@tinycloud/node-sdk 3.7.0-beta.2 → 3.7.0-beta.4

package/dist/encryption-keys.cjs

@@ -0,0 +1,74 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/encryption-keys.ts
+var encryption_keys_exports = {};
+__export(encryption_keys_exports, {
+  NamedKeyClient: () => import_named_keys2.NamedKeyClient,
+  NamedKeyError: () => import_named_keys2.NamedKeyError,
+  buildKeyAdminFacts: () => import_named_keys2.buildKeyAdminFacts,
+  buildKeyDescribeFacts: () => import_named_keys2.buildKeyDescribeFacts,
+  createNamedKeyClient: () => createNamedKeyClient
+});
+module.exports = __toCommonJS(encryption_keys_exports);
+var import_named_keys = require("@tinycloud/sdk-services/encryption/named-keys");
+var import_named_keys2 = require("@tinycloud/sdk-services/encryption/named-keys");
+function createNamedKeyClient(node, options = {}) {
+  const internals = node;
+  for (const hook of ["signRawNetworkAuthorization", "createEncryptionCrypto"]) {
+    if (typeof internals[hook] !== "function") {
+      throw new import_named_keys.NamedKeyError(
+        "NODE_HOOK_MISSING",
+        `TinyCloudNode.${hook} is not available; named keys cannot sign invocations`
+      );
+    }
+  }
+  const signer = internals;
+  const host = node.hosts[0];
+  if (host === void 0) throw new Error("TinyCloud node host has not been resolved");
+  const config = {
+    host,
+    crypto: signer.createEncryptionCrypto(),
+    fetch: options.fetch ?? globalThis.fetch.bind(globalThis),
+    defaultNetworkId: () => options.networkId ?? node.getDefaultEncryptionNetworkId(),
+    signInvocation: (input) => signer.signRawNetworkAuthorization({
+      targetNode: input.targetNode,
+      networkId: input.resource,
+      action: input.action,
+      facts: input.facts
+    }),
+    decryptRoot: (envelope) => {
+      const delegationCid = node.session?.delegationCid;
+      if (delegationCid === void 0) {
+        return Promise.reject(new Error("Not signed in. Call signIn() first."));
+      }
+      return node.encryption.decryptEnvelope(envelope, { proofs: [delegationCid] });
+    }
+  };
+  return new import_named_keys.NamedKeyClient(config);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  NamedKeyClient,
+  NamedKeyError,
+  buildKeyAdminFacts,
+  buildKeyDescribeFacts,
+  createNamedKeyClient
+});
+//# sourceMappingURL=encryption-keys.cjs.map

package/dist/encryption-keys.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/encryption-keys.ts"],"sourcesContent":["/**\n * Named encryption keys for a signed-in {@link TinyCloudNode}.\n *\n * Lives on its own subpath (`@tinycloud/node-sdk/encryption-keys`) so the\n * default root bundle does not carry it. Everything is dark unless the node's\n * `/info` `features` lists `encryption-named-keys-v1`; see the client in\n * `@tinycloud/sdk-services/encryption/named-keys` for the rules.\n *\n * The client signs through the node's existing raw-resource invocation path\n * (the same one network admin and decrypt use) and reuses its encryption\n * crypto, so both are reached through a narrow structural view of the node.\n */\n\nimport {\n  NamedKeyClient,\n  NamedKeyError,\n  type NamedKeyClientConfig,\n} from \"@tinycloud/sdk-services/encryption/named-keys\";\nimport type { EncryptionCrypto } from \"@tinycloud/sdk-services\";\nimport type { TinyCloudNode } from \"./TinyCloudNode\";\n\nexport {\n  NamedKeyClient,\n  NamedKeyError,\n  buildKeyAdminFacts,\n  buildKeyDescribeFacts,\n  type DecryptManyResult,\n  type KeyCallOptions,\n  type KeyDescriptor,\n  type KeyEncryptOptions,\n  type NamedKeyEnvelope,\n  type NamedKeyErrorCode,\n  type PublicKeyDescriptor,\n} from \"@tinycloud/sdk-services/encryption/named-keys\";\n\ninterface NodeSigningInternals {\n  signRawNetworkAuthorization(input: {\n    targetNode: string;\n    networkId: string;\n    action: string;\n    facts: object;\n  }): Promise<{ authorization: string; invocationCid: string }>;\n  createEncryptionCrypto(): EncryptionCrypto;\n}\n\nexport interface CreateNamedKeyClientOptions {\n  /** Network used when a call does not name one. Defaults to the node's default network. */\n  networkId?: string;\n  /** Override `fetch` (tests). */\n  fetch?: typeof fetch;\n}\n\n/**\n * Build a named-key client bound to a signed-in node.\n *\n * `signInvocation` passes the EXACT key URN as the invocation's single\n * resource (the signer's `networkId` argument is the capability `with`); the\n * real network id travels in the facts.\n */\nexport function createNamedKeyClient(\n  node: TinyCloudNode,\n  options: CreateNamedKeyClientOptions = {},\n): NamedKeyClient {\n  const internals = node as unknown as Partial<NodeSigningInternals>;\n  for (const hook of [\"signRawNetworkAuthorization\", \"createEncryptionCrypto\"] as const) {\n    if (typeof internals[hook] !== \"function\") {\n      throw new NamedKeyError(\n        \"NODE_HOOK_MISSING\",\n        `TinyCloudNode.${hook} is not available; named keys cannot sign invocations`,\n      );\n    }\n  }\n  const signer = internals as NodeSigningInternals;\n  const host = node.hosts[0];\n  if (host === undefined) throw new Error(\"TinyCloud node host has not been resolved\");\n  const config: NamedKeyClientConfig = {\n    host,\n    crypto: signer.createEncryptionCrypto(),\n    fetch: options.fetch ?? globalThis.fetch.bind(globalThis),\n    defaultNetworkId: () => options.networkId ?? node.getDefaultEncryptionNetworkId(),\n    signInvocation: (input) =>\n      signer.signRawNetworkAuthorization({\n        targetNode: input.targetNode,\n        networkId: input.resource,\n        action: input.action,\n        facts: input.facts,\n      }),\n    decryptRoot: (envelope) => {\n      const delegationCid = node.session?.delegationCid;\n      if (delegationCid === undefined) {\n        return Promise.reject(new Error(\"Not signed in. Call signIn() first.\"));\n      }\n      return node.encryption.decryptEnvelope(envelope, { proofs: [delegationCid] });\n    },\n  };\n  return new NamedKeyClient(config);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaA,wBAIO;AAIP,IAAAA,qBAYO;AA0BA,SAAS,qBACd,MACA,UAAuC,CAAC,GACxB;AAChB,QAAM,YAAY;AAClB,aAAW,QAAQ,CAAC,+BAA+B,wBAAwB,GAAY;AACrF,QAAI,OAAO,UAAU,IAAI,MAAM,YAAY;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,iBAAiB,IAAI;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS;AACf,QAAM,OAAO,KAAK,MAAM,CAAC;AACzB,MAAI,SAAS,OAAW,OAAM,IAAI,MAAM,2CAA2C;AACnF,QAAM,SAA+B;AAAA,IACnC;AAAA,IACA,QAAQ,OAAO,uBAAuB;AAAA,IACtC,OAAO,QAAQ,SAAS,WAAW,MAAM,KAAK,UAAU;AAAA,IACxD,kBAAkB,MAAM,QAAQ,aAAa,KAAK,8BAA8B;AAAA,IAChF,gBAAgB,CAAC,UACf,OAAO,4BAA4B;AAAA,MACjC,YAAY,MAAM;AAAA,MAClB,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM;AAAA,MACd,OAAO,MAAM;AAAA,IACf,CAAC;AAAA,IACH,aAAa,CAAC,aAAa;AACzB,YAAM,gBAAgB,KAAK,SAAS;AACpC,UAAI,kBAAkB,QAAW;AAC/B,eAAO,QAAQ,OAAO,IAAI,MAAM,qCAAqC,CAAC;AAAA,MACxE;AACA,aAAO,KAAK,WAAW,gBAAgB,UAAU,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,SAAO,IAAI,iCAAe,MAAM;AAClC;","names":["import_named_keys"]}

package/dist/encryption-keys.d.cts

@@ -0,0 +1,38 @@
+import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
+export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
+import { T as TinyCloudNode } from './TinyCloudNode-DD7qjyLU.cjs';
+import '@tinycloud/sdk-core';
+import '@tinycloud/sdk-services/kv/replication';
+import '@tinycloud/sdk-services';
+import 'events';
+import './delegation-0LKZkmP2.cjs';
+
+/**
+ * Named encryption keys for a signed-in {@link TinyCloudNode}.
+ *
+ * Lives on its own subpath (`@tinycloud/node-sdk/encryption-keys`) so the
+ * default root bundle does not carry it. Everything is dark unless the node's
+ * `/info` `features` lists `encryption-named-keys-v1`; see the client in
+ * `@tinycloud/sdk-services/encryption/named-keys` for the rules.
+ *
+ * The client signs through the node's existing raw-resource invocation path
+ * (the same one network admin and decrypt use) and reuses its encryption
+ * crypto, so both are reached through a narrow structural view of the node.
+ */
+
+interface CreateNamedKeyClientOptions {
+    /** Network used when a call does not name one. Defaults to the node's default network. */
+    networkId?: string;
+    /** Override `fetch` (tests). */
+    fetch?: typeof fetch;
+}
+/**
+ * Build a named-key client bound to a signed-in node.
+ *
+ * `signInvocation` passes the EXACT key URN as the invocation's single
+ * resource (the signer's `networkId` argument is the capability `with`); the
+ * real network id travels in the facts.
+ */
+declare function createNamedKeyClient(node: TinyCloudNode, options?: CreateNamedKeyClientOptions): NamedKeyClient;
+
+export { type CreateNamedKeyClientOptions, createNamedKeyClient };

package/dist/encryption-keys.d.ts

@@ -0,0 +1,38 @@
+import { NamedKeyClient } from '@tinycloud/sdk-services/encryption/named-keys';
+export { DecryptManyResult, KeyCallOptions, KeyDescriptor, KeyEncryptOptions, NamedKeyClient, NamedKeyEnvelope, NamedKeyError, NamedKeyErrorCode, PublicKeyDescriptor, buildKeyAdminFacts, buildKeyDescribeFacts } from '@tinycloud/sdk-services/encryption/named-keys';
+import { T as TinyCloudNode } from './TinyCloudNode-Cw00iiSP.js';
+import '@tinycloud/sdk-core';
+import '@tinycloud/sdk-services/kv/replication';
+import '@tinycloud/sdk-services';
+import 'events';
+import './delegation-0LKZkmP2.js';
+
+/**
+ * Named encryption keys for a signed-in {@link TinyCloudNode}.
+ *
+ * Lives on its own subpath (`@tinycloud/node-sdk/encryption-keys`) so the
+ * default root bundle does not carry it. Everything is dark unless the node's
+ * `/info` `features` lists `encryption-named-keys-v1`; see the client in
+ * `@tinycloud/sdk-services/encryption/named-keys` for the rules.
+ *
+ * The client signs through the node's existing raw-resource invocation path
+ * (the same one network admin and decrypt use) and reuses its encryption
+ * crypto, so both are reached through a narrow structural view of the node.
+ */
+
+interface CreateNamedKeyClientOptions {
+    /** Network used when a call does not name one. Defaults to the node's default network. */
+    networkId?: string;
+    /** Override `fetch` (tests). */
+    fetch?: typeof fetch;
+}
+/**
+ * Build a named-key client bound to a signed-in node.
+ *
+ * `signInvocation` passes the EXACT key URN as the invocation's single
+ * resource (the signer's `networkId` argument is the capability `with`); the
+ * real network id travels in the facts.
+ */
+declare function createNamedKeyClient(node: TinyCloudNode, options?: CreateNamedKeyClientOptions): NamedKeyClient;
+
+export { type CreateNamedKeyClientOptions, createNamedKeyClient };

package/dist/encryption-keys.js

@@ -0,0 +1,53 @@
+// src/encryption-keys.ts
+import {
+  NamedKeyClient,
+  NamedKeyError
+} from "@tinycloud/sdk-services/encryption/named-keys";
+import {
+  NamedKeyClient as NamedKeyClient2,
+  NamedKeyError as NamedKeyError2,
+  buildKeyAdminFacts,
+  buildKeyDescribeFacts
+} from "@tinycloud/sdk-services/encryption/named-keys";
+function createNamedKeyClient(node, options = {}) {
+  const internals = node;
+  for (const hook of ["signRawNetworkAuthorization", "createEncryptionCrypto"]) {
+    if (typeof internals[hook] !== "function") {
+      throw new NamedKeyError(
+        "NODE_HOOK_MISSING",
+        `TinyCloudNode.${hook} is not available; named keys cannot sign invocations`
+      );
+    }
+  }
+  const signer = internals;
+  const host = node.hosts[0];
+  if (host === void 0) throw new Error("TinyCloud node host has not been resolved");
+  const config = {
+    host,
+    crypto: signer.createEncryptionCrypto(),
+    fetch: options.fetch ?? globalThis.fetch.bind(globalThis),
+    defaultNetworkId: () => options.networkId ?? node.getDefaultEncryptionNetworkId(),
+    signInvocation: (input) => signer.signRawNetworkAuthorization({
+      targetNode: input.targetNode,
+      networkId: input.resource,
+      action: input.action,
+      facts: input.facts
+    }),
+    decryptRoot: (envelope) => {
+      const delegationCid = node.session?.delegationCid;
+      if (delegationCid === void 0) {
+        return Promise.reject(new Error("Not signed in. Call signIn() first."));
+      }
+      return node.encryption.decryptEnvelope(envelope, { proofs: [delegationCid] });
+    }
+  };
+  return new NamedKeyClient(config);
+}
+export {
+  NamedKeyClient2 as NamedKeyClient,
+  NamedKeyError2 as NamedKeyError,
+  buildKeyAdminFacts,
+  buildKeyDescribeFacts,
+  createNamedKeyClient
+};
+//# sourceMappingURL=encryption-keys.js.map

package/dist/encryption-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/encryption-keys.ts"],"sourcesContent":["/**\n * Named encryption keys for a signed-in {@link TinyCloudNode}.\n *\n * Lives on its own subpath (`@tinycloud/node-sdk/encryption-keys`) so the\n * default root bundle does not carry it. Everything is dark unless the node's\n * `/info` `features` lists `encryption-named-keys-v1`; see the client in\n * `@tinycloud/sdk-services/encryption/named-keys` for the rules.\n *\n * The client signs through the node's existing raw-resource invocation path\n * (the same one network admin and decrypt use) and reuses its encryption\n * crypto, so both are reached through a narrow structural view of the node.\n */\n\nimport {\n  NamedKeyClient,\n  NamedKeyError,\n  type NamedKeyClientConfig,\n} from \"@tinycloud/sdk-services/encryption/named-keys\";\nimport type { EncryptionCrypto } from \"@tinycloud/sdk-services\";\nimport type { TinyCloudNode } from \"./TinyCloudNode\";\n\nexport {\n  NamedKeyClient,\n  NamedKeyError,\n  buildKeyAdminFacts,\n  buildKeyDescribeFacts,\n  type DecryptManyResult,\n  type KeyCallOptions,\n  type KeyDescriptor,\n  type KeyEncryptOptions,\n  type NamedKeyEnvelope,\n  type NamedKeyErrorCode,\n  type PublicKeyDescriptor,\n} from \"@tinycloud/sdk-services/encryption/named-keys\";\n\ninterface NodeSigningInternals {\n  signRawNetworkAuthorization(input: {\n    targetNode: string;\n    networkId: string;\n    action: string;\n    facts: object;\n  }): Promise<{ authorization: string; invocationCid: string }>;\n  createEncryptionCrypto(): EncryptionCrypto;\n}\n\nexport interface CreateNamedKeyClientOptions {\n  /** Network used when a call does not name one. Defaults to the node's default network. */\n  networkId?: string;\n  /** Override `fetch` (tests). */\n  fetch?: typeof fetch;\n}\n\n/**\n * Build a named-key client bound to a signed-in node.\n *\n * `signInvocation` passes the EXACT key URN as the invocation's single\n * resource (the signer's `networkId` argument is the capability `with`); the\n * real network id travels in the facts.\n */\nexport function createNamedKeyClient(\n  node: TinyCloudNode,\n  options: CreateNamedKeyClientOptions = {},\n): NamedKeyClient {\n  const internals = node as unknown as Partial<NodeSigningInternals>;\n  for (const hook of [\"signRawNetworkAuthorization\", \"createEncryptionCrypto\"] as const) {\n    if (typeof internals[hook] !== \"function\") {\n      throw new NamedKeyError(\n        \"NODE_HOOK_MISSING\",\n        `TinyCloudNode.${hook} is not available; named keys cannot sign invocations`,\n      );\n    }\n  }\n  const signer = internals as NodeSigningInternals;\n  const host = node.hosts[0];\n  if (host === undefined) throw new Error(\"TinyCloud node host has not been resolved\");\n  const config: NamedKeyClientConfig = {\n    host,\n    crypto: signer.createEncryptionCrypto(),\n    fetch: options.fetch ?? globalThis.fetch.bind(globalThis),\n    defaultNetworkId: () => options.networkId ?? node.getDefaultEncryptionNetworkId(),\n    signInvocation: (input) =>\n      signer.signRawNetworkAuthorization({\n        targetNode: input.targetNode,\n        networkId: input.resource,\n        action: input.action,\n        facts: input.facts,\n      }),\n    decryptRoot: (envelope) => {\n      const delegationCid = node.session?.delegationCid;\n      if (delegationCid === undefined) {\n        return Promise.reject(new Error(\"Not signed in. Call signIn() first.\"));\n      }\n      return node.encryption.decryptEnvelope(envelope, { proofs: [delegationCid] });\n    },\n  };\n  return new NamedKeyClient(config);\n}\n"],"mappings":";AAaA;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAIP;AAAA,EACE,kBAAAA;AAAA,EACA,iBAAAC;AAAA,EACA;AAAA,EACA;AAAA,OAQK;AA0BA,SAAS,qBACd,MACA,UAAuC,CAAC,GACxB;AAChB,QAAM,YAAY;AAClB,aAAW,QAAQ,CAAC,+BAA+B,wBAAwB,GAAY;AACrF,QAAI,OAAO,UAAU,IAAI,MAAM,YAAY;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,iBAAiB,IAAI;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS;AACf,QAAM,OAAO,KAAK,MAAM,CAAC;AACzB,MAAI,SAAS,OAAW,OAAM,IAAI,MAAM,2CAA2C;AACnF,QAAM,SAA+B;AAAA,IACnC;AAAA,IACA,QAAQ,OAAO,uBAAuB;AAAA,IACtC,OAAO,QAAQ,SAAS,WAAW,MAAM,KAAK,UAAU;AAAA,IACxD,kBAAkB,MAAM,QAAQ,aAAa,KAAK,8BAA8B;AAAA,IAChF,gBAAgB,CAAC,UACf,OAAO,4BAA4B;AAAA,MACjC,YAAY,MAAM;AAAA,MAClB,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM;AAAA,MACd,OAAO,MAAM;AAAA,IACf,CAAC;AAAA,IACH,aAAa,CAAC,aAAa;AACzB,YAAM,gBAAgB,KAAK,SAAS;AACpC,UAAI,kBAAkB,QAAW;AAC/B,eAAO,QAAQ,OAAO,IAAI,MAAM,qCAAqC,CAAC;AAAA,MACxE;AACA,aAAO,KAAK,WAAW,gBAAgB,UAAU,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,SAAO,IAAI,eAAe,MAAM;AAClC;","names":["NamedKeyClient","NamedKeyError"]}

package/dist/index.cjs

@@ -21681,7 +21681,10 @@ var _TinyCloudNode = class _TinyCloudNode {
      * and remembers whose storage is full so sign-in and listing skip their
      * best-effort writes. Lives as long as this instance, across sign-ins.
      */
-    this.storageFull = new import_sdk_core10.StorageFullMonitor((spaceId) => spaceOwnerKey(spaceId) ?? spaceId);
+    this.storageFull = new import_sdk_core10.StorageFullMonitor(
+      (spaceId) => spaceOwnerKey(spaceId) ?? spaceId,
+      () => this.currentStorageOwner()
+    );
     this.invokeWithRuntimePermissions = (session, service, path, action, facts) => {
       const operation = {
         spaceId: session.spaceId,
@@ -21837,12 +21840,15 @@ var _TinyCloudNode = class _TinyCloudNode {
     return this._bootstrapStatus;
   }
   /**
-   * Subscribe to `storage.full`. It fires once, on the first write any
-   * service had rejected because the owner's TinyCloud storage is full
+   * Subscribe to `storage.full`. It fires on the first write any service had
+   * rejected because the owner's TinyCloud storage is full
    * (`STORAGE_QUOTA_EXCEEDED` or `STORAGE_LIMIT_REACHED`), so an app can show
-   * one read-only banner. Reads keep working. It fires again only after
-   * `storage.status()` has reported space again for every owner whose write
-   * was rejected. Returns the unsubscribe function.
+   * one read-only banner. Reads keep working. For the signed-in account's own
+   * storage it fires once per episode: the episode ends only when a write to
+   * that storage succeeds, or on sign-out. A `storage.status()` read does not
+   * end it. A rejection on another owner's delegated space fires once per
+   * owner, until that owner's `storage.status()` reports space again. Returns
+   * the unsubscribe function.
    */
   on(event, handler) {
     if (event !== "storage.full") {
@@ -21850,6 +21856,21 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return this.storageFull.on(handler);
   }
+  /**
+   * Storage episode state for the UI mount. @internal
+   *
+   * `current()` returns the own-storage rejection that started the episode, or
+   * undefined. `subscribe` calls its listener when the own episode starts or
+   * ends; read `current()` inside it. `subscribeDelegated` calls its listener
+   * once per delegated owner found full, until that owner is cleared.
+   */
+  get storageEpisode() {
+    return {
+      current: () => this.storageFull.rejection,
+      subscribe: (listener) => this.storageFull.onEpisode(listener),
+      subscribeDelegated: (listener) => this.storageFull.onDelegated(listener)
+    };
+  }
   /** Owner key of the account the current session's own storage belongs to. */
   currentStorageOwner() {
     return spaceOwnerKey(this._serviceContext?.session?.spaceId ?? this.currentTinyCloudSession()?.spaceId);