@tinycloud/node-sdk 2.11.0-beta.1 → 2.11.0-beta.4

package/dist/{core-CQ_5wXQT.d.cts → core-BmfrcQcJ.d.cts}

@@ -195,9 +195,9 @@ interface NodeUserAuthorizationConfig {
     tinycloudRegistryUrl?: string | null;
     /** Fallback TinyCloud hosts. Default: hosted TinyCloud node. */
     tinycloudFallbackHosts?: string[] | null;
-    /** Probe for a locally-running TinyCloud node before registry/fallback resolution. Default: true. */
+    /** Probe configured/registered local nodes before registry/fallback resolution. Default: true. */
     autoDiscoverLocalNode?: boolean;
-    /** Local loopback node URL to probe. Default: http://127.0.0.1:8000. */
+    /** Local loopback node URL to probe. Omit to avoid probing loopback. */
     localNodeUrl?: string;
     /** Known `*.local.tinycloud.link` subdomain name, probed directly. */
     localLinkName?: string;
@@ -319,6 +319,12 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private _address?;
     private _chainId?;
     private _nodeFeatures;
+    /**
+     * `nodeId` from the `GET /info` performed during sign-in/restore, tagged with
+     * the host it came from. Callers that need the node DID (encryption-network
+     * admin invocations) reuse this instead of re-fetching `/info`.
+     */
+    private _nodeInfoIdentity?;
     private _lastActivationSkippedSpaceIds;
     constructor(config: NodeUserAuthorizationConfig);
     /**
@@ -387,6 +393,13 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private requireTinyCloudHosts;
     private get primaryTinyCloudHost();
     get nodeFeatures(): string[];
+    /**
+     * The node DID reported by `GET /info` for `host`, if the sign-in (or
+     * restore) that populated it targeted that same host. Returns `undefined`
+     * for any other host, and for nodes whose `/info` omits `nodeId`, so callers
+     * fall back to fetching it themselves rather than using a foreign node's DID.
+     */
+    nodeIdForHost(host: string): string | undefined;
     get lastActivationSkippedSpaceIds(): string[];
     /**
      * Compute the `abilities` map the WASM `prepareSession` call should
@@ -887,9 +900,9 @@ interface TinyCloudNodeConfig {
     tinycloudRegistryUrl?: string | null;
     /** Fallback TinyCloud hosts. Default: hosted TinyCloud node. */
     tinycloudFallbackHosts?: string[] | null;
-    /** Probe for a locally-running TinyCloud node before registry/fallback resolution. Default: true. */
+    /** Probe configured/registered local nodes before registry/fallback resolution. Default: true. */
     autoDiscoverLocalNode?: boolean;
-    /** Local loopback node URL to probe. Default: http://127.0.0.1:8000. */
+    /** Local loopback node URL to probe. Omit to avoid probing loopback. */
     localNodeUrl?: string;
     /** Known `*.local.tinycloud.link` subdomain name, probed directly. */
     localLinkName?: string;
@@ -987,6 +1000,21 @@ interface RuntimePermissionGrantOptions {
     /** Override expiry. ms-format string ("7d", "1h") or raw milliseconds. */
     expiry?: string | number;
 }
+interface EnsureEncryptionNetworkOptions {
+    /**
+     * Skip the `GET /encryption/networks/{id}` existence probe and go straight
+     * to the create.
+     *
+     * The probe pays for itself only when the network already exists. On a
+     * freshly bootstrapped account it is a guaranteed 404, so it costs a round
+     * trip on the cold sign-in path and saves nothing. Creating without it is
+     * safe: the server answers `409 Conflict` if the network is already there,
+     * which {@link TinyCloudNode.createEncryptionNetwork} resolves by reading the
+     * existing descriptor. Set this only when the caller knows the account was
+     * just provisioned.
+     */
+    assumeMissing?: boolean;
+}
 /**
  * High-level TinyCloud API for Node.js environments.
  *
@@ -1044,6 +1072,12 @@ declare class TinyCloudNode {
      * so this avoids re-parsing the recap on every registration.
      */
     private _recapOperationsCache?;
+    /**
+     * Owned space ids this sign-in has already confirmed are hosted. Consulted by
+     * {@link ensureOwnedSpaceHostedById}; cleared on every {@link signIn} because
+     * hosting is confirmed against the session that was active at the time.
+     */
+    private readonly confirmedHostedSpaceIds;
     /**
      * TinyCloudSession captured by {@link restoreSession} when there's no
      * auth-layer signer available (session-only mode used by OpenKey-backed
@@ -1252,6 +1286,22 @@ declare class TinyCloudNode {
     private withAccountRegistryRetry;
     private requestedEncryptionNetworkIds;
     private ensureRequestedEncryptionNetworks;
+    /**
+     * Ensure one of this user's owned spaces is hosted, at most once per space
+     * per sign-in.
+     *
+     * Account bootstrap funnels six calls through here (via
+     * `AccountService.ensureAccountSpaceHosted`), and each one re-submits
+     * `activateSessionWithHost` with the *primary* session. That session's recap
+     * covers only `default` and `secrets`, so the account space appears in
+     * neither `activated` nor `skipped` and the guard below returns immediately
+     * — the repeat calls cannot change the outcome, they only cost round trips.
+     *
+     * The memo is per sign-in ({@link confirmedHostedSpaceIds} is cleared in
+     * `signIn`) and only records confirmed successes. A wrong skip is
+     * self-revealing: the next write to the space fails immediately and loudly
+     * with `404 Space not found`.
+     */
     private ensureOwnedSpaceHostedById;
     /**
      * Host one of this user's owned spaces by name (e.g. `"applications"`).
@@ -1462,6 +1512,14 @@ declare class TinyCloudNode {
      */
     private requireEncryptionSession;
     private createEncryptionCrypto;
+    /**
+     * The node DID for {@link config.host}.
+     *
+     * Sign-in already performs `GET /info` for the protocol-version check, and
+     * that response carries `nodeId`, so reuse it rather than fetching `/info` a
+     * second time. Only a value recorded for this exact host qualifies; older
+     * nodes that omit `nodeId` fall through to the fetch.
+     */
     private fetchNodeId;
     private signRawNetworkAuthorization;
     private fetchEncryptionNetworkAt;
@@ -1586,7 +1644,13 @@ declare class TinyCloudNode {
     get encryption(): IEncryptionService;
     getEncryptionNetwork(nameOrNetworkId?: string): Promise<NetworkDescriptor | null>;
     createEncryptionNetwork(name?: string): Promise<NetworkDescriptor>;
-    ensureEncryptionNetwork(nameOrNetworkId?: string): Promise<NetworkDescriptor>;
+    /**
+     * Ensure an encryption network exists, creating it if necessary.
+     *
+     * @param nameOrNetworkId - Network name or full `urn:tinycloud:encryption:` id.
+     * @param options - See {@link EnsureEncryptionNetworkOptions}.
+     */
+    ensureEncryptionNetwork(nameOrNetworkId?: string, options?: EnsureEncryptionNetworkOptions): Promise<NetworkDescriptor>;
     /**
      * App-facing secrets API backed by the `secrets` space vault.
      */
@@ -2168,4 +2232,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { type AuthDelegationArtifact as A, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimeDelegationActivator as g, type RuntimePermissionGrantOptions as h, type SecretReadInput as i, type SecretReadResult as j, type SignStrategy as k, type TinyCloudNodeConfig as l, type WasmKeyProviderConfig as m, activateValidatedRuntimeDelegation as n, createWasmKeyProvider as o, defaultSignStrategy as p, deserializeDelegation as q, grantAuthRequest as r, serializeDelegation as s };
+export { type AuthDelegationArtifact as A, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimeDelegationActivator as g, type RuntimePermissionGrantOptions as h, type SecretReadInput as i, type SecretReadResult as j, type SignStrategy as k, type TinyCloudNodeConfig as l, type WasmKeyProviderConfig as m, activateValidatedRuntimeDelegation as n, createWasmKeyProvider as o, defaultSignStrategy as p, deserializeDelegation as q, grantAuthRequest as r, serializeDelegation as s };

package/dist/{core-CQ_5wXQT.d.ts → core-BmfrcQcJ.d.ts}

@@ -195,9 +195,9 @@ interface NodeUserAuthorizationConfig {
     tinycloudRegistryUrl?: string | null;
     /** Fallback TinyCloud hosts. Default: hosted TinyCloud node. */
     tinycloudFallbackHosts?: string[] | null;
-    /** Probe for a locally-running TinyCloud node before registry/fallback resolution. Default: true. */
+    /** Probe configured/registered local nodes before registry/fallback resolution. Default: true. */
     autoDiscoverLocalNode?: boolean;
-    /** Local loopback node URL to probe. Default: http://127.0.0.1:8000. */
+    /** Local loopback node URL to probe. Omit to avoid probing loopback. */
     localNodeUrl?: string;
     /** Known `*.local.tinycloud.link` subdomain name, probed directly. */
     localLinkName?: string;
@@ -319,6 +319,12 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private _address?;
     private _chainId?;
     private _nodeFeatures;
+    /**
+     * `nodeId` from the `GET /info` performed during sign-in/restore, tagged with
+     * the host it came from. Callers that need the node DID (encryption-network
+     * admin invocations) reuse this instead of re-fetching `/info`.
+     */
+    private _nodeInfoIdentity?;
     private _lastActivationSkippedSpaceIds;
     constructor(config: NodeUserAuthorizationConfig);
     /**
@@ -387,6 +393,13 @@ declare class NodeUserAuthorization implements IUserAuthorization {
     private requireTinyCloudHosts;
     private get primaryTinyCloudHost();
     get nodeFeatures(): string[];
+    /**
+     * The node DID reported by `GET /info` for `host`, if the sign-in (or
+     * restore) that populated it targeted that same host. Returns `undefined`
+     * for any other host, and for nodes whose `/info` omits `nodeId`, so callers
+     * fall back to fetching it themselves rather than using a foreign node's DID.
+     */
+    nodeIdForHost(host: string): string | undefined;
     get lastActivationSkippedSpaceIds(): string[];
     /**
      * Compute the `abilities` map the WASM `prepareSession` call should
@@ -887,9 +900,9 @@ interface TinyCloudNodeConfig {
     tinycloudRegistryUrl?: string | null;
     /** Fallback TinyCloud hosts. Default: hosted TinyCloud node. */
     tinycloudFallbackHosts?: string[] | null;
-    /** Probe for a locally-running TinyCloud node before registry/fallback resolution. Default: true. */
+    /** Probe configured/registered local nodes before registry/fallback resolution. Default: true. */
     autoDiscoverLocalNode?: boolean;
-    /** Local loopback node URL to probe. Default: http://127.0.0.1:8000. */
+    /** Local loopback node URL to probe. Omit to avoid probing loopback. */
     localNodeUrl?: string;
     /** Known `*.local.tinycloud.link` subdomain name, probed directly. */
     localLinkName?: string;
@@ -987,6 +1000,21 @@ interface RuntimePermissionGrantOptions {
     /** Override expiry. ms-format string ("7d", "1h") or raw milliseconds. */
     expiry?: string | number;
 }
+interface EnsureEncryptionNetworkOptions {
+    /**
+     * Skip the `GET /encryption/networks/{id}` existence probe and go straight
+     * to the create.
+     *
+     * The probe pays for itself only when the network already exists. On a
+     * freshly bootstrapped account it is a guaranteed 404, so it costs a round
+     * trip on the cold sign-in path and saves nothing. Creating without it is
+     * safe: the server answers `409 Conflict` if the network is already there,
+     * which {@link TinyCloudNode.createEncryptionNetwork} resolves by reading the
+     * existing descriptor. Set this only when the caller knows the account was
+     * just provisioned.
+     */
+    assumeMissing?: boolean;
+}
 /**
  * High-level TinyCloud API for Node.js environments.
  *
@@ -1044,6 +1072,12 @@ declare class TinyCloudNode {
      * so this avoids re-parsing the recap on every registration.
      */
     private _recapOperationsCache?;
+    /**
+     * Owned space ids this sign-in has already confirmed are hosted. Consulted by
+     * {@link ensureOwnedSpaceHostedById}; cleared on every {@link signIn} because
+     * hosting is confirmed against the session that was active at the time.
+     */
+    private readonly confirmedHostedSpaceIds;
     /**
      * TinyCloudSession captured by {@link restoreSession} when there's no
      * auth-layer signer available (session-only mode used by OpenKey-backed
@@ -1252,6 +1286,22 @@ declare class TinyCloudNode {
     private withAccountRegistryRetry;
     private requestedEncryptionNetworkIds;
     private ensureRequestedEncryptionNetworks;
+    /**
+     * Ensure one of this user's owned spaces is hosted, at most once per space
+     * per sign-in.
+     *
+     * Account bootstrap funnels six calls through here (via
+     * `AccountService.ensureAccountSpaceHosted`), and each one re-submits
+     * `activateSessionWithHost` with the *primary* session. That session's recap
+     * covers only `default` and `secrets`, so the account space appears in
+     * neither `activated` nor `skipped` and the guard below returns immediately
+     * — the repeat calls cannot change the outcome, they only cost round trips.
+     *
+     * The memo is per sign-in ({@link confirmedHostedSpaceIds} is cleared in
+     * `signIn`) and only records confirmed successes. A wrong skip is
+     * self-revealing: the next write to the space fails immediately and loudly
+     * with `404 Space not found`.
+     */
     private ensureOwnedSpaceHostedById;
     /**
      * Host one of this user's owned spaces by name (e.g. `"applications"`).
@@ -1462,6 +1512,14 @@ declare class TinyCloudNode {
      */
     private requireEncryptionSession;
     private createEncryptionCrypto;
+    /**
+     * The node DID for {@link config.host}.
+     *
+     * Sign-in already performs `GET /info` for the protocol-version check, and
+     * that response carries `nodeId`, so reuse it rather than fetching `/info` a
+     * second time. Only a value recorded for this exact host qualifies; older
+     * nodes that omit `nodeId` fall through to the fetch.
+     */
     private fetchNodeId;
     private signRawNetworkAuthorization;
     private fetchEncryptionNetworkAt;
@@ -1586,7 +1644,13 @@ declare class TinyCloudNode {
     get encryption(): IEncryptionService;
     getEncryptionNetwork(nameOrNetworkId?: string): Promise<NetworkDescriptor | null>;
     createEncryptionNetwork(name?: string): Promise<NetworkDescriptor>;
-    ensureEncryptionNetwork(nameOrNetworkId?: string): Promise<NetworkDescriptor>;
+    /**
+     * Ensure an encryption network exists, creating it if necessary.
+     *
+     * @param nameOrNetworkId - Network name or full `urn:tinycloud:encryption:` id.
+     * @param options - See {@link EnsureEncryptionNetworkOptions}.
+     */
+    ensureEncryptionNetwork(nameOrNetworkId?: string, options?: EnsureEncryptionNetworkOptions): Promise<NetworkDescriptor>;
     /**
      * App-facing secrets API backed by the `secrets` space vault.
      */
@@ -2168,4 +2232,4 @@ declare class WasmKeyProvider implements KeyProvider {
  */
 declare function createWasmKeyProvider(sessionManager: SessionManagerWithListing): WasmKeyProvider;
 
-export { type AuthDelegationArtifact as A, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimeDelegationActivator as g, type RuntimePermissionGrantOptions as h, type SecretReadInput as i, type SecretReadResult as j, type SignStrategy as k, type TinyCloudNodeConfig as l, type WasmKeyProviderConfig as m, activateValidatedRuntimeDelegation as n, createWasmKeyProvider as o, defaultSignStrategy as p, deserializeDelegation as q, grantAuthRequest as r, serializeDelegation as s };
+export { type AuthDelegationArtifact as A, type CreateOwnerDelegationParams as C, type DelegateToOptions as D, type EnsureEncryptionNetworkOptions as E, FileSessionStorage as F, MemorySessionStorage as M, type NodeEventEmitterStrategy as N, type OwnerDelegationReceipt as O, type PortableDelegation as P, type RestorableSession as R, type SecretPermissionHint as S, TinyCloudNode as T, UnsupportedSessionRestoreError as U, type ValidatedRuntimeDelegation as V, WasmKeyProvider as W, type AuthRequestArtifact as a, type DelegateToResult as b, DelegatedAccess as c, type DelegationAuthority as d, NodeUserAuthorization as e, type NodeUserAuthorizationConfig as f, type RuntimeDelegationActivator as g, type RuntimePermissionGrantOptions as h, type SecretReadInput as i, type SecretReadResult as j, type SignStrategy as k, type TinyCloudNodeConfig as l, type WasmKeyProviderConfig as m, activateValidatedRuntimeDelegation as n, createWasmKeyProvider as o, defaultSignStrategy as p, deserializeDelegation as q, grantAuthRequest as r, serializeDelegation as s };

package/dist/core.cjs

@@ -551,6 +551,15 @@ var NodeUserAuthorization = class {
   get nodeFeatures() {
     return this._nodeFeatures;
   }
+  /**
+   * The node DID reported by `GET /info` for `host`, if the sign-in (or
+   * restore) that populated it targeted that same host. Returns `undefined`
+   * for any other host, and for nodes whose `/info` omits `nodeId`, so callers
+   * fall back to fetching it themselves rather than using a foreign node's DID.
+   */
+  nodeIdForHost(host) {
+    return this._nodeInfoIdentity?.host === host ? this._nodeInfoIdentity.nodeId : void 0;
+  }
   get lastActivationSkippedSpaceIds() {
     return [...this._lastActivationSkippedSpaceIds];
   }
@@ -1020,11 +1029,13 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
+    const infoHost = this.primaryTinyCloudHost;
     const nodeInfo = await (0, import_sdk_core3.checkNodeInfo)(
-      this.primaryTinyCloudHost,
+      infoHost,
       this.wasm.protocolVersion()
     );
     this._nodeFeatures = nodeInfo.features;
+    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -1190,11 +1201,13 @@ var NodeUserAuthorization = class {
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
+    const infoHost = this.primaryTinyCloudHost;
     const nodeInfo = await (0, import_sdk_core3.checkNodeInfo)(
-      this.primaryTinyCloudHost,
+      infoHost,
       this.wasm.protocolVersion()
     );
     this._nodeFeatures = nodeInfo.features;
+    this._nodeInfoIdentity = nodeInfo.nodeId ? { host: infoHost, nodeId: nodeInfo.nodeId } : void 0;
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
@@ -2088,6 +2101,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._baseSecrets = /* @__PURE__ */ new Map();
     this._secrets = /* @__PURE__ */ new Map();
     this.runtimePermissionGrants = [];
+    /**
+     * Owned space ids this sign-in has already confirmed are hosted. Consulted by
+     * {@link ensureOwnedSpaceHostedById}; cleared on every {@link signIn} because
+     * hosting is confirmed against the session that was active at the time.
+     */
+    this.confirmedHostedSpaceIds = /* @__PURE__ */ new Set();
     /**
      * True when the last signIn() detected an interactive signer and skipped
      * client-side bootstrap. Apps can read this to know whether bootstrap was
@@ -2484,6 +2503,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._spaceService = void 0;
     this._serviceContext = void 0;
     this.runtimePermissionGrants = [];
+    this.confirmedHostedSpaceIds.clear();
     await this.tc.signIn(options);
     this.syncResolvedHostFromAuth();
     const oldGraph = this._serviceGraph;
@@ -2666,14 +2686,18 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       if (step.kind === "seed-applications") {
         const registered = await this.account.applications.register(
-          step.manifests.length > 0 ? [...step.manifests] : import_sdk_core8.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST
+          step.manifests.length > 0 ? [...step.manifests] : import_sdk_core8.TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST,
+          // Bootstrap only runs on an account with no registry records, so the
+          // manifest-hash pre-read is definitionally a miss. Skip it; the write
+          // it guards is an INSERT OR REPLACE and is safe to repeat.
+          { assumeUnregistered: true }
         );
         if (!registered.ok) {
           throw new Error(`Failed to seed bootstrap applications: ${registered.error.message}`);
         }
       }
       if (step.kind === "encryption-network-create") {
-        await this.ensureEncryptionNetwork(step.networkId);
+        await this.ensureEncryptionNetwork(step.networkId, { assumeMissing: true });
       }
       if (step.kind === "secret-records-schema") {
         const db = this.sqlForSpace(step.spaceId).db(step.database);
@@ -2952,6 +2976,22 @@ var _TinyCloudNode = class _TinyCloudNode {
       await this.ensureEncryptionNetwork(networkId);
     }
   }
+  /**
+   * Ensure one of this user's owned spaces is hosted, at most once per space
+   * per sign-in.
+   *
+   * Account bootstrap funnels six calls through here (via
+   * `AccountService.ensureAccountSpaceHosted`), and each one re-submits
+   * `activateSessionWithHost` with the *primary* session. That session's recap
+   * covers only `default` and `secrets`, so the account space appears in
+   * neither `activated` nor `skipped` and the guard below returns immediately
+   * — the repeat calls cannot change the outcome, they only cost round trips.
+   *
+   * The memo is per sign-in ({@link confirmedHostedSpaceIds} is cleared in
+   * `signIn`) and only records confirmed successes. A wrong skip is
+   * self-revealing: the next write to the space fails immediately and loudly
+   * with `404 Space not found`.
+   */
   async ensureOwnedSpaceHostedById(spaceId) {
     if (!this.auth) {
       throw new Error("Owned space hosting requires wallet mode");
@@ -2960,12 +3000,16 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session) {
       throw new Error("Owned space hosting requires an active session");
     }
+    if (this.confirmedHostedSpaceIds.has(spaceId)) {
+      return;
+    }
     const host = this.hosts[0] ?? this.config.host;
     if (!host) {
       throw new Error("Owned space hosting requires a TinyCloud host");
     }
     const activation = await (0, import_sdk_core8.activateSessionWithHost)(host, session.delegationHeader);
     if (activation.success && !activation.skipped?.includes(spaceId)) {
+      this.confirmedHostedSpaceIds.add(spaceId);
       return;
     }
     if (!activation.success && activation.status !== 404) {
@@ -2984,6 +3028,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         `Failed to activate session after creating owned space ${spaceId}: ${retry.error ?? "space was skipped"}`
       );
     }
+    this.confirmedHostedSpaceIds.add(spaceId);
   }
   /**
    * Host one of this user's owned spaces by name (e.g. `"applications"`).
@@ -3306,6 +3351,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.tc = stagedGraph.core;
     this._recapOperationsCache = stagedPrimary.cache;
     this.runtimePermissionGrants = stagedPrimary.grants;
+    this.confirmedHostedSpaceIds.clear();
     if (this.auth) {
       this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost]);
       this._restoredTcSession = void 0;
@@ -3888,7 +3934,17 @@ var _TinyCloudNode = class _TinyCloudNode {
       verifyNodeSignature: (nodeId, message, signature) => (0, import_sdk_core8.verifyDidKeyEd25519Signature)(nodeId, message, signature)
     };
   }
+  /**
+   * The node DID for {@link config.host}.
+   *
+   * Sign-in already performs `GET /info` for the protocol-version check, and
+   * that response carries `nodeId`, so reuse it rather than fetching `/info` a
+   * second time. Only a value recorded for this exact host qualifies; older
+   * nodes that omit `nodeId` fall through to the fetch.
+   */
   async fetchNodeId() {
+    const cached = this.auth?.nodeIdForHost(this.config.host);
+    if (cached) return cached;
     const response = await fetch(`${this.config.host}/info`);
     if (!response.ok) {
       throw new Error(`Failed to fetch node info: HTTP ${response.status}`);
@@ -4660,6 +4716,13 @@ var _TinyCloudNode = class _TinyCloudNode {
         body
       )
     });
+    if (response.status === 409) {
+      const existing = await this.getEncryptionNetwork(networkId);
+      if (existing) return existing;
+      throw new Error(
+        `Encryption network ${networkId} already exists but could not be read back`
+      );
+    }
     if (!response.ok) {
       throw new Error(
         `Failed to create encryption network ${networkId}: HTTP ${response.status} ${await response.text()}`
@@ -4668,11 +4731,19 @@ var _TinyCloudNode = class _TinyCloudNode {
     const created = await response.json();
     return created.descriptor;
   }
-  async ensureEncryptionNetwork(nameOrNetworkId = DEFAULT_ENCRYPTION_NETWORK_NAME) {
+  /**
+   * Ensure an encryption network exists, creating it if necessary.
+   *
+   * @param nameOrNetworkId - Network name or full `urn:tinycloud:encryption:` id.
+   * @param options - See {@link EnsureEncryptionNetworkOptions}.
+   */
+  async ensureEncryptionNetwork(nameOrNetworkId = DEFAULT_ENCRYPTION_NETWORK_NAME, options = {}) {
     const networkId = nameOrNetworkId.startsWith("urn:tinycloud:encryption:") ? nameOrNetworkId : this.getDefaultEncryptionNetworkId(nameOrNetworkId);
-    const existing = await this.getEncryptionNetwork(networkId);
-    if (existing) {
-      return existing;
+    if (!options.assumeMissing) {
+      const existing = await this.getEncryptionNetwork(networkId);
+      if (existing) {
+        return existing;
+      }
     }
     const parsed = (0, import_sdk_core8.parseNetworkId)(networkId);
     if (!didPrincipalMatches2(parsed.ownerDid, this.did)) {