/** ZCAP-LD issuer: mint root + delegate. */
import { Capability, type KeyMaterial } from './model';
import { type Caveat } from './caveats';
export declare class InvalidDelegationError extends Error {
    constructor(message: string);
}
/**
 * Mint the root capability for a new vault/resource. Root's controller
 * is the issuer themselves (the vault host). Proof is self-issued.
 */
export declare function mintRoot({ invocationTarget, controller, signingKey, allowedAction, expires, caveats, }: {
    invocationTarget: string;
    controller: string;
    signingKey: KeyMaterial;
    allowedAction: string[];
    expires?: string;
    caveats?: Caveat[];
}): Capability;
/**
 * Delegate a sub-capability from `parent` to `toController`.
 *
 * Rules (enforced):
 *   * Parent MUST NOT carry NonDelegable.
 *   * `allowedAction` MUST be a subset of parent's allowedAction.
 *   * Expiry MUST NOT extend beyond parent's expiry.
 *   * Caveats stack — child carries parent caveats + new ones.
 *
 * The signing key MUST be the delegator's (parent's controller).
 */
export declare function delegate({ parent, toController, signingKey, allowedAction, expires, addCaveats, }: {
    parent: Capability;
    toController: string;
    signingKey: KeyMaterial;
    allowedAction?: string[];
    expires?: string;
    addCaveats?: Caveat[];
}): Capability;