#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DelegationConstraints {
/// Whether delegation is allowed at all

pub allow_delegation: bool,
/// Maximum depth of delegation (0 = no further delegation)

pub max_depth: u8,
/// Scopes that can be delegated (must be subset of parent)

#[serde(skip_serializing_if = "Option::is_none")]
pub delegatable_scopes: Option<ScopeSet>,
/// Agents that can receive delegation, named by OAS DID

///

/// A DID rather than a local key, because this constraint is a token claim:

/// whoever verifies the delegated token must be able to resolve the identity

/// it names.

#[serde(default)]
pub allowed_delegates: Vec<OasDid>,
/// Whether any agent can receive delegation

pub allow_any_delegate: bool,
/// Maximum TTL reduction required (seconds)

pub min_ttl_reduction: i64,
/// Require explicit approval for delegation

pub require_approval: bool
}

#[must_use]
pub fn allow(max_depth: u8) -> Self;

#[must_use]
pub fn deny() -> Self;

#[must_use]
pub fn can_delegate_to(&self, agent_did: &OasDid) -> bool;

#[must_use]
pub fn can_delegate_scope(&self, scope: &ScopeSet) -> bool;

pub fn validate_delegation(
        &self,
        target_agent: &OasDid,
        requested_scopes: &ScopeSet,
        current_depth: u8,
        parent_ttl: i64,
        requested_ttl: i64,
    ) -> ArsenalResult<()>;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DelegationLink {
/// Token ID of the delegating token

pub parent_token_id: TokenId,
/// Agent that delegated

pub delegator: AgentId,
/// Agent that received delegation

pub delegate: AgentId,
/// Scopes that were delegated

pub delegated_scopes: ScopeSet,
/// When the delegation occurred

pub delegated_at: chrono::DateTime<chrono::Utc>,
/// Depth in the chain (0 = first delegation)

pub depth: u8
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DelegationChain {

}

#[must_use]
pub fn new(root_token_id: TokenId, root_agent: AgentId) -> Self;

pub fn add_link(&mut self, link: DelegationLink) -> ArsenalResult<()>;

#[must_use]
pub fn depth(&self) -> u8;

#[must_use]
pub fn root_token_id(&self) -> &TokenId;

#[must_use]
pub fn root_agent(&self) -> &AgentId;

#[must_use]
pub fn current_delegate(&self) -> &AgentId;

#[must_use]
pub fn links(&self) -> &[DelegationLink];

pub fn validate(&self) -> ArsenalResult<()>;

#[must_use]
pub fn contains_agent(&self, agent_id: &AgentId) -> bool;

#[must_use]
pub fn effective_scopes(&self) -> Option<ScopeSet>;

pub fn to_cbor(&self) -> ArsenalResult<Vec<u8>>;

pub fn from_cbor(bytes: &[u8]) -> ArsenalResult<Self>;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DelegationRequest {
/// Agent requesting delegation

pub delegator: AgentId,
/// Target agent to delegate to

pub delegate: AgentId,
/// Scopes to delegate

pub scopes: ScopeSet,
/// Requested TTL in seconds

pub ttl_seconds: i64,
/// Parent token ID

pub parent_token_id: TokenId,
/// Current delegation chain (if any)

#[serde(skip_serializing_if = "Option::is_none")]
pub chain: Option<DelegationChain>
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DelegationResult {
/// Whether delegation was approved

pub approved: bool,
/// New token ID (if approved)

#[serde(skip_serializing_if = "Option::is_none")]
pub token_id: Option<TokenId>,
/// Updated delegation chain

#[serde(skip_serializing_if = "Option::is_none")]
pub chain: Option<DelegationChain>,
/// Reason for denial (if not approved)

#[serde(skip_serializing_if = "Option::is_none")]
pub denial_reason: Option<String>
}