@tinycloud/node-sdk 3.2.1-beta.0 → 3.2.1-beta.1

package/dist/{WasmKeyProvider-6_YwgSkd.d.cts → WasmKeyProvider-DRlOpvpG.d.cts}

@@ -337,6 +337,11 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      */
     private _nodeInfoIdentity?;
     private _lastActivationSkippedSpaceIds;
+    /**
+     * Spaces the sign-in activation reported hosted. Only the first POST of a
+     * delegation lists them: the node answers a repeat with empty lists.
+     */
+    private _lastActivationActivatedSpaceIds;
     constructor(config: NodeUserAuthorizationConfig);
     /**
      * Return the manifest currently driving sign-in behavior, or
@@ -414,6 +419,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      */
     nodeIdForHost(host: string): string | undefined;
     get lastActivationSkippedSpaceIds(): string[];
+    get lastActivationActivatedSpaceIds(): string[];
     /**
      * Compute the `abilities` map the WASM `prepareSession` call should
      * see at sign-in time.
@@ -1479,9 +1485,25 @@ declare class TinyCloudNode {
      * hosting is confirmed against the session that was active at the time.
      */
     private readonly confirmedHostedSpaceIds;
+    /**
+     * Owned space ids known to be hosted for the current session: the sign-in
+     * activation listed them as `activated`, or this session hosted them. Unlike
+     * {@link confirmedHostedSpaceIds}, nothing here is inferred from a space being
+     * merely absent from `skipped`. Read by {@link ensureOwnedSpaceHosted}.
+     */
+    private readonly hostedOwnedSpaceIds;
+    /**
+     * In-flight host delegations, so concurrent callers share one approval per
+     * space. `waiters` counts callers still waiting; the request is cancelled
+     * once every caller with a signal has aborted and none waits without one.
+     */
+    private readonly ownedSpaceHosts;
     /** Serializes account-registry writes for the active node instance. */
     private accountRegistryTail;
-    /** Bounds best-effort registry work on the sign-in critical path. */
+    /**
+     * Hang guard for the background registry sync. It is off the sign-in path,
+     * so it must outlast a slow but healthy sync (9–18 s on prod 1.20.2, TC-998).
+     */
     private accountRegistryDeadlineMs;
     private pendingAccountRegistrySync?;
     /**
@@ -1691,6 +1713,15 @@ declare class TinyCloudNode {
      * @param options - Optional per-call SIWE overrides for this sign-in only
      */
     signIn(options?: SignInOptions): Promise<void>;
+    /**
+     * Wait for the account-registry sync that {@link signIn} starts in the
+     * background (account index, this app's manifest record, space list).
+     * Resolves once it has finished, failed or hit its hang guard; it never
+     * rejects, and failures are logged as warnings. `signIn()` does not wait for
+     * it, so call this only when you need the registry written, or before a first
+     * write against a SQLite-backed node older than 1.20.2 (TC-899).
+     */
+    waitForAccountRegistrySync(): Promise<void>;
     private ownedSpaceId;
     private bootstrapAccountIfNeeded;
     private resolveBootstrapDecision;
@@ -1811,23 +1842,35 @@ declare class TinyCloudNode {
      * registered on the node.
      *
      * Calling this resolves `name` to the owner's owned-space URI
-     * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`). It first consults the
-     * account-space spaces registry (`account/spaces/{space_id}`, the canonical
-     * KV source of truth, fronted by a best-effort SQLite index): if the space is
-     * already registered/hosted it returns the URI WITHOUT submitting a host
-     * delegation, avoiding a redundant host-SIWE signature prompt for owners who
-     * already use the space. Only when the space is absent — or the registry
-     * check fails for any reason (e.g. a cold SQLite index reporting
-     * `no such table: spaces`) — does it fall through to {@link hostOwnedSpace}.
-     *
-     * The registry check is purely an optimization: any failure falls back to
-     * hosting, and the host SIWE is idempotent server-side, so re-hosting an
-     * existing space remains a safe no-op. Must be called after {@link signIn}.
+     * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`). It returns WITHOUT
+     * submitting a host delegation when the space is known to be hosted: the
+     * sign-in activation listed it as `activated` (any space the session's recap
+     * covers), this session already hosted it, or the account-space spaces
+     * registry (`account/spaces/{space_id}`, the canonical KV source of truth,
+     * fronted by a best-effort SQLite index) has its record. Otherwise it falls
+     * through to {@link hostOwnedSpace}, which asks for a signature; a host
+     * already in flight for the same space (e.g. from the background registry
+     * sync) is shared rather than asked for twice.
+     *
+     * Hosting is still needed when the space really isn't hosted, or when the
+     * session's recap doesn't cover it and the registry has no record; the host
+     * SIWE is idempotent server-side. Must be called after {@link signIn}.
      *
      * @param name - The owned space name (e.g. `"secrets"`).
      * @returns The hosted owned-space URI.
      */
     ensureOwnedSpaceHosted(name: string): Promise<string>;
+    /**
+     * Submit the host delegation for an owned space, sharing one in-flight
+     * request (and so one approval) between concurrent callers in this session,
+     * such as the background registry sync and {@link ensureOwnedSpaceHosted}.
+     * Each caller's `signal` releases only its own wait; the request itself is
+     * cancelled once no caller is left waiting, or when the session is replaced
+     * ({@link cancelOwnedSpaceHosts}), so a late approval is discarded.
+     */
+    private hostOwnedSpaceOnce;
+    /** Session replacement: cancel the replaced session's in-flight hosts and forget them. */
+    private cancelOwnedSpaceHosts;
     /** Resolve and authenticate the owner encoded by an owned-space URI. */
     credentialSpaceOwnerDid(spaceId: string): string;
     /**

package/dist/{WasmKeyProvider-6_YwgSkd.d.ts → WasmKeyProvider-DRlOpvpG.d.ts}

@@ -337,6 +337,11 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      */
     private _nodeInfoIdentity?;
     private _lastActivationSkippedSpaceIds;
+    /**
+     * Spaces the sign-in activation reported hosted. Only the first POST of a
+     * delegation lists them: the node answers a repeat with empty lists.
+     */
+    private _lastActivationActivatedSpaceIds;
     constructor(config: NodeUserAuthorizationConfig);
     /**
      * Return the manifest currently driving sign-in behavior, or
@@ -414,6 +419,7 @@ declare class NodeUserAuthorization implements IUserAuthorization {
      */
     nodeIdForHost(host: string): string | undefined;
     get lastActivationSkippedSpaceIds(): string[];
+    get lastActivationActivatedSpaceIds(): string[];
     /**
      * Compute the `abilities` map the WASM `prepareSession` call should
      * see at sign-in time.
@@ -1479,9 +1485,25 @@ declare class TinyCloudNode {
      * hosting is confirmed against the session that was active at the time.
      */
     private readonly confirmedHostedSpaceIds;
+    /**
+     * Owned space ids known to be hosted for the current session: the sign-in
+     * activation listed them as `activated`, or this session hosted them. Unlike
+     * {@link confirmedHostedSpaceIds}, nothing here is inferred from a space being
+     * merely absent from `skipped`. Read by {@link ensureOwnedSpaceHosted}.
+     */
+    private readonly hostedOwnedSpaceIds;
+    /**
+     * In-flight host delegations, so concurrent callers share one approval per
+     * space. `waiters` counts callers still waiting; the request is cancelled
+     * once every caller with a signal has aborted and none waits without one.
+     */
+    private readonly ownedSpaceHosts;
     /** Serializes account-registry writes for the active node instance. */
     private accountRegistryTail;
-    /** Bounds best-effort registry work on the sign-in critical path. */
+    /**
+     * Hang guard for the background registry sync. It is off the sign-in path,
+     * so it must outlast a slow but healthy sync (9–18 s on prod 1.20.2, TC-998).
+     */
     private accountRegistryDeadlineMs;
     private pendingAccountRegistrySync?;
     /**
@@ -1691,6 +1713,15 @@ declare class TinyCloudNode {
      * @param options - Optional per-call SIWE overrides for this sign-in only
      */
     signIn(options?: SignInOptions): Promise<void>;
+    /**
+     * Wait for the account-registry sync that {@link signIn} starts in the
+     * background (account index, this app's manifest record, space list).
+     * Resolves once it has finished, failed or hit its hang guard; it never
+     * rejects, and failures are logged as warnings. `signIn()` does not wait for
+     * it, so call this only when you need the registry written, or before a first
+     * write against a SQLite-backed node older than 1.20.2 (TC-899).
+     */
+    waitForAccountRegistrySync(): Promise<void>;
     private ownedSpaceId;
     private bootstrapAccountIfNeeded;
     private resolveBootstrapDecision;
@@ -1811,23 +1842,35 @@ declare class TinyCloudNode {
      * registered on the node.
      *
      * Calling this resolves `name` to the owner's owned-space URI
-     * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`). It first consults the
-     * account-space spaces registry (`account/spaces/{space_id}`, the canonical
-     * KV source of truth, fronted by a best-effort SQLite index): if the space is
-     * already registered/hosted it returns the URI WITHOUT submitting a host
-     * delegation, avoiding a redundant host-SIWE signature prompt for owners who
-     * already use the space. Only when the space is absent — or the registry
-     * check fails for any reason (e.g. a cold SQLite index reporting
-     * `no such table: spaces`) — does it fall through to {@link hostOwnedSpace}.
-     *
-     * The registry check is purely an optimization: any failure falls back to
-     * hosting, and the host SIWE is idempotent server-side, so re-hosting an
-     * existing space remains a safe no-op. Must be called after {@link signIn}.
+     * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`). It returns WITHOUT
+     * submitting a host delegation when the space is known to be hosted: the
+     * sign-in activation listed it as `activated` (any space the session's recap
+     * covers), this session already hosted it, or the account-space spaces
+     * registry (`account/spaces/{space_id}`, the canonical KV source of truth,
+     * fronted by a best-effort SQLite index) has its record. Otherwise it falls
+     * through to {@link hostOwnedSpace}, which asks for a signature; a host
+     * already in flight for the same space (e.g. from the background registry
+     * sync) is shared rather than asked for twice.
+     *
+     * Hosting is still needed when the space really isn't hosted, or when the
+     * session's recap doesn't cover it and the registry has no record; the host
+     * SIWE is idempotent server-side. Must be called after {@link signIn}.
      *
      * @param name - The owned space name (e.g. `"secrets"`).
      * @returns The hosted owned-space URI.
      */
     ensureOwnedSpaceHosted(name: string): Promise<string>;
+    /**
+     * Submit the host delegation for an owned space, sharing one in-flight
+     * request (and so one approval) between concurrent callers in this session,
+     * such as the background registry sync and {@link ensureOwnedSpaceHosted}.
+     * Each caller's `signal` releases only its own wait; the request itself is
+     * cancelled once no caller is left waiting, or when the session is replaced
+     * ({@link cancelOwnedSpaceHosts}), so a late approval is discarded.
+     */
+    private hostOwnedSpaceOnce;
+    /** Session replacement: cancel the replaced session's in-flight hosts and forget them. */
+    private cancelOwnedSpaceHosts;
     /** Resolve and authenticate the owner encoded by an owned-space URI. */
     credentialSpaceOwnerDid(spaceId: string): string;
     /**

package/dist/core.cjs

@@ -462,6 +462,11 @@ var NodeUserAuthorization = class {
     this._nodeFeatures = [];
     this._nodeFeaturesKnown = false;
     this._lastActivationSkippedSpaceIds = [];
+    /**
+     * Spaces the sign-in activation reported hosted. Only the first POST of a
+     * delegation lists them: the node answers a repeat with empty lists.
+     */
+    this._lastActivationActivatedSpaceIds = [];
     this.wasm = config.wasmBindings;
     this.signer = config.signer;
     this.signStrategy = config.signStrategy ?? defaultSignStrategy;
@@ -591,6 +596,7 @@ var NodeUserAuthorization = class {
     this._nodeInfoIdentity = void 0;
     this.tinycloudHosts = hosts && hosts.length > 0 ? [...hosts] : void 0;
     this._lastActivationSkippedSpaceIds = [];
+    this._lastActivationActivatedSpaceIds = [];
     if (!session) {
       this._session = void 0;
       this._tinyCloudSession = void 0;
@@ -685,6 +691,9 @@ var NodeUserAuthorization = class {
   get lastActivationSkippedSpaceIds() {
     return [...this._lastActivationSkippedSpaceIds];
   }
+  get lastActivationActivatedSpaceIds() {
+    return [...this._lastActivationActivatedSpaceIds];
+  }
   /**
    * Compute the `abilities` map the WASM `prepareSession` call should
    * see at sign-in time.
@@ -1180,8 +1189,10 @@ var NodeUserAuthorization = class {
   recordActivationSkippedSpaces(result, primarySpaceId) {
     if (result.success) {
       this._lastActivationSkippedSpaceIds = result.skipped ?? [];
+      this._lastActivationActivatedSpaceIds = result.activated ?? [];
       return;
     }
+    this._lastActivationActivatedSpaceIds = [];
     this._lastActivationSkippedSpaceIds = result.status === 404 ? [primarySpaceId] : [];
   }
   async createBootstrapSession(options) {
@@ -3433,10 +3444,26 @@ var _TinyCloudNode = class _TinyCloudNode {
      * hosting is confirmed against the session that was active at the time.
      */
     this.confirmedHostedSpaceIds = /* @__PURE__ */ new Set();
+    /**
+     * Owned space ids known to be hosted for the current session: the sign-in
+     * activation listed them as `activated`, or this session hosted them. Unlike
+     * {@link confirmedHostedSpaceIds}, nothing here is inferred from a space being
+     * merely absent from `skipped`. Read by {@link ensureOwnedSpaceHosted}.
+     */
+    this.hostedOwnedSpaceIds = /* @__PURE__ */ new Set();
+    /**
+     * In-flight host delegations, so concurrent callers share one approval per
+     * space. `waiters` counts callers still waiting; the request is cancelled
+     * once every caller with a signal has aborted and none waits without one.
+     */
+    this.ownedSpaceHosts = /* @__PURE__ */ new Map();
     /** Serializes account-registry writes for the active node instance. */
     this.accountRegistryTail = Promise.resolve();
-    /** Bounds best-effort registry work on the sign-in critical path. */
-    this.accountRegistryDeadlineMs = 4e3;
+    /**
+     * Hang guard for the background registry sync. It is off the sign-in path,
+     * so it must outlast a slow but healthy sync (9–18 s on prod 1.20.2, TC-998).
+     */
+    this.accountRegistryDeadlineMs = 3e4;
     /**
      * True when the last signIn() detected an interactive signer and skipped
      * client-side bootstrap. Apps can read this to know whether bootstrap was
@@ -4031,6 +4058,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         "Cannot signIn() in session-only mode. Provide a privateKey in config to create your own space."
       );
     }
+    this.pendingAccountRegistrySync?.controller.abort();
     await this.accountRegistryTail;
     await this.wasmBindings.ensureInitialized?.();
     const address = (0, import_sdk_core10.canonicalizeAddress)(await this.signer.getAddress());
@@ -4051,8 +4079,13 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._serviceContext = void 0;
     this.runtimePermissionGrants = [];
     this.confirmedHostedSpaceIds.clear();
+    this.hostedOwnedSpaceIds.clear();
     await this.tc.signIn(options);
+    this.cancelOwnedSpaceHosts();
     this.syncResolvedHostFromAuth();
+    for (const spaceId of this.auth.lastActivationActivatedSpaceIds ?? []) {
+      this.hostedOwnedSpaceIds.add(spaceId);
+    }
     this.replicationDelegateSession = void 0;
     this.replicationScopeError = void 0;
     if (this.replicationRuntime) await (await this.replicationRuntime).unbind();
@@ -4077,10 +4110,20 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     if (!bootstrapped) {
       this.scheduleAccountRegistrySync();
-      await this.accountRegistryTail;
     }
     this.notificationHandler.success("Successfully signed in");
   }
+  /**
+   * Wait for the account-registry sync that {@link signIn} starts in the
+   * background (account index, this app's manifest record, space list).
+   * Resolves once it has finished, failed or hit its hang guard; it never
+   * rejects, and failures are logged as warnings. `signIn()` does not wait for
+   * it, so call this only when you need the registry written, or before a first
+   * write against a SQLite-backed node older than 1.20.2 (TC-899).
+   */
+  async waitForAccountRegistrySync() {
+    await this.accountRegistryTail;
+  }
   ownedSpaceId(name) {
     if (!this._address) {
       throw new Error("Cannot resolve owned space before sign-in");
@@ -4686,17 +4729,17 @@ var _TinyCloudNode = class _TinyCloudNode {
         clearTimeout(deadline);
       }
     });
-    this.pendingAccountRegistrySync = { session, promise };
-    const clearPendingSync = () => {
+    this.pendingAccountRegistrySync = { session, promise, controller };
+    const settle = () => {
+      clearTimeout(deadline);
       if (this.pendingAccountRegistrySync?.promise === promise) {
         this.pendingAccountRegistrySync = void 0;
       }
     };
-    void promise.then(clearPendingSync, clearPendingSync);
-    void promise.then(
-      () => clearTimeout(deadline),
-      () => clearTimeout(deadline)
-    );
+    void promise.then(settle, (error) => {
+      settle();
+      console.warn("TinyCloud account registry sync failed", error);
+    });
   }
   enqueueAccountRegistryOperation(session, task) {
     const operation = this.accountRegistryTail.then(async () => {
@@ -4734,10 +4777,15 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   async withAccountRegistryRetry(task, signal) {
     const delays = [250, 1e3, 3e3];
+    const stopped = (detail) => {
+      if (signal.reason instanceof DOMException && signal.reason.name === "TimeoutError") {
+        console.warn("TinyCloud account registry sync stopped: deadline exceeded", detail);
+      }
+    };
     let lastError;
     for (let attempt = 0; attempt < delays.length; attempt += 1) {
       if (signal.aborted) {
-        console.warn("TinyCloud account registry sync stopped: deadline exceeded", signal.reason);
+        stopped(signal.reason);
         return;
       }
       try {
@@ -4745,7 +4793,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         return;
       } catch (error) {
         if (signal.aborted) {
-          console.warn("TinyCloud account registry sync stopped: deadline exceeded", error);
+          stopped(error);
           return;
         }
         const verdict = (0, import_sdk_core10.authorizationVerdictOf)(error);
@@ -4838,7 +4886,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session) {
       throw new Error("Owned space hosting requires an active session");
     }
-    if (this.confirmedHostedSpaceIds.has(spaceId)) {
+    if (this.confirmedHostedSpaceIds.has(spaceId) || this.hostedOwnedSpaceIds.has(spaceId)) {
       return;
     }
     const host = this.hosts[0] ?? this.config.host;
@@ -4856,8 +4904,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: activation }
       );
     }
-    const authorization = this.auth;
-    const created = signal ? await authorization.hostOwnedSpaceResult(spaceId, void 0, signal) : await authorization.hostOwnedSpaceResult(spaceId);
+    const created = await this.hostOwnedSpaceOnce(spaceId, signal);
     if (!created.success) {
       throw Object.assign(
         new Error(`Failed to create owned space ${spaceId}: ${describeHostFailure2(created)}`),
@@ -4874,7 +4921,10 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: retry }
       );
     }
-    this.confirmedHostedSpaceIds.add(spaceId);
+    if (this.auth.tinyCloudSession === session) {
+      this.confirmedHostedSpaceIds.add(spaceId);
+      this.hostedOwnedSpaceIds.add(spaceId);
+    }
   }
   /**
    * Host one of this user's owned spaces by name (e.g. `"applications"`).
@@ -4906,7 +4956,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!host) {
       throw new Error("Owned space hosting requires a TinyCloud host");
     }
-    const hosted = await this.auth.hostOwnedSpaceResult(spaceId);
+    const hosted = await this.hostOwnedSpaceOnce(spaceId);
     if (!hosted.success) {
       throw Object.assign(
         new Error(`Failed to host owned space ${spaceId}: ${describeHostFailure2(hosted)}`),
@@ -4925,6 +4975,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: activation }
       );
     }
+    if (this.auth?.tinyCloudSession === session) this.hostedOwnedSpaceIds.add(spaceId);
     try {
       await this.enqueueAccountRegistryOperation(session, async () => {
         await this.account.spaces.register({
@@ -4952,18 +5003,19 @@ var _TinyCloudNode = class _TinyCloudNode {
    * registered on the node.
    *
    * Calling this resolves `name` to the owner's owned-space URI
-   * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`). It first consults the
-   * account-space spaces registry (`account/spaces/{space_id}`, the canonical
-   * KV source of truth, fronted by a best-effort SQLite index): if the space is
-   * already registered/hosted it returns the URI WITHOUT submitting a host
-   * delegation, avoiding a redundant host-SIWE signature prompt for owners who
-   * already use the space. Only when the space is absent — or the registry
-   * check fails for any reason (e.g. a cold SQLite index reporting
-   * `no such table: spaces`) — does it fall through to {@link hostOwnedSpace}.
-   *
-   * The registry check is purely an optimization: any failure falls back to
-   * hosting, and the host SIWE is idempotent server-side, so re-hosting an
-   * existing space remains a safe no-op. Must be called after {@link signIn}.
+   * (`tinycloud:pkh:eip155:<chain>:<addr>:<name>`). It returns WITHOUT
+   * submitting a host delegation when the space is known to be hosted: the
+   * sign-in activation listed it as `activated` (any space the session's recap
+   * covers), this session already hosted it, or the account-space spaces
+   * registry (`account/spaces/{space_id}`, the canonical KV source of truth,
+   * fronted by a best-effort SQLite index) has its record. Otherwise it falls
+   * through to {@link hostOwnedSpace}, which asks for a signature; a host
+   * already in flight for the same space (e.g. from the background registry
+   * sync) is shared rather than asked for twice.
+   *
+   * Hosting is still needed when the space really isn't hosted, or when the
+   * session's recap doesn't cover it and the registry has no record; the host
+   * SIWE is idempotent server-side. Must be called after {@link signIn}.
    *
    * @param name - The owned space name (e.g. `"secrets"`).
    * @returns The hosted owned-space URI.
@@ -4972,13 +5024,57 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.auth || !this.auth.tinyCloudSession) {
       throw new Error("Not signed in. Call signIn() first.");
     }
-    await this.accountRegistryTail;
     const spaceId = this.ownedSpaceId(name);
-    if (await this.isOwnedSpaceRegistered(spaceId)) {
+    if (this.hostedOwnedSpaceIds.has(spaceId) || await this.isOwnedSpaceRegistered(spaceId)) {
       return spaceId;
     }
     return this.hostOwnedSpace(name);
   }
+  /**
+   * Submit the host delegation for an owned space, sharing one in-flight
+   * request (and so one approval) between concurrent callers in this session,
+   * such as the background registry sync and {@link ensureOwnedSpaceHosted}.
+   * Each caller's `signal` releases only its own wait; the request itself is
+   * cancelled once no caller is left waiting, or when the session is replaced
+   * ({@link cancelOwnedSpaceHosts}), so a late approval is discarded.
+   */
+  hostOwnedSpaceOnce(spaceId, signal) {
+    if (signal?.aborted) return Promise.reject(signal.reason);
+    let entry = this.ownedSpaceHosts.get(spaceId);
+    if (!entry) {
+      const controller = new AbortController();
+      const promise = this.auth.hostOwnedSpaceResult(spaceId, void 0, controller.signal);
+      const created = { promise, controller, waiters: 0 };
+      this.ownedSpaceHosts.set(spaceId, created);
+      const forget = () => {
+        if (this.ownedSpaceHosts.get(spaceId) === created) this.ownedSpaceHosts.delete(spaceId);
+      };
+      promise.then(forget, forget);
+      entry = created;
+    }
+    if (!signal) {
+      entry.waiters = Number.POSITIVE_INFINITY;
+      return entry.promise;
+    }
+    entry.waiters += 1;
+    const shared = entry;
+    return new Promise((resolve, reject2) => {
+      const onAbort = () => {
+        reject2(signal.reason);
+        shared.waiters -= 1;
+        if (shared.waiters !== 0) return;
+        shared.controller.abort(signal.reason);
+        if (this.ownedSpaceHosts.get(spaceId) === shared) this.ownedSpaceHosts.delete(spaceId);
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+      shared.promise.then(resolve, reject2).finally(() => signal.removeEventListener("abort", onAbort));
+    });
+  }
+  /** Session replacement: cancel the replaced session's in-flight hosts and forget them. */
+  cancelOwnedSpaceHosts() {
+    for (const { controller } of this.ownedSpaceHosts.values()) controller.abort();
+    this.ownedSpaceHosts.clear();
+  }
   /** Resolve and authenticate the owner encoded by an owned-space URI. */
   credentialSpaceOwnerDid(spaceId) {
     const ownerDid = this.ownerDidFromSpaceId(spaceId);
@@ -5221,6 +5317,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       sessionExpiry: stagedSessionExpiry,
       recap: stagedRecap
     });
+    this.pendingAccountRegistrySync?.controller.abort();
+    await this.accountRegistryTail;
     const oldGraph = this._serviceGraph;
     const oldCore = this.tc;
     this.sessionManager = stagedManager;
@@ -5254,6 +5352,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     this._recapOperationsCache = stagedPrimary.cache;
     this.runtimePermissionGrants = stagedPrimary.grants;
     this.confirmedHostedSpaceIds.clear();
+    this.hostedOwnedSpaceIds.clear();
+    this.cancelOwnedSpaceHosts();
     this._restoredNodeFeatures = restoredNodeFeatures;
     if (this.auth) {
       this.auth.installRestoredSession(stagedManager, stagedTcSession, [stagedHost], restoredNodeFeatures);