@tinycloud/sdk-core 3.8.0-beta.5 → 3.8.0

package/dist/types.schema-BmN-OnCA.d.cts

@@ -0,0 +1,1763 @@
+import { z } from 'zod';
+import { ServiceSession, InvokeFunction, InvokeAnyFunction, FetchFunction } from '@tinycloud/sdk-services';
+
+/**
+ * Zod schemas for delegation management types.
+ *
+ * These schemas provide runtime validation for delegation, capability key management,
+ * and sharing link functionality. Types are derived from schemas using z.infer<>.
+ *
+ * @packageDocumentation
+ */
+
+/**
+ * Result type pattern for delegation operations.
+ */
+type Result<T, E = DelegationError> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    error: E;
+};
+/**
+ * JSON Web Key representation for cryptographic keys.
+ * Follows the JWK specification (RFC 7517).
+ */
+declare const JWKSchema: z.ZodObject<{
+    /** Key type (e.g., "EC", "RSA", "OKP") */
+    kty: z.ZodString;
+    /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
+    crv: z.ZodOptional<z.ZodString>;
+    /** X coordinate for EC keys, public key for OKP */
+    x: z.ZodOptional<z.ZodString>;
+    /** Y coordinate for EC keys */
+    y: z.ZodOptional<z.ZodString>;
+    /** Private key value (d parameter) */
+    d: z.ZodOptional<z.ZodString>;
+    /** Public exponent for RSA keys */
+    e: z.ZodOptional<z.ZodString>;
+    /** Modulus for RSA keys */
+    n: z.ZodOptional<z.ZodString>;
+    /** Key ID */
+    kid: z.ZodOptional<z.ZodString>;
+    /** Algorithm */
+    alg: z.ZodOptional<z.ZodString>;
+    /** Key use (e.g., "sig", "enc") */
+    use: z.ZodOptional<z.ZodString>;
+    /** Key operations (e.g., ["sign", "verify"]) */
+    key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    kty: string;
+    kid?: string | undefined;
+    alg?: string | undefined;
+    crv?: string | undefined;
+    x?: string | undefined;
+    y?: string | undefined;
+    d?: string | undefined;
+    e?: string | undefined;
+    n?: string | undefined;
+    use?: string | undefined;
+    key_ops?: string[] | undefined;
+}, {
+    kty: string;
+    kid?: string | undefined;
+    alg?: string | undefined;
+    crv?: string | undefined;
+    x?: string | undefined;
+    y?: string | undefined;
+    d?: string | undefined;
+    e?: string | undefined;
+    n?: string | undefined;
+    use?: string | undefined;
+    key_ops?: string[] | undefined;
+}>;
+type JWK = z.infer<typeof JWKSchema>;
+/**
+ * Type of key in the capability registry.
+ */
+declare const KeyTypeSchema: z.ZodEnum<["main", "session", "ingested"]>;
+type KeyType = z.infer<typeof KeyTypeSchema>;
+/**
+ * Information about a cryptographic key used for delegations.
+ */
+declare const KeyInfoSchema: z.ZodObject<{
+    /** Unique identifier for this key */
+    id: z.ZodString;
+    /** DID associated with this key */
+    did: z.ZodString;
+    /** Type of key determining its authority level */
+    type: z.ZodEnum<["main", "session", "ingested"]>;
+    /** Private key in JWK format */
+    jwk: z.ZodOptional<z.ZodObject<{
+        /** Key type (e.g., "EC", "RSA", "OKP") */
+        kty: z.ZodString;
+        /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
+        crv: z.ZodOptional<z.ZodString>;
+        /** X coordinate for EC keys, public key for OKP */
+        x: z.ZodOptional<z.ZodString>;
+        /** Y coordinate for EC keys */
+        y: z.ZodOptional<z.ZodString>;
+        /** Private key value (d parameter) */
+        d: z.ZodOptional<z.ZodString>;
+        /** Public exponent for RSA keys */
+        e: z.ZodOptional<z.ZodString>;
+        /** Modulus for RSA keys */
+        n: z.ZodOptional<z.ZodString>;
+        /** Key ID */
+        kid: z.ZodOptional<z.ZodString>;
+        /** Algorithm */
+        alg: z.ZodOptional<z.ZodString>;
+        /** Key use (e.g., "sig", "enc") */
+        use: z.ZodOptional<z.ZodString>;
+        /** Key operations (e.g., ["sign", "verify"]) */
+        key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        kty: string;
+        kid?: string | undefined;
+        alg?: string | undefined;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        d?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        use?: string | undefined;
+        key_ops?: string[] | undefined;
+    }, {
+        kty: string;
+        kid?: string | undefined;
+        alg?: string | undefined;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        d?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        use?: string | undefined;
+        key_ops?: string[] | undefined;
+    }>>;
+    /** Priority for key selection (lower = higher priority) */
+    priority: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    type: "session" | "main" | "ingested";
+    did: string;
+    id: string;
+    priority: number;
+    jwk?: {
+        kty: string;
+        kid?: string | undefined;
+        alg?: string | undefined;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        d?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        use?: string | undefined;
+        key_ops?: string[] | undefined;
+    } | undefined;
+}, {
+    type: "session" | "main" | "ingested";
+    did: string;
+    id: string;
+    priority: number;
+    jwk?: {
+        kty: string;
+        kid?: string | undefined;
+        alg?: string | undefined;
+        crv?: string | undefined;
+        x?: string | undefined;
+        y?: string | undefined;
+        d?: string | undefined;
+        e?: string | undefined;
+        n?: string | undefined;
+        use?: string | undefined;
+        key_ops?: string[] | undefined;
+    } | undefined;
+}>;
+type KeyInfo = z.infer<typeof KeyInfoSchema>;
+/**
+ * Error type for delegation operations.
+ */
+declare const DelegationErrorSchema: z.ZodObject<{
+    /** Error code for programmatic handling */
+    code: z.ZodString;
+    /** Human-readable error message */
+    message: z.ZodString;
+    /** The service that produced the error */
+    service: z.ZodLiteral<"delegation">;
+    /** Original error if wrapping another error */
+    cause: z.ZodOptional<z.ZodType<Error, z.ZodTypeDef, Error>>;
+    /** Additional metadata about the error */
+    meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    message: string;
+    service: "delegation";
+    cause?: Error | undefined;
+    meta?: Record<string, unknown> | undefined;
+}, {
+    code: string;
+    message: string;
+    service: "delegation";
+    cause?: Error | undefined;
+    meta?: Record<string, unknown> | undefined;
+}>;
+type DelegationError = z.infer<typeof DelegationErrorSchema>;
+/**
+ * Error codes for delegation operations.
+ */
+declare const DelegationErrorCodes: {
+    readonly AUTH_REQUIRED: "AUTH_REQUIRED";
+    readonly AUTH_UNAUTHORIZED: "AUTH_UNAUTHORIZED";
+    readonly AUTH_EXPIRED: "AUTH_EXPIRED";
+    readonly NOT_INITIALIZED: "NOT_INITIALIZED";
+    readonly NOT_FOUND: "NOT_FOUND";
+    readonly REVOKED: "REVOKED";
+    readonly NETWORK_ERROR: "NETWORK_ERROR";
+    readonly TIMEOUT: "TIMEOUT";
+    readonly ABORTED: "ABORTED";
+    readonly INVALID_INPUT: "INVALID_INPUT";
+    readonly PERMISSION_DENIED: "PERMISSION_DENIED";
+    readonly CREATION_FAILED: "CREATION_FAILED";
+    readonly REVOCATION_FAILED: "REVOCATION_FAILED";
+    readonly INVALID_TOKEN: "INVALID_TOKEN";
+    readonly KV_SERVICE_UNAVAILABLE: "KV_SERVICE_UNAVAILABLE";
+    readonly DATA_FETCH_FAILED: "DATA_FETCH_FAILED";
+    readonly VALIDATION_ERROR: "VALIDATION_ERROR";
+    readonly UNSUPPORTED_OPERATION: "UNSUPPORTED_OPERATION";
+    /** The node answered 503: the delegation chain is too deep to evaluate right now. Retry later. */
+    readonly CHAIN_TOO_DEEP: "CHAIN_TOO_DEEP";
+    /** The node answered 400 "invalid delegation query cursor": malformed, foreign or from another filter. Start the listing again without it. */
+    readonly INVALID_CURSOR: "INVALID_CURSOR";
+};
+type DelegationErrorCode = (typeof DelegationErrorCodes)[keyof typeof DelegationErrorCodes];
+/**
+ * Represents a delegation from one DID to another.
+ */
+declare const DelegationSchema: z.ZodObject<{
+    /** Content identifier (CID) of the delegation */
+    cid: z.ZodString;
+    /** DID of the delegate (the party receiving the delegation) */
+    delegateDID: z.ZodString;
+    /** Space ID this delegation applies to */
+    spaceId: z.ZodString;
+    /** Resource path this delegation grants access to */
+    path: z.ZodString;
+    /** Actions this delegation authorizes */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** Exact ReCap caveats that constrain every action in this scope. */
+    caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+    /** When this delegation expires (accepts Date or ISO string from JSON) */
+    expiry: z.ZodDate;
+    /** Whether this delegation has been revoked */
+    isRevoked: z.ZodBoolean;
+    /** DID of the delegator (the party granting the delegation) */
+    delegatorDID: z.ZodOptional<z.ZodString>;
+    /** When this delegation was created (accepts Date or ISO string from JSON) */
+    createdAt: z.ZodOptional<z.ZodDate>;
+    /** Parent delegation CID if this is a sub-delegation */
+    parentCid: z.ZodOptional<z.ZodString>;
+    /** Whether sub-delegation is allowed */
+    allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+    /** Authorization header (UCAN bearer token) */
+    authHeader: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    expiry: Date;
+    actions: string[];
+    spaceId: string;
+    cid: string;
+    delegateDID: string;
+    isRevoked: boolean;
+    caveats?: Record<string, unknown>[] | undefined;
+    createdAt?: Date | undefined;
+    delegatorDID?: string | undefined;
+    parentCid?: string | undefined;
+    allowSubDelegation?: boolean | undefined;
+    authHeader?: string | undefined;
+}, {
+    path: string;
+    expiry: Date;
+    actions: string[];
+    spaceId: string;
+    cid: string;
+    delegateDID: string;
+    isRevoked: boolean;
+    caveats?: Record<string, unknown>[] | undefined;
+    createdAt?: Date | undefined;
+    delegatorDID?: string | undefined;
+    parentCid?: string | undefined;
+    allowSubDelegation?: boolean | undefined;
+    authHeader?: string | undefined;
+}>;
+type Delegation = z.infer<typeof DelegationSchema>;
+/** Node-confirmed lifecycle state for one delegation. */
+declare const DelegationStatusSchema: z.ZodEffects<z.ZodObject<{
+    cid: z.ZodString;
+    status: z.ZodEnum<["active", "revoked", "expired", "unavailable", "not_found"]>;
+    exists: z.ZodBoolean;
+    active: z.ZodBoolean;
+    revoked: z.ZodBoolean;
+    expired: z.ZodBoolean;
+}, "strict", z.ZodTypeAny, {
+    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
+    active: boolean;
+    revoked: boolean;
+    cid: string;
+    expired: boolean;
+    exists: boolean;
+}, {
+    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
+    active: boolean;
+    revoked: boolean;
+    cid: string;
+    expired: boolean;
+    exists: boolean;
+}>, {
+    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
+    active: boolean;
+    revoked: boolean;
+    cid: string;
+    expired: boolean;
+    exists: boolean;
+}, {
+    status: "active" | "revoked" | "expired" | "unavailable" | "not_found";
+    active: boolean;
+    revoked: boolean;
+    cid: string;
+    expired: boolean;
+    exists: boolean;
+}>;
+type DelegationStatus = z.infer<typeof DelegationStatusSchema>;
+declare const DelegationRevocationReceiptSchema: z.ZodObject<{
+    revoked: z.ZodLiteral<true>;
+    cid: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    revoked: true;
+    cid: string;
+}, {
+    revoked: true;
+    cid: string;
+}>;
+type DelegationRevocationReceipt = z.infer<typeof DelegationRevocationReceiptSchema>;
+declare const AccountDelegationResourceSchema: z.ZodObject<{
+    resource: z.ZodString;
+    actions: z.ZodArray<z.ZodString, "many">;
+    caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+}, "strict", z.ZodTypeAny, {
+    actions: string[];
+    caveats: Record<string, unknown>[];
+    resource: string;
+}, {
+    actions: string[];
+    caveats: Record<string, unknown>[];
+    resource: string;
+}>;
+declare const AccountDelegationRecordSchema: z.ZodObject<{
+    cid: z.ZodString;
+    direction: z.ZodEnum<["granted", "received"]>;
+    delegatorDid: z.ZodString;
+    delegateDid: z.ZodString;
+    resources: z.ZodArray<z.ZodObject<{
+        resource: z.ZodString;
+        actions: z.ZodArray<z.ZodString, "many">;
+        caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }, {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }>, "many">;
+    parents: z.ZodArray<z.ZodString, "many">;
+    issuedAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    notBefore: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    expiresAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+    status: z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>;
+    revokedAt: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>>;
+    revokedBy: z.ZodOptional<z.ZodString>;
+    revokedAncestorCid: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+    notBefore: Date | null;
+    resources: {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }[];
+    issuedAt: Date | null;
+    expiresAt: Date | null;
+    cid: string;
+    direction: "received" | "granted";
+    delegatorDid: string;
+    delegateDid: string;
+    parents: string[];
+    revokedAt?: Date | null | undefined;
+    revokedBy?: string | undefined;
+    revokedAncestorCid?: string | undefined;
+}, {
+    status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+    notBefore: string | null;
+    resources: {
+        actions: string[];
+        caveats: Record<string, unknown>[];
+        resource: string;
+    }[];
+    issuedAt: string | null;
+    expiresAt: string | null;
+    cid: string;
+    direction: "received" | "granted";
+    delegatorDid: string;
+    delegateDid: string;
+    parents: string[];
+    revokedAt?: string | null | undefined;
+    revokedBy?: string | undefined;
+    revokedAncestorCid?: string | undefined;
+}>;
+declare const AccountDelegationPageSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    items: z.ZodArray<z.ZodObject<{
+        cid: z.ZodString;
+        direction: z.ZodEnum<["granted", "received"]>;
+        delegatorDid: z.ZodString;
+        delegateDid: z.ZodString;
+        resources: z.ZodArray<z.ZodObject<{
+            resource: z.ZodString;
+            actions: z.ZodArray<z.ZodString, "many">;
+            caveats: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">;
+        }, "strict", z.ZodTypeAny, {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }, {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }>, "many">;
+        parents: z.ZodArray<z.ZodString, "many">;
+        issuedAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        notBefore: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        expiresAt: z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>;
+        status: z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>;
+        revokedAt: z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodString, Date, string>>>;
+        revokedBy: z.ZodOptional<z.ZodString>;
+        revokedAncestorCid: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: Date | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        issuedAt: Date | null;
+        expiresAt: Date | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: Date | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }, {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: string | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        issuedAt: string | null;
+        expiresAt: string | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: string | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }>, "many">;
+    nextCursor: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    schemaVersion: 2;
+    items: {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: Date | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        issuedAt: Date | null;
+        expiresAt: Date | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: Date | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }[];
+    nextCursor?: string | undefined;
+}, {
+    schemaVersion: 2;
+    items: {
+        status: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked";
+        notBefore: string | null;
+        resources: {
+            actions: string[];
+            caveats: Record<string, unknown>[];
+            resource: string;
+        }[];
+        issuedAt: string | null;
+        expiresAt: string | null;
+        cid: string;
+        direction: "received" | "granted";
+        delegatorDid: string;
+        delegateDid: string;
+        parents: string[];
+        revokedAt?: string | null | undefined;
+        revokedBy?: string | undefined;
+        revokedAncestorCid?: string | undefined;
+    }[];
+    nextCursor?: string | undefined;
+}>;
+type AccountDelegationResource = z.infer<typeof AccountDelegationResourceSchema>;
+type AccountDelegationRecord = z.infer<typeof AccountDelegationRecordSchema>;
+type AccountDelegationPage = z.infer<typeof AccountDelegationPageSchema>;
+declare const AccountDelegationQueryOptionsSchema: z.ZodObject<{
+    direction: z.ZodOptional<z.ZodEnum<["granted", "received", "all", "issued"]>>;
+    status: z.ZodOptional<z.ZodEnum<["active", "pending", "expired", "revoked", "ancestor_revoked"]>>;
+    space: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status?: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked" | undefined;
+    space?: string | undefined;
+    direction?: "received" | "all" | "granted" | "issued" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}, {
+    status?: "active" | "revoked" | "expired" | "pending" | "ancestor_revoked" | undefined;
+    space?: string | undefined;
+    direction?: "received" | "all" | "granted" | "issued" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}>;
+type AccountDelegationQueryOptions = z.infer<typeof AccountDelegationQueryOptionsSchema>;
+/**
+ * Entry in the capability registry mapping a capability to available keys.
+ */
+declare const CapabilityEntrySchema: z.ZodObject<{
+    /** Resource URI this capability applies to */
+    resource: z.ZodString;
+    /** Action this capability authorizes */
+    action: z.ZodString;
+    /** Keys that can exercise this capability, ordered by priority */
+    keys: z.ZodArray<z.ZodObject<{
+        /** Unique identifier for this key */
+        id: z.ZodString;
+        /** DID associated with this key */
+        did: z.ZodString;
+        /** Type of key determining its authority level */
+        type: z.ZodEnum<["main", "session", "ingested"]>;
+        /** Private key in JWK format */
+        jwk: z.ZodOptional<z.ZodObject<{
+            /** Key type (e.g., "EC", "RSA", "OKP") */
+            kty: z.ZodString;
+            /** Curve for EC/OKP keys (e.g., "P-256", "Ed25519") */
+            crv: z.ZodOptional<z.ZodString>;
+            /** X coordinate for EC keys, public key for OKP */
+            x: z.ZodOptional<z.ZodString>;
+            /** Y coordinate for EC keys */
+            y: z.ZodOptional<z.ZodString>;
+            /** Private key value (d parameter) */
+            d: z.ZodOptional<z.ZodString>;
+            /** Public exponent for RSA keys */
+            e: z.ZodOptional<z.ZodString>;
+            /** Modulus for RSA keys */
+            n: z.ZodOptional<z.ZodString>;
+            /** Key ID */
+            kid: z.ZodOptional<z.ZodString>;
+            /** Algorithm */
+            alg: z.ZodOptional<z.ZodString>;
+            /** Key use (e.g., "sig", "enc") */
+            use: z.ZodOptional<z.ZodString>;
+            /** Key operations (e.g., ["sign", "verify"]) */
+            key_ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            kty: string;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        }, {
+            kty: string;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        }>>;
+        /** Priority for key selection (lower = higher priority) */
+        priority: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        type: "session" | "main" | "ingested";
+        did: string;
+        id: string;
+        priority: number;
+        jwk?: {
+            kty: string;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        } | undefined;
+    }, {
+        type: "session" | "main" | "ingested";
+        did: string;
+        id: string;
+        priority: number;
+        jwk?: {
+            kty: string;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        } | undefined;
+    }>, "many">;
+    /** The delegation that grants this capability */
+    delegation: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+    /** When this capability expires (accepts Date or ISO string from JSON) */
+    expiresAt: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    keys: {
+        type: "session" | "main" | "ingested";
+        did: string;
+        id: string;
+        priority: number;
+        jwk?: {
+            kty: string;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        } | undefined;
+    }[];
+    delegation: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    resource: string;
+    action: string;
+    expiresAt?: Date | undefined;
+}, {
+    keys: {
+        type: "session" | "main" | "ingested";
+        did: string;
+        id: string;
+        priority: number;
+        jwk?: {
+            kty: string;
+            kid?: string | undefined;
+            alg?: string | undefined;
+            crv?: string | undefined;
+            x?: string | undefined;
+            y?: string | undefined;
+            d?: string | undefined;
+            e?: string | undefined;
+            n?: string | undefined;
+            use?: string | undefined;
+            key_ops?: string[] | undefined;
+        } | undefined;
+    }[];
+    delegation: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    resource: string;
+    action: string;
+    expiresAt?: Date | undefined;
+}>;
+type CapabilityEntry = z.infer<typeof CapabilityEntrySchema>;
+/**
+ * Persistent record of a delegation stored in the system.
+ */
+declare const DelegationRecordSchema: z.ZodObject<{
+    /** Content identifier (CID) of the delegation */
+    cid: z.ZodString;
+    /** Space ID this delegation applies to */
+    spaceId: z.ZodString;
+    /** DID of the delegator (grantor) */
+    delegator: z.ZodString;
+    /** DID of the delegatee (recipient) */
+    delegatee: z.ZodString;
+    /** Key ID used to sign/exercise this delegation */
+    keyId: z.ZodOptional<z.ZodString>;
+    /** Resource path pattern this delegation grants access to */
+    path: z.ZodString;
+    /** Actions this delegation authorizes */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** When this delegation expires (accepts Date or ISO string from JSON) */
+    expiry: z.ZodOptional<z.ZodDate>;
+    /** When this delegation becomes valid (not before) (accepts Date or ISO string) */
+    notBefore: z.ZodOptional<z.ZodDate>;
+    /** Whether this delegation has been revoked */
+    isRevoked: z.ZodBoolean;
+    /** When this delegation was created (accepts Date or ISO string from JSON) */
+    createdAt: z.ZodDate;
+    /** Parent delegation CID if this is a sub-delegation */
+    parentCid: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    actions: string[];
+    createdAt: Date;
+    spaceId: string;
+    cid: string;
+    isRevoked: boolean;
+    delegator: string;
+    delegatee: string;
+    notBefore?: Date | undefined;
+    expiry?: Date | undefined;
+    parentCid?: string | undefined;
+    keyId?: string | undefined;
+}, {
+    path: string;
+    actions: string[];
+    createdAt: Date;
+    spaceId: string;
+    cid: string;
+    isRevoked: boolean;
+    delegator: string;
+    delegatee: string;
+    notBefore?: Date | undefined;
+    expiry?: Date | undefined;
+    parentCid?: string | undefined;
+    keyId?: string | undefined;
+}>;
+type DelegationRecord = z.infer<typeof DelegationRecordSchema>;
+/**
+ * Parameters for creating a new delegation.
+ */
+declare const CreateDelegationParamsSchema: z.ZodObject<{
+    /** DID of the delegate (the party receiving the delegation) */
+    delegateDID: z.ZodString;
+    /** Resource path this delegation grants access to */
+    path: z.ZodString;
+    /** Actions to authorize */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** When this delegation expires (accepts Date or ISO string) */
+    expiry: z.ZodOptional<z.ZodDate>;
+    /** Whether to disable sub-delegation */
+    disableSubDelegation: z.ZodOptional<z.ZodBoolean>;
+    /** Optional statement for the SIWE message */
+    statement: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    actions: string[];
+    delegateDID: string;
+    statement?: string | undefined;
+    expiry?: Date | undefined;
+    disableSubDelegation?: boolean | undefined;
+}, {
+    path: string;
+    actions: string[];
+    delegateDID: string;
+    statement?: string | undefined;
+    expiry?: Date | undefined;
+    disableSubDelegation?: boolean | undefined;
+}>;
+type CreateDelegationParams = z.infer<typeof CreateDelegationParamsSchema>;
+/**
+ * A chain of delegations from root to leaf (array format).
+ */
+declare const DelegationChainSchema: z.ZodArray<z.ZodObject<{
+    /** Content identifier (CID) of the delegation */
+    cid: z.ZodString;
+    /** DID of the delegate (the party receiving the delegation) */
+    delegateDID: z.ZodString;
+    /** Space ID this delegation applies to */
+    spaceId: z.ZodString;
+    /** Resource path this delegation grants access to */
+    path: z.ZodString;
+    /** Actions this delegation authorizes */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** Exact ReCap caveats that constrain every action in this scope. */
+    caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+    /** When this delegation expires (accepts Date or ISO string from JSON) */
+    expiry: z.ZodDate;
+    /** Whether this delegation has been revoked */
+    isRevoked: z.ZodBoolean;
+    /** DID of the delegator (the party granting the delegation) */
+    delegatorDID: z.ZodOptional<z.ZodString>;
+    /** When this delegation was created (accepts Date or ISO string from JSON) */
+    createdAt: z.ZodOptional<z.ZodDate>;
+    /** Parent delegation CID if this is a sub-delegation */
+    parentCid: z.ZodOptional<z.ZodString>;
+    /** Whether sub-delegation is allowed */
+    allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+    /** Authorization header (UCAN bearer token) */
+    authHeader: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    expiry: Date;
+    actions: string[];
+    spaceId: string;
+    cid: string;
+    delegateDID: string;
+    isRevoked: boolean;
+    caveats?: Record<string, unknown>[] | undefined;
+    createdAt?: Date | undefined;
+    delegatorDID?: string | undefined;
+    parentCid?: string | undefined;
+    allowSubDelegation?: boolean | undefined;
+    authHeader?: string | undefined;
+}, {
+    path: string;
+    expiry: Date;
+    actions: string[];
+    spaceId: string;
+    cid: string;
+    delegateDID: string;
+    isRevoked: boolean;
+    caveats?: Record<string, unknown>[] | undefined;
+    createdAt?: Date | undefined;
+    delegatorDID?: string | undefined;
+    parentCid?: string | undefined;
+    allowSubDelegation?: boolean | undefined;
+    authHeader?: string | undefined;
+}>, "many">;
+type DelegationChain = z.infer<typeof DelegationChainSchema>;
+/**
+ * Structured delegation chain (v2 spec).
+ */
+declare const DelegationChainV2Schema: z.ZodObject<{
+    /** The root delegation from the original authority */
+    root: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+    /** Intermediate delegations in the chain (may be empty) */
+    chain: z.ZodArray<z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>, "many">;
+    /** The final delegation to the current user */
+    leaf: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    root: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    chain: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }[];
+    leaf: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+}, {
+    root: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    chain: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }[];
+    leaf: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+}>;
+type DelegationChainV2 = z.infer<typeof DelegationChainV2Schema>;
+/**
+ * Direction of delegation to filter by.
+ */
+declare const DelegationDirectionSchema: z.ZodEnum<["granted", "received", "all"]>;
+type DelegationDirection = z.infer<typeof DelegationDirectionSchema>;
+/**
+ * Filters for listing delegations.
+ */
+declare const DelegationFiltersSchema: z.ZodObject<{
+    /** Filter by delegation direction */
+    direction: z.ZodOptional<z.ZodEnum<["granted", "received", "all"]>>;
+    /** Filter by resource path pattern */
+    path: z.ZodOptional<z.ZodString>;
+    /** Filter by required actions */
+    actions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Include revoked delegations */
+    includeRevoked: z.ZodOptional<z.ZodBoolean>;
+    /** Filter by delegator DID */
+    delegator: z.ZodOptional<z.ZodString>;
+    /** Filter by delegatee DID */
+    delegatee: z.ZodOptional<z.ZodString>;
+    /** Only include delegations valid at this time */
+    validAt: z.ZodOptional<z.ZodDate>;
+    /** Maximum number of results to return */
+    limit: z.ZodOptional<z.ZodNumber>;
+    /** Cursor for pagination */
+    cursor: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    path?: string | undefined;
+    actions?: string[] | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+    delegator?: string | undefined;
+    delegatee?: string | undefined;
+    includeRevoked?: boolean | undefined;
+    validAt?: Date | undefined;
+}, {
+    path?: string | undefined;
+    actions?: string[] | undefined;
+    direction?: "received" | "all" | "granted" | undefined;
+    limit?: number | undefined;
+    cursor?: string | undefined;
+    delegator?: string | undefined;
+    delegatee?: string | undefined;
+    includeRevoked?: boolean | undefined;
+    validAt?: Date | undefined;
+}>;
+type DelegationFilters = z.infer<typeof DelegationFiltersSchema>;
+/**
+ * Type of space ownership.
+ */
+declare const SpaceOwnershipSchema: z.ZodEnum<["owned", "delegated"]>;
+type SpaceOwnership = z.infer<typeof SpaceOwnershipSchema>;
+/**
+ * Information about a space the user has access to.
+ */
+declare const SpaceInfoSchema: z.ZodObject<{
+    /** Space identifier */
+    id: z.ZodString;
+    /** Human-readable name for the space */
+    name: z.ZodOptional<z.ZodString>;
+    /** DID of the space owner */
+    owner: z.ZodString;
+    /** Whether user owns or has delegated access */
+    type: z.ZodEnum<["owned", "delegated"]>;
+    /** Permissions the user has in this space */
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** When the access expires (for delegated spaces) */
+    expiresAt: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    type: "owned" | "delegated";
+    id: string;
+    owner: string;
+    expiresAt?: Date | undefined;
+    name?: string | undefined;
+    permissions?: string[] | undefined;
+}, {
+    type: "owned" | "delegated";
+    id: string;
+    owner: string;
+    expiresAt?: Date | undefined;
+    name?: string | undefined;
+    permissions?: string[] | undefined;
+}>;
+type SpaceInfo = z.infer<typeof SpaceInfoSchema>;
+/**
+ * Schema for encoding share link data.
+ */
+declare const ShareSchemaSchema: z.ZodEnum<["base64", "compact", "ipfs"]>;
+type ShareSchema = z.infer<typeof ShareSchemaSchema>;
+/**
+ * A shareable link containing delegation credentials.
+ */
+declare const ShareLinkSchema: z.ZodObject<{
+    /** Unique token identifying this share link */
+    token: z.ZodString;
+    /** Full URL for sharing */
+    url: z.ZodString;
+    /** The delegation this link grants access to */
+    delegation: z.ZodObject<{
+        /** Content identifier (CID) of the delegation */
+        cid: z.ZodString;
+        /** DID of the delegate (the party receiving the delegation) */
+        delegateDID: z.ZodString;
+        /** Space ID this delegation applies to */
+        spaceId: z.ZodString;
+        /** Resource path this delegation grants access to */
+        path: z.ZodString;
+        /** Actions this delegation authorizes */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+        /** When this delegation expires (accepts Date or ISO string from JSON) */
+        expiry: z.ZodDate;
+        /** Whether this delegation has been revoked */
+        isRevoked: z.ZodBoolean;
+        /** DID of the delegator (the party granting the delegation) */
+        delegatorDID: z.ZodOptional<z.ZodString>;
+        /** When this delegation was created (accepts Date or ISO string from JSON) */
+        createdAt: z.ZodOptional<z.ZodDate>;
+        /** Parent delegation CID if this is a sub-delegation */
+        parentCid: z.ZodOptional<z.ZodString>;
+        /** Whether sub-delegation is allowed */
+        allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+        /** Authorization header (UCAN bearer token) */
+        authHeader: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }, {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    }>;
+    /** Encoding schema used for the link */
+    schema: z.ZodEnum<["base64", "compact", "ipfs"]>;
+    /** When this share link expires */
+    expiresAt: z.ZodOptional<z.ZodDate>;
+    /** Human-readable description of what is being shared */
+    description: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    schema: "base64" | "compact" | "ipfs";
+    delegation: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    url: string;
+    token: string;
+    expiresAt?: Date | undefined;
+    description?: string | undefined;
+}, {
+    schema: "base64" | "compact" | "ipfs";
+    delegation: {
+        path: string;
+        expiry: Date;
+        actions: string[];
+        spaceId: string;
+        cid: string;
+        delegateDID: string;
+        isRevoked: boolean;
+        caveats?: Record<string, unknown>[] | undefined;
+        createdAt?: Date | undefined;
+        delegatorDID?: string | undefined;
+        parentCid?: string | undefined;
+        allowSubDelegation?: boolean | undefined;
+        authHeader?: string | undefined;
+    };
+    url: string;
+    token: string;
+    expiresAt?: Date | undefined;
+    description?: string | undefined;
+}>;
+type ShareLink = z.infer<typeof ShareLinkSchema>;
+type ShareLinkData<T = unknown> = {
+    data: T;
+    delegation: Delegation;
+    spaceId: string;
+    path: string;
+};
+/**
+ * Options for ingesting an external delegation.
+ */
+declare const IngestOptionsSchema: z.ZodObject<{
+    /** Whether to persist the delegation to storage */
+    persist: z.ZodOptional<z.ZodBoolean>;
+    /** Whether to validate the full delegation chain */
+    validateChain: z.ZodOptional<z.ZodBoolean>;
+    /** Name for the ingested key */
+    keyName: z.ZodOptional<z.ZodString>;
+    /** Whether to create a session key for this delegation */
+    createSessionKey: z.ZodOptional<z.ZodBoolean>;
+    /** Override the priority for the ingested key */
+    priority: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    priority?: number | undefined;
+    persist?: boolean | undefined;
+    validateChain?: boolean | undefined;
+    keyName?: string | undefined;
+    createSessionKey?: boolean | undefined;
+}, {
+    priority?: number | undefined;
+    persist?: boolean | undefined;
+    validateChain?: boolean | undefined;
+    keyName?: string | undefined;
+    createSessionKey?: boolean | undefined;
+}>;
+type IngestOptions = z.infer<typeof IngestOptionsSchema>;
+/**
+ * Parameters for generating a share link.
+ */
+declare const GenerateShareParamsSchema: z.ZodObject<{
+    /** Resource path to share */
+    path: z.ZodString;
+    /** Actions to authorize */
+    actions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** When the share link expires */
+    expiry: z.ZodOptional<z.ZodDate>;
+    /** Encoding schema for the link */
+    schema: z.ZodOptional<z.ZodEnum<["base64", "compact", "ipfs"]>>;
+    /** Human-readable description */
+    description: z.ZodOptional<z.ZodString>;
+    /** Base URL for the share link */
+    baseUrl: z.ZodOptional<z.ZodString>;
+    /**
+     * Whether the recipient may re-delegate the share. Default `true`.
+     * `false` issues a terminal delegation: the node refuses onward `/delegate`.
+     * Without a session-key delegation that covers the path, `false` fails with PERMISSION_DENIED.
+     * Receive such a share with `receive(link, { autoSubdelegate: false })`; the default auto-subdelegation is refused for it.
+     */
+    allowSubDelegation: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    description?: string | undefined;
+    schema?: "base64" | "compact" | "ipfs" | undefined;
+    expiry?: Date | undefined;
+    actions?: string[] | undefined;
+    allowSubDelegation?: boolean | undefined;
+    baseUrl?: string | undefined;
+}, {
+    path: string;
+    description?: string | undefined;
+    schema?: "base64" | "compact" | "ipfs" | undefined;
+    expiry?: Date | undefined;
+    actions?: string[] | undefined;
+    allowSubDelegation?: boolean | undefined;
+    baseUrl?: string | undefined;
+}>;
+type GenerateShareParams = z.infer<typeof GenerateShareParamsSchema>;
+/**
+ * Signs invocations with the session's own did:key and no proof. The node
+ * accepts these for listing the delegations that key issued and for revoking
+ * a delegation that key is the delegator of.
+ */
+interface SessionInvocationSigner {
+    /** The session key's bare did:key (no fragment). */
+    did(): string;
+    /**
+     * Signs one short-lived invocation carrying exactly `attenuation` and no
+     * proof; returns the `Authorization` header value.
+     */
+    sign(attenuation: Readonly<Record<string, Readonly<Record<string, readonly unknown[]>>>>): Promise<string>;
+}
+/**
+ * Configuration for DelegationManager.
+ * Note: ServiceSession, InvokeFunction, and FetchFunction are external types.
+ */
+declare const DelegationManagerConfigSchema: z.ZodObject<{
+    /** TinyCloud host URLs */
+    hosts: z.ZodArray<z.ZodString, "many">;
+    /** Account space used by account-wide delegation history queries */
+    accountSpaceId: z.ZodOptional<z.ZodString>;
+    /** Active session for authentication */
+    session: z.ZodEffects<z.ZodUnknown, ServiceSession, unknown>;
+    /** Platform-specific invoke function */
+    invoke: z.ZodEffects<z.ZodUnknown, InvokeFunction, unknown>;
+    /** Platform-specific invoke function for raw resource URIs */
+    invokeAny: z.ZodOptional<z.ZodEffects<z.ZodUnknown, InvokeAnyFunction, unknown>>;
+    /** Optional owner-signed authorization for direct CID revocation */
+    signOwnerRevocation: z.ZodOptional<z.ZodType<(cid: string) => Promise<string>, z.ZodTypeDef, (cid: string) => Promise<string>>>;
+    /** Optional signer for proofless invocations by the session's own did:key (issued-delegation list and revoke) */
+    sessionInvocationSigner: z.ZodOptional<z.ZodType<SessionInvocationSigner, z.ZodTypeDef, SessionInvocationSigner>>;
+    /** Optional custom fetch implementation */
+    fetch: z.ZodOptional<z.ZodEffects<z.ZodUnknown, FetchFunction, unknown>>;
+}, "strip", z.ZodTypeAny, {
+    session: ServiceSession;
+    hosts: string[];
+    invoke: InvokeFunction;
+    invokeAny?: InvokeAnyFunction | undefined;
+    accountSpaceId?: string | undefined;
+    signOwnerRevocation?: ((cid: string) => Promise<string>) | undefined;
+    sessionInvocationSigner?: SessionInvocationSigner | undefined;
+    fetch?: FetchFunction | undefined;
+}, {
+    hosts: string[];
+    session?: unknown;
+    invokeAny?: unknown;
+    accountSpaceId?: string | undefined;
+    invoke?: unknown;
+    signOwnerRevocation?: ((cid: string) => Promise<string>) | undefined;
+    sessionInvocationSigner?: SessionInvocationSigner | undefined;
+    fetch?: unknown;
+}>;
+type DelegationManagerConfig = z.infer<typeof DelegationManagerConfigSchema>;
+/**
+ * Provider interface for cryptographic key operations.
+ */
+declare const KeyProviderSchema: z.ZodObject<{
+    /** Generate a new session key, returns key ID */
+    createSessionKey: z.ZodEffects<z.ZodUnknown, (name: string) => Promise<string>, unknown>;
+    /** Get JWK for a key */
+    getJWK: z.ZodEffects<z.ZodUnknown, (keyId: string) => object, unknown>;
+    /** Get DID for a key */
+    getDID: z.ZodEffects<z.ZodUnknown, (keyId: string) => Promise<string>, unknown>;
+}, "strip", z.ZodTypeAny, {
+    createSessionKey: (name: string) => Promise<string>;
+    getJWK: (keyId: string) => object;
+    getDID: (keyId: string) => Promise<string>;
+}, {
+    createSessionKey?: unknown;
+    getJWK?: unknown;
+    getDID?: unknown;
+}>;
+type KeyProvider = z.infer<typeof KeyProviderSchema>;
+/**
+ * Response from the delegation API.
+ */
+declare const DelegationApiResponseSchema: z.ZodObject<{
+    /** SIWE message content */
+    siwe: z.ZodString;
+    /** Signature of the SIWE message */
+    signature: z.ZodString;
+    /** Delegation version */
+    version: z.ZodNumber;
+    /** CID of the created delegation */
+    cid: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    siwe: string;
+    signature: string;
+    version: number;
+    cid?: string | undefined;
+}, {
+    siwe: string;
+    signature: string;
+    version: number;
+    cid?: string | undefined;
+}>;
+type DelegationApiResponse = z.infer<typeof DelegationApiResponseSchema>;
+/**
+ * A single (service, space, path, actions) entry inside a
+ * createDelegation WASM result.
+ *
+ * Mirrors the Rust `DelegatedResource` struct in
+ * `tinycloud-sdk-wasm/src/session.rs`. Field names match the manifest
+ * {@link PermissionEntry} shape so callers can reconstruct what they sent
+ * without having to re-parse the UCAN.
+ *
+ * `service` is the short form (e.g. `"kv"`, `"sql"`) as returned by the
+ * Rust layer. The SDK layer translates to the long form
+ * (`"tinycloud.kv"`) when comparing against manifests.
+ */
+declare const DelegatedResourceSchema: z.ZodObject<{
+    /** Short-form service name, e.g. "kv", "sql", "duckdb", "capabilities", "hooks". */
+    service: z.ZodString;
+    /** Full space id string, e.g. "tinycloud:pkh:eip155:1:0x....:default". */
+    space: z.ZodString;
+    /** Resource path; empty string when the resource URI had no path segment. */
+    path: z.ZodString;
+    /** Full-URN ability strings, e.g. ["tinycloud.kv/get", "tinycloud.kv/put"]. */
+    actions: z.ZodArray<z.ZodString, "many">;
+    /** Exact ReCap caveats that constrain every action in this scope. */
+    caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    space: string;
+    actions: string[];
+    service: string;
+    caveats?: Record<string, unknown>[] | undefined;
+}, {
+    path: string;
+    space: string;
+    actions: string[];
+    service: string;
+    caveats?: Record<string, unknown>[] | undefined;
+}>;
+type DelegatedResource = z.infer<typeof DelegatedResourceSchema>;
+/**
+ * Input parameters for the createDelegation WASM function.
+ *
+ * A single call may encode multiple `(service, path, actions)` entries
+ * via the `abilities` map — the underlying UCAN will contain one
+ * attenuation entry per `(service, path)` pair, all signed by the same
+ * session key in one blob.
+ *
+ * The `abilities` shape is identical to what `prepareSession` accepts
+ * (`Record<shortService, Record<path, actionURNs[]>>`), so manifest
+ * resolution can feed both sides from one data structure.
+ */
+declare const CreateDelegationWasmParamsSchema: z.ZodObject<{
+    /** The session containing delegation credentials */
+    session: z.ZodEffects<z.ZodUnknown, ServiceSession, unknown>;
+    /** DID of the delegate */
+    delegateDID: z.ZodString;
+    /** Space ID this delegation applies to */
+    spaceId: z.ZodString;
+    /**
+     * Multi-resource abilities map: short-service → path → full-URN actions.
+     * Matches the shape accepted by `prepareSession`.
+     *
+     * Example:
+     * ```
+     * {
+     *   kv: {
+     *     "com.listen.app/": ["tinycloud.kv/get", "tinycloud.kv/put"]
+     *   },
+     *   sql: {
+     *     "com.listen.app/data.sqlite": ["tinycloud.sql/read"]
+     *   }
+     * }
+     * ```
+     */
+    abilities: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+    /** Expiration time in seconds since Unix epoch */
+    expirationSecs: z.ZodNumber;
+    /** Optional not-before time in seconds since Unix epoch */
+    notBeforeSecs: z.ZodOptional<z.ZodNumber>;
+    /** Issue a terminal delegation: the node refuses onward delegation. Default `false`. */
+    disableSubDelegation: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    abilities: Record<string, Record<string, string[]>>;
+    session: ServiceSession;
+    spaceId: string;
+    delegateDID: string;
+    expirationSecs: number;
+    disableSubDelegation?: boolean | undefined;
+    notBeforeSecs?: number | undefined;
+}, {
+    abilities: Record<string, Record<string, string[]>>;
+    spaceId: string;
+    delegateDID: string;
+    expirationSecs: number;
+    session?: unknown;
+    disableSubDelegation?: boolean | undefined;
+    notBeforeSecs?: number | undefined;
+}>;
+type CreateDelegationWasmParams = z.infer<typeof CreateDelegationWasmParamsSchema>;
+/**
+ * Result from the createDelegation WASM function.
+ *
+ * A single UCAN may cover multiple resources. The `resources` array
+ * describes every `(service, space, path, actions)` entry granted, in
+ * deterministic (service, path) lexicographic order (the Rust side sorts
+ * the HashMap entries before signing).
+ */
+declare const CreateDelegationWasmResultSchema: z.ZodObject<{
+    /** Base64url-encoded UCAN delegation */
+    delegation: z.ZodString;
+    /** CID of the delegation */
+    cid: z.ZodString;
+    /** DID of the delegate */
+    delegateDID: z.ZodString;
+    /** Expiration time */
+    expiry: z.ZodDate;
+    /**
+     * All (service, space, path, actions) entries granted by this delegation.
+     * Always non-empty on success.
+     */
+    resources: z.ZodArray<z.ZodObject<{
+        /** Short-form service name, e.g. "kv", "sql", "duckdb", "capabilities", "hooks". */
+        service: z.ZodString;
+        /** Full space id string, e.g. "tinycloud:pkh:eip155:1:0x....:default". */
+        space: z.ZodString;
+        /** Resource path; empty string when the resource URI had no path segment. */
+        path: z.ZodString;
+        /** Full-URN ability strings, e.g. ["tinycloud.kv/get", "tinycloud.kv/put"]. */
+        actions: z.ZodArray<z.ZodString, "many">;
+        /** Exact ReCap caveats that constrain every action in this scope. */
+        caveats: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        space: string;
+        actions: string[];
+        service: string;
+        caveats?: Record<string, unknown>[] | undefined;
+    }, {
+        path: string;
+        space: string;
+        actions: string[];
+        service: string;
+        caveats?: Record<string, unknown>[] | undefined;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    resources: {
+        path: string;
+        space: string;
+        actions: string[];
+        service: string;
+        caveats?: Record<string, unknown>[] | undefined;
+    }[];
+    delegation: string;
+    expiry: Date;
+    cid: string;
+    delegateDID: string;
+}, {
+    resources: {
+        path: string;
+        space: string;
+        actions: string[];
+        service: string;
+        caveats?: Record<string, unknown>[] | undefined;
+    }[];
+    delegation: string;
+    expiry: Date;
+    cid: string;
+    delegateDID: string;
+}>;
+type CreateDelegationWasmResult = z.infer<typeof CreateDelegationWasmResultSchema>;
+
+export { type AccountDelegationPage as A, type CapabilityEntry as C, type DelegationError as D, type GenerateShareParams as G, type IngestOptions as I, type JWK as J, type KeyInfo as K, type Result as R, type SessionInvocationSigner as S, type AccountDelegationQueryOptions as a, type AccountDelegationRecord as b, type AccountDelegationResource as c, type CreateDelegationParams as d, type CreateDelegationWasmParams as e, type CreateDelegationWasmResult as f, type DelegatedResource as g, type Delegation as h, type DelegationApiResponse as i, type DelegationChain as j, type DelegationChainV2 as k, type DelegationDirection as l, type DelegationErrorCode as m, DelegationErrorCodes as n, type DelegationFilters as o, type DelegationManagerConfig as p, type DelegationRecord as q, type DelegationRevocationReceipt as r, type DelegationStatus as s, type KeyProvider as t, type KeyType as u, type ShareLink as v, type ShareLinkData as w, type ShareSchema as x, type SpaceInfo as y, type SpaceOwnership as z };