import { Capability, KeyMaterial } from "./model.mjs";
import { Caveat } from "./caveats.mjs";

//#region src/zcap/issuer.d.ts
declare class InvalidDelegationError extends Error {
  constructor(message: string);
}
/**
 * Mint the root capability for a new vault/resource. Root's controller
 * is the issuer themselves (the vault host). Proof is self-issued.
 */
declare function mintRoot({
  invocationTarget,
  controller,
  signingKey,
  allowedAction,
  expires,
  caveats
}: {
  invocationTarget: string;
  controller: string;
  signingKey: KeyMaterial;
  allowedAction: string[];
  expires?: string;
  caveats?: Caveat[];
}): Capability;
/**
 * Delegate a sub-capability from `parent` to `toController`.
 *
 * Rules (enforced):
 *   * Parent MUST NOT carry NonDelegable.
 *   * `allowedAction` MUST be a subset of parent's allowedAction.
 *   * Expiry MUST NOT extend beyond parent's expiry.
 *   * Caveats stack — child carries parent caveats + new ones.
 *
 * The signing key MUST be the delegator's (parent's controller).
 */
declare function delegate({
  parent,
  toController,
  signingKey,
  allowedAction,
  expires,
  addCaveats
}: {
  parent: Capability;
  toController: string;
  signingKey: KeyMaterial;
  allowedAction?: string[];
  expires?: string;
  addCaveats?: Caveat[];
}): Capability;
//#endregion
export { InvalidDelegationError, delegate, mintRoot };
//# sourceMappingURL=issuer.d.mts.map