@interop/was-react 0.8.2 → 0.9.0

package/dist/session/authStore.js

@@ -33,26 +33,22 @@
  * vanilla zustand store the hooks consume through context.
  */
 import { createStore } from 'zustand/vanilla';
+import { acquireDescriptors } from '@interop/wallet-core/descriptors';
 import { DEFAULT_DB_NAME, DEFAULT_EXPIRY_WARNING_MS, DEFAULT_EXPIRY_WATCH_MS, DEFAULT_ONBOARDING } from '../config.js';
 import { createDocumentLoader } from '../identity/documentLoader.js';
-import { initAppSession } from '../identity/initAppSession.js';
-import { createSeedStore } from '../identity/seedStore.js';
-import { clearAppSession, persistAppSession, restoreAppSession, isNearExpiry, earliestExpiry } from '../identity/appSession.js';
+import { deriveIdentity } from '../identity/agents.js';
+import { createDescriptorCache, createSeedStore } from '../identity/seedStore.js';
+import { clearAppSession, peekAppSession, persistAppSession, restoreAppSession, isNearExpiry, earliestExpiry, NO_EXPIRY_MS } from '../identity/appSession.js';
 import { loginWithWallet, requestGrants, LoginCancelledError } from '../auth/loginFlow.js';
 import { parseGrants } from '../grants.js';
 import { LocalStore, dbNameForController } from '../storage/localStore.js';
-import { clearLocalStore, clearRemoteStore, hasStore, requireStore, setLocalStore, setRemoteStore } from '../storage/storageManager.js';
+import { clearLocalStore, clearRemoteStore, getClientId, hasStore, requireStore, setLocalStore, setRemoteStore } from '../storage/storageManager.js';
 import { cancelScheduledRehydrates, clearAllEntityStores, hydrateAll, patchFromChange } from '../storage/rehydrate.js';
 import { mergeAdopted } from '../storage/adopt.js';
 import { startWasSync } from '../storage/wasSync.js';
 import { errorMessage } from '../sync/index.js';
-import { createSyncController } from '../storage/syncController.js';
+import { SyncController } from '../storage/syncController.js';
 import { useSyncStatusStore } from '../storage/syncStatusStore.js';
-/**
- * A nominal far-future expiry (ms) for grants minted without one (dev/test).
- * Well past the near-expiry warning, so the watch never fires against them.
- */
-const FAR_FUTURE_EXPIRY_MS = 100 * 365 * 24 * 60 * 60 * 1000;
 /**
  * Builds the session auth store bound to an app's config and store registry.
  * Call once (the React provider does) and share the returned store through
@@ -71,7 +67,20 @@ const FAR_FUTURE_EXPIRY_MS = 100 * 365 * 24 * 60 * 60 * 1000;
 export function createAuthStore({ config, registry, seedStore, storage }) {
     const dbName = config.dbName ?? DEFAULT_DB_NAME;
     const onboarding = config.onboarding ?? DEFAULT_ONBOARDING;
+    // Resolve the per-install LWW client id ONCE, honoring the configured
+    // localStorage prefix, so every stamp -- the app's own writes and the
+    // adoption repair -- carries the same attribution identity.
+    const clientId = getClientId({
+        ...(config.storageKeyPrefix !== undefined && {
+            storageKeyPrefix: config.storageKeyPrefix
+        })
+    });
     const sessionStore = seedStore ?? createSeedStore({ dbName: `${dbName}-session` });
+    // The offline encryption-descriptor cache, presented as the seam
+    // `@interop/wallet-core/descriptors` acquires through. Reads serve the
+    // connected replica's epoch-aware open (cache-only, no network); writes land
+    // the descriptors the sync bootstrap fetched.
+    const descriptorCache = createDescriptorCache({ store: sessionStore });
     // The anonymous-seed persistence for `local` mode: only a raw 32-byte seed,
     // no session record, in its own IndexedDB so it never collides with the
     // wallet session or a connected replica.
@@ -108,6 +117,7 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
      */
     const watchMs = config.expiry?.watchMs ?? DEFAULT_EXPIRY_WATCH_MS;
     let expiryTimer;
+    let expiryInitialCheck;
     // The per-session controller: single-use, stopped on logout and replaced on a
     // reconnect (started once per grant set).
     let controller = null;
@@ -145,11 +155,22 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
             clearInterval(expiryTimer);
             expiryTimer = undefined;
         }
+        if (expiryInitialCheck) {
+            clearTimeout(expiryInitialCheck);
+            expiryInitialCheck = undefined;
+        }
     }
     /**
      * Watches the session's earliest grant expiry and raises the reconnect banner
-     * once it is within `warningMs` (or already past). Checks immediately, then on
-     * a coarse interval; re-armed with the fresh expiry after a reconnect.
+     * once it is within `warningMs` (or already past). The first check is
+     * DEFERRED a macrotask rather than run synchronously: every caller awaits
+     * `persistAndStartSync` (which arms this watch) BEFORE writing
+     * `status: 'connected'`, so a synchronous check
+     * would always be swallowed by `notifyAccessExpired`'s connected gate and
+     * then actively cleared -- leaving a restored near-expiry session without
+     * its proactive banner until the first `watchMs` tick. Deferring runs the
+     * check after the caller's continuation has set the status. Then checks on a
+     * coarse interval; re-armed with the fresh expiry after a reconnect.
      */
     function armExpiryWatch(expires) {
         disarmExpiryWatch();
@@ -158,7 +179,7 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
                 store.getState().notifyAccessExpired();
             }
         };
-        check();
+        expiryInitialCheck = setTimeout(check, 0);
         expiryTimer = setInterval(check, watchMs);
     }
     /**
@@ -169,7 +190,7 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
      * `stopController` clears it.
      */
     async function beginSync({ parsed, zcapClient, keyAgreementKey, keyResolver }) {
-        controller = createSyncController({
+        controller = new SyncController({
             collections: config.collections,
             ...(config.sync && { sync: config.sync })
         });
@@ -185,9 +206,7 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
             }),
             identityKeys: { keyAgreementKey, keyResolver },
             onAuthError: () => store.getState().notifyAccessExpired(),
-            onDescriptorsFetched: descriptors => void sessionStore
-                .saveDescriptors(descriptors)
-                .catch(err => console.warn('Failed to cache encryption descriptors:', err))
+            onDescriptorsFetched: descriptors => void cacheDescriptors(descriptors).catch(err => console.warn('Failed to cache encryption descriptors:', err))
         });
         setRemoteStore(remoteStore);
         store.setState({ sharedCollections });
@@ -225,7 +244,20 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
             keyAgreementKey: identity.keyAgreementKey,
             keyResolver: identity.keyResolver
         });
-        void pendingSync.catch(err => console.warn('WAS sync failed to start:', err));
+        // A failed bootstrap must not resolve silently: surface it on the session
+        // `error` (the sync rollup shows the per-collection error statuses the
+        // controller leaves behind). The session stays usable -- local-first --
+        // but the UI no longer reports "Local only" over a wallet-connected
+        // session that simply failed to start replicating.
+        void pendingSync.catch(err => {
+            console.warn('WAS sync failed to start:', err);
+            // Deferred a macrotask: an immediate bootstrap failure would otherwise
+            // race the caller's own `set({ ..., error: null })` (which lands right
+            // after `persistAndStartSync` resolves) and be wiped by it.
+            setTimeout(() => store.setState({
+                error: `Sync failed to start: ${errorMessage(err)}`
+            }), 0);
+        });
         armExpiryWatch(expires);
     }
     /**
@@ -286,7 +318,7 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
         });
         setLocalStore(local);
         if (adopt) {
-            await mergeAdopted({ store: local, entities: adopt.entities });
+            await mergeAdopted({ store: local, entities: adopt.entities, clientId });
         }
         await hydrateAll(registry);
     }
@@ -315,7 +347,7 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
      */
     async function openLocal() {
         const { seed, created } = await loadOrCreateAnonSeed();
-        const identity = await initAppSession({ seed });
+        const identity = await deriveIdentity({ seed });
         await openAndHydrate({ identity });
         if (created && config.seedLocal) {
             await config.seedLocal();
@@ -324,7 +356,6 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
             status: 'local',
             controllerDid: identity.controllerDid,
             expires: null,
-            accessExpired: false,
             error: null
         });
     }
@@ -334,25 +365,42 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
      * anonymous local replica re-opened (so the app never dead-ends), then the
      * error is surfaced and rethrown for the caller to finalize.
      *
-     * @param session {ActiveSession}
+     * @param session {object}   the session to open: its seed, identity, parsed
+     *   grants and expiry, plus the payloads to adopt (merge logins only)
      * @returns {Promise<void>}
      */
     /**
-     * Loads the persisted encryption-descriptor cache (keyed by WAS collection id),
-     * or `undefined` when none is stored or it is malformed. Best-effort: a read
-     * failure falls back to opening single-key ciphers (sync refreshes them).
+     * Loads the cached encryption descriptors for the registered collections
+     * (keyed by WAS collection id), or `undefined` when none are cached.
+     *
+     * Acquired CACHE-ONLY -- `acquireDescriptors` with no `source` -- because
+     * this runs before any remote store exists and must not touch the network:
+     * the whole point is that an offline hot restore opens epoch-aware. The
+     * connected session refreshes them from the server once sync bootstraps.
+     * Best-effort: a read failure falls back to opening single-key ciphers.
      */
     async function loadCachedDescriptors() {
         try {
-            const stored = await sessionStore.loadDescriptors();
-            if (stored && typeof stored === 'object' && !Array.isArray(stored)) {
-                return stored;
-            }
+            const descriptors = await acquireDescriptors({
+                cache: descriptorCache,
+                collectionIds: config.collections.map(collection => collection.id)
+            });
+            return Object.keys(descriptors).length > 0 ? descriptors : undefined;
         }
         catch (err) {
             console.warn('Failed to load cached encryption descriptors:', err);
+            return undefined;
         }
-        return undefined;
+    }
+    /**
+     * Writes the descriptors the sync bootstrap fetched into the offline cache,
+     * through the same seam {@link loadCachedDescriptors} reads.
+     *
+     * @param descriptors {Record<string, CollectionEncryption>}
+     * @returns {Promise<void>}
+     */
+    async function cacheDescriptors(descriptors) {
+        await Promise.all(Object.entries(descriptors).map(([collectionId, descriptor]) => descriptorCache.writeDescriptor({ collectionId, descriptor })));
     }
     async function activateConnected(session) {
         try {
@@ -384,20 +432,29 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
     /**
      * Tears down the live replica + sync + entity stores WITHOUT touching either
      * persisted seed (the anonymous seed and the session record survive). Closes
-     * the database; use {@link resetToFreshLocal} to delete it.
+     * the database by default; `deleteDb` deletes it instead (the wipe paths, via
+     * {@link resetToFreshLocal}).
      *
+     * @param [options] {object}
+     * @param [options.deleteDb] {boolean}   delete the database rather than
+     *   closing it
      * @returns {Promise<void>}
      */
-    async function deactivateStore() {
+    async function deactivateStore({ deleteDb = false } = {}) {
         disarmExpiryWatch();
         cancelScheduledRehydrates();
         await stopController();
         if (hasStore()) {
             try {
-                await requireStore().close();
+                if (deleteDb) {
+                    await requireStore().remove();
+                }
+                else {
+                    await requireStore().close();
+                }
             }
             catch (err) {
-                console.warn('Error closing the local store:', err);
+                console.warn('Error tearing down the local store:', err);
             }
             clearLocalStore();
         }
@@ -417,25 +474,7 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
      * @returns {Promise<void>}
      */
     async function resetToFreshLocal({ deleteDb, discardAnonSeed = false }) {
-        disarmExpiryWatch();
-        cancelScheduledRehydrates();
-        await stopController();
-        if (hasStore()) {
-            try {
-                if (deleteDb) {
-                    await requireStore().remove();
-                }
-                else {
-                    await requireStore().close();
-                }
-            }
-            catch (err) {
-                console.warn('Error tearing down the local store:', err);
-            }
-            clearLocalStore();
-        }
-        clearAllEntityStores(registry);
-        useSyncStatusStore.getState().reset();
+        await deactivateStore({ deleteDb });
         if (discardAnonSeed) {
             await anonStore.clearSeedStore();
         }
@@ -457,10 +496,19 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
      * are OFF the serialized boot/destroy lifecycle chain). Re-deriving from the
      * seed keeps the collect independent of the holder's lifecycle.
      *
+     * Decides off the caller's PRE-FLOW snapshot of `{ status, controllerDid }`,
+     * never the live state: a provider unmount (a route change or StrictMode
+     * remount) firing `destroy` while the CHAPI popup is open resets the live
+     * status to `boot`, and reading it here would silently collect nothing --
+     * an `adopt: 'merge'` login would then resolve successfully while the
+     * user's pre-login data never reaches their Web Space.
+     *
+     * @param snapshot {object}   the caller's state snapshot from before its
+     *   first await
      * @returns {Promise<AdoptSource | null>}
      */
-    async function collectAdoptable() {
-        const { status, controllerDid } = store.getState();
+    async function collectAdoptable(snapshot) {
+        const { status, controllerDid } = snapshot;
         if (status !== 'local' || controllerDid === null) {
             return null;
         }
@@ -468,7 +516,7 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
         if (!seed) {
             return null;
         }
-        const { keyAgreementKey, keyResolver } = await initAppSession({ seed });
+        const { keyAgreementKey, keyResolver } = await deriveIdentity({ seed });
         const anonLocal = await LocalStore.init({
             keyAgreementKey,
             keyResolver,
@@ -477,10 +525,16 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
             ...(storage && { storage })
         });
         try {
+            // Read every collection at once: the replica is detached for the whole
+            // read, so the transition is as short as the slowest collection rather
+            // than the sum of them all.
+            const listed = await Promise.all(config.collections.map(async ({ key }) => ({
+                key,
+                payloads: await anonLocal.listEntities(key)
+            })));
             const entities = {};
             let total = 0;
-            for (const { key } of config.collections) {
-                const payloads = await anonLocal.listEntities(key);
+            for (const { key, payloads } of listed) {
                 if (payloads.length > 0) {
                     entities[key] = payloads;
                     total += payloads.length;
@@ -507,15 +561,17 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
      * has been adopted yet; `local` survives intact) and rethrows.
      *
      * @param adopt {'merge' | 'leave'}
+     * @param snapshot {object}   the caller's pre-flow `{ status, controllerDid }`
+     *   snapshot (see {@link collectAdoptable})
      * @returns {Promise<AdoptSource | null>}
      */
-    async function detachAndCollect(adopt) {
+    async function detachAndCollect(adopt, snapshot) {
         await deactivateStore();
         if (adopt !== 'merge') {
             return null;
         }
         try {
-            return await collectAdoptable();
+            return await collectAdoptable(snapshot);
         }
         catch (err) {
             await openLocal();
@@ -526,18 +582,30 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
      * Deletes the adopted anonymous replica -- its persisted seed and its
      * per-controller database -- so the data lives on only in the connected
      * replica and a later logout lands in a genuinely fresh `local`. Called only
-     * after the connected activation has succeeded; any earlier failure leaves
-     * the anonymous replica intact for the fallback to re-open.
+     * after the connected activation has landed (status written); any earlier
+     * failure leaves the anonymous replica intact for the fallback to re-open.
+     *
+     * Best-effort: a deletion failure (an anonymous Dexie database still open in
+     * another tab, an IndexedDB quota error) is logged and swallowed. The
+     * connected session is already live and syncing at this point, so failing
+     * the login over its cleanup would report `local` over a genuinely connected
+     * session; at worst a stale anonymous replica lingers and its (already
+     * merged) payloads are re-collected by a later login's idempotent LWW merge.
      *
      * @param controllerDid {string}   the anonymous controller DID
      * @returns {Promise<void>}
      */
     async function discardAnonReplica(controllerDid) {
-        await anonStore.clearSeedStore();
-        await LocalStore.removeDatabase({
-            dbName: dbNameForController({ dbName, controllerDid }),
-            ...(storage && { storage })
-        });
+        try {
+            await anonStore.clearSeedStore();
+            await LocalStore.removeDatabase({
+                dbName: dbNameForController({ dbName, controllerDid }),
+                ...(storage && { storage })
+            });
+        }
+        catch (err) {
+            console.warn('Failed to delete the adopted anonymous replica:', err);
+        }
     }
     // Declared last so `prefer-const` is satisfied; the lifecycle closures above
     // only dereference `store` at call time, by which point it is assigned.
@@ -552,7 +620,7 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
                     await openLocal();
                     return;
                 }
-                const identity = await initAppSession({ seed: restored.seed });
+                const identity = await deriveIdentity({ seed: restored.seed });
                 if (identity.controllerDid !== restored.controllerDid) {
                     // A corrupt record; treat as logged out and fall to local.
                     await clearAppSession({ store: sessionStore });
@@ -576,8 +644,7 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
                     status: uncovered.length > 0 ? 'reconnect' : 'connected',
                     controllerDid: identity.controllerDid,
                     expires: restored.expires,
-                    error: null,
-                    accessExpired: uncovered.length > 0
+                    error: null
                 });
             }
             catch (err) {
@@ -608,12 +675,10 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
             // fully-open session, never an in-flight one.
             set({
                 status: 'boot',
-                authenticating: false,
                 phase: null,
                 error: null,
                 controllerDid: null,
                 expires: null,
-                accessExpired: false,
                 reconnecting: false,
                 sharedCollections: {}
             });
@@ -621,20 +686,27 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
         return {
             status: 'boot',
             onboarding,
-            authenticating: false,
+            clientId,
             phase: null,
             error: null,
             controllerDid: null,
             expires: null,
-            accessExpired: false,
             reconnecting: false,
             sharedCollections: {},
             boot: () => serializeLifecycle(bootImpl),
             login: async ({ adopt = 'merge' } = {}) => {
-                if (get().authenticating || get().status === 'connected') {
+                if (get().phase !== null || get().status === 'connected') {
                     return null;
                 }
-                set({ authenticating: true, error: null, phase: 'connecting' });
+                // Snapshot the pre-login state BEFORE the popup await: a provider
+                // unmount (`destroy`) landing while CHAPI is open resets the live
+                // status to `boot`, and the adoption collect must still see the
+                // `local` session this login left.
+                const preLogin = {
+                    status: get().status,
+                    controllerDid: get().controllerDid
+                };
+                set({ error: null, phase: 'connecting' });
                 try {
                     const outcome = await loginWithWallet({
                         config: loginConfig,
@@ -645,7 +717,7 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
                     // The anonymous seed and database are deleted only after the
                     // activation lands, so a failure below still falls back to an intact
                     // `local`.
-                    const source = await detachAndCollect(adopt);
+                    const source = await detachAndCollect(adopt, preLogin);
                     await activateConnected({
                         seed: outcome.seed,
                         identity: outcome.identity,
@@ -654,18 +726,19 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
                         expires: outcome.expires,
                         ...(source && { adopt: source })
                     });
-                    if (source) {
-                        await discardAnonReplica(source.controllerDid);
-                    }
                     set({
                         status: 'connected',
-                        authenticating: false,
                         controllerDid: outcome.identity.controllerDid,
                         expires: outcome.expires,
                         phase: null,
-                        error: null,
-                        accessExpired: false
+                        error: null
                     });
+                    // Adopted-replica cleanup runs AFTER the connected status lands (and
+                    // is best-effort): a cleanup failure must not leave the session
+                    // reporting `local` over a live, syncing connected session.
+                    if (source) {
+                        await discardAnonReplica(source.controllerDid);
+                    }
                     return { firstRun: outcome.firstRun };
                 }
                 catch (err) {
@@ -673,15 +746,13 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
                     // scary error, and resolve with `null` so the caller can distinguish it
                     // from a connected outcome. `local` stays intact.
                     if (err instanceof LoginCancelledError) {
-                        set({ authenticating: false, phase: null, error: null });
+                        set({ phase: null, error: null });
                         return null;
                     }
                     // A genuine failure: record the message so the UI state still reflects
                     // it, then rethrow so the caller's promise rejects.
-                    const message = err instanceof Error
-                        ? `Login failed: ${err.message}`
-                        : 'Login failed.';
-                    set({ authenticating: false, phase: null, error: message });
+                    const message = `Login failed: ${errorMessage(err)}`;
+                    set({ phase: null, error: message });
                     throw err;
                 }
             },
@@ -703,11 +774,15 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
                     if (get().status === 'connected') {
                         return;
                     }
-                    const identity = await initAppSession({ seed });
+                    const preConnect = {
+                        status: get().status,
+                        controllerDid: get().controllerDid
+                    };
+                    const identity = await deriveIdentity({ seed });
                     const parsed = parseGrants(grants);
                     const expires = earliestExpiry(grants) ??
-                        new Date(Date.now() + FAR_FUTURE_EXPIRY_MS).toISOString();
-                    const source = await detachAndCollect(adopt);
+                        new Date(Date.now() + NO_EXPIRY_MS).toISOString();
+                    const source = await detachAndCollect(adopt, preConnect);
                     await activateConnected({
                         seed,
                         identity,
@@ -716,16 +791,16 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
                         expires,
                         ...(source && { adopt: source })
                     });
-                    if (source) {
-                        await discardAnonReplica(source.controllerDid);
-                    }
                     set({
                         status: 'connected',
                         controllerDid: identity.controllerDid,
                         expires,
-                        error: null,
-                        accessExpired: false
+                        error: null
                     });
+                    // After the status lands, and best-effort (see `discardAnonReplica`).
+                    if (source) {
+                        await discardAnonReplica(source.controllerDid);
+                    }
                 });
             },
             reconnect: async () => {
@@ -735,17 +810,37 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
                 }
                 set({ reconnecting: true, error: null });
                 try {
-                    // The seed survives grant expiry; only the grants need renewing. Read it
-                    // directly (not via `restoreAppSession`, which WIPES an expired record
-                    // -- seed included -- exactly in the case reconnect exists for). A
-                    // missing seed means the session is unrecoverable in place.
-                    const seed = await sessionStore.loadSeed();
+                    // The seed survives grant expiry; only the grants need renewing, and
+                    // the record carries the storage location the continuity check below
+                    // compares against. Peeked (not `restoreAppSession`, which WIPES an
+                    // expired record -- seed included -- exactly in the case reconnect
+                    // exists for), and read before the popup so the comparison baseline
+                    // cannot be overwritten mid-flow. A missing seed means the session is
+                    // unrecoverable in place.
+                    const { seed, record } = await peekAppSession({ store: sessionStore });
                     if (!seed) {
                         await get().logout();
                         return;
                     }
-                    const identity = await initAppSession({ seed });
+                    const identity = await deriveIdentity({ seed });
                     const checked = await requestGrants({ identity, config: loginConfig });
+                    // Continuity check: `parseGrants` only asserts the returned set is
+                    // INTERNALLY consistent. Without this comparison, a reconnect
+                    // returning internally-consistent grants for a DIFFERENT server or
+                    // space would silently re-point the whole encrypted replica (whose
+                    // database name derives from the controller DID alone) at a new
+                    // storage location the user never chose. Refuse instead; switching
+                    // storage is a logout + fresh login, an explicit user action.
+                    if (record !== null &&
+                        (checked.parsed.serverUrl !== record.serverUrl ||
+                            checked.parsed.spaceId !== record.spaceId)) {
+                        throw new Error(`The renewed grants point at a different storage location ` +
+                            `("${checked.parsed.serverUrl}", space ` +
+                            `"${checked.parsed.spaceId}") than this session's ` +
+                            `("${record.serverUrl}", space "${record.spaceId}"). ` +
+                            `Refusing to re-point the session; log out and log in again ` +
+                            `to switch storage.`);
+                    }
                     await stopController();
                     await persistAndStartSync({
                         seed,
@@ -756,14 +851,12 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
                     });
                     set({
                         status: 'connected',
-                        accessExpired: false,
                         expires: checked.expires,
                         reconnecting: false
                     });
                 }
                 catch (err) {
-                    const message = err instanceof Error ? err.message : 'Reconnect failed.';
-                    set({ reconnecting: false, error: message });
+                    set({ reconnecting: false, error: errorMessage(err) });
                 }
             },
             logout: async ({ wipe = false } = {}) => {
@@ -783,11 +876,10 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
                     return false;
                 }
                 try {
-                    for (const { key } of config.collections) {
-                        if ((await requireStore().countEntities(key)) > 0) {
-                            return true;
-                        }
-                    }
+                    // Counted in parallel: this runs on a login-button click, so the
+                    // probe costs one round of counts rather than one per collection.
+                    const counts = await Promise.all(config.collections.map(({ key }) => requireStore().countEntities(key)));
+                    return counts.some(count => count > 0);
                 }
                 catch {
                     // A defensive guard: this probe runs off the serialized boot/destroy
@@ -797,11 +889,10 @@ export function createAuthStore({ config, registry, seedStore, storage }) {
                     // collects (through a fresh handle) whatever exists.
                     return false;
                 }
-                return false;
             },
             notifyAccessExpired: () => {
                 if (get().status === 'connected') {
-                    set({ status: 'reconnect', accessExpired: true });
+                    set({ status: 'reconnect' });
                 }
             },
             destroy: () => serializeLifecycle(destroyImpl)