/*!
 * Copyright (c) 2026 Interop Alliance. All rights reserved.
 */
/**
 * Single-verb Space capabilities: the short-lived children a transient
 * session mints so it can destroy (or read) a Space it has no root
 * invocation over. Two shapes, one mint, both target-exact:
 *
 * - Three links, over a stored parent. The parent is the management zcap an
 *   unlock identity delegated to the account at bind time. The deletion
 *   child's `invocationTarget` is the parent's own, copied verbatim from the
 *   parent's bytes rather than rebuilt, the probe child narrows that same
 *   target by one segment to the Space Metadata object beneath it, and a
 *   `GET` given a `resource` narrows it further to one Resource beneath the
 *   Space. All three are taken from the parent's own bytes rather than
 *   rebuilt from a server URL and a Space id, because this module holds
 *   neither. That does not make any stored target workable: the admission
 *   predicate matches one canonical form, so a parent out of canonical form
 *   is refused rather than copied.
 * - Two links, over a Space's synthesized root. The child's
 *   `invocationTarget` is the verb's own target, built with was-client's path
 *   builders so a sub-path deployment keeps its prefix.
 *
 * `allowedAction` is exactly one HTTP verb -- `DELETE` for the deletion
 * child, `GET` for the probe or Resource-read child -- and the target is the
 * one that verb addresses, which together are what a storage server's
 * admission predicate keys on. A container URL carries a trailing slash in
 * canonical form, so the Space URL a `DELETE` names is also the root of the
 * Space's subtree; narrowness comes from the one-verb action set plus the
 * target-unchanged rule rather than from a slash-less form. A bare `GET`
 * names the Space Metadata object at the Space's `meta` sub-resource, where a
 * Space Description is read; a `GET` given a `resource` names that one
 * Resource instead, which is what a transient session invokes to read an
 * unlock Space's keyring record under the stored management zcap.
 *
 * The delegatee is the caller's: the ladder VM's bare did:key on a transient
 * session (it re-derives from the ladder seed and resolves from its own
 * bytes, so it outlives the account log it was minted beside), the account
 * did:webvh on a remembered one.
 *
 * Nothing here is stored. A child is minted immediately before its own
 * request and dropped; on a torn run it lapses by its short TTL, so no
 * revocation is owed.
 *
 * Two checks stay with the caller rather than here: that the parent's
 * `controller` is the delegator this client signs as, and that the parent's
 * target names the Space the caller means on the deployment it is talking
 * to. The caller holds the deployment URL and the delegator DID; this module
 * holds neither, and guessing either would rebuild the very bytes the
 * verbatim copy exists to preserve.
 */
import type { IZcap } from '@interop/data-integrity-core';
import type { ZcapClient } from '@interop/ezcap';
/**
 * The single-verb Space capability's lifetime: ten minutes, long enough for
 * the request it is minted for and twice `@interop/zcap`'s 300-second clock
 * skew allowance. A child's `expires` is the earlier of this and its
 * parent's, since the library refuses a child less restrictive than its
 * parent with no skew allowance.
 */
export declare const DELETION_ZCAP_TTL_MS: number;
/**
 * The two verbs a single-verb Space capability may carry: the deletion
 * child's `DELETE` and the probe child's `GET`.
 */
export type SpaceCapabilityVerb = 'DELETE' | 'GET';
/**
 * The typed refusal of a mint over a parent capability whose own `expires`
 * has already passed: the child would verify nowhere, so nothing is minted
 * and nothing is sent. Matched on `name` -- error classes do not survive
 * crossing package copies. The parent's `expires` and `id` ride the error so
 * a caller can name the lapsed capability in its own copy without re-reading
 * the parent.
 */
export declare class ExpiredParentCapabilityError extends Error {
    readonly parentExpires: string;
    readonly parentId: string | undefined;
    constructor({ message, parentExpires, parentId }: {
        message: string;
        parentExpires: string;
        parentId: string | undefined;
    });
}
/**
 * Mints a single-verb child of a STORED parent capability -- the three-link
 * shape, used on an unlock Space whose management zcap the account already
 * holds. The child's `invocationTarget` is {@link childTarget}'s: the
 * parent's unchanged for the deletion child, the Space Metadata object
 * beneath it for a bare `GET`, or one Resource beneath the Space for a `GET`
 * given `resource` -- e.g. a transient session reading an unlock Space's
 * keyring record under the stored management zcap.
 *
 * @param options {object}
 * @param options.zcapClient {ZcapClient}   the delegating signer (the ladder
 *   VM's client on a transient session, an enrolled client's on a remembered
 *   one)
 * @param options.parent {IZcap}   the stored parent capability
 * @param options.verb {SpaceCapabilityVerb}   the child's one allowed action
 * @param options.controller {string}   the delegatee DID
 * @param [options.resource] {object}   a single Resource beneath the Space,
 *   admitted only for `GET`
 * @param options.resource.collectionId {string}
 * @param options.resource.resourceId {string}
 * @param [options.ttlMs] {number}   the child's requested lifetime
 * @param [options.now] {number}   the clock the child is minted against
 *   (epoch milliseconds); a caller holding server-relative time passes it
 *   so the proof's `created` and the child's `expires` come off one clock
 * @returns {Promise<IZcap>}
 */
export declare function mintSpaceVerbCapability({ zcapClient, parent, verb, controller, resource, ttlMs, now }: {
    zcapClient: ZcapClient;
    parent: IZcap;
    verb: SpaceCapabilityVerb;
    controller: string;
    resource?: {
        collectionId: string;
        resourceId: string;
    };
    ttlMs?: number;
    now?: number;
}): Promise<IZcap>;
/**
 * The target a single-verb Space capability names, by verb. `DELETE`
 * addresses the Space container itself, which in canonical form carries a
 * trailing slash; `GET` addresses the Space Metadata object at the Space's
 * `meta` sub-resource, where the Space Description is served.
 *
 * @param options {object}
 * @param options.storageServerUrl {string}
 * @param options.spaceId {string}
 * @param options.verb {SpaceCapabilityVerb}
 * @returns {string}
 */
export declare function spaceVerbTarget({ storageServerUrl, spaceId, verb }: {
    storageServerUrl: string;
    spaceId: string;
    verb: SpaceCapabilityVerb;
}): string;
/**
 * Mints a single-verb child of a Space's SYNTHESIZED ROOT -- the two-link
 * shape, used on the account Space and an auxiliary annex Space, where the
 * session holds no stored parent. The chain roots in the Space's own root
 * capability, and the child's `invocationTarget` is
 * {@link spaceVerbTarget}'s: the canonical Space URL for the deletion child,
 * the Space Metadata object for the probe child. The probe therefore narrows
 * its root's target rather than restating it, and neither child can be read
 * as the broad subtree grant the Space URL would otherwise be, because its
 * action set is one verb.
 *
 * @param options {object}
 * @param options.zcapClient {ZcapClient}   the delegating signer
 * @param options.storageServerUrl {string}   the Space's storage server
 * @param options.spaceId {string}
 * @param options.verb {SpaceCapabilityVerb}   the child's one allowed action
 * @param options.controller {string}   the delegatee DID
 * @param [options.ttlMs] {number}   the child's requested lifetime
 * @param [options.now] {number}   the clock the child is minted against
 *   (epoch milliseconds); a caller holding server-relative time passes it
 *   so the proof's `created` and the child's `expires` come off one clock
 * @returns {Promise<IZcap>}
 */
export declare function mintSpaceRootVerbCapability({ zcapClient, storageServerUrl, spaceId, verb, controller, ttlMs, now }: {
    zcapClient: ZcapClient;
    storageServerUrl: string;
    spaceId: string;
    verb: SpaceCapabilityVerb;
    controller: string;
    ttlMs?: number;
    now?: number;
}): Promise<IZcap>;
/**
 * Mints the GET-only child that reads an unlock Space's keyring record, over
 * the stored management zcap the account holds for that Space -- what a
 * wallet does when it reads a SIBLING unlock credential's record, having no
 * root invocation over the Space.
 *
 * It exists so the capability's target and the URL `getUnlockKeyring`
 * addresses come from the same two constants, `KEYRING_COLLECTION.id` and
 * `KEYRING_RESOURCE`. The child then matches the request by construction,
 * rather than by a caller restating the record's placement beside the read
 * and having to agree with it. Both wallets run this read.
 *
 * @param options {object}
 * @param options.zcapClient {ZcapClient}   the delegating signer
 * @param options.parent {IZcap}   the stored management zcap for the unlock
 *   Space
 * @param options.controller {string}   the delegatee DID
 * @param [options.ttlMs] {number}   the child's requested lifetime
 * @param [options.now] {number}   the clock the child is minted against
 *   (epoch milliseconds)
 * @returns {Promise<IZcap>}
 */
export declare function mintUnlockKeyringReadCapability({ zcapClient, parent, controller, ttlMs, now }: {
    zcapClient: ZcapClient;
    parent: IZcap;
    controller: string;
    ttlMs?: number;
    now?: number;
}): Promise<IZcap>;
//# sourceMappingURL=spaceCapability.d.ts.map