@tinycloud/node-sdk 3.11.0 → 3.12.0-beta.1

package/dist/credentials-core.d.cts

@@ -1,5 +1,5 @@
 import { CredentialFlowDescriptor, CredentialRequirement, CredentialHolderBinding, IssuedCredentialEnvelope, CredentialIssuerMetadata, ClientSession, IKVService, StoredCredentialRecord, VerifiedCredential, CredentialProgressEvent, CredentialStorageReceipt, UnifiedPolicyV2, UnifiedPolicyCapability, PolicyCredentialAdmissionV3 } from '@tinycloud/sdk-core';
-import { V as ValidatedRuntimeDelegation } from './delegation-Ckc3UETl.cjs';
+import { V as ValidatedRuntimeDelegation } from './delegation-BQbAuKad.cjs';
 
 interface CredentialClient {
     readonly sessionDid: string;

package/dist/credentials-core.d.ts

@@ -1,5 +1,5 @@
 import { CredentialFlowDescriptor, CredentialRequirement, CredentialHolderBinding, IssuedCredentialEnvelope, CredentialIssuerMetadata, ClientSession, IKVService, StoredCredentialRecord, VerifiedCredential, CredentialProgressEvent, CredentialStorageReceipt, UnifiedPolicyV2, UnifiedPolicyCapability, PolicyCredentialAdmissionV3 } from '@tinycloud/sdk-core';
-import { V as ValidatedRuntimeDelegation } from './delegation-Ckc3UETl.js';
+import { V as ValidatedRuntimeDelegation } from './delegation-BQbAuKad.js';
 
 interface CredentialClient {
     readonly sessionDid: string;

package/dist/credentials.d.cts

@@ -1,7 +1,7 @@
 export { CredentialAcquisitionTheme, CredentialAcquisitionTransport, CredentialBrowserInteractionAdapter, CredentialClient, CredentialInlineInteractionAdapter, CredentialInputRequest, CredentialInteractionAdapter, CredentialInteractionKind, CredentialInteractionSurface, CredentialProofSubject, CredentialRedirectResumeState, CredentialRedirectStore, CredentialRequestState, CredentialSigningAdapter, CredentialsAcquireOptions, CredentialsEnsureOptions, CredentialsEnsureResult, CredentialsOperationOptions, CredentialsPolicyAdmissionOptions, CredentialsPolicyAdmissionResult, HolderSignatureKey, InlineCredentialProofHandler, InlineCredentialProofRequest, OpenCredentialsHttpTransport, PrimitiveStepHandler, PrimitiveStepResult, ReceiverCredentialCustody, interpretCredentialFlow, mailboxSubject } from './credentials-core.cjs';
 export { D as DEFAULT_EMAIL_PROOF_PROFILE, b as EMAIL_PROOF_CREDENTIAL_TYPE, c as EMAIL_PROOF_PENDING_MAX_MS, d as EmailProofAcquireInput, e as EmailProofAcquisition, f as EmailProofError, g as EmailProofErrorCode, h as EmailProofOptions, a as EmailProofPending, E as EmailProofPendingStore, i as EmailProofProfileId, j as EmailProofRequestInput, k as EmailProofResult, l as EmailProofStep, H as HolderAlgorithm, m as HolderSigner, S as StoredEmailProofInput, n as StoredEmailProofRecord, o as acquireEmailProof, p as completeEmailProof, q as createEd25519HolderSigner, r as createMemoryEmailProofPendingStore, s as emailProofRequirement, t as isTicketEmailProofResult, u as requestEmailProofCode, v as verifyStoredEmailProof } from './email-proof-B4DRizIL.cjs';
 import '@tinycloud/sdk-core';
-import './delegation-Ckc3UETl.cjs';
+import './delegation-BQbAuKad.cjs';
 import '@tinycloud/sdk-core/held-credentials';
 
 /** Production pins. Credentials verify only against these values. Tests pin them literally. */

package/dist/credentials.d.ts

@@ -1,7 +1,7 @@
 export { CredentialAcquisitionTheme, CredentialAcquisitionTransport, CredentialBrowserInteractionAdapter, CredentialClient, CredentialInlineInteractionAdapter, CredentialInputRequest, CredentialInteractionAdapter, CredentialInteractionKind, CredentialInteractionSurface, CredentialProofSubject, CredentialRedirectResumeState, CredentialRedirectStore, CredentialRequestState, CredentialSigningAdapter, CredentialsAcquireOptions, CredentialsEnsureOptions, CredentialsEnsureResult, CredentialsOperationOptions, CredentialsPolicyAdmissionOptions, CredentialsPolicyAdmissionResult, HolderSignatureKey, InlineCredentialProofHandler, InlineCredentialProofRequest, OpenCredentialsHttpTransport, PrimitiveStepHandler, PrimitiveStepResult, ReceiverCredentialCustody, interpretCredentialFlow, mailboxSubject } from './credentials-core.js';
 export { D as DEFAULT_EMAIL_PROOF_PROFILE, b as EMAIL_PROOF_CREDENTIAL_TYPE, c as EMAIL_PROOF_PENDING_MAX_MS, d as EmailProofAcquireInput, e as EmailProofAcquisition, f as EmailProofError, g as EmailProofErrorCode, h as EmailProofOptions, a as EmailProofPending, E as EmailProofPendingStore, i as EmailProofProfileId, j as EmailProofRequestInput, k as EmailProofResult, l as EmailProofStep, H as HolderAlgorithm, m as HolderSigner, S as StoredEmailProofInput, n as StoredEmailProofRecord, o as acquireEmailProof, p as completeEmailProof, q as createEd25519HolderSigner, r as createMemoryEmailProofPendingStore, s as emailProofRequirement, t as isTicketEmailProofResult, u as requestEmailProofCode, v as verifyStoredEmailProof } from './email-proof-B4DRizIL.js';
 import '@tinycloud/sdk-core';
-import './delegation-Ckc3UETl.js';
+import './delegation-BQbAuKad.js';
 import '@tinycloud/sdk-core/held-credentials';
 
 /** Production pins. Credentials verify only against these values. Tests pin them literally. */

package/dist/{delegation-Ckc3UETl.d.cts → delegation-BQbAuKad.d.cts}

@@ -248,4 +248,4 @@ declare function serializeDelegation(delegation: PortableDelegation): string;
  */
 declare function deserializeDelegation(data: string): PortableDelegation;
 
-export { type AuthDelegationArtifact as A, type CompactRuntimeDelegationInput as C, type DelegationAuthority as D, type PortableDelegation as P, RuntimeDelegationRejectedError as R, type SessionGrantProof as S, type ValidatedRuntimeDelegation as V, type RuntimeDelegationRejection as a, activateCompactRuntimeDelegation as b, activateValidatedRuntimeDelegation as c, deserializeDelegation as d, type AuthRequestArtifact as e, RUNTIME_DELEGATION_REJECTIONS as f, type RuntimeDelegationActivator as g, type VerifiedSessionGrant as h, grantAuthRequest as i, signedCompactUcanExpiry as j, siweRuntimeDelegation as k, serializeDelegation as s };
+export { type AuthDelegationArtifact as A, type CompactRuntimeDelegationInput as C, type DelegationAuthority as D, type PortableDelegation as P, RuntimeDelegationRejectedError as R, type SessionGrantProof as S, type ValidatedRuntimeDelegation as V, type RuntimeDelegationRejection as a, activateCompactRuntimeDelegation as b, activateValidatedRuntimeDelegation as c, deserializeDelegation as d, type VerifiedSessionGrant as e, type AuthRequestArtifact as f, RUNTIME_DELEGATION_REJECTIONS as g, type RuntimeDelegationActivator as h, grantAuthRequest as i, signedCompactUcanExpiry as j, siweRuntimeDelegation as k, serializeDelegation as s };

package/dist/{delegation-Ckc3UETl.d.ts → delegation-BQbAuKad.d.ts}

@@ -248,4 +248,4 @@ declare function serializeDelegation(delegation: PortableDelegation): string;
  */
 declare function deserializeDelegation(data: string): PortableDelegation;
 
-export { type AuthDelegationArtifact as A, type CompactRuntimeDelegationInput as C, type DelegationAuthority as D, type PortableDelegation as P, RuntimeDelegationRejectedError as R, type SessionGrantProof as S, type ValidatedRuntimeDelegation as V, type RuntimeDelegationRejection as a, activateCompactRuntimeDelegation as b, activateValidatedRuntimeDelegation as c, deserializeDelegation as d, type AuthRequestArtifact as e, RUNTIME_DELEGATION_REJECTIONS as f, type RuntimeDelegationActivator as g, type VerifiedSessionGrant as h, grantAuthRequest as i, signedCompactUcanExpiry as j, siweRuntimeDelegation as k, serializeDelegation as s };
+export { type AuthDelegationArtifact as A, type CompactRuntimeDelegationInput as C, type DelegationAuthority as D, type PortableDelegation as P, RuntimeDelegationRejectedError as R, type SessionGrantProof as S, type ValidatedRuntimeDelegation as V, type RuntimeDelegationRejection as a, activateCompactRuntimeDelegation as b, activateValidatedRuntimeDelegation as c, deserializeDelegation as d, type VerifiedSessionGrant as e, type AuthRequestArtifact as f, RUNTIME_DELEGATION_REJECTIONS as g, type RuntimeDelegationActivator as h, grantAuthRequest as i, signedCompactUcanExpiry as j, siweRuntimeDelegation as k, serializeDelegation as s };

package/dist/encryption-keys.d.cts

@@ -1,11 +1,12 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-CnVaWnAX.cjs';
+import { T as TinyCloudNode } from './TinyCloudNode-C24728N_.cjs';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';
+import './NodeUserAuthorization-BtoDI9in.cjs';
 import 'events';
-import './delegation-Ckc3UETl.cjs';
+import './delegation-BQbAuKad.cjs';
 
 /**
  * Named encryption keys for a signed-in {@link TinyCloudNode}.

package/dist/encryption-keys.d.ts

@@ -1,11 +1,12 @@
 import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
 export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
-import { T as TinyCloudNode } from './TinyCloudNode-BlNcvo1c.js';
+import { T as TinyCloudNode } from './TinyCloudNode-DLrINr98.js';
 import '@tinycloud/sdk-core';
 import '@tinycloud/sdk-services/kv/replication';
 import '@tinycloud/sdk-services';
+import './NodeUserAuthorization-BtoDI9in.js';
 import 'events';
-import './delegation-Ckc3UETl.js';
+import './delegation-BQbAuKad.js';
 
 /**
  * Named encryption keys for a signed-in {@link TinyCloudNode}.

package/dist/index.cjs

@@ -18968,6 +18968,18 @@ var MemorySessionStorage = class {
   }
 };
 
+// src/storage/clearPersistedSessionIfOwn.ts
+async function clearPersistedSessionIfOwn(storage, address, ownSignature) {
+  if (ownSignature !== void 0) {
+    try {
+      const stored = await storage.load(address);
+      if (stored !== null && stored.signature !== ownSignature) return;
+    } catch {
+    }
+  }
+  await storage.clear(address);
+}
+
 // src/authorization/NodeUserAuthorization.ts
 function assertMaxExpiresAt(value) {
   if (value === void 0 || typeof value === "function") return;
@@ -19061,6 +19073,8 @@ var NodeUserAuthorization = class {
      * delegation lists them: the node answers a repeat with empty lists.
      */
     this._lastActivationActivatedSpaceIds = [];
+    /** See {@link spaceHosting}. Written only from node answers. */
+    this._spaceHosting = "unknown";
     this.wasm = config.wasmBindings;
     this.signer = config.signer;
     this.signStrategy = config.signStrategy ?? defaultSignStrategy;
@@ -19220,6 +19234,7 @@ var NodeUserAuthorization = class {
     this.registryVerdict = void 0;
     this._lastActivationSkippedSpaceIds = [];
     this._lastActivationActivatedSpaceIds = [];
+    this._spaceHosting = "unknown";
     if (!session) {
       this._session = void 0;
       this._tinyCloudSession = void 0;
@@ -19360,6 +19375,18 @@ var NodeUserAuthorization = class {
   get lastActivationActivatedSpaceIds() {
     return [...this._lastActivationActivatedSpaceIds];
   }
+  /**
+   * The node's last answer for whether this session's primary space is hosted:
+   * recorded from the sign-in activation, or by {@link noteSpaceHosting}.
+   * `unknown` until one of them answers, and after a restore.
+   */
+  get spaceHosting() {
+    return this._spaceHosting;
+  }
+  /** @internal Record the hosting probe's answer for the primary space. */
+  noteSpaceHosting(hosting) {
+    this._spaceHosting = hosting;
+  }
   /**
    * Compute the `abilities` map the WASM `prepareSession` call should
    * see at sign-in time.
@@ -19820,103 +19847,55 @@ var NodeUserAuthorization = class {
       this._tinyCloudSession.delegationHeader
     );
     this.recordActivationSkippedSpaces(result, primarySpaceId);
+    if (!result.success && result.status !== 404) {
+      throw Object.assign(
+        new Error(`Failed to activate session: ${describeHostFailure(result)}`),
+        { cause: result }
+      );
+    }
+    await this.ensurePrimarySpaceHosted(this._spaceHosting);
+  }
+  /**
+   * The create step of {@link ensureSpaceExists}: given the node's answer for
+   * the primary space, host it through the space creation handler when it is
+   * `not-hosted`. Any other answer, and a missing handler, change nothing. The
+   * caller supplies the answer (sign-in's activation, or the hosting probe);
+   * an empty activation list is never one.
+   *
+   * @throws Error if the creation handler fails or times out, or hosting fails
+   */
+  async ensurePrimarySpaceHosted(hosting) {
+    if (hosting !== "not-hosted") {
+      return;
+    }
+    const session = this._tinyCloudSession;
+    if (!session) {
+      throw new Error("Must be signed in to host the primary space");
+    }
     const handler = this.spaceCreationHandler ?? (this.autoCreateSpace ? new import_sdk_core5.AutoApproveSpaceCreationHandler() : void 0);
+    if (!handler) {
+      return;
+    }
+    await this.ensureTinyCloudHosts();
+    const host = this.primaryTinyCloudHost;
+    const primarySpaceId = session.spaceId;
     const creationContext = {
       spaceId: primarySpaceId,
       address: this._address,
       chainId: this._chainId,
       host
     };
-    if (result.success) {
-      const primarySkipped = result.skipped?.includes(primarySpaceId);
-      if (!primarySkipped) {
-        return;
-      }
-      if (!handler) {
-        return;
-      }
-      await this.guardSpaceCreation(handler, creationContext);
-      const confirmed = await handler.confirmSpaceCreation(creationContext);
-      if (!confirmed) {
-        return;
-      }
-      try {
-        const created = await this.hostSpace();
-        if (!created.success) {
-          const err2 = Object.assign(
-            new Error(`Failed to create space ${primarySpaceId}: ${describeHostFailure(created)}`),
-            { cause: created }
-          );
-          throw err2;
-        }
-      } catch (error) {
-        handler.onSpaceCreationFailed?.(
-          creationContext,
-          error instanceof Error ? error : new Error(String(error))
-        );
-        throw error;
-      }
-      await new Promise((resolve2) => setTimeout(resolve2, 100));
-      const retryResult = await (0, import_sdk_core5.activateSessionWithHost)(
-        host,
-        this._tinyCloudSession.delegationHeader
-      );
-      if (!retryResult.success) {
-        const err2 = Object.assign(
-          new Error(`Failed to activate session after creating space: ${describeHostFailure(retryResult)}`),
-          { cause: retryResult }
-        );
-        handler.onSpaceCreationFailed?.(creationContext, err2);
-        throw err2;
-      }
-      handler.onSpaceCreated?.(creationContext);
-      return;
-    }
-    if (result.status === 404) {
-      if (!handler) {
-        return;
-      }
-      await this.guardSpaceCreation(handler, creationContext);
-      const confirmed = await handler.confirmSpaceCreation(creationContext);
-      if (!confirmed) {
-        return;
-      }
-      try {
-        const created = await this.hostSpace();
-        if (!created.success) {
-          const err2 = Object.assign(
-            new Error(`Failed to create space ${primarySpaceId}: ${describeHostFailure(created)}`),
-            { cause: created }
-          );
-          throw err2;
-        }
-      } catch (error) {
-        handler.onSpaceCreationFailed?.(
-          creationContext,
-          error instanceof Error ? error : new Error(String(error))
-        );
-        throw error;
-      }
-      await new Promise((resolve2) => setTimeout(resolve2, 100));
-      const retryResult = await (0, import_sdk_core5.activateSessionWithHost)(
-        host,
-        this._tinyCloudSession.delegationHeader
-      );
-      if (!retryResult.success) {
-        const err2 = Object.assign(
-          new Error(`Failed to activate session after creating space: ${describeHostFailure(retryResult)}`),
-          { cause: retryResult }
-        );
-        handler.onSpaceCreationFailed?.(creationContext, err2);
-        throw err2;
-      }
-      handler.onSpaceCreated?.(creationContext);
-      return;
-    }
-    throw Object.assign(
-      new Error(`Failed to activate session: ${describeHostFailure(result)}`),
-      { cause: result }
-    );
+    const { createPrimarySpace } = await import("./space-hosting.cjs");
+    await createPrimarySpace({
+      handler,
+      context: creationContext,
+      guard: () => this.guardSpaceCreation(handler, creationContext),
+      host: () => this.hostSpace(primarySpaceId),
+      onHosted: () => {
+        this._spaceHosting = "hosted";
+      },
+      activate: () => (0, import_sdk_core5.activateSessionWithHost)(host, session.delegationHeader)
+    });
   }
   /** {@link assertMayCreateSpace}, reporting a refusal to the creation handler before rethrowing it. */
   async guardSpaceCreation(handler, context) {
@@ -19932,10 +19911,12 @@ var NodeUserAuthorization = class {
     if (result.success) {
       this._lastActivationSkippedSpaceIds = result.skipped ?? [];
       this._lastActivationActivatedSpaceIds = result.activated ?? [];
+      this._spaceHosting = this._lastActivationSkippedSpaceIds.includes(primarySpaceId) ? "not-hosted" : this._lastActivationActivatedSpaceIds.includes(primarySpaceId) ? "hosted" : "unknown";
       return;
     }
     this._lastActivationActivatedSpaceIds = [];
     this._lastActivationSkippedSpaceIds = result.status === 404 ? [primarySpaceId] : [];
+    this._spaceHosting = result.status === 404 ? "not-hosted" : "unknown";
   }
   async createBootstrapSession(options) {
     refuseCaveated(options.capabilityRequest.manifests);
@@ -20784,12 +20765,13 @@ var NodeUserAuthorization = class {
     };
   }
   /**
-   * Clear persisted session data.
+   * Clear persisted session data. With `ownSignature`, a stored session that provably has a different
+   * signature (a newer sign-in for the same address) is left alone.
    */
-  async clearPersistedSession(address) {
+  async clearPersistedSession(address, ownSignature) {
     const targetAddress = address ?? this._address;
     if (targetAddress) {
-      await this.sessionStorage.clear(targetAddress);
+      await clearPersistedSessionIfOwn(this.sessionStorage, targetAddress, ownSignature);
     }
   }
   /**
@@ -21873,6 +21855,8 @@ var _TinyCloudNode = class _TinyCloudNode {
      * hosting is confirmed against the session that was active at the time.
      */
     this.confirmedHostedSpaceIds = /* @__PURE__ */ new Set();
+    /** The primary space's hosting answer when no authorization layer holds it (a session-only restore). */
+    this._restoredSpaceHosting = "unknown";
     /**
      * Owned space ids known to be hosted for the current session: the sign-in
      * activation listed them as `activated`, or this session hosted them. Unlike
@@ -22211,6 +22195,84 @@ var _TinyCloudNode = class _TinyCloudNode {
       ));
     }
   }
+  /**
+   * Whether the TinyCloud node hosts the primary space (the default) or a named
+   * or full-id space: `"hosted"`, `"not-hosted"`, or `"unknown"` when the node
+   * cannot say.
+   *
+   * Sends one authorized read the session already holds on that space (a kv
+   * list under a granted prefix, else kv metadata, `tinycloud.space/info`, or
+   * a kv get of a key that does not exist), signed for that space. A session
+   * with no such read sends nothing and answers `unknown`. A 401/403 registers
+   * the session delegation with the node once and asks again once. Network
+   * failures, 5xx and a 5 s timeout answer `unknown`; this never throws.
+   *
+   * `hosted` is remembered for the session and `not-hosted` never is. The
+   * answer for the primary space is also what {@link spaceHosting} reports; a
+   * `unknown` answer leaves the previous one in place.
+   */
+  async checkSpaceHosting(space) {
+    try {
+      return await this.probeSpaceHosting(space);
+    } catch {
+      return "unknown";
+    }
+  }
+  /**
+   * The node's last answer for the primary space: recorded at sign-in from the
+   * activation, or by {@link checkSpaceHosting}. `unknown` after a restore until
+   * something asks.
+   */
+  get spaceHosting() {
+    return this.auth ? this.auth.spaceHosting : this._restoredSpaceHosting;
+  }
+  async probeSpaceHosting(space) {
+    const context = this._serviceContext;
+    const session = context?.session;
+    const host = context?.hosts[0];
+    if (!context || !session || !host) {
+      return "unknown";
+    }
+    const spaceId = space === void 0 ? session.spaceId : space.startsWith("tinycloud:") ? space : this.ownedSpaceId(space);
+    const graph = this._serviceGraph;
+    const epoch = this.sessionEpoch;
+    const assertCurrent = () => {
+      graph.assertActive();
+      if (epoch !== this.sessionEpoch || graph !== this._serviceGraph || this._serviceContext !== context) {
+        throw new Error("The session changed during the hosting check.");
+      }
+    };
+    const { askSpaceHosting } = await import("./space-hosting.cjs");
+    assertCurrent();
+    this.pruneExpiredRuntimePermissionGrants();
+    const primary = this.currentTinyCloudSession();
+    const answer = await askSpaceHosting({
+      spaceId,
+      operations: [
+        ...this.runtimePermissionGrants.flatMap((grant) => grant.operations),
+        ...primary ? this.recapOperationsFromSession(primary) : []
+      ],
+      covers: (granted, requested) => this.operationCovers(granted, requested),
+      scope: context,
+      host,
+      fetch: unrecordedFetchOf(context),
+      sign: (entries) => {
+        assertCurrent();
+        return graph.invokeAny({ ...session, spaceId }, entries);
+      },
+      // A session saved but never registered on this node is refused: it registers once.
+      activate: (signal) => {
+        assertCurrent();
+        return (0, import_sdk_core10.activateSessionWithHost)(host, session.delegationHeader, AbortSignal.any([signal, graph.signal]));
+      }
+    });
+    assertCurrent();
+    if (answer !== "unknown" && this.spaceIdsEqual(spaceId, session.spaceId)) {
+      if (this.auth) this.auth.noteSpaceHosting(answer);
+      else this._restoredSpaceHosting = answer;
+    }
+    return answer;
+  }
   get nodeFeatures() {
     return this.auth?.nodeFeatures ?? this._restoredNodeFeatures ?? [];
   }
@@ -22579,6 +22641,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const leavingChainId = this._chainId;
     const leavingPrincipal = this.replicaSessionPrincipal ?? (leavingAddress ? (0, import_sdk_core10.pkhDid)(leavingAddress, leavingChainId) : void 0);
     const leavingAuth = this.auth;
+    const leavingSignature = leavingAuth?.tinyCloudSession?.signature ?? this._restoredTcSession?.signature;
     const leavingContext = this._serviceContext;
     let denied;
     let erased;
@@ -22595,7 +22658,7 @@ var _TinyCloudNode = class _TinyCloudNode {
           if (denied) erased = await this.eraseReplicaLocalCopy("sign_out", denied.status);
         } finally {
           if (leavingAddress) {
-            await (leavingAuth ? leavingAuth.clearPersistedSession(leavingAddress) : this.config.sessionStorage?.clear(leavingAddress));
+            await (leavingAuth ? leavingAuth.clearPersistedSession(leavingAddress, leavingSignature) : this.config.sessionStorage && clearPersistedSessionIfOwn(this.config.sessionStorage, leavingAddress, leavingSignature));
           }
         }
       }
@@ -22701,6 +22764,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._spaceService = void 0;
     this.runtimePermissionGrants = [];
     this._recapOperationsCache = void 0;
+    this._restoredSpaceHosting = "unknown";
     this.confirmedHostedSpaceIds.clear();
     this.hostedOwnedSpaceIds.clear();
     this.cancelOwnedSpaceHosts();
@@ -22894,6 +22958,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     const primarySession = this.currentTinyCloudSession();
     if (primarySession) {
       this.registerPrimarySessionGrant(primarySession);
+      if (this.auth?.spaceHosting === "unknown") {
+        await this.checkSpaceHosting();
+        this.assertSessionEpoch(epoch, "Sign-in");
+      }
     }
     const bootstrapped = await this.bootstrapAccountIfNeeded();
     this.assertSessionEpoch(epoch, "Sign-in");
@@ -24273,6 +24341,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.tc = stagedGraph.core;
     this._recapOperationsCache = stagedPrimary.cache;
     this.runtimePermissionGrants = stagedPrimary.grants;
+    this._restoredSpaceHosting = "unknown";
     this.confirmedHostedSpaceIds.clear();
     this.hostedOwnedSpaceIds.clear();
     this.cancelOwnedSpaceHosts();
@@ -28341,10 +28410,22 @@ var FileSessionStorage = class {
   async save(address, session) {
     const filePath = this.getFilePath(address);
     const data = JSON.stringify(session, null, 2);
-    (0, import_fs.writeFileSync)(filePath, data, "utf-8");
+    const tempPath = `${filePath}.${process.pid}.${process.hrtime.bigint()}.tmp`;
+    try {
+      (0, import_fs.writeFileSync)(tempPath, data, { mode: 384, flag: "wx" });
+      (0, import_fs.renameSync)(tempPath, filePath);
+    } catch (error) {
+      try {
+        (0, import_fs.unlinkSync)(tempPath);
+      } catch {
+      }
+      throw error;
+    }
   }
   /**
    * Load a session for an address.
+   *
+   * Rejects when the file exists but cannot be read or parsed; the file is left in place.
    */
   async load(address) {
     const filePath = this.getFilePath(address);
@@ -28368,11 +28449,9 @@ var FileSessionStorage = class {
       }
       return session;
     } catch (error) {
-      try {
-        (0, import_fs.unlinkSync)(filePath);
-      } catch {
-      }
-      return null;
+      throw new Error(
+        `Could not read session file ${filePath}: ${error}`
+      );
     }
   }
   /**