    readonly TIMEOUT: "TIMEOUT";
-    readonly ABORTED: "ABORTED";
-    readonly INVALID_INPUT: "INVALID_INPUT";
-    readonly PERMISSION_DENIED: "PERMISSION_DENIED";
-    readonly CREATION_FAILED: "CREATION_FAILED";
-    readonly REVOCATION_FAILED: "REVOCATION_FAILED";
-    readonly INVALID_TOKEN: "INVALID_TOKEN";
-    readonly KV_SERVICE_UNAVAILABLE: "KV_SERVICE_UNAVAILABLE";
-    readonly DATA_FETCH_FAILED: "DATA_FETCH_FAILED";
-    readonly VALIDATION_ERROR: "VALIDATION_ERROR";
-};
-type DelegationErrorCode = (typeof DelegationErrorCodes)[keyof typeof DelegationErrorCodes];
-/**
- * Represents a delegation from one DID to another.
- */
-declare const DelegationSchema: z.ZodObject<{
-    /** Content identifier (CID) of the delegation */
-    cid: z.ZodString;
-    /** DID of the delegate (the party receiving the delegation) */
-    delegateDID: z.ZodString;
-    /** Space ID this delegation applies to */
-    spaceId: z.ZodString;
-    /** Resource path this delegation grants access to */
-    path: z.ZodString;
-    /** Actions this delegation authorizes */
-    actions: z.ZodArray<z.ZodString, "many">;
-    /** Exact ReCap caveats that constrain every action in this scope. */
-    caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
-    /** When this delegation expires (accepts Date or ISO string from JSON) */
-    expiry: z.ZodDate;
-    /** Whether this delegation has been revoked */
-    isRevoked: z.ZodBoolean;
-    /** DID of the delegator (the party granting the delegation) */
-    delegatorDID: z.ZodOptional<z.ZodString>;
-    /** When this delegation was created (accepts Date or ISO string from JSON) */
-    createdAt: z.ZodOptional<z.ZodDate>;
-    /** Parent delegation CID if this is a sub-delegation */
-    parentCid: z.ZodOptional<z.ZodString>;
-    /** Whether sub-delegation is allowed */
-    allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
-    /** Authorization header (UCAN bearer token) */
-    authHeader: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    path: string;
-    expiry: Date;
-    actions: string[];
-    spaceId: string;
-    cid: string;
-    delegateDID: string;
-    isRevoked: boolean;
-    caveats?: Record<string, unknown>[] | undefined;
-    createdAt?: Date | undefined;
-    delegatorDID?: string | undefined;
-    parentCid?: string | undefined;
-    allowSubDelegation?: boolean | undefined;
-    authHeader?: string | undefined;
-}, {
-    path: string;
-    expiry: Date;
-    actions: string[];
-    spaceId: string;
-    cid: string;
-    delegateDID: string;
-    isRevoked: boolean;
-    caveats?: Record<string, unknown>[] | undefined;
-    createdAt?: Date | undefined;
-    delegatorDID?: string | undefined;
-    parentCid?: string | undefined;
-    allowSubDelegation?: boolean | undefined;
-    authHeader?: string | undefined;
-}>;
-type Delegation = z.infer<typeof DelegationSchema>;
-/** Node-confirmed lifecycle state for one delegation. */
-declare const DelegationStatusSchema: z.ZodEffects<z.ZodObject<{
-    cid: z.ZodString;
-    status: z.ZodEnum<["active", "revoked", "expired", "unavailable", "not_found"]>;
-    exists: z.ZodBoolean;
-    active: z.ZodBoolean;
-    revoked: z.ZodBoolean;
-    expired: z.ZodBoolean;
-}, "strict", z.ZodTypeAny, {
-    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
-    active: boolean;
-    revoked: boolean;
-    cid: string;
-    expired: boolean;
-    exists: boolean;
-}, {
-    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
-    active: boolean;
-    revoked: boolean;
-    cid: string;
-    expired: boolean;
-    exists: boolean;
-}>, {
-    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
-    active: boolean;
-    revoked: boolean;
-    cid: string;
-    expired: boolean;
-    exists: boolean;
-}, {
-    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
-    active: boolean;
-    revoked: boolean;
-    cid: string;
-    expired: boolean;
-    exists: boolean;
-}>;
-type DelegationStatus = z.infer<typeof DelegationStatusSchema>;
-declare const DelegationRevocationReceiptSchema: z.ZodObject<{
-    revoked: z.ZodLiteral<true>;
-    cid: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    revoked: true;
-    cid: string;
-}, {
-    revoked: true;
-    cid: string;
-}>;
-type DelegationRevocationReceipt = z.infer<typeof DelegationRevocationReceiptSchema>;
-declare const AccountDelegationResourceSchema: z.ZodObject<{
-    resource: z.ZodString;
-    actions: z.ZodArray<z.ZodString, "many">;
-    caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
-}, "strict", z.ZodTypeAny, {
-    actions: string[];
-    caveats: Record<string, unknown>[];
-    resource: string;
-}, {
-    actions: string[];
-    caveats: Record<string, unknown>[];
-    resource: string;
-}>;
-declare const AccountDelegationRecordSchema: z.ZodObject<{
-    cid: z.ZodString;
-    direction: z.ZodEnum<["granted", "received"]>;
-    delegatorDid: z.ZodString;
-    delegateDid: z.ZodString;
-    resources: z.ZodArray<z.ZodObject<{
-        resource: z.ZodString;
-        actions: z.ZodArray<z.ZodString, "many">;
-        caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
-    }, "strict", z.ZodTypeAny, {
-        actions: string[];
-        caveats: Record<string, unknown>[];
-        resource: string;
-    }, {
-        actions: string[];
-        caveats: Record<string, unknown>[];
-        resource: string;
-    }>, "many">;
-    parents: z.ZodArray<z.ZodString, "many">;
-    issuedAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
-    notBefore: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
-    expiresAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
-    status: z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>;
-    revokedAt: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>>;
-    revokedBy: z.ZodOptional<z.ZodString>;
-    revokedAncestorCid: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
-    notBefore: Date | null;
-    resources: {
-        actions: string[];
-        caveats: Record<string, unknown>[];
-        resource: string;
-    }[];
-    expiresAt: Date | null;
-    issuedAt: Date | null;
-    cid: string;
-    direction: "received" | "granted";
-    delegatorDid: string;
-    delegateDid: string;
-    parents: string[];
-    revokedAt?: Date | null | undefined;
-    revokedBy?: string | undefined;
-    revokedAncestorCid?: string | undefined;
-}, {
-    status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
-    notBefore: string | null;
-    resources: {
-        actions: string[];
-        caveats: Record<string, unknown>[];
-        resource: string;
-    }[];
-    expiresAt: string | null;
-    issuedAt: string | null;
-    cid: string;
-    direction: "received" | "granted";
-    delegatorDid: string;
-    delegateDid: string;
-    parents: string[];
-    revokedAt?: string | null | undefined;
-    revokedBy?: string | undefined;
-    revokedAncestorCid?: string | undefined;
-}>;
-declare const AccountDelegationPageSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<2>;
-    items: z.ZodArray<z.ZodObject<{
-        cid: z.ZodString;
-        direction: z.ZodEnum<["granted", "received"]>;
-        delegatorDid: z.ZodString;
-        delegateDid: z.ZodString;
-        resources: z.ZodArray<z.ZodObject<{
-            resource: z.ZodString;
-            actions: z.ZodArray<z.ZodString, "many">;
-            caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
-        }, "strict", z.ZodTypeAny, {
-            actions: string[];
-            caveats: Record<string, unknown>[];
-            resource: string;
-        }, {
-            actions: string[];
-            caveats: Record<string, unknown>[];
-            resource: string;
-        }>, "many">;
-        parents: z.ZodArray<z.ZodString, "many">;
-        issuedAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
-        notBefore: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
-        expiresAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
-        status: z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>;
-        revokedAt: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>>;
-        revokedBy: z.ZodOptional<z.ZodString>;
-        revokedAncestorCid: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
-        notBefore: Date | null;
-        resources: {
-            actions: string[];
-            caveats: Record<string, unknown>[];
-            resource: string;
-        }[];
-        expiresAt: Date | null;
-        issuedAt: Date | null;
-        cid: string;
-        direction: "received" | "granted";
-        delegatorDid: string;
-        delegateDid: string;
-        parents: string[];
-        revokedAt?: Date | null | undefined;
-        revokedBy?: string | undefined;
-        revokedAncestorCid?: string | undefined;
-    }, {
-        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
-        notBefore: string | null;
-        resources: {
-            actions: string[];
-            caveats: Record<string, unknown>[];
-            resource: string;
-        }[];
-        expiresAt: string | null;
-        issuedAt: string | null;
-        cid: string;
-        direction: "received" | "granted";
-        delegatorDid: string;
-        delegateDid: string;
-        parents: string[];
-        revokedAt?: string | null | undefined;
-        revokedBy?: string | undefined;
-        revokedAncestorCid?: string | undefined;
-    }>, "many">;
-    nextCursor: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    schemaVersion: 2;
-    items: {
-        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
-        notBefore: Date | null;
-        resources: {
-            actions: string[];
-            caveats: Record<string, unknown>[];
-            resource: string;
-        }[];
-        expiresAt: Date | null;
-        issuedAt: Date | null;
-        cid: string;
-        direction: "received" | "granted";
-        delegatorDid: string;
-        delegateDid: string;
-        parents: string[];
-        revokedAt?: Date | null | undefined;
-        revokedBy?: string | undefined;
-        revokedAncestorCid?: string | undefined;
-    }[];
-    nextCursor?: string | undefined;
-}, {
-    schemaVersion: 2;
-    items: {
-        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
-        notBefore: string | null;
-        resources: {
-            actions: string[];
-            caveats: Record<string, unknown>[];
-            resource: string;
-        }[];
-        expiresAt: string | null;
-        issuedAt: string | null;
-        cid: string;
-        direction: "received" | "granted";
-        delegatorDid: string;
-        delegateDid: string;
-        parents: string[];
-        revokedAt?: string | null | undefined;
-        revokedBy?: string | undefined;
-        revokedAncestorCid?: string | undefined;
-    }[];
-    nextCursor?: string | undefined;
-}>;
-type AccountDelegationResource = z.infer<typeof AccountDelegationResourceSchema>;
-type AccountDelegationRecord = z.infer<typeof AccountDelegationRecordSchema>;
-type AccountDelegationPage = z.infer<typeof AccountDelegationPageSchema>;
-declare const AccountDelegationQueryOptionsSchema: z.ZodObject<{
-    direction: z.ZodOptional<z.ZodEnum<["granted", "received", "all"]>>;
-    status: z.ZodOptional<z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>>;
-    space: z.ZodOptional<z.ZodString>;
-    limit: z.ZodOptional<z.ZodNumber>;
-    cursor: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    status?: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked" | undefined;
-    space?: string | undefined;
-    direction?: "received" | "all" | "granted" | undefined;
-    limit?: number | undefined;
-    cursor?: string | undefined;
-}, {
-    status?: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked" | undefined;
-    space?: string | undefined;
-    direction?: "received" | "all" | "granted" | undefined;
-    limit?: number | undefined;
-    cursor?: string | undefined;
-}>;
-type AccountDelegationQueryOptions = z.infer<typeof AccountDelegationQueryOptionsSchema>;
-/**
- * Entry in the capability registry mapping a capability to available keys.
- */
-declare const CapabilityEntrySchema: z.ZodObject<{
-    /** Resource URI this capability applies to */
-    resource: z.ZodString;
-    /** Action this capability authorizes */
-    action: z.ZodString;
-    /** Keys that can exercise this capability, ordered by priority */
-    keys: z.ZodArray<z.ZodObject<{
-        /** Unique identifier for this key */
-        id: z.ZodString;
-        /** DID associated with this key */
-        did: z.ZodString;
-        /** Type of key determining its authority level */
-        type: z.ZodEnum<["main", "session", "ingested"]>;
-        /** Private key in JWK format */
-        jwk: z.ZodOptional<z.ZodObject<{
-            /** Key type (e.g., "EC", "RSA", "OKP") */
-            kty: z.ZodString;
-            /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
-            crv: z.ZodOptional<z.ZodString>;
-            /** X coordinate for EC keys, public key for OKP */
-            x: z.ZodOptional<z.ZodString>;
-            /** Y coordinate for EC keys */
-            y: z.ZodOptional<z.ZodString>;
-            /** Private key value (d parameter) */
-            d: z.ZodOptional<z.ZodString>;
-            /** Public exponent for RSA keys */
-            e: z.ZodOptional<z.ZodString>;
-            /** Modulus for RSA keys */
-            n: z.ZodOptional<z.ZodString>;
-            /** Key ID */
-            kid: z.ZodOptional<z.ZodString>;
-            /** Algorithm */
-            alg: z.ZodOptional<z.ZodString>;
-            /** Key use (e.g., "sig", "enc") */
-            use: z.ZodOptional<z.ZodString>;
-            /** Key operations (e.g., ["sign", "verify"]) */
-            key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        }, "strip", z.ZodTypeAny, {
-            kty: string;
-            crv?: string | undefined;
-            x?: string | undefined;
-            y?: string | undefined;
-            d?: string | undefined;
-            e?: string | undefined;
-            n?: string | undefined;
-            kid?: string | undefined;
-            alg?: string | undefined;
-            use?: string | undefined;
-            key_ops?: string[] | undefined;
-        }, {
-            kty: string;
-            crv?: string | undefined;
-            x?: string | undefined;
-            y?: string | undefined;
-            d?: string | undefined;
-            e?: string | undefined;
-            n?: string | undefined;
-            kid?: string | undefined;
-            alg?: string | undefined;
-            use?: string | undefined;
-            key_ops?: string[] | undefined;
-        }>>;
-        /** Priority for key selection (lower = higher priority) */
-        priority: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        type: "session" | "main" | "ingested";
-        did: string;
-        id: string;
-        priority: number;
-        jwk?: {
-            kty: string;
-            crv?: string | undefined;
-            x?: string | undefined;
-            y?: string | undefined;
-            d?: string | undefined;
-            e?: string | undefined;
-            n?: string | undefined;
-            kid?: string | undefined;
-            alg?: string | undefined;
-            use?: string | undefined;
-            key_ops?: string[] | undefined;
-        } | undefined;
-    }, {
-        type: "session" | "main" | "ingested";
-        did: string;
-        id: string;
-        priority: number;
-        jwk?: {
-            kty: string;
-            crv?: string | undefined;
-            x?: string | undefined;
-            y?: string | undefined;
-            d?: string | undefined;
-            e?: string | undefined;
-            n?: string | undefined;
-            kid?: string | undefined;
-            alg?: string | undefined;
-            use?: string | undefined;
-            key_ops?: string[] | undefined;
-        } | undefined;
-    }>, "many">;
-    /** The delegation that grants this capability */
-    delegation: z.ZodObject<{
-        /** Content identifier (CID) of the delegation */
-        cid: z.ZodString;
-        /** DID of the delegate (the party receiving the delegation) */
-        delegateDID: z.ZodString;
-        /** Space ID this delegation applies to */
-        spaceId: z.ZodString;
-        /** Resource path this delegation grants access to */
-        path: z.ZodString;
-        /** Actions this delegation authorizes */
-        actions: z.ZodArray<z.ZodString, "many">;
-        /** Exact ReCap caveats that constrain every action in this scope. */
-        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
-        /** When this delegation expires (accepts Date or ISO string from JSON) */
-        expiry: z.ZodDate;
-        /** Whether this delegation has been revoked */
-        isRevoked: z.ZodBoolean;
-        /** DID of the delegator (the party granting the delegation) */
-        delegatorDID: z.ZodOptional<z.ZodString>;
-        /** When this delegation was created (accepts Date or ISO string from JSON) */
-        createdAt: z.ZodOptional<z.ZodDate>;
-        /** Parent delegation CID if this is a sub-delegation */
-        parentCid: z.ZodOptional<z.ZodString>;
-        /** Whether sub-delegation is allowed */
-        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
-        /** Authorization header (UCAN bearer token) */
-        authHeader: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    }, {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    }>;
-    /** When this capability expires (accepts Date or ISO string from JSON) */
-    expiresAt: z.ZodOptional<z.ZodDate>;
-}, "strip", z.ZodTypeAny, {
-    keys: {
-        type: "session" | "main" | "ingested";
-        did: string;
-        id: string;
-        priority: number;
-        jwk?: {
-            kty: string;
-            crv?: string | undefined;
-            x?: string | undefined;
-            y?: string | undefined;
-            d?: string | undefined;
-            e?: string | undefined;
-            n?: string | undefined;
-            kid?: string | undefined;
-            alg?: string | undefined;
-            use?: string | undefined;
-            key_ops?: string[] | undefined;
-        } | undefined;
-    }[];
-    delegation: {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    };
-    resource: string;
-    action: string;
-    expiresAt?: Date | undefined;
-}, {
-    keys: {
-        type: "session" | "main" | "ingested";
-        did: string;
-        id: string;
-        priority: number;
-        jwk?: {
-            kty: string;
-            crv?: string | undefined;
-            x?: string | undefined;
-            y?: string | undefined;
-            d?: string | undefined;
-            e?: string | undefined;
-            n?: string | undefined;
-            kid?: string | undefined;
-            alg?: string | undefined;
-            use?: string | undefined;
-            key_ops?: string[] | undefined;
-        } | undefined;
-    }[];
-    delegation: {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    };
-    resource: string;
-    action: string;
-    expiresAt?: Date | undefined;
-}>;
-type CapabilityEntry = z.infer<typeof CapabilityEntrySchema>;
-/**
- * Persistent record of a delegation stored in the system.
- */
-declare const DelegationRecordSchema: z.ZodObject<{
-    /** Content identifier (CID) of the delegation */
-    cid: z.ZodString;
-    /** Space ID this delegation applies to */
-    spaceId: z.ZodString;
-    /** DID of the delegator (grantor) */
-    delegator: z.ZodString;
-    /** DID of the delegatee (recipient) */
-    delegatee: z.ZodString;
-    /** Key ID used to sign/exercise this delegation */
-    keyId: z.ZodOptional<z.ZodString>;
-    /** Resource path pattern this delegation grants access to */
-    path: z.ZodString;
-    /** Actions this delegation authorizes */
-    actions: z.ZodArray<z.ZodString, "many">;
-    /** When this delegation expires (accepts Date or ISO string from JSON) */
-    expiry: z.ZodOptional<z.ZodDate>;
-    /** When this delegation becomes valid (not before) (accepts Date or ISO string) */
-    notBefore: z.ZodOptional<z.ZodDate>;
-    /** Whether this delegation has been revoked */
-    isRevoked: z.ZodBoolean;
-    /** When this delegation was created (accepts Date or ISO string from JSON) */
-    createdAt: z.ZodDate;
-    /** Parent delegation CID if this is a sub-delegation */
-    parentCid: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    path: string;
-    actions: string[];
-    createdAt: Date;
-    spaceId: string;
-    cid: string;
-    isRevoked: boolean;
-    delegator: string;
-    delegatee: string;
-    notBefore?: Date | undefined;
-    expiry?: Date | undefined;
-    parentCid?: string | undefined;
-    keyId?: string | undefined;
-}, {
-    path: string;
-    actions: string[];
-    createdAt: Date;
-    spaceId: string;
-    cid: string;
-    isRevoked: boolean;
-    delegator: string;
-    delegatee: string;
-    notBefore?: Date | undefined;
-    expiry?: Date | undefined;
-    parentCid?: string | undefined;
-    keyId?: string | undefined;
-}>;
-type DelegationRecord = z.infer<typeof DelegationRecordSchema>;
-/**
- * Parameters for creating a new delegation.
- */
-declare const CreateDelegationParamsSchema: z.ZodObject<{
-    /** DID of the delegate (the party receiving the delegation) */
-    delegateDID: z.ZodString;
-    /** Resource path this delegation grants access to */
-    path: z.ZodString;
-    /** Actions to authorize */
-    actions: z.ZodArray<z.ZodString, "many">;
-    /** When this delegation expires (accepts Date or ISO string) */
-    expiry: z.ZodOptional<z.ZodDate>;
-    /** Whether to disable sub-delegation */
-    disableSubDelegation: z.ZodOptional<z.ZodBoolean>;
-    /** Optional statement for the SIWE message */
-    statement: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    path: string;
-    actions: string[];
-    delegateDID: string;
-    statement?: string | undefined;
-    expiry?: Date | undefined;
-    disableSubDelegation?: boolean | undefined;
-}, {
-    path: string;
-    actions: string[];
-    delegateDID: string;
-    statement?: string | undefined;
-    expiry?: Date | undefined;
-    disableSubDelegation?: boolean | undefined;
-}>;
-type CreateDelegationParams = z.infer<typeof CreateDelegationParamsSchema>;
-/**
- * A chain of delegations from root to leaf (array format).
- */
-declare const DelegationChainSchema: z.ZodArray<z.ZodObject<{
-    /** Content identifier (CID) of the delegation */
-    cid: z.ZodString;
-    /** DID of the delegate (the party receiving the delegation) */
-    delegateDID: z.ZodString;
-    /** Space ID this delegation applies to */
-    spaceId: z.ZodString;
-    /** Resource path this delegation grants access to */
-    path: z.ZodString;
-    /** Actions this delegation authorizes */
-    actions: z.ZodArray<z.ZodString, "many">;
-    /** Exact ReCap caveats that constrain every action in this scope. */
-    caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
-    /** When this delegation expires (accepts Date or ISO string from JSON) */
-    expiry: z.ZodDate;
-    /** Whether this delegation has been revoked */
-    isRevoked: z.ZodBoolean;
-    /** DID of the delegator (the party granting the delegation) */
-    delegatorDID: z.ZodOptional<z.ZodString>;
-    /** When this delegation was created (accepts Date or ISO string from JSON) */
-    createdAt: z.ZodOptional<z.ZodDate>;
-    /** Parent delegation CID if this is a sub-delegation */
-    parentCid: z.ZodOptional<z.ZodString>;
-    /** Whether sub-delegation is allowed */
-    allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
-    /** Authorization header (UCAN bearer token) */
-    authHeader: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    path: string;
-    expiry: Date;
-    actions: string[];
-    spaceId: string;
-    cid: string;
-    delegateDID: string;
-    isRevoked: boolean;
-    caveats?: Record<string, unknown>[] | undefined;
-    createdAt?: Date | undefined;
-    delegatorDID?: string | undefined;
-    parentCid?: string | undefined;
-    allowSubDelegation?: boolean | undefined;
-    authHeader?: string | undefined;
-}, {
-    path: string;
-    expiry: Date;
-    actions: string[];
-    spaceId: string;
-    cid: string;
-    delegateDID: string;
-    isRevoked: boolean;
-    caveats?: Record<string, unknown>[] | undefined;
-    createdAt?: Date | undefined;
-    delegatorDID?: string | undefined;
-    parentCid?: string | undefined;
-    allowSubDelegation?: boolean | undefined;
-    authHeader?: string | undefined;
-}>, "many">;
-type DelegationChain = z.infer<typeof DelegationChainSchema>;
-/**
- * Structured delegation chain (v2 spec).
- */
-declare const DelegationChainV2Schema: z.ZodObject<{
-    /** The root delegation from the original authority */
-    root: z.ZodObject<{
-        /** Content identifier (CID) of the delegation */
-        cid: z.ZodString;
-        /** DID of the delegate (the party receiving the delegation) */
-        delegateDID: z.ZodString;
-        /** Space ID this delegation applies to */
-        spaceId: z.ZodString;
-        /** Resource path this delegation grants access to */
-        path: z.ZodString;
-        /** Actions this delegation authorizes */
-        actions: z.ZodArray<z.ZodString, "many">;
-        /** Exact ReCap caveats that constrain every action in this scope. */
-        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
-        /** When this delegation expires (accepts Date or ISO string from JSON) */
-        expiry: z.ZodDate;
-        /** Whether this delegation has been revoked */
-        isRevoked: z.ZodBoolean;
-        /** DID of the delegator (the party granting the delegation) */
-        delegatorDID: z.ZodOptional<z.ZodString>;
-        /** When this delegation was created (accepts Date or ISO string from JSON) */
-        createdAt: z.ZodOptional<z.ZodDate>;
-        /** Parent delegation CID if this is a sub-delegation */
-        parentCid: z.ZodOptional<z.ZodString>;
-        /** Whether sub-delegation is allowed */
-        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
-        /** Authorization header (UCAN bearer token) */
-        authHeader: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    }, {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    }>;
-    /** Intermediate delegations in the chain (may be empty) */
-    chain: z.ZodArray<z.ZodObject<{
-        /** Content identifier (CID) of the delegation */
-        cid: z.ZodString;
-        /** DID of the delegate (the party receiving the delegation) */
-        delegateDID: z.ZodString;
-        /** Space ID this delegation applies to */
-        spaceId: z.ZodString;
-        /** Resource path this delegation grants access to */
-        path: z.ZodString;
-        /** Actions this delegation authorizes */
-        actions: z.ZodArray<z.ZodString, "many">;
-        /** Exact ReCap caveats that constrain every action in this scope. */
-        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
-        /** When this delegation expires (accepts Date or ISO string from JSON) */
-        expiry: z.ZodDate;
-        /** Whether this delegation has been revoked */
-        isRevoked: z.ZodBoolean;
-        /** DID of the delegator (the party granting the delegation) */
-        delegatorDID: z.ZodOptional<z.ZodString>;
-        /** When this delegation was created (accepts Date or ISO string from JSON) */
-        createdAt: z.ZodOptional<z.ZodDate>;
-        /** Parent delegation CID if this is a sub-delegation */
-        parentCid: z.ZodOptional<z.ZodString>;
-        /** Whether sub-delegation is allowed */
-        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
-        /** Authorization header (UCAN bearer token) */
-        authHeader: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    }, {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    }>, "many">;
-    /** The final delegation to the current user */
-    leaf: z.ZodObject<{
-        /** Content identifier (CID) of the delegation */
-        cid: z.ZodString;
-        /** DID of the delegate (the party receiving the delegation) */
-        delegateDID: z.ZodString;
-        /** Space ID this delegation applies to */
-        spaceId: z.ZodString;
-        /** Resource path this delegation grants access to */
-        path: z.ZodString;
-        /** Actions this delegation authorizes */
-        actions: z.ZodArray<z.ZodString, "many">;
-        /** Exact ReCap caveats that constrain every action in this scope. */
-        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
-        /** When this delegation expires (accepts Date or ISO string from JSON) */
-        expiry: z.ZodDate;
-        /** Whether this delegation has been revoked */
-        isRevoked: z.ZodBoolean;
-        /** DID of the delegator (the party granting the delegation) */
-        delegatorDID: z.ZodOptional<z.ZodString>;
-        /** When this delegation was created (accepts Date or ISO string from JSON) */
-        createdAt: z.ZodOptional<z.ZodDate>;
-        /** Parent delegation CID if this is a sub-delegation */
-        parentCid: z.ZodOptional<z.ZodString>;
-        /** Whether sub-delegation is allowed */
-        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
-        /** Authorization header (UCAN bearer token) */
-        authHeader: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    }, {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    }>;
-}, "strip", z.ZodTypeAny, {
-    root: {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    };
-    chain: {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    }[];
-    leaf: {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    };
-}, {
-    root: {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    };
-    chain: {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    }[];
-    leaf: {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    };
-}>;
-type DelegationChainV2 = z.infer<typeof DelegationChainV2Schema>;
-/**
- * Direction of delegation to filter by.
- */
-declare const DelegationDirectionSchema: z.ZodEnum<["granted", "received", "all"]>;
-type DelegationDirection = z.infer<typeof DelegationDirectionSchema>;
-/**
- * Filters for listing delegations.
- */
-declare const DelegationFiltersSchema: z.ZodObject<{
-    /** Filter by delegation direction */
-    direction: z.ZodOptional<z.ZodEnum<["granted", "received", "all"]>>;
-    /** Filter by resource path pattern */
-    path: z.ZodOptional<z.ZodString>;
-    /** Filter by required actions */
-    actions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    /** Include revoked delegations */
-    includeRevoked: z.ZodOptional<z.ZodBoolean>;
-    /** Filter by delegator DID */
-    delegator: z.ZodOptional<z.ZodString>;
-    /** Filter by delegatee DID */
-    delegatee: z.ZodOptional<z.ZodString>;
-    /** Only include delegations valid at this time */
-    validAt: z.ZodOptional<z.ZodDate>;
-    /** Maximum number of results to return */
-    limit: z.ZodOptional<z.ZodNumber>;
-    /** Cursor for pagination */
-    cursor: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    path?: string | undefined;
-    actions?: string[] | undefined;
-    direction?: "received" | "all" | "granted" | undefined;
-    limit?: number | undefined;
-    cursor?: string | undefined;
-    delegator?: string | undefined;
-    delegatee?: string | undefined;
-    includeRevoked?: boolean | undefined;
-    validAt?: Date | undefined;
-}, {
-    path?: string | undefined;
-    actions?: string[] | undefined;
-    direction?: "received" | "all" | "granted" | undefined;
-    limit?: number | undefined;
-    cursor?: string | undefined;
-    delegator?: string | undefined;
-    delegatee?: string | undefined;
-    includeRevoked?: boolean | undefined;
-    validAt?: Date | undefined;
-}>;
-type DelegationFilters = z.infer<typeof DelegationFiltersSchema>;
-/**
- * Type of space ownership.
- */
-declare const SpaceOwnershipSchema: z.ZodEnum<["owned", "delegated"]>;
-type SpaceOwnership = z.infer<typeof SpaceOwnershipSchema>;
-/**
- * Information about a space the user has access to.
- */
-declare const SpaceInfoSchema: z.ZodObject<{
-    /** Space identifier */
-    id: z.ZodString;
-    /** Human-readable name for the space */
-    name: z.ZodOptional<z.ZodString>;
-    /** DID of the space owner */
-    owner: z.ZodString;
-    /** Whether user owns or has delegated access */
-    type: z.ZodEnum<["owned", "delegated"]>;
-    /** Permissions the user has in this space */
-    permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    /** When the access expires (for delegated spaces) */
-    expiresAt: z.ZodOptional<z.ZodDate>;
-}, "strip", z.ZodTypeAny, {
-    type: "owned" | "delegated";
-    id: string;
-    owner: string;
-    name?: string | undefined;
-    expiresAt?: Date | undefined;
-    permissions?: string[] | undefined;
-}, {
-    type: "owned" | "delegated";
-    id: string;
-    owner: string;
-    name?: string | undefined;
-    expiresAt?: Date | undefined;
-    permissions?: string[] | undefined;
-}>;
-type SpaceInfo = z.infer<typeof SpaceInfoSchema>;
-/**
- * Schema for encoding share link data.
- */
-declare const ShareSchemaSchema: z.ZodEnum<["base64", "compact", "ipfs"]>;
-type ShareSchema = z.infer<typeof ShareSchemaSchema>;
-/**
- * A shareable link containing delegation credentials.
- */
-declare const ShareLinkSchema: z.ZodObject<{
-    /** Unique token identifying this share link */
-    token: z.ZodString;
-    /** Full URL for sharing */
-    url: z.ZodString;
-    /** The delegation this link grants access to */
-    delegation: z.ZodObject<{
-        /** Content identifier (CID) of the delegation */
-        cid: z.ZodString;
-        /** DID of the delegate (the party receiving the delegation) */
-        delegateDID: z.ZodString;
-        /** Space ID this delegation applies to */
-        spaceId: z.ZodString;
-        /** Resource path this delegation grants access to */
-        path: z.ZodString;
-        /** Actions this delegation authorizes */
-        actions: z.ZodArray<z.ZodString, "many">;
-        /** Exact ReCap caveats that constrain every action in this scope. */
-        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
-        /** When this delegation expires (accepts Date or ISO string from JSON) */
-        expiry: z.ZodDate;
-        /** Whether this delegation has been revoked */
-        isRevoked: z.ZodBoolean;
-        /** DID of the delegator (the party granting the delegation) */
-        delegatorDID: z.ZodOptional<z.ZodString>;
-        /** When this delegation was created (accepts Date or ISO string from JSON) */
-        createdAt: z.ZodOptional<z.ZodDate>;
-        /** Parent delegation CID if this is a sub-delegation */
-        parentCid: z.ZodOptional<z.ZodString>;
-        /** Whether sub-delegation is allowed */
-        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
-        /** Authorization header (UCAN bearer token) */
-        authHeader: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    }, {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    }>;
-    /** Encoding schema used for the link */
-    schema: z.ZodEnum<["base64", "compact", "ipfs"]>;
-    /** When this share link expires */
-    expiresAt: z.ZodOptional<z.ZodDate>;
-    /** Human-readable description of what is being shared */
-    description: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    delegation: {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    };
-    schema: "base64" | "compact" | "ipfs";
-    url: string;
-    token: string;
-    description?: string | undefined;
-    expiresAt?: Date | undefined;
-}, {
-    delegation: {
-        path: string;
-        expiry: Date;
-        actions: string[];
-        spaceId: string;
-        cid: string;
-        delegateDID: string;
-        isRevoked: boolean;
-        caveats?: Record<string, unknown>[] | undefined;
-        createdAt?: Date | undefined;
-        delegatorDID?: string | undefined;
-        parentCid?: string | undefined;
-        allowSubDelegation?: boolean | undefined;
-        authHeader?: string | undefined;
-    };
-    schema: "base64" | "compact" | "ipfs";
-    url: string;
-    token: string;
-    description?: string | undefined;
-    expiresAt?: Date | undefined;
-}>;
-type ShareLink = z.infer<typeof ShareLinkSchema>;
-type ShareLinkData<T = unknown> = {
-    data: T;
-    delegation: Delegation;
-    spaceId: string;
-    path: string;
-};
-/**
- * Options for ingesting an external delegation.
- */
-declare const IngestOptionsSchema: z.ZodObject<{
-    /** Whether to persist the delegation to storage */
-    persist: z.ZodOptional<z.ZodBoolean>;
-    /** Whether to validate the full delegation chain */
-    validateChain: z.ZodOptional<z.ZodBoolean>;
-    /** Name for the ingested key */
-    keyName: z.ZodOptional<z.ZodString>;
-    /** Whether to create a session key for this delegation */
-    createSessionKey: z.ZodOptional<z.ZodBoolean>;
-    /** Override the priority for the ingested key */
-    priority: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    priority?: number | undefined;
-    persist?: boolean | undefined;
-    validateChain?: boolean | undefined;
-    keyName?: string | undefined;
-    createSessionKey?: boolean | undefined;
-}, {
-    priority?: number | undefined;
-    persist?: boolean | undefined;
-    validateChain?: boolean | undefined;
-    keyName?: string | undefined;
-    createSessionKey?: boolean | undefined;
-}>;
-type IngestOptions = z.infer<typeof IngestOptionsSchema>;
-/**
- * Parameters for generating a share link.
- */
-declare const GenerateShareParamsSchema: z.ZodObject<{
-    /** Resource path to share */
-    path: z.ZodString;
-    /** Actions to authorize */
-    actions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    /** When the share link expires */
-    expiry: z.ZodOptional<z.ZodDate>;
-    /** Encoding schema for the link */
-    schema: z.ZodOptional<z.ZodEnum<["base64", "compact", "ipfs"]>>;
-    /** Human-readable description */
-    description: z.ZodOptional<z.ZodString>;
-    /** Base URL for the share link */
-    baseUrl: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    path: string;
-    schema?: "base64" | "compact" | "ipfs" | undefined;
-    expiry?: Date | undefined;
-    description?: string | undefined;
-    actions?: string[] | undefined;
-    baseUrl?: string | undefined;
-}, {
-    path: string;
-    schema?: "base64" | "compact" | "ipfs" | undefined;
-    expiry?: Date | undefined;
-    description?: string | undefined;
-    actions?: string[] | undefined;
-    baseUrl?: string | undefined;
-}>;
-type GenerateShareParams = z.infer<typeof GenerateShareParamsSchema>;
-/**
- * Configuration for DelegationManager.
- * Note: ServiceSession, InvokeFunction, and FetchFunction are external types.
- */
-declare const DelegationManagerConfigSchema: z.ZodObject<{
-    /** TinyCloud host URLs */
-    hosts: z.ZodArray<z.ZodString, "many">;
-    /** Account space used by account-wide delegation history queries */
-    accountSpaceId: z.ZodOptional<z.ZodString>;
-    /** Active session for authentication */
-    session: z.ZodEffects<z.ZodUnknown, ServiceSession, unknown>;
-    /** Platform-specific invoke function */
-    invoke: z.ZodEffects<z.ZodUnknown, InvokeFunction, unknown>;
-    /** Platform-specific invoke function for raw resource URIs */
-    invokeAny: z.ZodOptional<z.ZodEffects<z.ZodUnknown, InvokeAnyFunction, unknown>>;
-    /** Optional custom fetch implementation */
-    fetch: z.ZodOptional<z.ZodEffects<z.ZodUnknown, FetchFunction, unknown>>;
-}, "strip", z.ZodTypeAny, {
-    session: ServiceSession;
-    hosts: string[];
-    invoke: InvokeFunction;
-    invokeAny?: InvokeAnyFunction | undefined;
-    accountSpaceId?: string | undefined;
-    fetch?: FetchFunction | undefined;
-}, {
-    hosts: string[];
-    invokeAny?: unknown;
-    session?: unknown;
-    accountSpaceId?: string | undefined;
-    invoke?: unknown;
-    fetch?: unknown;
-}>;
-type DelegationManagerConfig = z.infer<typeof DelegationManagerConfigSchema>;
-/**
- * Provider interface for cryptographic key operations.
- */
-declare const KeyProviderSchema: z.ZodObject<{
-    /** Generate a new session key, returns key ID */
-    createSessionKey: z.ZodEffects<z.ZodUnknown, (name: string) => Promise<string>, unknown>;
-    /** Get JWK for a key */
-    getJWK: z.ZodEffects<z.ZodUnknown, (keyId: string) => object, unknown>;
-    /** Get DID for a key */
-    getDID: z.ZodEffects<z.ZodUnknown, (keyId: string) => Promise<string>, unknown>;
-}, "strip", z.ZodTypeAny, {
-    createSessionKey: (name: string) => Promise<string>;
-    getJWK: (keyId: string) => object;
-    getDID: (keyId: string) => Promise<string>;
-}, {
-    createSessionKey?: unknown;
-    getJWK?: unknown;
-    getDID?: unknown;
-}>;
-type KeyProvider = z.infer<typeof KeyProviderSchema>;
-/**
- * Response from the delegation API.
- */
-declare const DelegationApiResponseSchema: z.ZodObject<{
-    /** SIWE message content */
-    siwe: z.ZodString;
-    /** Signature of the SIWE message */
-    signature: z.ZodString;
-    /** Delegation version */
-    version: z.ZodNumber;
-    /** CID of the created delegation */
-    cid: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    siwe: string;
-    signature: string;
-    version: number;
-    cid?: string | undefined;
-}, {
-    siwe: string;
-    signature: string;
-    version: number;
-    cid?: string | undefined;
-}>;
-type DelegationApiResponse = z.infer<typeof DelegationApiResponseSchema>;
-/**
- * A single (service, space, path, actions) entry inside a
- * createDelegation WASM result.
- *
- * Mirrors the Rust `DelegatedResource` struct in
- * `tinycloud-sdk-wasm/src/session.rs`. Field names match the manifest
- * {@link PermissionEntry} shape so callers can reconstruct what they sent
- * without having to re-parse the UCAN.
- *
- * `service` is the short form (e.g. `"kv"`, `"sql"`) as returned by the
- * Rust layer. The SDK layer translates to the long form
- * (`"tinycloud.kv"`) when comparing against manifests.
- */
-declare const DelegatedResourceSchema: z.ZodObject<{
-    /** Short-form service name, e.g. "kv", "sql", "duckdb", "capabilities", "hooks". */
-    service: z.ZodString;
-    /** Full space id string, e.g. "tinycloud:pkh:eip155:1:0x....:default". */
-    space: z.ZodString;
-    /** Resource path; empty string when the resource URI had no path segment. */
-    path: z.ZodString;
-    /** Full-URN ability strings, e.g. ["tinycloud.kv/get", "tinycloud.kv/put"]. */
-    actions: z.ZodArray<z.ZodString, "many">;
-    /** Exact ReCap caveats that constrain every action in this scope. */
-    caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
-}, "strip", z.ZodTypeAny, {
-    path: string;
-    actions: string[];
-    space: string;
-    service: string;
-    caveats?: Record<string, unknown>[] | undefined;
-}, {
-    path: string;
-    actions: string[];
-    space: string;
-    service: string;
-    caveats?: Record<string, unknown>[] | undefined;
-}>;
-type DelegatedResource = z.infer<typeof DelegatedResourceSchema>;
-/**
- * Input parameters for the createDelegation WASM function.
- *
- * A single call may encode multiple `(service, path, actions)` entries
- * via the `abilities` map — the underlying UCAN will contain one
- * attenuation entry per `(service, path)` pair, all signed by the same
- * session key in one blob.
- *
- * The `abilities` shape is identical to what `prepareSession` accepts
- * (`Record<shortService, Record<path, actionURNs[]>>`), so manifest
- * resolution can feed both sides from one data structure.
- */
-declare const CreateDelegationWasmParamsSchema: z.ZodObject<{
-    /** The session containing delegation credentials */
-    session: z.ZodEffects<z.ZodUnknown, ServiceSession, unknown>;
-    /** DID of the delegate */
-    delegateDID: z.ZodString;
-    /** Space ID this delegation applies to */
-    spaceId: z.ZodString;
-    /**
-     * Multi-resource abilities map: short-service → path → full-URN actions.
-     * Matches the shape accepted by `prepareSession`.
-     *
-     * Example:
-     * ```
-     * {
-     *   kv: {
-     *     "com.listen.app/": ["tinycloud.kv/get", "tinycloud.kv/put"]
-     *   },
-     *   sql: {
-     *     "com.listen.app/data.sqlite": ["tinycloud.sql/read"]
-     *   }
-     * }
-     * ```
-     */
-    abilities: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
-    /** Expiration time in seconds since Unix epoch */
-    expirationSecs: z.ZodNumber;
-    /** Optional not-before time in seconds since Unix epoch */
-    notBeforeSecs: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    spaceId: string;
-    session: ServiceSession;
-    delegateDID: string;
-    abilities: Record<string, Record<string, string[]>>;
-    expirationSecs: number;
-    notBeforeSecs?: number | undefined;
-}, {
-    spaceId: string;
-    delegateDID: string;
-    abilities: Record<string, Record<string, string[]>>;
-    expirationSecs: number;
-    session?: unknown;
-    notBeforeSecs?: number | undefined;
-}>;
-type CreateDelegationWasmParams = z.infer<typeof CreateDelegationWasmParamsSchema>;
-/**
- * Result from the createDelegation WASM function.
- *
- * A single UCAN may cover multiple resources. The `resources` array
- * describes every `(service, space, path, actions)` entry granted, in
- * deterministic (service, path) lexicographic order (the Rust side sorts
- * the HashMap entries before signing).
- */
-declare const CreateDelegationWasmResultSchema: z.ZodObject<{
-    /** Base64url-encoded UCAN delegation */
-    delegation: z.ZodString;
-    /** CID of the delegation */
-    cid: z.ZodString;
-    /** DID of the delegate */
-    delegateDID: z.ZodString;
-    /** Expiration time */
-    expiry: z.ZodDate;
-    /**
-     * All (service, space, path, actions) entries granted by this delegation.
-     * Always non-empty on success.
-     */
-    resources: z.ZodArray<z.ZodObject<{
-        /** Short-form service name, e.g. "kv", "sql", "duckdb", "capabilities", "hooks". */
-        service: z.ZodString;
-        /** Full space id string, e.g. "tinycloud:pkh:eip155:1:0x....:default". */
-        space: z.ZodString;
-        /** Resource path; empty string when the resource URI had no path segment. */
-        path: z.ZodString;
-        /** Full-URN ability strings, e.g. ["tinycloud.kv/get", "tinycloud.kv/put"]. */
-        actions: z.ZodArray<z.ZodString, "many">;
-        /** Exact ReCap caveats that constrain every action in this scope. */
-        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
-    }, "strip", z.ZodTypeAny, {
-        path: string;
-        actions: string[];
-        space: string;
-        service: string;
-        caveats?: Record<string, unknown>[] | undefined;
-    }, {
-        path: string;
-        actions: string[];
-        space: string;
-        service: string;
-        caveats?: Record<string, unknown>[] | undefined;
-    }>, "many">;
-}, "strip", z.ZodTypeAny, {
-    resources: {
-        path: string;
-        actions: string[];
-        space: string;
-        service: string;
-        caveats?: Record<string, unknown>[] | undefined;
-    }[];
-    delegation: string;
-    expiry: Date;
-    cid: string;
-    delegateDID: string;
-}, {
-    resources: {
-        path: string;
-        actions: string[];
-        space: string;
-        service: string;
-        caveats?: Record<string, unknown>[] | undefined;
-    }[];
-    delegation: string;
-    expiry: Date;
-    cid: string;
-    delegateDID: string;
-}>;
-type CreateDelegationWasmResult = z.infer<typeof CreateDelegationWasmResultSchema>;
-
-/**
- * CapabilityKeyRegistry - Tracks keys and their capabilities for automatic key selection.
- *
- * The registry maintains mappings between:
- * - Keys and their associated delegations
- * - Capabilities (resource/action pairs) and the keys that can exercise them
- *
- * This enables automatic key selection when performing operations, choosing
- * the most appropriate key based on priority and validity.
- *
- * @packageDocumentation
- */
-
-/**
- * Error codes specific to CapabilityKeyRegistry operations.
- */
-declare const CapabilityKeyRegistryErrorCodes: {
-    /** Key not found in registry */
-    readonly KEY_NOT_FOUND: "KEY_NOT_FOUND";
-    /** No key available for the requested capability */
-    readonly NO_CAPABLE_KEY: "NO_CAPABLE_KEY";
-    /** Delegation has expired */
-    readonly DELEGATION_EXPIRED: "DELEGATION_EXPIRED";
-    /** Delegation has been revoked */
-    readonly DELEGATION_REVOKED: "DELEGATION_REVOKED";
-    /** Invalid delegation data */
-    readonly INVALID_DELEGATION: "INVALID_DELEGATION";
-    /** Key already registered */
-    readonly KEY_EXISTS: "KEY_EXISTS";
-};
-type CapabilityKeyRegistryErrorCode = (typeof CapabilityKeyRegistryErrorCodes)[keyof typeof CapabilityKeyRegistryErrorCodes];
-/**
- * Stored delegation with chain information.
- */
-interface StoredDelegationChain {
-    /** The delegation itself */
-    delegation: Delegation;
-    /** Parent delegation CID if this is a sub-delegation */
-    parentCid?: string;
-    /** Key ID used to sign/exercise this delegation */
-    keyId: string;
-    /** When this was stored */
-    storedAt: Date;
-}
-/**
- * Interface for the CapabilityKeyRegistry.
- *
- * Tracks keys and their capabilities for automatic key selection.
- */
-interface ICapabilityKeyRegistry {
-    /**
-     * Register a key with its associated delegations.
-     *
-     * @param key - Key information
-     * @param delegations - Delegations granted to this key
-     */
-    registerKey(key: KeyInfo, delegations: Delegation[]): void;
-    /**
-     * Remove a key and all its associated delegations.
-     *
-     * @param keyId - The key ID to remove
-     */
-    removeKey(keyId: string): void;
-    /**
-     * Get a key that can exercise the specified capability.
-     *
-     * Uses the key selection algorithm:
-     * 1. Filter keys that have the required capability
-     * 2. Check delegation validity (not expired, not revoked)
-     * 3. Sort by priority (session=0, main=1, ingested=2)
-     * 4. Return highest priority valid key
-     *
-     * @param resource - Resource URI (e.g., "tinycloud://space-id/kv/my-data")
-     * @param action - Action to perform (e.g., "tinycloud.kv/get")
-     * @returns The best matching key, or null if none available
-     */
-    getKeyForCapability(resource: string, action: string): KeyInfo | null;
-    /**
-     * Get all registered capabilities.
-     *
-     * @returns All capability entries in the registry
-     */
-    getAllCapabilities(): CapabilityEntry[];
-    /**
-     * Get all delegations for a specific key.
-     *
-     * @param keyId - The key ID
-     * @returns Array of delegations for this key
-     */
-    getDelegationsForKey(keyId: string): Delegation[];
-    /**
-     * Ingest a key and delegation from an external source (e.g., sharing link).
-     *
-     * @param key - Key information to ingest
-     * @param delegation - Delegation to associate with the key
-     * @param options - Ingestion options
-     */
-    ingestKey(key: KeyInfo, delegation: Delegation, options?: IngestOptions): void;
-    /**
-     * Check if a delegation is currently valid.
-     *
-     * @param delegation - The delegation to check
-     * @returns true if valid, false if expired or revoked
-     */
-    isDelegationValid(delegation: Delegation): boolean;
-    /**
-     * Get a key by its ID.
-     *
-     * @param keyId - The key ID
-     * @returns The key info, or undefined if not found
-     */
-    getKey(keyId: string): KeyInfo | undefined;
-    /**
-     * Get all registered keys.
-     *
-     * @returns Array of all registered keys
-     */
-    getAllKeys(): KeyInfo[];
-    /**
-     * Clear all registered keys and delegations.
-     */
-    clear(): void;
-    /**
-     * Revoke a delegation by CID.
-     *
-     * @param cid - The delegation CID to revoke
-     * @returns Result indicating success or failure
-     */
-    revokeDelegation(cid: string): Result$1<void, ServiceError>;
-    /**
-     * Find capabilities that match a resource path pattern.
-     *
-     * @param resourcePattern - Resource pattern (supports wildcards)
-     * @param action - Optional action filter
-     * @returns Matching capability entries
-     */
-    findCapabilities(resourcePattern: string, action?: string): CapabilityEntry[];
-}
-/**
- * CapabilityKeyRegistry - Tracks keys and their capabilities for automatic key selection.
- *
- * @example
- * ```typescript
- * const registry = new CapabilityKeyRegistry();
- *
- * // Register a session key with its delegations
- * registry.registerKey(sessionKey, [rootDelegation]);
- *
- * // Get the best key for an operation
- * const key = registry.getKeyForCapability(
- *   "tinycloud://my-space/kv/data",
- *   "tinycloud.kv/get"
- * );
- *
- * if (key) {
- *   // Use this key for the operation
- *   console.log("Using key:", key.id);
- * }
- * ```
- */
-declare class CapabilityKeyRegistry implements ICapabilityKeyRegistry {
-    /**
-     * Registry of all keys indexed by ID.
-     */
-    private keys;
-    /**
-     * Delegation storage.
-     */
-    private store;
-    /**
-     * Register a key with its associated delegations.
-     *
-     * @param key - Key information
-     * @param delegations - Delegations granted to this key
-     */
-    registerKey(key: KeyInfo, delegations: Delegation[]): void;
-    /**
-     * Remove a key and all its associated delegations.
-     *
-     * @param keyId - The key ID to remove
-     */
-    removeKey(keyId: string): void;
-    /**
-     * Get a key that can exercise the specified capability.
-     *
-     * Key selection algorithm:
-     * 1. Filter keys that have the required capability
-     * 2. Check delegation validity (not expired, not revoked)
-     * 3. Sort by priority (session=0, main=1, ingested=2)
-     * 4. Return highest priority valid key
-     *
-     * @param resource - Resource URI
-     * @param action - Action to perform
-     * @returns The best matching key, or null if none available
-     */
-    getKeyForCapability(resource: string, action: string): KeyInfo | null;
-    /**
-     * Get all registered capabilities.
-     *
-     * @returns All capability entries in the registry
-     */
-    getAllCapabilities(): CapabilityEntry[];
-    /**
-     * Get all delegations for a specific key.
-     *
-     * @param keyId - The key ID
-     * @returns Array of delegations for this key
-     */
-    getDelegationsForKey(keyId: string): Delegation[];
-    /**
-     * Ingest a key and delegation from an external source.
-     *
-     * @param key - Key information to ingest
-     * @param delegation - Delegation to associate with the key
-     * @param options - Ingestion options
-     */
-    ingestKey(key: KeyInfo, delegation: Delegation, options?: IngestOptions): void;
-    /**
-     * Check if a delegation is currently valid.
-     *
-     * @param delegation - The delegation to check
-     * @returns true if valid, false if expired or revoked
-     */
-    isDelegationValid(delegation: Delegation): boolean;
-    /**
-     * Get a key by its ID.
-     *
-     * @param keyId - The key ID
-     * @returns The key info, or undefined if not found
-     */
-    getKey(keyId: string): KeyInfo | undefined;
-    /**
-     * Get all registered keys.
-     *
-     * @returns Array of all registered keys
-     */
-    getAllKeys(): KeyInfo[];
-    /**
-     * Clear all registered keys and delegations.
-     */
-    clear(): void;
-    /**
-     * Revoke a delegation by CID.
-     *
-     * @param cid - The delegation CID to revoke
-     * @returns Result indicating success or failure
-     */
-    revokeDelegation(cid: string): Result$1<void, ServiceError>;
-    /**
-     * Find capabilities that match a resource path pattern.
-     *
-     * @param resourcePattern - Resource pattern (supports wildcards)
-     * @param action - Optional action filter
-     * @returns Matching capability entries
-     */
-    findCapabilities(resourcePattern: string, action?: string): CapabilityEntry[];
-    /**
-     * Add a delegation to the store.
-     *
-     * @param key - The key associated with this delegation
-     * @param delegation - The delegation to add
-     */
-    private addDelegation;
+ * @packageDocumentation
+ */
+
+/**
+ * Session storage interface.
+ *
+ * Abstracts how sessions are persisted across different platforms.
+ * - Browser: localStorage
+ * - Node.js: file system or memory
+ */
+interface ISessionStorage {
     /**
-     * Create a capability key for indexing.
-     *
-     * @param resource - Resource path
-     * @param action - Action
-     * @returns Combined key string
+     * Save a session for an address.
+     * @param address - Ethereum address (key for lookup)
+     * @param session - Session data to persist
      */
-    private makeCapabilityKey;
-    private sameDelegationScope;
+    save(address: string, session: PersistedSessionData): Promise<void>;
     /**
-     * Find capability entries that match a resource and action.
-     *
-     * @param resource - Resource to match
-     * @param action - Action to match
-     * @returns Matching entries
+     * Load a session for an address.
+     * @param address - Ethereum address
+     * @returns Session data or null if not found
      */
-    private findMatchingEntries;
+    load(address: string): Promise<PersistedSessionData | null>;
     /**
-     * Check if an action pattern matches a specific action.
-     *
-     * @param pattern - Action pattern (may include wildcard like "tinycloud.kv/*")
-     * @param action - Specific action to check
-     * @returns true if pattern matches action
+     * Clear a session for an address.
+     * @param address - Ethereum address
      */
-    private actionMatches;
+    clear(address: string): Promise<void>;
     /**
-     * Check if a resource matches a pattern.
-     *
-     * Patterns support:
-     * - Exact match: "/kv/data" matches "/kv/data"
-     * - Wildcard suffix: "/kv/*" matches "/kv/anything"
-     * - Double wildcard: "/kv/**" matches "/kv/any/nested/path"
-     *
-     * @param resource - The specific resource being accessed
-     * @param pattern - The pattern from the delegation
-     * @returns true if resource matches pattern
+     * Check if a session exists for an address (synchronous check).
+     * @param address - Ethereum address
+     * @returns true if session exists
      */
-    private resourceMatchesPattern;
+    exists(address: string): boolean;
     /**
-     * Check if a specific resource matches a resource pattern for searching.
-     *
-     * @param entryResource - The resource from a capability entry
-     * @param searchPattern - The pattern to search for
-     * @returns true if entry resource matches search pattern
+     * Check if the storage backend is available.
+     * @returns true if storage can be used
      */
-    private matchesResourcePattern;
+    isAvailable(): boolean;
 }
-/**
- * Create a new CapabilityKeyRegistry instance.
- *
- * @returns A new registry instance
- */
-declare function createCapabilityKeyRegistry(): ICapabilityKeyRegistry;
 
 /**
  * SignStrategy types for TinyCloud authorization.
@@ -3969,7 +1936,7 @@ declare class TinyCloud {
      *
      * Requires the user to be signed in and services to be initialized.
      */
-    ensurePublicSpace(): Promise<Result$1<void, ServiceError>>;
+    ensurePublicSpace(): Promise<Result<void, ServiceError>>;
     /**
      * Get a KVService scoped to the user's own public space.
      * Writes require authentication (owner/delegate).
@@ -3987,7 +1954,7 @@ declare class TinyCloud {
      * @param fetchFn - Optional custom fetch function
      * @returns The data at the key
      */
-    static readPublicSpace<T = unknown>(host: string, spaceId: string, key: string, fetchFn?: FetchFunction): Promise<Result$1<T, ServiceError>>;
+    static readPublicSpace<T = unknown>(host: string, spaceId: string, key: string, fetchFn?: FetchFunction): Promise<Result<T, ServiceError>>;
     /**
      * Read from any user's public space by address (unauthenticated).
      * Convenience method that constructs the space ID from address and chain ID.
@@ -3999,590 +1966,8 @@ declare class TinyCloud {
      * @param fetchFn - Optional custom fetch function
      * @returns The data at the key
      */
-    static readPublicKey<T = unknown>(host: string, address: string, chainId: number, key: string, fetchFn?: FetchFunction): Promise<Result$1<T, ServiceError>>;
-}
-
-/**
- * DelegationManager - Handles delegation CRUD operations.
- *
- * This class manages the creation, revocation, listing, and querying
- * of delegations within TinyCloud. It extracts and improves upon the
- * delegation functionality previously in ITinyCloudStorage.
- *
- * @packageDocumentation
- */
-
-/**
- * DelegationManager handles all delegation-related operations.
- *
- * @example
- * ```typescript
- * import { DelegationManager } from "@tinycloud/sdk-core/delegations";
- *
- * const delegations = new DelegationManager({
- *   hosts: ["https://node.tinycloud.xyz"],
- *   session,
- *   invoke,
- * });
- *
- * // Create a delegation
- * const result = await delegations.create({
- *   delegateDID: "did:pkh:eip155:1:0x...",
- *   path: "shared/",
- *   actions: ["tinycloud.kv/get", "tinycloud.kv/list"],
- *   expiry: new Date(Date.now() + 24 * 60 * 60 * 1000), // 24 hours
- * });
- *
- * if (result.ok) {
- *   console.log("Created delegation:", result.data.cid);
- * }
- * ```
- */
-declare class DelegationManager {
-    private hosts;
-    private session;
-    private invoke;
-    private invokeAny?;
-    private fetchFn;
-    private accountSpaceId?;
-    /**
-     * Creates a new DelegationManager instance.
-     *
-     * @param config - Configuration including hosts, session, and invoke function
-     */
-    constructor(config: DelegationManagerConfig);
-    /**
-     * Updates the session (e.g., after re-authentication).
-     *
-     * @param session - New session to use for operations
-     */
-    updateSession(session: ServiceSession): void;
-    /**
-     * Gets the primary host URL.
-     */
-    private get host();
-    /**
-     * Executes an invoke operation against the delegation API.
-     */
-    private invokeOperation;
-    /**
-     * Creates a new delegation.
-     *
-     * Delegates specific permissions to another DID for a given path.
-     * The delegatee can then use these permissions to access resources
-     * within the specified scope.
-     *
-     * @param params - Parameters for the delegation
-     * @returns Result containing the created Delegation or an error
-     *
-     * @example
-     * ```typescript
-     * const result = await manager.create({
-     *   delegateDID: bob.did,
-     *   path: "documents/shared/",
-     *   actions: ["tinycloud.kv/get", "tinycloud.kv/put"],
-     *   expiry: new Date(Date.now() + 7 * 24 * 60 * 60 * 1000), // 7 days
-     * });
-     * ```
-     */
-    create(params: CreateDelegationParams): Promise<Result<Delegation>>;
-    /**
-     * Revokes an existing delegation.
-     *
-     * Once revoked, the delegation can no longer be used to access resources.
-     * This also invalidates any sub-delegations derived from this delegation.
-     *
-     * @param cid - The CID of the delegation to revoke
-     * @returns Result indicating success or an error
-     *
-     * @example
-     * ```typescript
-     * const result = await manager.revoke("bafy...");
-     * if (result.ok) {
-     *   console.log("Delegation revoked successfully");
-     * }
-     * ```
-     */
-    revoke(cid: string): Promise<Result<DelegationRevocationReceipt>>;
-    /**
-     * Reads the node-confirmed lifecycle state of one delegation without
-     * exposing delegation metadata.
-     */
-    status(cid: string): Promise<Result<DelegationStatus>>;
-    /** Query lifecycle-complete delegation history for the authenticated account. */
-    query(options?: AccountDelegationQueryOptions): Promise<Result<AccountDelegationPage>>;
-    /**
-     * Lists all delegations for the current session's space.
-     *
-     * Returns both delegations created by the current user (as delegator)
-     * and delegations granted to the current user (as delegatee).
-     *
-     * @returns Result containing an array of Delegations or an error
-     *
-     * @example
-     * ```typescript
-     * const result = await manager.list();
-     * if (result.ok) {
-     *   for (const delegation of result.data) {
-     *     console.log(`${delegation.cid}: ${delegation.path} -> ${delegation.delegateDID}`);
-     *   }
-     * }
-     * ```
-     */
-    list(): Promise<Result<Delegation[]>>;
-    /**
-     * Gets the full delegation chain for a given delegation.
-     *
-     * Returns the chain of delegations from the root (original delegator)
-     * to the specified delegation, including all intermediate sub-delegations.
-     *
-     * @param cid - The CID of the delegation to get the chain for
-     * @returns Result containing the DelegationChain or an error
-     *
-     * @example
-     * ```typescript
-     * const result = await manager.getChain("bafy...");
-     * if (result.ok) {
-     *   console.log("Chain length:", result.data.length);
-     *   for (const delegation of result.data) {
-     *     console.log(`- ${delegation.delegatorDID} -> ${delegation.delegateDID}`);
-     *   }
-     * }
-     * ```
-     */
-    getChain(cid: string): Promise<Result<DelegationChain>>;
-    /**
-     * Checks if the current session has permission for a given path and action.
-     *
-     * This can be used to verify permissions before attempting an operation,
-     * or to implement custom access control logic.
-     *
-     * @param path - The resource path to check
-     * @param action - The action to check (e.g., "tinycloud.kv/get")
-     * @returns Result containing a boolean indicating permission or an error
-     *
-     * @example
-     * ```typescript
-     * const result = await manager.checkPermission("documents/private/", "tinycloud.kv/put");
-     * if (result.ok && result.data) {
-     *   console.log("Permission granted");
-     * } else {
-     *   console.log("Permission denied");
-     * }
-     * ```
-     */
-    checkPermission(path: string, action: string): Promise<Result<boolean>>;
-}
-
-/**
- * SharingService - v2 sharing link service with embedded private keys.
- *
- * This service implements the v2 sharing specification, which embeds private keys
- * directly in sharing links. This allows recipients to exercise delegations
- * without requiring prior session setup.
- *
- * Key differences from v1 SharingLinks:
- * - Private keys are embedded in the link (not just tokens)
- * - Recipients can optionally sub-delegate to their own session key
- * - Pre-configured KV service returned for immediate use
- *
- * @packageDocumentation
- */
-
-/**
- * Data encoded in a sharing link.
- */
-interface EncodedShareData {
-    /** Private key in JWK format (includes d parameter) */
-    key: JWK;
-    /** DID of the key */
-    keyDid: string;
-    /** The delegation granting access */
-    delegation: Delegation;
-    /** Resource path this link grants access to */
-    path: string;
-    /** TinyCloud host URL */
-    host: string;
-    /** Space ID */
-    spaceId: string;
-    /** Schema version */
-    version: 1;
-}
-/**
- * Options for receiving a sharing link.
- */
-interface ReceiveOptions {
-    /**
-     * Whether to automatically create a sub-delegation to the current session key.
-     * Default: true
-     */
-    autoSubdelegate?: boolean;
-    /**
-     * Whether to use the current session key for operations (requires autoSubdelegate).
-     * Default: true
-     */
-    useSessionKey?: boolean;
-    /**
-     * Ingestion options passed to CapabilityKeyRegistry.
-     */
-    ingestOptions?: IngestOptions;
-}
-/**
- * Result of receiving a sharing link.
- */
-interface ShareAccess {
-    /** The delegation that was received/created */
-    delegation: Delegation;
-    /** Key info for the received key */
-    key: KeyInfo;
-    /** Pre-configured KV service for the shared path */
-    kv: IKVService;
-    /** The space ID */
-    spaceId: string;
-    /** The path prefix for this share */
-    path: string;
-}
-/**
- * Parameters for attenuating a received share to another principal.
- *
- * Omitted path/actions/expiry inherit the received share's exact values. Any
- * supplied value must be equal to or an attenuated subset of the parent.
- */
-interface DelegateReceivedShareParams {
-    /** DID that may exercise the child delegation. */
-    delegateDID: string;
-    /** Equal to or below the shared path. Defaults to the shared path. */
-    path?: string;
-    /** Subset of the shared actions. Defaults to all shared actions. */
-    actions?: string[];
-    /** No later than the sharing-link expiry. Defaults to the parent expiry. */
-    expiry?: Date;
-    /** Optional node origin that further narrows the configured-host allowlist. */
-    expectedHost?: string;
-}
-/**
- * A transport-ready child delegation with non-secret source lineage.
- *
- * `delegation.delegationHeader` is a live bearer credential. Treat it like a
- * secret: do not log it or persist it outside secure credential storage.
- * Only `source` is safe to retain as non-secret lineage metadata.
- */
-interface DelegatedShareAccess {
-    delegation: Delegation & {
-        delegationHeader: {
-            Authorization: string;
-        };
-        ownerAddress: string;
-        chainId: number;
-        host: string;
-        resources: Array<{
-            service: string;
-            space: string;
-            path: string;
-            actions: string[];
-        }>;
-        disableSubDelegation: boolean;
-    };
-    source: {
-        parentCid: string;
-        spaceId: string;
-        path: string;
-        host: string;
-        expiresAt: Date;
-    };
-}
-/**
- * Configuration for SharingService.
- */
-interface SharingServiceConfig {
-    /** TinyCloud host URLs */
-    hosts: string[];
-    /**
-     * Active session for authentication.
-     * Required for generate(), optional for receive().
-     */
-    session?: ServiceSession;
-    /** Platform-specific invoke function */
-    invoke: InvokeFunction;
-    /** Optional custom fetch implementation */
-    fetch?: FetchFunction;
-    /** Key provider for cryptographic operations */
-    keyProvider: KeyProvider;
-    /** Capability key registry for key/delegation management */
-    registry: ICapabilityKeyRegistry;
-    /**
-     * Delegation manager for creating delegations (used if createDelegation not provided).
-     * Required for generate(), optional for receive().
-     */
-    delegationManager?: DelegationManager;
-    /** Factory for creating KV service instances */
-    createKVService: (config: {
-        hosts: string[];
-        session: ServiceSession;
-        invoke: InvokeFunction;
-        fetch?: FetchFunction;
-        pathPrefix?: string;
-    }) => IKVService;
-    /** Base URL for sharing links (e.g., "https://share.myapp.com") */
-    baseUrl?: string;
-    /**
-     * Custom delegation creation function. When provided, this is used instead
-     * of delegationManager.create(). This allows platforms to use their own
-     * delegation creation logic (e.g., SIWE-based /delegate endpoint).
-     */
-    createDelegation?: (params: CreateDelegationParams) => Promise<Result<Delegation, DelegationError>>;
-    /**
-     * WASM function for client-side delegation creation.
-     * When provided, this is preferred over server-side creation (createDelegation/delegationManager).
-     * Creates UCAN delegations directly without requiring server roundtrip.
-     */
-    createDelegationWasm?: (params: CreateDelegationWasmParams) => CreateDelegationWasmResult;
-    /** Compute a CID for serialized delegation bytes. Required for share attenuation. */
-    computeCid?: (data: Uint8Array, codec: bigint) => string;
-    /**
-     * Path prefix for KV operations.
-     * When set, paths passed to generate() are prefixed with this value.
-     * This ensures the share path matches the session's authorized paths.
-     */
-    pathPrefix?: string;
-    /**
-     * Session expiry time.
-     * When set, sharing link expiry is clamped to not exceed this value
-     * unless onRootDelegationNeeded is provided and returns a new delegation.
-     */
-    sessionExpiry?: Date;
-    /**
-     * Callback to create a DIRECT delegation from the root (wallet) to a share key.
-     * This bypasses the session delegation chain, allowing share links with
-     * expiry longer than the current session.
-     *
-     * When provided and share expiry > session expiry:
-     * 1. SharingService creates the ephemeral share key
-     * 2. This callback is invoked with the share key DID
-     * 3. The callback signs a direct PKH -> share key delegation with the wallet
-     * 4. The returned delegation is used for the share link
-     *
-     * This is the CORRECT solution for long-lived share links because:
-     * - It creates a fresh delegation chain: PKH -> share key
-     * - Not constrained by session expiry (no sub-delegation from session key)
-     *
-     * @param params - Parameters for creating the root delegation
-     * @returns The delegation from wallet to share key, or undefined to fall back to session extension
-     */
-    onRootDelegationNeeded?: (params: {
-        /** DID of the share key to delegate to */
-        shareKeyDID: string;
-        /** Space ID */
-        spaceId: string;
-        /** Path to grant access to */
-        path: string;
-        /** Actions to grant */
-        actions: string[];
-        /** Requested expiry time */
-        requestedExpiry: Date;
-    }) => Promise<Delegation | undefined>;
-    /** Reject operations after the host session/service graph has been retired. */
-    assertActive?: () => void;
-}
-/**
- * Interface for the SharingService.
- */
-interface ISharingService {
-    /**
-     * Generate a sharing link with an embedded private key.
-     *
-     * This creates a new session key, delegates to it, and encodes
-     * the key and delegation into a shareable link.
-     */
-    generate(params: GenerateShareParams): Promise<Result<ShareLink, DelegationError>>;
-    /**
-     * Receive and activate a sharing link.
-     *
-     * Decodes the link, ingests the key into the registry, and optionally
-     * creates a sub-delegation to the current session key.
-     */
-    receive(link: string, options?: ReceiveOptions): Promise<Result<ShareAccess, DelegationError>>;
-    /**
-     * Consume a sharing link locally and create an attenuated child delegation.
-     * The raw link and embedded private JWK are never returned. The returned
-     * child delegation is itself a sensitive bearer credential.
-     */
-    delegateReceivedShare(link: string, params: DelegateReceivedShareParams): Promise<Result<DelegatedShareAccess, DelegationError>>;
-    /**
-     * Encode sharing data into a link string.
-     */
-    encodeLink(data: EncodedShareData, schema?: ShareSchema): string;
-    /**
-     * Decode a link string into sharing data.
-     */
-    decodeLink(link: string): EncodedShareData;
-}
-/**
- * SharingService - v2 sharing link service with embedded private keys.
- *
- * @example
- * ```typescript
- * import { SharingService } from "@tinycloud/sdk-core/delegations";
- *
- * const sharing = new SharingService({
- *   hosts: ["https://node.tinycloud.xyz"],
- *   session,
- *   invoke,
- *   keyProvider,
- *   registry,
- *   delegationManager,
- *   createKVService,
- *   baseUrl: "https://share.myapp.com"
- * });
- *
- * // Generate a sharing link
- * const result = await sharing.generate({
- *   path: "/kv/documents/report.pdf",
- *   actions: ["tinycloud.kv/get"],
- *   expiry: new Date("2024-12-31")
- * });
- *
- * if (result.ok) {
- *   console.log("Share this URL:", result.data.url);
- * }
- *
- * // Receive a sharing link
- * const receiveResult = await sharing.receive(shareUrl);
- * if (receiveResult.ok) {
- *   // Use the pre-configured KV service
- *   const data = await receiveResult.data.kv.get("report.pdf");
- * }
- * ```
- */
-declare class SharingService implements ISharingService {
-    private hosts;
-    private session?;
-    private invoke;
-    private fetchFn;
-    private keyProvider;
-    private registry;
-    private delegationManager?;
-    private createKVService;
-    private baseUrl;
-    private createDelegationFn?;
-    private createDelegationWasmFn?;
-    private computeCidFn?;
-    private pathPrefix;
-    private sessionExpiry?;
-    private onRootDelegationNeeded?;
-    private assertActiveFn?;
-    /**
-     * Creates a new SharingService instance.
-     */
-    constructor(config: SharingServiceConfig);
-    /**
-     * Gets the primary host URL.
-     */
-    private get host();
-    /**
-     * Updates the session (e.g., after re-authentication).
-     */
-    updateSession(session: ServiceSession): void;
-    /**
-     * Updates the service configuration.
-     * Used to add full capabilities (session, delegationManager, createDelegation, createDelegationWasm) after signIn.
-     */
-    updateConfig(config: Partial<Pick<SharingServiceConfig, "session" | "delegationManager" | "createDelegation" | "createDelegationWasm" | "sessionExpiry" | "onRootDelegationNeeded" | "assertActive">>): void;
-    /**
-     * Generate a sharing link with an embedded private key.
-     *
-     * Flow:
-     * 1. Spawn new session key (unique per share)
-     * 2. Create delegation from current session to spawned key
-     * 3. Package: { key (with private!), delegation, path, host }
-     * 4. Encode based on schema (base64 for now)
-     * 5. Return link string
-     */
-    generate(params: GenerateShareParams): Promise<Result<ShareLink, DelegationError>>;
-    /**
-     * Check if any key in the registry can satisfy the delegation request.
-     * A key can satisfy if it has a delegation that:
-     * 1. Covers the required path (exact match or parent path)
-     * 2. Has all required actions
-     * 3. Has sufficient expiry (delegation.expiry >= requestedExpiry)
-     * 4. Allows sub-delegation
-     * @internal
-     */
-    private findSuitableKeyForDelegation;
-    private retiredGraphError;
-    /**
-     * Check if a delegation path matches/covers the requested path.
-     * A delegation path covers the request if:
-     * - It's an exact match
-     * - It's a parent path (e.g., delegation for "" covers "foo/bar")
-     * - It uses wildcards that match
-     * @internal
-     */
-    private pathMatches;
-    /**
-     * Create a delegation from the current session to a share key.
-     * This is the fallback path when root delegation is not available.
-     * @internal
-     */
-    private createSessionDelegation;
-    /**
-     * Receive and activate a sharing link.
-     *
-     * Flow:
-     * 1. Decode link -> extract { key, delegation, path, host }
-     * 2. Ingest key into CapabilityKeyRegistry
-     * 3. If autoSubdelegate (default true) + useSessionKey:
-     *    - Create sub-delegation from ingested key -> current session
-     *    - Register sub-delegation capabilities
-     * 4. Return ShareAccess with pre-configured KV service
-     */
-    receive(link: string, options?: ReceiveOptions): Promise<Result<ShareAccess, DelegationError>>;
-    /**
-     * Create a constrained child delegation from a received sharing link.
-     *
-     * This is the safe handoff for a browser delegating shared input to an
-     * agent or service: the bearer link is decoded and used only in this SDK
-     * instance, while the recipient receives a child UCAN without the embedded
-     * private key. The child UCAN is a sensitive bearer credential and must not
-     * be logged or stored insecurely.
-     */
-    delegateReceivedShare(link: string, params: DelegateReceivedShareParams): Promise<Result<DelegatedShareAccess, DelegationError>>;
-    /**
-     * The child-delegation WASM boundary accepts action-only abilities. Reject
-     * every constrained parent branch before that boundary can broaden it.
-     */
-    private assertDelegationCaveatsPreservable;
-    /**
-     * Encode sharing data into a link string.
-     *
-     * @param data - The share data to encode
-     * @param schema - The encoding schema (default: "base64")
-     * @returns Encoded link string
-     */
-    encodeLink(data: EncodedShareData, schema?: ShareSchema): string;
-    /**
-     * Decode a link string into sharing data.
-     *
-     * @param link - The encoded link string (may include URL prefix)
-     * @returns Decoded share data
-     * @throws Error if link format is invalid or data fails validation
-     */
-    decodeLink(link: string): EncodedShareData;
-    /**
-     * Decode and validate a link string into sharing data.
-     *
-     * Internal method that returns a Result instead of throwing.
-     * Used by receive() for proper error handling.
-     *
-     * @param link - The encoded link string (may include URL prefix)
-     * @returns Result with decoded share data or validation error
-     */
-    private decodeLinkWithValidation;
+    static readPublicKey<T = unknown>(host: string, address: string, chainId: number, key: string, fetchFn?: FetchFunction): Promise<Result<T, ServiceError>>;
 }
-/**
- * Create a new SharingService instance.
- */
-declare function createSharingService(config: SharingServiceConfig): ISharingService;
 
 /**
  * Interface for space-scoped delegation operations.
@@ -4593,19 +1978,19 @@ interface ISpaceScopedDelegations {
     /**
      * List delegations created by the user in this space (outgoing).
      */
-    list(): Promise<Result$1<Delegation[], ServiceError>>;
+    list(): Promise<Result<Delegation[], ServiceError>>;
     /**
      * List delegations received by the user for this space (incoming).
      */
-    listReceived(): Promise<Result$1<Delegation[], ServiceError>>;
+    listReceived(): Promise<Result<Delegation[], ServiceError>>;
     /**
      * Create a delegation within this space.
      */
-    create(params: Omit<CreateDelegationParams, "spaceId">): Promise<Result$1<Delegation, ServiceError>>;
+    create(params: Omit<CreateDelegationParams, "spaceId">): Promise<Result<Delegation, ServiceError>>;
     /**
      * Revoke a delegation within this space.
      */
-    revoke(cid: string): Promise<Result$1<void, ServiceError>>;
+    revoke(cid: string): Promise<Result<void, ServiceError>>;
 }
 /**
  * Interface for space-scoped sharing operations.
@@ -4616,15 +2001,15 @@ interface ISpaceScopedSharing {
     /**
      * Generate a sharing link for a resource in this space.
      */
-    generate(params: Omit<GenerateShareParams, "spaceId">): Promise<Result$1<ShareLink, ServiceError>>;
+    generate(params: Omit<GenerateShareParams, "spaceId">): Promise<Result<ShareLink, ServiceError>>;
     /**
      * List active sharing links in this space.
      */
-    list(): Promise<Result$1<ShareLink[], ServiceError>>;
+    list(): Promise<Result<ShareLink[], ServiceError>>;
     /**
      * Revoke a sharing link.
      */
-    revoke(token: string): Promise<Result$1<void, ServiceError>>;
+    revoke(token: string): Promise<Result<void, ServiceError>>;
 }
 /**
  * Interface for a Space object.
@@ -4663,7 +2048,7 @@ interface ISpace {
     /**
      * Get space metadata.
      */
-    info(): Promise<Result$1<SpaceInfo, ServiceError>>;
+    info(): Promise<Result<SpaceInfo, ServiceError>>;
 }
 /**
  * Configuration for creating a Space object.
@@ -4700,7 +2085,7 @@ interface SpaceConfig {
     /**
      * Function to get space info.
      */
-    getInfo: (spaceId: string) => Promise<Result$1<SpaceInfo, ServiceError>>;
+    getInfo: (spaceId: string) => Promise<Result<SpaceInfo, ServiceError>>;
 }
 /**
  * Space - Provides scoped access to services within a specific space.
@@ -4772,7 +2157,7 @@ declare class Space implements ISpace {
      *
      * @returns Result containing space information
      */
-    info(): Promise<Result$1<SpaceInfo, ServiceError>>;
+    info(): Promise<Result<SpaceInfo, ServiceError>>;
 }
 
 /**
@@ -4817,7 +2202,7 @@ interface SpaceDelegationParams extends Omit<CreateDelegationParams, "spaceId">
  * Function type for creating delegations.
  * Platform SDKs provide this to handle SIWE-based delegation creation.
  */
-type CreateDelegationFunction = (params: SpaceDelegationParams) => Promise<Result$1<Delegation, ServiceError>>;
+type CreateDelegationFunction = (params: SpaceDelegationParams) => Promise<Result<Delegation, ServiceError>>;
 /**
  * Configuration for SpaceService.
  */
@@ -4858,13 +2243,13 @@ interface ISpaceService {
     /**
      * List all spaces the user has access to (owned + delegated).
      */
-    list(): Promise<Result$1<SpaceInfo[], ServiceError>>;
+    list(): Promise<Result<SpaceInfo[], ServiceError>>;
     /**
      * Create a new space.
      *
      * @param name - The name for the new space
      */
-    create(name: string): Promise<Result$1<SpaceInfo, ServiceError>>;
+    create(name: string): Promise<Result<SpaceInfo, ServiceError>>;
     /**
      * Get a Space object by name or full URI.
      *
@@ -4879,7 +2264,7 @@ interface ISpaceService {
      *
      * @param nameOrUri - Short name or full URI
      */
-    exists(nameOrUri: string): Promise<Result$1<boolean, ServiceError>>;
+    exists(nameOrUri: string): Promise<Result<boolean, ServiceError>>;
     /**
      * Get the current user's primary space ID.
      */
@@ -5006,7 +2391,7 @@ declare class SpaceService implements ISpaceService {
      * Combines owned spaces (from the server) with delegated spaces
      * (from the capability registry).
      */
-    list(): Promise<Result$1<SpaceInfo[], ServiceError>>;
+    list(): Promise<Result<SpaceInfo[], ServiceError>>;
     /**
      * List owned spaces from the server.
      */
@@ -5028,7 +2413,7 @@ declare class SpaceService implements ISpaceService {
      *
      * @param name - The name for the new space
      */
-    create(name: string): Promise<Result$1<SpaceInfo, ServiceError>>;
+    create(name: string): Promise<Result<SpaceInfo, ServiceError>>;
     private notifySpaceRegistered;
     /**
      * Get a Space object by name or full URI.
@@ -5043,7 +2428,7 @@ declare class SpaceService implements ISpaceService {
     /**
      * Check if a space exists and the user has access.
      */
-    exists(nameOrUri: string): Promise<Result$1<boolean, ServiceError>>;
+    exists(nameOrUri: string): Promise<Result<boolean, ServiceError>>;
     /**
      * Get space info from server or cache.
      */
@@ -5162,39 +2547,39 @@ interface AccountServiceConfig {
 declare class AccountService {
     private readonly config;
     constructor(config: AccountServiceConfig);
-    status(): Promise<Result$1<AccountStatus>>;
+    status(): Promise<Result<AccountStatus>>;
     readonly applications: {
-        list: (options?: AccountApplicationListOptions) => Promise<Result$1<AccountApplication[]>>;
-        get: (appId: string) => Promise<Result$1<AccountApplication>>;
-        register: (manifest: Manifest | Manifest[]) => Promise<Result$1<AccountApplication>>;
-        remove: (appId: string) => Promise<Result$1<void>>;
+        list: (options?: AccountApplicationListOptions) => Promise<Result<AccountApplication[]>>;
+        get: (appId: string) => Promise<Result<AccountApplication>>;
+        register: (manifest: Manifest | Manifest[]) => Promise<Result<AccountApplication>>;
+        remove: (appId: string) => Promise<Result<void>>;
     };
     readonly spaces: {
-        list: (options?: AccountSpaceListOptions) => Promise<Result$1<AccountSpace[]>>;
-        get: (spaceId: string) => Promise<Result$1<AccountSpace>>;
-        register: (space: SpaceInfo | AccountSpace) => Promise<Result$1<AccountSpace>>;
-        syncAccessible: () => Promise<Result$1<AccountSpace[]>>;
-        remove: (spaceId: string) => Promise<Result$1<void>>;
+        list: (options?: AccountSpaceListOptions) => Promise<Result<AccountSpace[]>>;
+        get: (spaceId: string) => Promise<Result<AccountSpace>>;
+        register: (space: SpaceInfo | AccountSpace) => Promise<Result<AccountSpace>>;
+        syncAccessible: () => Promise<Result<AccountSpace[]>>;
+        remove: (spaceId: string) => Promise<Result<void>>;
     };
     readonly delegations: {
-        query: (options?: AccountDelegationQueryOptions) => Promise<Result$1<AccountDelegationPage>>;
-        list: (options?: AccountDelegationListOptions) => Promise<Result$1<AccountDelegation[]>>;
-        revoke: (input: string | AccountDelegationRevokeOptions) => Promise<Result$1<DelegationRevocationReceipt | void>>;
+        query: (options?: AccountDelegationQueryOptions) => Promise<Result<AccountDelegationPage>>;
+        list: (options?: AccountDelegationListOptions) => Promise<Result<AccountDelegation[]>>;
+        revoke: (input: string | AccountDelegationRevokeOptions) => Promise<Result<DelegationRevocationReceipt | void>>;
     };
     readonly index: {
-        ensure: () => Promise<Result$1<AccountIndexEnsureResult>>;
-        rebuild: () => Promise<Result$1<AccountIndexRebuildResult>>;
+        ensure: () => Promise<Result<AccountIndexEnsureResult>>;
+        rebuild: () => Promise<Result<AccountIndexRebuildResult>>;
         applications: {
-            list: () => Promise<Result$1<AccountApplication[]>>;
+            list: () => Promise<Result<AccountApplication[]>>;
         };
         spaces: {
-            list: () => Promise<Result$1<AccountSpace[]>>;
+            list: () => Promise<Result<AccountSpace[]>>;
         };
         delegations: {
-            list: (options?: AccountDelegationListOptions) => Promise<Result$1<AccountDelegation[]>>;
+            list: (options?: AccountDelegationListOptions) => Promise<Result<AccountDelegation[]>>;
         };
-        query: <T = Record<string, unknown>>(sql: string, params?: SqlValue[]) => Promise<Result$1<QueryResponse<T>>>;
-        status: () => Promise<Result$1<AccountIndexStatus>>;
+        query: <T = Record<string, unknown>>(sql: string, params?: SqlValue[]) => Promise<Result<QueryResponse<T>>>;
+        status: () => Promise<Result<AccountIndexStatus>>;
     };
     private accountKV;
     private accountDb;
@@ -5274,6 +2659,10 @@ declare function submitHostDelegation(host: string, headers: Record<string, stri
  * This submits the session delegation to the server, enabling the session
  * key to perform operations on behalf of the user.
  *
+ * Concurrent calls with the same host and a byte-identical delegation header
+ * share a single `POST /delegate`; see {@link inFlightActivations}. Sequential
+ * calls always issue a fresh request.
+ *
  * @param host - TinyCloud server URL
  * @param delegationHeader - Session delegation header (from session.delegationHeader)
  * @returns Result indicating success/failure (404 means space doesn't exist)
@@ -5554,4 +2943,4 @@ declare const EXPIRY: {
 declare const DEFAULT_SIGNED_READ_URL_EXPIRY_MS: number;
 type ExpiryTier = keyof typeof EXPIRY;
 
-export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountDelegation, type AccountDelegationListOptions, type AccountDelegationPage, type AccountDelegationQueryOptions, type AccountDelegationRecord, type AccountDelegationResource, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, type CapabilityEntry, CapabilityKeyRegistry, type CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, type CreateDelegationParams, type CreateDelegationWasmParams, type CreateDelegationWasmResult, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, type DelegateReceivedShareParams, type DelegatedResource, type DelegatedShareAccess, type Delegation, type DelegationApiResponse, type DelegationChain, type DelegationChainV2, type DelegationDirection, type DelegationError, type DelegationErrorCode, DelegationErrorCodes, type DelegationFilters, DelegationManager, type DelegationManagerConfig, type DelegationRecord, type Result as DelegationResult, type DelegationRevocationReceipt, type DelegationStatus, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EncodedShareData, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, type GenerateShareParams, type ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, type ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, type IngestOptions, type JWK, type KeyInfo, type KeyProvider, type KeyType, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ReceiveOptions, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, type ShareAccess, type ShareLink, type ShareLinkData, type ShareSchema, SharingService, type SharingServiceConfig, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, type SpaceInfo, type SpaceOwnership, SpaceService, type SpaceServiceConfig, type StoredDelegationChain, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createSharingService, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, discoverLocalTinyCloudNode, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, type AbilitiesMap, type AccountApplication, type AccountApplicationListOptions, type AccountDelegation, type AccountDelegationListOptions, AccountDelegationPage, AccountDelegationQueryOptions, type AccountDelegationRevokeOptions, type AccountIndexEnsureResult, type AccountIndexRebuildResult, type AccountIndexStatus, type AccountIndexedReadOptions, AccountService, type AccountServiceConfig, type AccountSpace, type AccountSpaceListOptions, type AccountStatus, AutoApproveSpaceCreationHandler, type AutoRejectStrategy, type AutoSignStrategy, type Bytes, type CallbackStrategy, type CanonicalAddress, type CanonicalParsedNetworkId, CaveatedDelegationUnsupportedError, type ClientSession, ClientSessionSchema, CloudLocationResolutionError, type ComposeManifestOptions, type ComposedManifestRequest, type CreateDelegationFunction, CreateDelegationParams, DEFAULT_DEFAULTS, DEFAULT_EXPIRY, DEFAULT_KNOWLEDGE_ROOT, DEFAULT_LOCAL_NODE_PIN_STORAGE_KEY, DEFAULT_LOCAL_NODE_URL, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DEFAULT_SIGNED_READ_URL_EXPIRY_MS, DEFAULT_TINYCLOUD_FALLBACK_HOST, DEFAULT_TINYCLOUD_LOCATION_REGISTRY_URL, Delegation, DelegationManager, DelegationRevocationReceipt, type DidCacheKeyOptions, type DidEqualsOptions, type DiscoverLocalTinyCloudNodeOptions, type DiscoveredLocalTinyCloudNode, ENCRYPTION_MANIFEST_SPACE, ENCRYPTION_PERMISSION_SERVICE, EXPIRY, type EnsData, EnsDataSchema, type EventEmitterStrategy, type ExpiryTier, type Extension, GenerateShareParams, ICapabilityKeyRegistry, type IENSResolver, type INotificationHandler, type ISessionManager, type ISessionStorage, ISharingService, type ISigner, type ISpace, type ISpaceCreationHandler, type ISpaceScopedDelegations, type ISpaceScopedSharing, type ISpaceService, type IUserAuthorization, type IWasmBindings, IdentityParseError, LOCAL_LINK_HOST_SUFFIX, LOCAL_LINK_PROBE_TIMEOUT_MS, LOCAL_LOOPBACK_PROBE_TIMEOUT_MS, type LocalNodeIdentityStore, type LocationCandidate, type LocationCandidateInput, type LocationRecord, type LocationRecordPayload, type LocationRecordSigner, LocationRecordValidationError, type LocationResolutionAttempt, type LocationSource, type Manifest, type ManifestDefaults, type ManifestKnowledge, type ManifestRegistryRecord, type ManifestSecretActions, ManifestValidationError, type NodeInfo, type OpenKeyCallbackStrategy, type OpenKeySigningRequestBody, type OpenKeySigningResponseBody, type OpenKeySigningStrategyOptions, type ParseRecapFromSiwe, type PartialSiweMessage, type PermissionEntry, PermissionNotInManifestError, type PersistedSessionData, type PersistedSessionProof, type PersistedTinyCloudSession, type PkhDidParts, ProtocolMismatchError, type ResolveCloudLocationOptions, type ResolveTinyCloudHostsOptions, type ResolvedCapabilities, type ResolvedCloudLocation, type ResolvedDelegate, type ResolvedTinyCloudHosts, type ResourceCapability, SECRETS_SPACE, SERVICE_LONG_TO_SHORT, SERVICE_SHORT_TO_LONG, type ServerHost, SessionExpiredError, ShareLink, type SignCallback, type SignInOptions, type SignRequest, type SignResponse, type SignStrategy, SilentNotificationHandler, type SiweConfig, SiweConfigSchema, Space, type SpaceAbilitiesMap, type SpaceConfig, type SpaceCreationContext, type SpaceDelegationParams, type SpaceErrorCode, SpaceErrorCodes, type SpaceHostResult, SpaceInfo, SpaceService, type SpaceServiceConfig, type SubsetCheckResult, TinyCloud, type TinyCloudConfig, type TinyCloudSession, UnsupportedFeatureError, type UserAuthorizationConfig, VAULT_PERMISSION_SERVICE, type ValidatedPersistedSessionProof, type ValidationError, VersionCheckError, type WasmRecapEntry, type WebStorageLike, actionContains, activateSessionWithHost, addressStorageKey, applyPrefix, buildSpaceUri, canonicalLocationPayload, canonicalizeAddress, canonicalizeDid, canonicalizeDidUrl, canonicalizeNetworkId, canonicalizeRecapCaveats, checkNodeInfo, composeManifestRequest, createInMemoryLocalNodeIdentityStore, createLocalStorageLocalNodeIdentityStore, createOpenKeyCallbackSigningStrategy, createSpaceService, defaultSignStrategy, defaultSpaceCreationHandler, didCacheKey, didEquals, discoverLocalTinyCloudNode, expandActionShortNames, expandPermissionEntries, expandPermissionEntry, fetchLocationRecord, fetchPeerId, httpUrlToMultiaddr, isCapabilitySubset, isEvmAddress, loadManifest, locationPayloadForRecord, makePkhSpaceId, makePublicSpaceId, manifestAbilitiesUnion, multiaddrToHttpUrl, normalizeDefaults, parseCanonicalNetworkId, parseExpiry, parsePkhDid, parseRecapCapabilities, parseSpaceUri, pkhDid, principalDid, principalDidEquals, recapCaveatsEqual, resolveCloudLocation, resolveManifest, resolveManifestKnowledgeRoot, resolveTinyCloudHosts, resourceCapabilitiesToAbilitiesMap, resourceCapabilitiesToSpaceAbilitiesMap, signLocationRecord, submitHostDelegation, validateClientSession, validateLocationRecord, validateLocationRecordPayload, validateManifest, validatePersistedSessionData, verifyDidKeyEd25519Signature, verifyLocationRecord };