@tinycloud/node-sdk 3.2.6-beta.1 → 3.2.6-beta.3

package/dist/core.js

@@ -389,6 +389,13 @@ function cloneAbilitiesMap(actions) {
 var NodeUserAuthorization = class {
   constructor(config) {
     this.activeSessionKeyId = "default";
+    /** Incremented by resetSession; a sign-in started earlier publishes nothing. */
+    this.sessionGeneration = 0;
+    /**
+     * Sign-in saves run one at a time, in order, each together with its own
+     * cancellation cleanup, so no later write can land between the two.
+     */
+    this.persistenceQueue = Promise.resolve();
     this.extensions = [];
     this._nodeFeatures = [];
     this._nodeFeaturesKnown = false;
@@ -519,6 +526,27 @@ var NodeUserAuthorization = class {
       this.tinycloudHosts = [...hosts];
     }
   }
+  /**
+   * @internal End the session: adopt a fresh session manager whose active key
+   * is `sessionKeyId`, and return to the constructed state.
+   */
+  resetSession(sessionManager, sessionKeyId, hosts) {
+    this.sessionGeneration++;
+    this.installRestoredSession(sessionManager, void 0, hosts);
+    this.activeSessionKeyId = sessionKeyId;
+  }
+  /** Throws when the session was reset (signed out) after `generation` was read. */
+  assertSignInCurrent(generation) {
+    if (generation !== this.sessionGeneration) {
+      throw new Error("Sign-in was cancelled by sign-out.");
+    }
+  }
+  /** Runs `task` after every earlier queued persistence task has settled. */
+  enqueuePersistence(task) {
+    const run = this.persistenceQueue.then(task);
+    this.persistenceQueue = run.catch(() => void 0);
+    return run;
+  }
   /** @internal Atomically adopt the state staged by TinyCloudNode.restoreSession. */
   installRestoredSession(sessionManager, session, hosts, nodeFeatures) {
     this.sessionManager = sessionManager;
@@ -1207,11 +1235,14 @@ var NodeUserAuthorization = class {
    * @param options - Optional per-call SIWE overrides for this sign-in only
    */
   async signIn(options) {
-    this._address = canonicalizeAddress(await this.signer.getAddress());
-    this._chainId = await this.signer.getChainId();
-    const address = this._address;
-    const chainId = this._chainId;
+    const generation = this.sessionGeneration;
+    const address = canonicalizeAddress(await this.signer.getAddress());
+    const chainId = await this.signer.getChainId();
+    this.assertSignInCurrent(generation);
+    this._address = address;
+    this._chainId = chainId;
     await this.resolveTinyCloudHostsForSignIn(address, chainId);
+    this.assertSignInCurrent(generation);
     const keyId = `session-${Date.now()}`;
     this.sessionManager.renameSessionKeyId(this.activeSessionKeyId, keyId);
     this.activeSessionKeyId = keyId;
@@ -1244,6 +1275,7 @@ var NodeUserAuthorization = class {
       type: "siwe",
       purpose: "sign-in"
     });
+    this.assertSignInCurrent(generation);
     const session = this.wasm.completeSessionSetup({
       ...prepared,
       signature
@@ -1288,18 +1320,27 @@ var NodeUserAuthorization = class {
       version: "1.0",
       tinycloudHosts: this.tinycloudHosts
     };
-    await this.sessionStorage.save(address, persistedData);
+    await this.enqueuePersistence(async () => {
+      await this.sessionStorage.save(address, persistedData);
+      if (generation !== this.sessionGeneration) {
+        await this.sessionStorage.clear(address);
+      }
+    });
+    this.assertSignInCurrent(generation);
     this._session = clientSession;
     this._tinyCloudSession = tinyCloudSession;
     this._address = address;
     this._chainId = chainId;
     await this.refreshNodeInfo();
+    this.assertSignInCurrent(generation);
     for (const ext of this.extensions) {
       if (ext.afterSignIn) {
         await ext.afterSignIn(clientSession);
+        this.assertSignInCurrent(generation);
       }
     }
     await this.ensureSpaceExists();
+    this.assertSignInCurrent(generation);
     return clientSession;
   }
   /**
@@ -2546,17 +2587,24 @@ import {
   ServiceContext
 } from "@tinycloud/sdk-core";
 var DelegatedAccess = class {
-  constructor(session, delegation, host, invoke, invokeAny, telemetry) {
+  /**
+   * @param lifetime - Optional owner of this access: its `fetch` is used for
+   *   requests and the service context is registered with `track`, so the
+   *   owner can cancel and retire the access (TinyCloudNode does this when its
+   *   session is replaced or signed out).
+   */
+  constructor(session, delegation, host, invoke, invokeAny, telemetry, lifetime) {
     this.session = session;
     this._delegation = delegation;
     this.host = host;
-    this._serviceContext = new ServiceContext({
+    const context = new ServiceContext({
       invoke,
       invokeAny,
-      fetch: globalThis.fetch.bind(globalThis),
+      fetch: lifetime?.fetch ?? globalThis.fetch.bind(globalThis),
       hosts: [host],
       telemetry
     });
+    this._serviceContext = lifetime ? lifetime.track(context) : context;
     const prefix = this._delegation.path.replace(/\/$/, "");
     this._kv = new KVService({ prefix });
     this._kv.initialize(this._serviceContext);
@@ -3140,6 +3188,19 @@ function exactVerifiedRecap(verified) {
     caveats: cloneRecapCaveats(entry.caveats)
   }));
 }
+function createDefaultSessionKey(wasm) {
+  const manager = wasm.createSessionManager();
+  let keyId = "default";
+  let jwkStr = manager.jwk(keyId);
+  if (!jwkStr) {
+    keyId = manager.createSessionKey(keyId);
+    jwkStr = manager.jwk(keyId);
+  }
+  if (!jwkStr) {
+    throw new Error("Failed to get session key JWK");
+  }
+  return { manager, keyId, jwk: JSON.parse(jwkStr) };
+}
 var ServiceGraphLifetime = class {
   constructor(invokeFn, invokeAnyFn, fetchFn, observeContext) {
     this.invokeFn = invokeFn;
@@ -3189,9 +3250,13 @@ var ServiceGraphLifetime = class {
       this.contexts.clear();
     }
   }
+  /** Aborted when the graph retires: cancels requests made for its session. */
+  get signal() {
+    return this.abortController.signal;
+  }
   assertActive() {
     if (this.retired) {
-      throw new Error("Service graph has been retired by session replacement.");
+      throw new Error("Service graph has been retired: its session was replaced or signed out.");
     }
   }
   combineSignals(signal) {
@@ -3493,6 +3558,16 @@ var _TinyCloudNode = class _TinyCloudNode {
      * so it must outlast a slow but healthy sync (9–18 s on prod 1.20.2, TC-998).
      */
     this.accountRegistryDeadlineMs = 3e4;
+    /**
+     * Incremented by every sign-out. A sign-in or restore records it when it
+     * starts and does not establish its session once it has changed.
+     */
+    this.sessionEpoch = 0;
+    /**
+     * Numbers sign-in and restore attempts. A cancelled attempt cleans up only
+     * while it is still the latest, so it never ends a newer session.
+     */
+    this.latestSessionAttempt = 0;
     /**
      * True when the last signIn() detected an interactive signer and skipped
      * client-side bootstrap. Apps can read this to know whether bootstrap was
@@ -3626,54 +3701,17 @@ var _TinyCloudNode = class _TinyCloudNode {
         "wasmBindings must be provided in config. Import from '@tinycloud/node-sdk' (not '/core') for automatic Node.js defaults."
       );
     }
-    this.sessionManager = this.wasmBindings.createSessionManager();
-    const defaultKeyId = "default";
-    let jwkStr = this.sessionManager.jwk(defaultKeyId);
-    if (jwkStr) {
-      this.sessionKeyId = defaultKeyId;
-    } else {
-      this.sessionKeyId = this.sessionManager.createSessionKey(defaultKeyId);
-      jwkStr = this.sessionManager.jwk(this.sessionKeyId);
-    }
-    if (!jwkStr) {
-      throw new Error("Failed to get session key JWK");
-    }
-    this.sessionKeyJwk = JSON.parse(jwkStr);
+    const sessionKey = createDefaultSessionKey(this.wasmBindings);
+    this.sessionManager = sessionKey.manager;
+    this.sessionKeyId = sessionKey.keyId;
+    this.sessionKeyJwk = sessionKey.jwk;
     this._serviceGraph = this.createServiceGraphLifetime();
     this._capabilityRegistry = new CapabilityKeyRegistry();
     this._keyProvider = new WasmKeyProvider({
       sessionManager: this.sessionManager
     });
     this.notificationHandler = config.notificationHandler ?? new SilentNotificationHandler();
-    const receiveOnlyGraph = this._serviceGraph;
-    this._sharingService = new SharingService({
-      hosts: [this.config.host],
-      // session: undefined - not needed for receive()
-      invoke: receiveOnlyGraph.invoke,
-      fetch: receiveOnlyGraph.fetch,
-      assertActive: () => receiveOnlyGraph.assertActive(),
-      keyProvider: this._keyProvider,
-      registry: this._capabilityRegistry,
-      createDelegationWasm: (params) => this.createDelegationWrapper(params),
-      computeCid: (data, codec) => {
-        if (!this.wasmBindings.computeCid) throw new Error("computeCid is unavailable");
-        return this.wasmBindings.computeCid(data, codec);
-      },
-      // delegationManager: undefined - not needed for receive()
-      createKVService: (config2) => {
-        const prefix = config2.pathPrefix?.replace(/\/$/, "");
-        const kvService = new KVService2({ prefix });
-        const kvContext = receiveOnlyGraph.track(new ServiceContext2({
-          invoke: config2.invoke,
-          fetch: config2.fetch ?? globalThis.fetch.bind(globalThis),
-          hosts: config2.hosts,
-          telemetry: this.config.telemetry
-        }));
-        kvContext.setSession(config2.session);
-        kvService.initialize(kvContext);
-        return kvService;
-      }
-    });
+    this._sharingService = this.createReceiveOnlySharing();
     if (config.signer) {
       this.signer = config.signer;
       this.setupAuth(config);
@@ -3815,6 +3853,42 @@ var _TinyCloudNode = class _TinyCloudNode {
   get siweDomain() {
     return this.config.domain ?? "app.tinycloud.xyz";
   }
+  /**
+   * SharingService for receive-only access (no session required), bound to the
+   * current service graph. This lets session-only users receive sharing links
+   * without signIn(); full capabilities (generate) are added after signIn().
+   */
+  createReceiveOnlySharing() {
+    const receiveOnlyGraph = this._serviceGraph;
+    return new SharingService({
+      hosts: [this.config.host],
+      // session: undefined - not needed for receive()
+      invoke: receiveOnlyGraph.invoke,
+      fetch: receiveOnlyGraph.fetch,
+      assertActive: () => receiveOnlyGraph.assertActive(),
+      keyProvider: this._keyProvider,
+      registry: this._capabilityRegistry,
+      createDelegationWasm: (params) => this.createDelegationWrapper(params),
+      computeCid: (data, codec) => {
+        if (!this.wasmBindings.computeCid) throw new Error("computeCid is unavailable");
+        return this.wasmBindings.computeCid(data, codec);
+      },
+      // delegationManager: undefined - not needed for receive()
+      createKVService: (config) => {
+        const prefix = config.pathPrefix?.replace(/\/$/, "");
+        const kvService = new KVService2({ prefix });
+        const kvContext = receiveOnlyGraph.track(new ServiceContext2({
+          invoke: config.invoke,
+          fetch: config.fetch ?? globalThis.fetch.bind(globalThis),
+          hosts: config.hosts,
+          telemetry: this.config.telemetry
+        }));
+        kvContext.setSession(config.session);
+        kvService.initialize(kvContext);
+        return kvService;
+      }
+    });
+  }
   /**
    * Set up authorization handler and TinyCloud instance.
    * @internal
@@ -4074,6 +4148,115 @@ var _TinyCloudNode = class _TinyCloudNode {
   get restorableSession() {
     return this.currentTinyCloudSession();
   }
+  /**
+   * Sign out and end the session on this instance.
+   *
+   * Every service built for the session (and every `useDelegation()` result)
+   * is retired and the session key is replaced before anything is awaited, so
+   * nothing captured from the session can sign once sign-out has started.
+   * Pending work is aborted and the persisted session is cleared from the
+   * configured session storage. Afterwards session accessors return
+   * `undefined` and service calls fail with "Not signed in" until
+   * {@link signIn} or {@link restoreSession}, which wait for a sign-out in
+   * progress.
+   */
+  signOut() {
+    this.signOutInFlight ?? (this.signOutInFlight = this.endSession().finally(() => {
+      this.signOutInFlight = void 0;
+    }));
+    return this.signOutInFlight;
+  }
+  async endSession() {
+    const leavingAddress = this.address ?? this._restoredTcSession?.address;
+    const leavingAuth = this.auth;
+    try {
+      this.teardownSession();
+    } finally {
+      try {
+        await this.accountRegistryTail;
+        if (this.replicationRuntime) await (await this.replicationRuntime).unbind();
+      } finally {
+        if (leavingAddress) {
+          await (leavingAuth ? leavingAuth.clearPersistedSession(leavingAddress) : this.config.sessionStorage?.clear(leavingAddress));
+        }
+      }
+    }
+  }
+  /**
+   * Synchronously drop every piece of in-memory session authority and
+   * invalidate sign-ins and restores still in flight (see `sessionEpoch`).
+   */
+  teardownSession() {
+    this.sessionEpoch++;
+    this.pendingAccountRegistrySync?.controller.abort();
+    const oldGraph = this._serviceGraph;
+    const oldCore = this.tc;
+    const oldAuth = this.auth;
+    this.auth = null;
+    this.tc = null;
+    this._address = void 0;
+    this._restoredTcSession = void 0;
+    this._activeServiceSession = void 0;
+    oldGraph.retire();
+    oldCore?.retireServices();
+    oldAuth?.resetSession(
+      this.sessionManager,
+      this.sessionKeyId,
+      this.explicitHost ? [this.explicitHost] : void 0
+    );
+    this.config.host = this.explicitHost ?? DEFAULT_HOST;
+    this._chainId = 1;
+    this._restoredNodeFeatures = void 0;
+    this._activeServiceSession = void 0;
+    this._serviceContext = void 0;
+    this._kv = void 0;
+    this._sql = void 0;
+    this._duckdb = void 0;
+    this._hooks = void 0;
+    this._vault = void 0;
+    this._encryption = void 0;
+    this._baseVaults.clear();
+    this._baseSecrets.clear();
+    this._secrets.clear();
+    this._account = void 0;
+    this._publicKV = void 0;
+    this._delegationManager = void 0;
+    this._spaceService = void 0;
+    this.runtimePermissionGrants = [];
+    this._recapOperationsCache = void 0;
+    this.confirmedHostedSpaceIds.clear();
+    this.hostedOwnedSpaceIds.clear();
+    this.cancelOwnedSpaceHosts();
+    this.storageFull.clear();
+    this._bootstrapSkipped = false;
+    this._bootstrapStatus = { skipped: false };
+    this.replicationDelegateSession = void 0;
+    this.replicationScopeError = void 0;
+    const sessionKey = createDefaultSessionKey(this.wasmBindings);
+    this.sessionManager = sessionKey.manager;
+    this.sessionKeyId = sessionKey.keyId;
+    this.sessionKeyJwk = sessionKey.jwk;
+    oldAuth?.resetSession(
+      sessionKey.manager,
+      sessionKey.keyId,
+      this.explicitHost ? [this.explicitHost] : void 0
+    );
+    this._serviceGraph = this.createServiceGraphLifetime();
+    this.auth = oldAuth;
+    this.tc = this.auth ? new TinyCloud(this.auth, {
+      invokeAny: this.invokeAnyWithRuntimePermissions,
+      telemetry: this.config.telemetry
+    }) : null;
+    this._capabilityRegistry = new CapabilityKeyRegistry();
+    this._keyProvider = new WasmKeyProvider({ sessionManager: this.sessionManager });
+    this._sharingService = this.createReceiveOnlySharing();
+  }
+  /** Throws when a sign-out started after `epoch` was read. */
+  assertSessionEpoch(epoch, operation) {
+    if (epoch !== this.sessionEpoch) {
+      throw new Error(`${operation} was cancelled by sign-out.`);
+    }
+  }
   /**
    * Sign in and create a new session.
    * This creates the user's space if it doesn't exist.
@@ -4087,11 +4270,28 @@ var _TinyCloudNode = class _TinyCloudNode {
         "Cannot signIn() in session-only mode. Provide a privateKey in config to create your own space."
       );
     }
+    const epoch = this.sessionEpoch;
+    const attempt = ++this.latestSessionAttempt;
+    await this.signOutInFlight;
+    try {
+      await this.establishSignIn(epoch, options);
+    } catch (error) {
+      if (epoch !== this.sessionEpoch && attempt === this.latestSessionAttempt) {
+        await this.endSession();
+      }
+      throw error;
+    }
+  }
+  async establishSignIn(epoch, options) {
+    if (!this.signer || !this.tc) {
+      throw new Error("Not signed in. Call signIn() first.");
+    }
     this.pendingAccountRegistrySync?.controller.abort();
     await this.accountRegistryTail;
     await this.wasmBindings.ensureInitialized?.();
     const address = canonicalizeAddress2(await this.signer.getAddress());
     const chainId = await this.signer.getChainId();
+    this.assertSessionEpoch(epoch, "Sign-in");
     if (address !== this._address || chainId !== this._chainId) this.storageFull.clear();
     this._address = address;
     this._chainId = chainId;
@@ -4110,6 +4310,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.confirmedHostedSpaceIds.clear();
     this.hostedOwnedSpaceIds.clear();
     await this.tc.signIn(options);
+    this.assertSessionEpoch(epoch, "Sign-in");
     this.cancelOwnedSpaceHosts();
     this.syncResolvedHostFromAuth();
     for (const spaceId of this.auth.lastActivationActivatedSpaceIds ?? []) {
@@ -4118,6 +4319,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.replicationDelegateSession = void 0;
     this.replicationScopeError = void 0;
     if (this.replicationRuntime) await (await this.replicationRuntime).unbind();
+    this.assertSessionEpoch(epoch, "Sign-in");
     const oldGraph = this._serviceGraph;
     this._serviceGraph = this.createServiceGraphLifetime();
     oldGraph.retire();
@@ -4128,15 +4330,19 @@ var _TinyCloudNode = class _TinyCloudNode {
       this.sessionKeyJwk = signedInSession.jwk;
     }
     await this.initializeServices();
+    this.assertSessionEpoch(epoch, "Sign-in");
     const primarySession = this.currentTinyCloudSession();
     if (primarySession) {
       this.registerPrimarySessionGrant(primarySession);
     }
     const bootstrapped = await this.bootstrapAccountIfNeeded();
+    this.assertSessionEpoch(epoch, "Sign-in");
     await this.ensureRequestedEncryptionNetworks();
+    this.assertSessionEpoch(epoch, "Sign-in");
     if (!bootstrapped && this.config.manifest === void 0 && this.config.capabilityRequest === void 0) {
       await this.ensureOwnedSpaceHostedById(this.ownedSpaceId(SECRETS_SPACE2));
     }
+    this.assertSessionEpoch(epoch, "Sign-in");
     if (!bootstrapped) {
       this.scheduleAccountRegistrySync();
     }
@@ -4318,6 +4524,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Account bootstrap requires a TinyCloud host");
     }
     const auth = this.auth;
+    const graph = this._serviceGraph;
     const sessions = /* @__PURE__ */ new Map();
     const rawAbilitiesBySpace = /* @__PURE__ */ new Map();
     const warnings = [];
@@ -4326,6 +4533,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const canReusePrimaryBootstrapSession = primarySession?.spaceId === defaultSpaceId && auth.capabilityRequest === BOOTSTRAP_SESSION_REQUESTS.default;
     for (const step of steps) {
       if (step.kind !== "session") continue;
+      graph.assertActive();
       if (step.space === "default" && canReusePrimaryBootstrapSession && primarySession) {
         sessions.set(step.space, primarySession);
         continue;
@@ -4353,6 +4561,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     for (const step of steps) {
       if (step.kind !== "host") continue;
+      graph.assertActive();
       const hosted = await auth.hostOwnedSpaceResult(step.spaceId, "bootstrap-host");
       if (!hosted.success) {
         throw Object.assign(
@@ -4364,11 +4573,16 @@ var _TinyCloudNode = class _TinyCloudNode {
     await new Promise((resolve) => setTimeout(resolve, 100));
     for (const step of steps) {
       if (step.kind !== "activate") continue;
+      graph.assertActive();
       const session = sessions.get(step.space);
       if (!session) {
         throw new Error(`Missing bootstrap session for ${step.space}`);
       }
-      const activated = await activateSessionWithHost2(host, session.delegationHeader);
+      const activated = await activateSessionWithHost2(host, session.delegationHeader, graph.signal).catch((error) => {
+        graph.assertActive();
+        throw error;
+      });
+      graph.assertActive();
       if (!activated.success || activated.skipped?.includes(step.spaceId)) {
         throw Object.assign(
           new Error(
@@ -4384,6 +4598,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       );
     }
     for (const step of steps) {
+      graph.assertActive();
       if (step.kind === "account-index-schema") {
         const ensured = await this.account.index.ensure();
         if (!ensured.ok) {
@@ -5159,6 +5374,9 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @param sessionData - The stored delegation data from the browser flow
    */
   async restoreSession(sessionData) {
+    const epoch = this.sessionEpoch;
+    const attempt = ++this.latestSessionAttempt;
+    await this.signOutInFlight;
     await this.wasmBindings.ensureInitialized?.();
     let restoredJwk;
     try {
@@ -5348,6 +5566,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     });
     this.pendingAccountRegistrySync?.controller.abort();
     await this.accountRegistryTail;
+    this.assertSessionEpoch(epoch, "Session restore");
     const oldGraph = this._serviceGraph;
     const oldCore = this.tc;
     this.sessionManager = stagedManager;
@@ -5393,6 +5612,12 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.replicationDelegateSession = compactReplicationSession;
     this.replicationScopeError = replicationScopeError;
     if (this.replicationRuntime) await (await this.replicationRuntime).unbind();
+    if (epoch !== this.sessionEpoch) {
+      oldGraph.retire();
+      oldCore?.retireServices?.();
+      if (attempt === this.latestSessionAttempt) await this.endSession();
+      this.assertSessionEpoch(epoch, "Session restore");
+    }
     oldGraph.retire();
     if (replicationScopeError) {
       stagedGraph.serviceContext.emit("replication.state", {
@@ -5403,6 +5628,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     await this.bindReplicationRuntime(stagedGraph.serviceContext, serviceSession, stagedGraph.kv, replicationPrincipal);
     oldCore?.retireServices?.();
+    if (epoch !== this.sessionEpoch) {
+      if (attempt === this.latestSessionAttempt) await this.endSession();
+      this.assertSessionEpoch(epoch, "Session restore");
+    }
   }
   stagePrimarySessionState(session, verificationMethod, host, sessionExpiry, recap) {
     if (!session?.siwe) return { cache: void 0, grants: [] };
@@ -7261,6 +7490,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * matching service calls and downstream `delegateTo()` calls can use it.
    */
   async useRuntimeDelegation(delegation) {
+    const graph = this._serviceGraph;
     const session = this.currentTinyCloudSession();
     if (!session) {
       throw new SessionExpiredError(/* @__PURE__ */ new Date(0));
@@ -7279,9 +7509,11 @@ var _TinyCloudNode = class _TinyCloudNode {
     try {
       activateResult = await activateSessionWithHost2(
         targetHost,
-        delegation.delegationHeader
+        delegation.delegationHeader,
+        graph.signal
       );
     } catch (cause) {
+      graph.assertActive();
       throw Object.assign(
         new Error("The TinyCloud host could not be reached to activate the delegation."),
         { code: "ACTIVATION_TRANSPORT_FAILED", cause }
@@ -7301,6 +7533,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: activateResult }
       );
     }
+    graph.assertActive();
     this.runtimePermissionGrants = this.runtimePermissionGrants.filter(
       (grant) => grant.delegation.cid !== delegation.cid
     );
@@ -7317,6 +7550,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!Array.isArray(permissions) || permissions.length === 0) {
       throw new Error("grantRuntimePermissions requires a non-empty permissions array");
     }
+    const graph = this._serviceGraph;
     const session = this.currentTinyCloudSession();
     if (!session) {
       throw new SessionExpiredError(/* @__PURE__ */ new Date(0));
@@ -7397,14 +7631,19 @@ var _TinyCloudNode = class _TinyCloudNode {
         }
       })();
       const signature = await this.signer.signMessage(prepared.siwe);
+      graph.assertActive();
       const delegatedSession = this.wasmBindings.completeSessionSetup({
         ...prepared,
         signature
       });
       const activateResult = await activateSessionWithHost2(
         this.config.host,
-        delegatedSession.delegationHeader
-      );
+        delegatedSession.delegationHeader,
+        graph.signal
+      ).catch((error) => {
+        graph.assertActive();
+        throw error;
+      });
       if (!activateResult.success) {
         if (rawForDelegation.some((entry) => this.isRawRevocationPermissionEntry(entry)) && activateResult.status === 401 && /Cannot find parent delegation/i.test(activateResult.error ?? "")) {
           throw Object.assign(
@@ -7425,6 +7664,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         expiresAt,
         { siwe: prepared.siwe, signature }
       );
+      graph.assertActive();
       this.runtimePermissionGrants.push({
         session: {
           delegationHeader: delegatedSession.delegationHeader,
@@ -8888,6 +9128,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * @returns A DelegatedAccess instance for performing operations
    */
   async useDelegation(delegation) {
+    const graph = this._serviceGraph;
     const delegationHeader = delegation.delegationHeader;
     const targetHost = delegation.host ?? this.config.host;
     if (this.isSessionOnly) {
@@ -8929,7 +9170,8 @@ var _TinyCloudNode = class _TinyCloudNode {
         targetHost,
         this.wasmBindings.invoke,
         this.wasmBindings.invokeAny,
-        this.config.telemetry
+        this.config.telemetry,
+        graph
       );
     }
     const mySession = this.auth?.tinyCloudSession;
@@ -8953,14 +9195,19 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...Object.keys(rawAbilities).length > 0 ? { rawAbilities } : {}
     });
     const signature = await this.signer.signMessage(prepared.siwe);
+    graph.assertActive();
     const invokerSession = this.wasmBindings.completeSessionSetup({
       ...prepared,
       signature
     });
     const activateResult = await activateSessionWithHost2(
       targetHost,
-      invokerSession.delegationHeader
-    );
+      invokerSession.delegationHeader,
+      graph.signal
+    ).catch((error) => {
+      graph.assertActive();
+      throw error;
+    });
     if (!activateResult.success) {
       throw Object.assign(
         new Error(`Failed to activate delegated session: ${describeHostFailure2(activateResult)}`),
@@ -8979,6 +9226,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       siwe: prepared.siwe,
       signature
     };
+    graph.assertActive();
     this.trackReceivedDelegation(delegation, jwk);
     this.installRuntimeGrantFromServiceSession(
       delegation,
@@ -8997,7 +9245,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       targetHost,
       this.wasmBindings.invoke,
       this.wasmBindings.invokeAny,
-      this.config.telemetry
+      this.config.telemetry,
+      graph
     );
   }
   /**