@tinycloud/node-sdk 2.1.0 → 2.2.0-beta.0

package/dist/core.d.cts

@@ -1,5 +1,5 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, SiweConfig, Manifest, ClientSession, TinyCloudSession, Extension, SignInOptions, Delegation, DelegatedResource, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, IDataVaultService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISharingService, CreateDelegationParams, DelegationResult, PermissionEntry, KeyProvider, ISessionManager, JWK } from '@tinycloud/sdk-core';
-export { AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, CreateDelegationParams, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IngestOptions, InvokeFunction, JWK, KVResponse, KVService, KVServiceConfig, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestDelegation, ManifestValidationError, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResourceCapability, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, buildSpaceUri, checkNodeInfo, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, expandActionShortNames, isCapabilitySubset, loadManifest, makePublicSpaceId, parseExpiry, parseSpaceUri, resolveManifest, validateManifest } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignInOptions, Delegation, DelegatedResource, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, IDataVaultService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISharingService, CreateDelegationParams, DelegationResult, PermissionEntry, ResolvedDelegate, KeyProvider, ISessionManager, JWK } from '@tinycloud/sdk-core';
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IngestOptions, InvokeFunction, JWK, KVResponse, KVService, KVServiceConfig, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestValidationError, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResourceCapability, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, buildSpaceUri, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, expandActionShortNames, isCapabilitySubset, loadManifest, makePublicSpaceId, parseExpiry, parseSpaceUri, resolveManifest, resourceCapabilitiesToSpaceAbilitiesMap, validateManifest } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction } from '@tinycloud/sdk-services';
 
@@ -221,7 +221,11 @@ interface NodeUserAuthorizationConfig {
      * When omitted, `signIn` falls back to `defaultActions` for
      * backwards compatibility.
      */
-    manifest?: Manifest;
+    manifest?: Manifest | Manifest[];
+    /** Pre-composed manifest request. Takes precedence over `manifest`. */
+    capabilityRequest?: ComposedManifestRequest;
+    /** Include implicit account registry permissions when composing `manifest`. Default true. */
+    includeAccountRegistryPermissions?: boolean;
 }
 /**
  * Node.js implementation of IUserAuthorization.
@@ -278,6 +282,8 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      * of falling back to {@link defaultActions}.
      */
     private _manifest?;
+    private _capabilityRequest?;
+    private readonly includeAccountRegistryPermissions;
     private sessionManager;
     private extensions;
     private _session?;
@@ -292,12 +298,14 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      * internals to surface the manifest for requestPermissions flows
      * without forcing the caller to track it separately.
      */
-    get manifest(): Manifest | undefined;
+    get manifest(): Manifest | Manifest[] | undefined;
+    get capabilityRequest(): ComposedManifestRequest | undefined;
     /**
      * Install or replace the stored manifest. Takes effect on the next
      * `signIn()` call — the current session (if any) is not touched.
      */
-    setManifest(manifest: Manifest | undefined): void;
+    setManifest(manifest: Manifest | Manifest[] | undefined): void;
+    setCapabilityRequest(request: ComposedManifestRequest | undefined): void;
     /**
      * The current active session (web-core compatible).
      */
@@ -334,7 +342,9 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      *
      * @internal
      */
-    private resolveSignInAbilities;
+    private getCapabilityRequest;
+    private resolveSpaceName;
+    private resolveSignInCapabilities;
     /**
      * Build SIWE overrides from the top-level nonce and siweConfig.
      * - Top-level `nonce` is seeded first so `siweConfig.nonce` wins if both are set.
@@ -363,6 +373,11 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      * Used for lazy creation of additional spaces (e.g., public).
      */
     hostPublicSpace(spaceId: string): Promise<boolean>;
+    /**
+     * Create a specific owned space on the server via host delegation.
+     * Used by manifest registry setup for the account space.
+     */
+    hostOwnedSpace(spaceId: string): Promise<boolean>;
     /**
      * Ensure the user's space exists on the TinyCloud server.
      * Creates the space if it doesn't exist and autoCreateSpace is enabled.
@@ -645,7 +660,11 @@ interface TinyCloudNodeConfig {
      * backwards compatibility with callers that pre-date the manifest
      * flow.
      */
-    manifest?: Manifest;
+    manifest?: Manifest | Manifest[];
+    /** Pre-composed manifest request. Takes precedence over `manifest`. */
+    capabilityRequest?: ComposedManifestRequest;
+    /** Include implicit account registry permissions when composing `manifest`. Default true. */
+    includeAccountRegistryPermissions?: boolean;
 }
 /**
  * Options for {@link TinyCloudNode.delegateTo}.
@@ -758,12 +777,14 @@ declare class TinyCloudNode {
      * layer (e.g. TinyCloudWeb.setManifest) so the manifest is kept
      * in sync across the stack.
      */
-    setManifest(manifest: Manifest | undefined): void;
+    setManifest(manifest: Manifest | Manifest[] | undefined): void;
+    setCapabilityRequest(request: ComposedManifestRequest | undefined): void;
     /**
      * Return the manifest currently installed on the auth handler,
      * or `undefined` if none is set.
      */
-    get manifest(): Manifest | undefined;
+    get manifest(): Manifest | Manifest[] | undefined;
+    get capabilityRequest(): ComposedManifestRequest | undefined;
     /**
      * Get the primary identity DID for this user.
      * - If wallet connected and signed in: returns PKH DID (did:pkh:eip155:{chainId}:{address})
@@ -807,6 +828,8 @@ declare class TinyCloudNode {
      * @param options - Optional per-call SIWE overrides for this sign-in only
      */
     signIn(options?: SignInOptions): Promise<void>;
+    private ownedSpaceId;
+    private writeManifestRegistryRecords;
     /**
      * Restore a previously established session from stored delegation data.
      *
@@ -1176,6 +1199,21 @@ declare class TinyCloudNode {
      *   `forceWalletSign` is not set.
      */
     delegateTo(did: string, permissions: PermissionEntry[], options?: DelegateToOptions): Promise<DelegateToResult>;
+    /**
+     * Materialize one manifest-declared delegation using the current session key.
+     * Delivery is intentionally out of band; callers decide how to transmit the
+     * returned UCAN to the delegate.
+     */
+    materializeDelegation(did: string, request?: ComposedManifestRequest | undefined): Promise<DelegateToResult & {
+        target: ResolvedDelegate;
+    }>;
+    /**
+     * Materialize every delegation target declared by the composed manifest
+     * request. This does not deliver the delegations anywhere.
+     */
+    materializeDelegations(request?: ComposedManifestRequest | undefined): Promise<Array<DelegateToResult & {
+        target: ResolvedDelegate;
+    }>>;
     /**
      * Issue a delegation via the session-key UCAN WASM path.
      *
@@ -1192,6 +1230,7 @@ declare class TinyCloudNode {
      * @internal
      */
     private createDelegationViaWasmPath;
+    private resolvePermissionSpace;
     /**
      * Issue a delegation via the legacy wallet-signed SIWE path for a single
      * {@link PermissionEntry}. Shares the implementation with the public

package/dist/core.d.ts

@@ -1,5 +1,5 @@
-import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, SiweConfig, Manifest, ClientSession, TinyCloudSession, Extension, SignInOptions, Delegation, DelegatedResource, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, IDataVaultService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISharingService, CreateDelegationParams, DelegationResult, PermissionEntry, KeyProvider, ISessionManager, JWK } from '@tinycloud/sdk-core';
-export { AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, CreateDelegationParams, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IngestOptions, InvokeFunction, JWK, KVResponse, KVService, KVServiceConfig, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestDelegation, ManifestValidationError, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResourceCapability, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, buildSpaceUri, checkNodeInfo, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, expandActionShortNames, isCapabilitySubset, loadManifest, makePublicSpaceId, parseExpiry, parseSpaceUri, resolveManifest, validateManifest } from '@tinycloud/sdk-core';
+import { ISessionStorage, PersistedSessionData, AutoSignStrategy, AutoRejectStrategy, CallbackStrategy, IUserAuthorization, ISigner, ISpaceCreationHandler, IWasmBindings, SiweConfig, Manifest, ComposedManifestRequest, ClientSession, TinyCloudSession, Extension, SignInOptions, Delegation, DelegatedResource, IKVService, ISQLService, IDuckDbService, IHooksService, INotificationHandler, IENSResolver, IDataVaultService, ICapabilityKeyRegistry, DelegationManager, ISpaceService, ISharingService, CreateDelegationParams, DelegationResult, PermissionEntry, ResolvedDelegate, KeyProvider, ISessionManager, JWK } from '@tinycloud/sdk-core';
+export { ACCOUNT_REGISTRY_PATH, ACCOUNT_REGISTRY_SPACE, AutoApproveSpaceCreationHandler, AutoRejectStrategy, AutoSignStrategy, BatchOptions, BatchResponse, CallbackStrategy, CapabilityEntry, CapabilityKeyRegistry, CapabilityKeyRegistryErrorCode, CapabilityKeyRegistryErrorCodes, ClientSession, ColumnInfo, ComposeManifestOptions, ComposedManifestRequest, CreateDelegationParams, DEFAULT_MANIFEST_SPACE, DEFAULT_MANIFEST_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, Delegation, DelegationChain, DelegationChainV2, DelegationDirection, DelegationError, DelegationErrorCode, DelegationErrorCodes, DelegationFilters, DelegationManager, DelegationManagerConfig, DelegationRecord, DelegationResult, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, EncodedShareData, ExecuteOptions, ExecuteResponse, Extension, FetchFunction, GenerateShareParams, ICapabilityKeyRegistry, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IENSResolver, IKVService, INotificationHandler, IPrefixedKVService, ISQLService, ISessionManager, ISessionStorage, ISharingService, ISigner, ISpace, ISpaceCreationHandler, ISpaceScopedDelegations, ISpaceScopedSharing, ISpaceService, IUserAuthorization, IWasmBindings, IngestOptions, InvokeFunction, JWK, KVResponse, KVService, KVServiceConfig, KeyInfo, KeyProvider, KeyType, Manifest, ManifestDefaults, ManifestRegistryRecord, ManifestValidationError, PermissionEntry, PermissionNotInManifestError, PersistedSessionData, PrefixedKVService, ProtocolMismatchError, QueryOptions, QueryResponse, ReceiveOptions, ResolvedCapabilities, ResolvedDelegate, ResourceCapability, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, ServiceContext, ServiceContextConfig, ServiceSession, SessionExpiredError, ShareAccess, ShareLink, ShareLinkData, ShareSchema, SharingService, SharingServiceConfig, SignCallback, SignInOptions, SignRequest, SignResponse, SilentNotificationHandler, Space, SpaceAbilitiesMap, SpaceConfig, SpaceCreationContext, SpaceErrorCode, SpaceErrorCodes, SpaceInfo, SpaceOwnership, SpaceService, SpaceServiceConfig, SqlStatement, SqlValue, StoredDelegationChain, TableInfo, TinyCloud, TinyCloudConfig, TinyCloudSession, UnsupportedFeatureError, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VersionCheckError, ViewInfo, WasmVaultFunctions, buildSpaceUri, checkNodeInfo, composeManifestRequest, createCapabilityKeyRegistry, createSharingService, createSpaceService, createVaultCrypto, defaultSpaceCreationHandler, expandActionShortNames, isCapabilitySubset, loadManifest, makePublicSpaceId, parseExpiry, parseSpaceUri, resolveManifest, resourceCapabilitiesToSpaceAbilitiesMap, validateManifest } from '@tinycloud/sdk-core';
 import { EventEmitter } from 'events';
 import { InvokeFunction } from '@tinycloud/sdk-services';
 
@@ -221,7 +221,11 @@ interface NodeUserAuthorizationConfig {
      * When omitted, `signIn` falls back to `defaultActions` for
      * backwards compatibility.
      */
-    manifest?: Manifest;
+    manifest?: Manifest | Manifest[];
+    /** Pre-composed manifest request. Takes precedence over `manifest`. */
+    capabilityRequest?: ComposedManifestRequest;
+    /** Include implicit account registry permissions when composing `manifest`. Default true. */
+    includeAccountRegistryPermissions?: boolean;
 }
 /**
  * Node.js implementation of IUserAuthorization.
@@ -278,6 +282,8 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      * of falling back to {@link defaultActions}.
      */
     private _manifest?;
+    private _capabilityRequest?;
+    private readonly includeAccountRegistryPermissions;
     private sessionManager;
     private extensions;
     private _session?;
@@ -292,12 +298,14 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      * internals to surface the manifest for requestPermissions flows
      * without forcing the caller to track it separately.
      */
-    get manifest(): Manifest | undefined;
+    get manifest(): Manifest | Manifest[] | undefined;
+    get capabilityRequest(): ComposedManifestRequest | undefined;
     /**
      * Install or replace the stored manifest. Takes effect on the next
      * `signIn()` call — the current session (if any) is not touched.
      */
-    setManifest(manifest: Manifest | undefined): void;
+    setManifest(manifest: Manifest | Manifest[] | undefined): void;
+    setCapabilityRequest(request: ComposedManifestRequest | undefined): void;
     /**
      * The current active session (web-core compatible).
      */
@@ -334,7 +342,9 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      *
      * @internal
      */
-    private resolveSignInAbilities;
+    private getCapabilityRequest;
+    private resolveSpaceName;
+    private resolveSignInCapabilities;
     /**
      * Build SIWE overrides from the top-level nonce and siweConfig.
      * - Top-level `nonce` is seeded first so `siweConfig.nonce` wins if both are set.
@@ -363,6 +373,11 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      * Used for lazy creation of additional spaces (e.g., public).
      */
     hostPublicSpace(spaceId: string): Promise<boolean>;
+    /**
+     * Create a specific owned space on the server via host delegation.
+     * Used by manifest registry setup for the account space.
+     */
+    hostOwnedSpace(spaceId: string): Promise<boolean>;
     /**
      * Ensure the user's space exists on the TinyCloud server.
      * Creates the space if it doesn't exist and autoCreateSpace is enabled.
@@ -645,7 +660,11 @@ interface TinyCloudNodeConfig {
      * backwards compatibility with callers that pre-date the manifest
      * flow.
      */
-    manifest?: Manifest;
+    manifest?: Manifest | Manifest[];
+    /** Pre-composed manifest request. Takes precedence over `manifest`. */
+    capabilityRequest?: ComposedManifestRequest;
+    /** Include implicit account registry permissions when composing `manifest`. Default true. */
+    includeAccountRegistryPermissions?: boolean;
 }
 /**
  * Options for {@link TinyCloudNode.delegateTo}.
@@ -758,12 +777,14 @@ declare class TinyCloudNode {
      * layer (e.g. TinyCloudWeb.setManifest) so the manifest is kept
      * in sync across the stack.
      */
-    setManifest(manifest: Manifest | undefined): void;
+    setManifest(manifest: Manifest | Manifest[] | undefined): void;
+    setCapabilityRequest(request: ComposedManifestRequest | undefined): void;
     /**
      * Return the manifest currently installed on the auth handler,
      * or `undefined` if none is set.
      */
-    get manifest(): Manifest | undefined;
+    get manifest(): Manifest | Manifest[] | undefined;
+    get capabilityRequest(): ComposedManifestRequest | undefined;
     /**
      * Get the primary identity DID for this user.
      * - If wallet connected and signed in: returns PKH DID (did:pkh:eip155:{chainId}:{address})
@@ -807,6 +828,8 @@ declare class TinyCloudNode {
      * @param options - Optional per-call SIWE overrides for this sign-in only
      */
     signIn(options?: SignInOptions): Promise<void>;
+    private ownedSpaceId;
+    private writeManifestRegistryRecords;
     /**
      * Restore a previously established session from stored delegation data.
      *
@@ -1176,6 +1199,21 @@ declare class TinyCloudNode {
      *   `forceWalletSign` is not set.
      */
     delegateTo(did: string, permissions: PermissionEntry[], options?: DelegateToOptions): Promise<DelegateToResult>;
+    /**
+     * Materialize one manifest-declared delegation using the current session key.
+     * Delivery is intentionally out of band; callers decide how to transmit the
+     * returned UCAN to the delegate.
+     */
+    materializeDelegation(did: string, request?: ComposedManifestRequest | undefined): Promise<DelegateToResult & {
+        target: ResolvedDelegate;
+    }>;
+    /**
+     * Materialize every delegation target declared by the composed manifest
+     * request. This does not deliver the delegations anywhere.
+     */
+    materializeDelegations(request?: ComposedManifestRequest | undefined): Promise<Array<DelegateToResult & {
+        target: ResolvedDelegate;
+    }>>;
     /**
      * Issue a delegation via the session-key UCAN WASM path.
      *
@@ -1192,6 +1230,7 @@ declare class TinyCloudNode {
      * @internal
      */
     private createDelegationViaWasmPath;
+    private resolvePermissionSpace;
     /**
      * Issue a delegation via the legacy wallet-signed SIWE path for a single
      * {@link PermissionEntry}. Shares the implementation with the public