@tinycloud/node-sdk 3.12.0-beta.2 → 3.12.0-beta.4

package/dist/index.js

@@ -17443,7 +17443,7 @@ import {
   canonicalizeRecapCaveats as canonicalizeRecapCaveats3,
   isCapabilitySubset as isCapabilitySubset3,
   principalDid,
-  parseSpaceUri as parseSpaceUri2
+  parseSpaceUri as parseSpaceUri3
 } from "@tinycloud/sdk-core";
 import { parseUcanGrant as replicaParseUcanGrant } from "@tinycloud/replica";
 function reportReplicaDenial(result, reason, onEvent, context) {
@@ -17625,7 +17625,7 @@ function replicationScopeFromSignedSession(input) {
   for (const resource of Object.keys(grant.att)) {
     const space = resource.match(/^(?:tinycloud:\/\/)?(.+?)\/kv(?:\/|$)/)?.[1];
     if (space !== input.persistedSpace) continue;
-    const owner = parseSpaceUri2(space);
+    const owner = parseSpaceUri3(space);
     if (owner?.owner && owner.address && owner.chainId) return { space, principal: owner.owner };
   }
   return void 0;
@@ -18151,6 +18151,7 @@ import {
   decodeBase64Url,
   principalDidEquals
 } from "@tinycloud/sdk-core";
+import { routingFailure } from "@tinycloud/sdk-services";
 var RUNTIME_DELEGATION_REJECTIONS = [
   "host_mismatch",
   "expired",
@@ -18192,7 +18193,8 @@ var SERVICE_BY_SHORT_NAME = {
   kv: "tinycloud.kv",
   sql: "tinycloud.sql",
   duckdb: "tinycloud.duckdb",
-  hooks: "tinycloud.hooks"
+  hooks: "tinycloud.hooks",
+  capabilities: "tinycloud.capabilities"
 };
 function authorizationWithoutBearer(authorization) {
   return authorization.replace(/^Bearer /i, "");
@@ -18323,8 +18325,8 @@ function signedAuthorityFromCompactUcan(authorization) {
       ));
       continue;
     }
-    const match = /^(?:tinycloud:\/\/([^/]+)|(tinycloud:[^/]+))\/(kv|sql|duckdb|hooks)(?:\/|$)(.*)$/.exec(resource);
-    if (!match) {
+    const match = /^(?:tinycloud:\/\/([^/]+)|(tinycloud:[^/]+))\/([^/]+)(?:\/|$)(.*)$/.exec(resource);
+    if (!match || !Object.prototype.hasOwnProperty.call(SERVICE_BY_SHORT_NAME, match[3])) {
       throw new Error(
         `Validated runtime delegation has an unsupported signed resource '${resource}'.`
       );
@@ -18469,13 +18471,8 @@ function resourcesMatch(actual, expected) {
   return JSON.stringify(actual.map(comparable)) === JSON.stringify(expected.map(comparable));
 }
 async function activateValidatedRuntimeDelegation(node, delegation, options) {
-  const host = normalizedHost(options.host);
-  if (delegation.host !== void 0 && normalizedHost(delegation.host) !== host) {
-    reject(
-      "host_mismatch",
-      `Runtime delegation host '${delegation.host}' does not match expected host '${options.host}'.`
-    );
-  }
+  let host = normalizedHost(options.host);
+  const differentHost = delegation.host !== void 0 && normalizedHost(delegation.host) !== host;
   if (!(delegation.expiry instanceof Date) || Number.isNaN(delegation.expiry.getTime())) {
     reject("authority_invalid", "Runtime delegation has an invalid expiry.");
   }
@@ -18519,6 +18516,13 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
   if (options.authorize !== void 0 && !options.authorize(signed2.permissions)) {
     throw new Error("Runtime delegation is not authorized for this runtime.");
   }
+  if (differentHost) {
+    const registeredHost = await node.resolveRegisteredDelegationHost?.(signed2.permissions, host);
+    if (registeredHost === void 0) {
+      reject("host_mismatch", `Runtime delegation host '${delegation.host}' does not match expected host '${options.host}'.`);
+    }
+    host = normalizedHost(registeredHost);
+  }
   const previouslyInstalled = node.getRuntimePermissionDelegations().find((candidate) => candidate.cid === cid);
   if (previouslyInstalled !== void 0 && previouslyInstalled.delegationHeader.Authorization !== authorization) {
     reject(
@@ -18562,6 +18566,7 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
       await node.useRuntimeDelegation(installedCandidate);
     }
   } catch (error) {
+    if (routingFailure(error)) throw error;
     reject(
       activationRejectionReason(error),
       error instanceof Error ? error.message : String(error)
@@ -18580,6 +18585,7 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
       "Runtime delegation activation installed authority that differs from the validated authority."
     );
   }
+  node.refreshRegistryForCapabilities?.(signed2.permissions);
   return {
     cid,
     delegation: installed,
@@ -18689,6 +18695,15 @@ function deserializeDelegation(data) {
 }
 
 // src/TinyCloudNode.ts
+import {
+  createResourceRoutingFetch,
+  verifyResourceDestination as verifyResourceDestination2,
+  NodeNotRespondingError as NodeNotRespondingError2,
+  NodeIdentityMismatchError,
+  PartialNodeWriteError as PartialNodeWriteError2,
+  ResourceNotRoutedError,
+  routingFailure as routingFailure3
+} from "@tinycloud/sdk-services";
 import { generateNonce, SiweMessage as SiweMessage3 } from "siwe";
 import { didKeyFromEd25519PublicKey } from "@tinycloud/share-envelope";
 
@@ -18762,9 +18777,15 @@ import {
   verifyDidKeyEd25519Signature,
   canonicalizeAddress as canonicalizeAddress2,
   pkhDid as pkhDid2,
-  resolveTinyCloudHosts as resolveTinyCloudHosts2,
-  resolveFailClosedTinyCloudHosts as resolveFailClosedTinyCloudHosts2,
+  parseSpaceUri as parseSpaceUri2,
+  resolveRegistryResource as resolveRegistryResource2,
+  warnRegistryDefaultNode as warnRegistryDefaultNode2,
+  NodeNotFoundError as NodeNotFoundError2,
+  exactHttpOrigin as exactHttpOrigin2,
   createInMemoryRegistrySequenceStore as createInMemoryRegistrySequenceStore2,
+  createInMemoryRegistryCacheStore as createInMemoryRegistryCacheStore2,
+  refreshOwnerRegistry,
+  registryOwnerKeyV2,
   publishLocationRecord,
   principalDidEquals as principalDidEquals3,
   parseNetworkId as parseNetworkId2,
@@ -18811,11 +18832,16 @@ import {
   principalDidEquals as principalDidEquals2,
   resourceCapabilitiesToAbilitiesMap,
   resourceCapabilitiesToSpaceAbilitiesMap,
-  resolveTinyCloudHosts,
-  resolveFailClosedTinyCloudHosts,
-  lookupOwnerRegistryVerdict,
+  resolveRegistryResource,
+  warnRegistryDefaultNode,
+  parseSpaceUri,
+  NodeNotFoundError,
+  RegistryUnavailableError,
+  discoverLocalTinyCloudNode,
+  exactHttpOrigin,
   assertSpaceCreationAllowed,
   createInMemoryRegistrySequenceStore,
+  createInMemoryRegistryCacheStore,
   registryOwnerSubjectV1,
   EXPIRY,
   assertExpiryWithinTechnicalLimit,
@@ -18838,7 +18864,13 @@ import {
   ENCRYPTION
 } from "@tinycloud/sdk-core";
 import { parseEncryptionResource } from "@tinycloud/sdk-services/encryption/resource";
-import { parseNetworkId } from "@tinycloud/sdk-services";
+import {
+  parseNetworkId,
+  verifyResourceDestination,
+  NodeNotRespondingError,
+  PartialNodeWriteError,
+  routingFailure as routingFailure2
+} from "@tinycloud/sdk-services";
 
 // src/authorization/appKeyHostBinding.ts
 var DOMAIN_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -19116,11 +19148,12 @@ var NodeUserAuthorization = class {
     this.tinycloudHosts = config.tinycloudHosts;
     this.tinycloudRegistryUrl = config.tinycloudRegistryUrl;
     this.tinycloudFallbackHosts = config.tinycloudFallbackHosts;
-    this.registryPolicy = config.registryPolicy;
     this.newUserHost = config.newUserHost;
     this.registryChainId = config.registryChainId;
     this.registrySequenceStore = config.registrySequenceStore ?? createInMemoryRegistrySequenceStore();
+    this.registryCacheStore = config.registryCacheStore ?? createInMemoryRegistryCacheStore();
     this.onNodeNotFound = config.onNodeNotFound;
+    this.onRegistryFallback = config.onRegistryFallback;
     this.autoDiscoverLocalNode = config.autoDiscoverLocalNode;
     this.localNodeUrl = config.localNodeUrl;
     this.localLinkName = config.localLinkName;
@@ -19188,13 +19221,8 @@ var NodeUserAuthorization = class {
    * undefined for missing SIWEs and the SDK then treats the session as
    * expired-at-epoch-zero.
    *
-   * @param hosts - The TinyCloud hosts this session was created against,
-   *   as persisted in {@link PersistedSessionData.tinycloudHosts}. When
-   *   present (and non-empty) they are adopted directly so the restored
-   *   session resolves to the same node as the original sign-in without
-   *   re-running registry/fallback resolution. When absent (old session)
-   *   hosts are resolved lazily on the first host-needing call via
-   *   {@link ensureTinyCloudHosts}.
+   * @param hosts - Persisted host hints for genuine no-entry onboarding.
+   *   Current signed registry membership always takes precedence.
    */
   setRestoredTinyCloudSession(session, hosts) {
     const address = canonicalizeAddress(session.address);
@@ -19256,89 +19284,84 @@ var NodeUserAuthorization = class {
       signature: session.signature
     };
   }
-  /**
-   * Ensure `tinycloudHosts` are resolved before a host-needing call.
-   *
-   * Fresh sign-in resolves hosts up front; a restored session may not have
-   * (old persisted sessions predate {@link PersistedSessionData.tinycloudHosts}).
-   * This guard makes a restored session resolve the node exactly like a fresh
-   * sign-in — persisted hosts are preferred (already set by
-   * {@link setRestoredTinyCloudSession}), otherwise the registry/fallback
-   * resolution runs lazily here. Idempotent: {@link resolveTinyCloudHostsForSignIn}
-   * early-returns when hosts are already set.
-   *
-   * Throws if hosts are unset and the restored session has no address/chainId
-   * to resolve from — a real failure that must surface, not be masked.
-   */
+  /** Refresh the primary space's registry destinations, including after restore. */
   async ensureTinyCloudHosts() {
-    if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
-      return;
-    }
     if (this._address === void 0 || this._chainId === void 0) {
-      throw new Error(
-        "Cannot resolve TinyCloud hosts: no address/chainId available. Sign in or restore a session first."
-      );
+      throw new Error("Cannot resolve TinyCloud hosts: sign in or restore a session first.");
     }
-    await this.resolveTinyCloudHostsForSignIn(this._address, this._chainId);
+    await this.resolveTinyCloudHostsForSignIn(this._address, this._chainId, this._tinyCloudSession?.spaceId);
   }
-  async resolveTinyCloudHostsForSignIn(address, chainId) {
-    if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
-      return;
-    }
-    if (this.registryPolicy === "fail-closed") {
-      const resolved2 = await resolveFailClosedTinyCloudHosts(address, {
-        registryUrl: this.tinycloudRegistryUrl,
-        registryChainId: this.registryChainId,
-        newUserHost: this.newUserHost,
-        sequenceStore: this.registrySequenceStore,
-        onNodeNotFound: this.onNodeNotFound,
-        autoDiscoverLocalNode: this.autoDiscoverLocalNode,
-        localNodeUrl: this.localNodeUrl,
-        localLinkName: this.localLinkName,
-        expectedNodeDid: this.expectedNodeDid,
-        localNodeIdentityStore: this.localNodeIdentityStore
-      });
-      this.tinycloudHosts = resolved2.hosts;
-      this.registryVerdict = resolved2.verdict;
-      return;
-    }
-    const subject = pkhDid(address, chainId);
-    const resolved = await resolveTinyCloudHosts(subject, {
-      registryUrl: this.tinycloudRegistryUrl,
-      fallbackHosts: this.tinycloudFallbackHosts,
-      autoDiscoverLocalNode: this.autoDiscoverLocalNode,
-      localNodeUrl: this.localNodeUrl,
-      localLinkName: this.localLinkName,
-      expectedNodeDid: this.expectedNodeDid,
-      localNodeIdentityStore: this.localNodeIdentityStore
-    });
-    this.tinycloudHosts = resolved.hosts;
+  async resolveTinyCloudHostsForSignIn(address, chainId, restoredSpaceId) {
+    const spaceId = restoredSpaceId ?? this.resolveSignInCapabilities(address, chainId).spaceId;
+    const destinations = await this.resolveResourceDestinations(spaceId, "read");
+    for (const destination of destinations) await verifyResourceDestination(destination, globalThis.fetch.bind(globalThis));
+    this.tinycloudHosts = destinations.map(({ url }) => url);
   }
-  /**
-   * Space-creation guard (TC-1443). Under `registryPolicy: "fail-closed"`,
-   * throws unless the owner's registry verdict allows a space on the primary
-   * host: `NodeRegistryEntryExistsError` when the owner's record does not
-   * list it, `RegistryUnavailableError` when the registry gives no
-   * verdict. Reuses this session's sign-in verdict unless it was
-   * `unavailable`, else looks it up now (explicit-host apps). Under the
-   * default policy it returns at once and performs no lookup.
-   */
-  async assertMayCreateSpace() {
-    if (this.registryPolicy !== "fail-closed") return;
-    if (this._address === void 0) {
-      throw new Error("Must be signed in to create a space");
+  /** Current full-resource registry routing; saved hosts are only no-entry hints. */
+  async resolveResourceDestinations(resource, access, noEntryHosts = this.tinycloudHosts ?? []) {
+    const owner = resource.startsWith("urn:tinycloud:encryption:") ? parseNetworkId(resource.split("/")[0]).ownerDid : parseSpaceUri(resource)?.owner ?? (() => {
+      const key2 = /^tinycloud:key:(z[^:]+):[^/]+$/.exec(resource);
+      return key2 ? `did:key:${key2[1]}` : void 0;
+    })();
+    if (!owner) throw new Error(`Cannot determine registry owner for ${resource}`);
+    const subject = owner.startsWith("did:pkh:") ? registryOwnerSubjectV1(owner.slice(owner.lastIndexOf(":") + 1), this.registryChainId) : owner;
+    for (let attempt = 1; ; attempt++) {
+      try {
+        const resolved = await resolveRegistryResource(subject, resource, access, {
+          registryUrl: this.tinycloudRegistryUrl,
+          registryChainId: this.registryChainId,
+          sequenceStore: this.registrySequenceStore,
+          cacheStore: this.registryCacheStore,
+          onRegistryFallback: this.onRegistryFallback
+        });
+        this.registryVerdict = resolved.verdict;
+        if (resolved.verdict.status === "unregistered") {
+          if (noEntryHosts.length === 0 && (this.autoDiscoverLocalNode ?? true)) {
+            const local = await discoverLocalTinyCloudNode({
+              localNodeUrl: this.localNodeUrl,
+              localLinkName: this.localLinkName,
+              expectedNodeDid: this.expectedNodeDid,
+              identityStore: this.localNodeIdentityStore
+            });
+            if (local) {
+              warnRegistryDefaultNode(resolved.verdict, this.registryCacheStore, this.onRegistryFallback);
+              return [{ url: local.url }];
+            }
+          }
+          const host = noEntryHosts[0] ?? this.newUserHost ?? (this.tinycloudFallbackHosts === void 0 ? "https://node.tinycloud.xyz" : this.tinycloudFallbackHosts?.[0]);
+          if (!host || this.newUserHost === null && noEntryHosts.length === 0) throw new NodeNotFoundError(subject, resolved.verdict);
+          const url = exactHttpOrigin(host, "new-user host");
+          warnRegistryDefaultNode(resolved.verdict, this.registryCacheStore, this.onRegistryFallback);
+          return [{ url }];
+        }
+        const destinations = resolved.hosts.flatMap((host) => host.urls.map((url) => ({ url, nodeDid: host.nodeDid })));
+        return destinations;
+      } catch (error) {
+        if (!(error instanceof NodeNotFoundError) && !(error instanceof RegistryUnavailableError)) throw error;
+        if (!this.onNodeNotFound) throw error;
+        const decision = await this.onNodeNotFound({ error, attempt });
+        if (decision.action === "retry") continue;
+        if (decision.action === "use-host" && error.verdict?.status === "unregistered") {
+          const url = exactHttpOrigin(decision.host, "new-user host");
+          warnRegistryDefaultNode(error.verdict, this.registryCacheStore, this.onRegistryFallback);
+          return [{ url }];
+        }
+        throw error;
+      }
     }
-    await this.ensureTinyCloudHosts();
-    const subject = registryOwnerSubjectV1(this._address, this.registryChainId);
-    let verdict = this.registryVerdict;
-    if (verdict?.subject !== subject || verdict.status === "unavailable") {
-      verdict = await lookupOwnerRegistryVerdict(subject, {
-        registryUrl: this.tinycloudRegistryUrl,
-        sequenceStore: this.registrySequenceStore
-      });
-      this.registryVerdict = verdict;
+  }
+  get registryRecordPresent() {
+    return this.registryVerdict?.status === "registered";
+  }
+  /** Refresh membership before hosting; a saved no-entry verdict never authorizes a later creation. */
+  async assertMayCreateSpace(spaceId = this._tinyCloudSession?.spaceId, host = this.primaryTinyCloudHost) {
+    if (!spaceId) throw new Error("Must be signed in to create a space");
+    const destinations = await this.resolveResourceDestinations(spaceId, "host");
+    if (!destinations.some((destination) => destination.url === host)) {
+      const subject = parseSpaceUri(spaceId)?.owner;
+      if (!subject || !this.registryVerdict) throw new Error("Cannot resolve space owner");
+      assertSpaceCreationAllowed(this.registryVerdict, host, spaceId);
     }
-    assertSpaceCreationAllowed(verdict, this.primaryTinyCloudHost);
   }
   requireTinyCloudHosts() {
     if (!this.tinycloudHosts || this.tinycloudHosts.length === 0) {
@@ -19784,6 +19807,31 @@ var NodeUserAuthorization = class {
     checkCurrent();
     const host = context?.host ?? this.primaryTinyCloudHost;
     const spaceId = context?.spaceId ?? (typeof targetSpaceId === "string" ? targetSpaceId : this._tinyCloudSession.spaceId);
+    const destinations = await this.resolveResourceDestinations(spaceId, "host");
+    if (this.registryVerdict?.status === "registered") {
+      const results = [];
+      for (const destination of destinations) {
+        checkCurrent();
+        try {
+          await verifyResourceDestination(destination, globalThis.fetch.bind(globalThis));
+          const result = await activateSessionWithHost(destination.url, this._tinyCloudSession.delegationHeader, signal);
+          results.push(result.skipped?.includes(spaceId) ? { ...result, success: false, status: 403, error: "The session does not activate the requested space" } : result);
+        } catch (error) {
+          if (routingFailure2(error) || signal?.aborted) throw error;
+          throw new NodeNotRespondingError([destination.url], error);
+        }
+      }
+      const failed = results.flatMap((result, index) => result.success ? [] : [{ url: destinations[index].url, status: result.status }]);
+      if (failed.length) {
+        if (destinations.length === 1) return results[0];
+        throw new PartialNodeWriteError(destinations.filter((_, index) => results[index].success).map(({ url }) => url), failed);
+      }
+      return {
+        ...results[0],
+        activated: [...new Set(results.flatMap((result) => result.activated ?? []))],
+        skipped: [...new Set(results.flatMap((result) => result.skipped ?? []))]
+      };
+    }
     const peerId = await fetchPeerId(host, spaceId, signal);
     checkCurrent();
     const siwe = this.wasm.generateHostSIWEMessage(
@@ -19854,13 +19902,45 @@ var NodeUserAuthorization = class {
     if (!this._tinyCloudSession) {
       throw new Error("Must be signed in to ensure space exists");
     }
-    await this.ensureTinyCloudHosts();
-    const host = this.primaryTinyCloudHost;
     const primarySpaceId = this._tinyCloudSession.spaceId;
-    const result = await activateSessionWithHost(
-      host,
-      this._tinyCloudSession.delegationHeader
-    );
+    const primary = await this.resolveResourceDestinations(primarySpaceId, "read");
+    this.tinycloudHosts = primary.map(({ url }) => url);
+    const targets = new Map(primary.map((destination) => [destination.url, destination]));
+    if (this.registryVerdict?.status === "registered" && this.registryVerdict.record) {
+      const record = this.registryVerdict.record;
+      const resources = Object.keys(extractRecapAttenuations(this._tinyCloudSession.siwe ?? ""));
+      for (const space of record.spaces) {
+        const registeredSpace = parseSpaceUri(space.space);
+        if (!resources.some((resource) => {
+          const fullSpace = resource.split("/")[0];
+          const requestedSpace = parseSpaceUri(fullSpace);
+          return fullSpace === space.space || registeredSpace !== null && requestedSpace !== null && registeredSpace.owner === requestedSpace.owner && registeredSpace.name === requestedSpace.name;
+        })) continue;
+        for (const membership of space.nodes) {
+          const node = record.nodes.find((candidate) => candidate.did === membership.did);
+          targets.set(node.url, { url: node.url, nodeDid: node.did });
+        }
+      }
+      if (record.encryptionNode && resources.some((resource) => resource.startsWith("urn:tinycloud:encryption:"))) {
+        const node = record.nodes.find((candidate) => candidate.did === record.encryptionNode);
+        targets.set(node.url, { url: node.url, nodeDid: node.did });
+      }
+    }
+    let result;
+    for (const destination of targets.values()) {
+      await verifyResourceDestination(destination, globalThis.fetch.bind(globalThis));
+      let activated;
+      try {
+        activated = await activateSessionWithHost(destination.url, this._tinyCloudSession.delegationHeader);
+      } catch (error) {
+        throw new NodeNotRespondingError([destination.url], error);
+      }
+      if (!activated.success && activated.status !== 404) {
+        throw Object.assign(new Error(`Failed to activate session: ${describeHostFailure(activated)}`), { cause: activated });
+      }
+      if (destination.url === primary[0].url) result = activated;
+    }
+    if (!result) throw new Error("Primary space activation did not return a result");
     this.recordActivationSkippedSpaces(result, primarySpaceId);
     if (!result.success && result.status !== 404) {
       throw Object.assign(
@@ -19908,7 +19988,7 @@ var NodeUserAuthorization = class {
   /** {@link assertMayCreateSpace}, reporting a refusal to the creation handler before rethrowing it. */
   async guardSpaceCreation(handler, context) {
     try {
-      await this.assertMayCreateSpace();
+      await this.assertMayCreateSpace(context.spaceId, context.host);
     } catch (error) {
       const failure = error instanceof Error ? error : new Error(String(error));
       handler.onSpaceCreationFailed?.(context, failure);
@@ -21830,6 +21910,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * ```
    */
   constructor(config = {}) {
+    this.registryRefreshOwners = /* @__PURE__ */ new Set();
     this.signer = null;
     this.auth = null;
     this.consumedOpenKeyPendings = /* @__PURE__ */ new WeakSet();
@@ -21993,8 +22074,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.config = {
       ...config,
       host: config.host ?? DEFAULT_HOST,
+      registryPolicy: "fail-closed",
       // One store for every authorization this client creates.
-      registrySequenceStore: config.registrySequenceStore ?? createInMemoryRegistrySequenceStore2()
+      registrySequenceStore: config.registrySequenceStore ?? createInMemoryRegistrySequenceStore2(),
+      registryCacheStore: config.registryCacheStore ?? createInMemoryRegistryCacheStore2()
     };
     if (this.config.replication?.enabled) {
       const runtime = getNodeReplicationLoaders().runtime().then(({ ReplicationRuntime: ReplicationRuntime2 }) => {
@@ -22298,7 +22381,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       // A session saved but never registered on this node is refused: it registers once.
       activate: (signal) => {
         assertCurrent();
-        return activateSessionWithHost2(host, session.delegationHeader, AbortSignal.any([signal, graph.signal]));
+        const activationSignal = AbortSignal.any([signal, graph.signal]);
+        if (primary && primary.delegationCid === session.delegationCid) {
+          return this.activateSignedSession(primary, primary.siwe, host, activationSignal);
+        }
+        return this.activateResourceSession(session.delegationHeader, [spaceId], host, activationSignal);
       }
     });
     assertCurrent();
@@ -22434,14 +22521,38 @@ var _TinyCloudNode = class _TinyCloudNode {
   get requests() {
     return this._requestLog === void 0 ? void 0 : readOnlyRequestLog(this._requestLog);
   }
-  createServiceGraphLifetime() {
+  throwRegistryRefusal(status, text) {
+    if (status !== 403 && status !== 503 || !text.startsWith("registry_unavailable:") && !text.startsWith("registry_hosting_denied:")) return;
+    const code = status === 503 ? "registry_unavailable" : "node_registry_entry_exists";
+    throw Object.assign(new Error(status === 503 ? "The location registry is unavailable for this resource." : "The registry does not authorize this node for the requested resource."), { code, meta: { status } });
+  }
+  createServiceGraphLifetime(session) {
+    const routedFetch = createResourceRoutingFetch(
+      async (url, init2) => {
+        try {
+          const response = await globalThis.fetch(url, init2);
+          if (response.status === 403 || response.status === 503) {
+            this.throwRegistryRefusal(response.status, await response.clone().text());
+          }
+          return response;
+        } catch (error) {
+          if (routingFailure3(error)) throw error;
+          if (new URL(url).pathname.startsWith("/encryption/") && !init2?.signal?.aborted) {
+            throw new NodeNotRespondingError2([new URL(url).origin], error);
+          }
+          throw error;
+        }
+      },
+      {
+        resolveResource: (resource, access) => this.routingDestinations(resource, access),
+        bindAudience: (authorization, nodeDid) => this.bindRoutedAudience(authorization, nodeDid, session),
+        verifyDestination: (target) => verifyResourceDestination2(target, globalThis.fetch.bind(globalThis))
+      }
+    );
     return new ServiceGraphLifetime(
       this.invokeWithRuntimePermissions,
       this.invokeAnyWithRuntimePermissions,
-      // Resolve fetch at request time. This keeps the graph-owned lifetime
-      // signal while preserving the SDK's existing injectable global fetch
-      // behavior (including adapters that install it after construction).
-      (url, init2) => globalThis.fetch(url, init2),
+      routedFetch,
       (context) => {
         this.storageFull.observe(context);
         if (this._requestLog) observeReplicaReads(context, this._requestLog);
@@ -22449,6 +22560,75 @@ var _TinyCloudNode = class _TinyCloudNode {
       this._requestLog
     );
   }
+  async routingDestinations(resource, access, noEntryHosts) {
+    const session = this.currentTinyCloudSession();
+    if (session) this.refreshRegistryOwner(pkhDid2(session.address, session.chainId));
+    if (this.auth) return this.auth.resolveResourceDestinations(resource, access, noEntryHosts);
+    const owner = resource.startsWith("urn:tinycloud:encryption:") ? parseNetworkId2(resource.split("/")[0]).ownerDid : parseSpaceUri2(resource)?.owner ?? (() => {
+      const key2 = /^tinycloud:key:(z[^:]+):[^/]+$/.exec(resource);
+      return key2 ? `did:key:${key2[1]}` : void 0;
+    })();
+    if (!owner) throw new Error(`Cannot determine registry owner for ${resource}`);
+    const subject = owner.startsWith("did:pkh:") ? pkhDid2(owner.slice(owner.lastIndexOf(":") + 1), this.config.registryChainId ?? 1) : owner;
+    const resolved = await resolveRegistryResource2(subject, resource, access, {
+      registryUrl: this.config.tinycloudRegistryUrl,
+      registryChainId: this.config.registryChainId,
+      sequenceStore: this.config.registrySequenceStore,
+      cacheStore: this.config.registryCacheStore,
+      onRegistryFallback: this.config.onRegistryFallback
+    });
+    if (resolved.verdict.status === "unregistered") {
+      const hint = noEntryHosts === void 0 ? this.explicitHost ?? this.config.host : noEntryHosts[0];
+      const host = hint ?? this.config.newUserHost ?? (this.config.tinycloudFallbackHosts === void 0 ? DEFAULT_HOST : this.config.tinycloudFallbackHosts?.[0]);
+      if (!host || !hint && this.config.newUserHost === null) throw new NodeNotFoundError2(subject, resolved.verdict);
+      const url = exactHttpOrigin2(host, "new-user host");
+      warnRegistryDefaultNode2(resolved.verdict, this.config.registryCacheStore, this.config.onRegistryFallback);
+      return [{ url }];
+    }
+    const destinations = resolved.hosts.flatMap((host) => host.urls.map((url) => ({ url, nodeDid: host.nodeDid })));
+    return destinations;
+  }
+  /** Transport hints cannot override verified full-resource registry routing. */
+  async resolveRegisteredDelegationHost(permissions, noEntryHost) {
+    const resources = /* @__PURE__ */ new Map();
+    let hasData = false;
+    for (const permission of permissions) {
+      const encryption = this.isEncryptionNetworkOperation(this.invocationServiceName(permission.service), permission.path, permission.space);
+      const resource = encryption ? permission.path.split("/")[0] : permission.space;
+      if (!resource) throw new ResourceNotRoutedError("delegation");
+      resources.set(resource, encryption ? "encryption" : "host");
+      hasData || (hasData = !encryption);
+    }
+    let dataHost;
+    let encryptionHost;
+    let unserved;
+    for (const [resource, access] of resources) {
+      try {
+        const destinations = await this.routingDestinations(resource, access, [noEntryHost]);
+        if (destinations.some(({ nodeDid }) => nodeDid === void 0)) return void 0;
+        if (access === "host") dataHost ?? (dataHost = destinations[0]?.url);
+        else encryptionHost ?? (encryptionHost = destinations[0]?.url);
+      } catch (error) {
+        if (!(error instanceof NodeNotFoundError2) || error.verdict.status !== "registered") throw error;
+        unserved ?? (unserved = error);
+      }
+    }
+    const host = hasData ? dataHost : encryptionHost;
+    if (!host) throw unserved ?? new ResourceNotRoutedError("delegation");
+    return host;
+  }
+  async bindRoutedAudience(authorization, nodeDid, stagedSession) {
+    const payload = JSON.parse(new TextDecoder().decode(base64UrlDecode(authorization.split(".")[1])));
+    const issuer = typeof payload === "object" && payload !== null && "iss" in payload ? payload.iss : void 0;
+    const session = [
+      stagedSession,
+      this._serviceContext?.session,
+      this.auth?.tinyCloudSession,
+      ...this.runtimePermissionGrants.map((grant) => grant.session)
+    ].find((candidate) => candidate?.verificationMethod === issuer);
+    if (!session) throw new Error("Invocation signing session is not active");
+    return rewriteInvocationAudience(authorization, nodeDid, session.jwk);
+  }
   syncResolvedHostFromAuth() {
     const host = this.auth?.hosts[0];
     if (host) {
@@ -22562,6 +22742,29 @@ var _TinyCloudNode = class _TinyCloudNode {
     const session = this.currentTinyCloudSession();
     return session?.siwe ? this.projectSignedRecapCapabilities(session.siwe) : [];
   }
+  /** Start one background refresh for each owner derived from verified authority. */
+  refreshRegistryForCapabilities(permissions) {
+    for (const permission of permissions) {
+      try {
+        const owner = permission.service === "tinycloud.encryption" && permission.path.startsWith("urn:tinycloud:encryption:") ? parseNetworkId2(permission.path.split("/")[0]).ownerDid : permission.space ? this.ownerDidFromSpaceId(permission.space) : void 0;
+        if (owner) this.refreshRegistryOwner(owner);
+      } catch {
+      }
+    }
+  }
+  refreshRegistryOwner(owner) {
+    if (this.config.tinycloudRegistryUrl === null) return;
+    const subject = owner.startsWith("did:pkh:") ? pkhDid2(owner.slice(owner.lastIndexOf(":") + 1), this.config.registryChainId ?? 1) : owner;
+    const key2 = registryOwnerKeyV2(subject);
+    if (this.registryRefreshOwners.has(key2)) return;
+    this.registryRefreshOwners.add(key2);
+    void refreshOwnerRegistry(subject, {
+      registryUrl: this.config.tinycloudRegistryUrl,
+      registryChainId: this.config.registryChainId,
+      sequenceStore: this.config.registrySequenceStore,
+      cacheStore: this.config.registryCacheStore
+    }).catch(() => void 0);
+  }
   /** Normalize signed capabilities without collapsing nested encryption into raw authority. */
   projectSignedRecapCapabilities(siwe) {
     const projected = this.parseRecapWithCaveats(siwe).map((entry) => {
@@ -22993,6 +23196,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     const primarySession = this.currentTinyCloudSession();
     if (primarySession) {
       this.registerPrimarySessionGrant(primarySession);
+      this.refreshRegistryOwner(pkhDid2(primarySession.address, primarySession.chainId));
+      this.refreshRegistryForCapabilities(this.getVerifiedSessionCapabilities());
       if (this.auth?.spaceHosting === "unknown") {
         await this.checkSpaceHosting();
         this.assertSessionEpoch(epoch, "Sign-in");
@@ -23215,8 +23420,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     const primarySession = auth.tinyCloudSession;
     const defaultSpaceId = this.ownedSpaceId("default");
     const canReusePrimaryBootstrapSession = primarySession?.spaceId === defaultSpaceId && auth.capabilityRequest === BOOTSTRAP_SESSION_REQUESTS.default;
-    if (steps.some((step) => step.kind === "host")) {
-      await this.assertMayCreateSpace();
+    for (const step of steps) {
+      if (step.kind === "host") await this.assertMayCreateSpace(step.spaceId);
     }
     for (const step of steps) {
       if (step.kind !== "session") continue;
@@ -23265,10 +23470,20 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (!session) {
         throw new Error(`Missing bootstrap session for ${step.space}`);
       }
-      const activated = await activateSessionWithHost2(host, session.delegationHeader, graph.signal).catch((error) => {
-        graph.assertActive();
-        throw error;
-      });
+      const destinations = await this.routingDestinations(step.spaceId, "host");
+      let activated;
+      for (const destination of destinations) {
+        try {
+          await verifyResourceDestination2(destination, globalThis.fetch.bind(globalThis));
+          const result = await activateSessionWithHost2(destination.url, session.delegationHeader, graph.signal);
+          if (!result.success) throw Object.assign(new Error("Bootstrap activation failed"), { cause: result });
+          activated = result;
+        } catch (error) {
+          graph.assertActive();
+          throw error;
+        }
+      }
+      if (!activated) throw new Error("Bootstrap space has no destination");
       graph.assertActive();
       if (!activated.success || activated.skipped?.includes(step.spaceId)) {
         throw Object.assign(
@@ -23851,6 +24066,13 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session) {
       throw new Error("Owned space hosting requires an active session");
     }
+    await this.assertMayCreateSpace(spaceId);
+    if (this.auth.registryRecordPresent) {
+      const hosted = await this.hostOwnedSpaceOnce(spaceId, signal);
+      if (!hosted.success) throw Object.assign(new Error(`Failed to activate listed space ${spaceId}: ${describeHostFailure2(hosted)}`), { cause: hosted });
+      if (this.auth.tinyCloudSession === session) this.confirmedHostedSpaceIds.add(spaceId);
+      return;
+    }
     if (this.confirmedHostedSpaceIds.has(spaceId) || this.hostedOwnedSpaceIds.has(spaceId)) {
       return;
     }
@@ -23869,7 +24091,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: activation }
       );
     }
-    await this.assertMayCreateSpace();
+    await this.assertMayCreateSpace(spaceId);
     if (signal?.aborted) throw signal.reason;
     const created = await this.hostOwnedSpaceOnce(spaceId, signal);
     if (!created.success) {
@@ -23930,17 +24152,19 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: hosted }
       );
     }
-    const activation = await activateSessionWithHost2(
-      host,
-      session.delegationHeader
-    );
-    if (!activation.success || activation.skipped?.includes(spaceId)) {
-      throw Object.assign(
-        new Error(
-          `Failed to activate session for owned space ${spaceId}: ${activation.success ? "space was skipped" : describeHostFailure2(activation)}`
-        ),
-        { cause: activation }
+    if (!this.auth.registryRecordPresent) {
+      const activation = await activateSessionWithHost2(
+        host,
+        session.delegationHeader
       );
+      if (!activation.success || activation.skipped?.includes(spaceId)) {
+        throw Object.assign(
+          new Error(
+            `Failed to activate session for owned space ${spaceId}: ${activation.success ? "space was skipped" : describeHostFailure2(activation)}`
+          ),
+          { cause: activation }
+        );
+      }
     }
     if (this.auth?.tinyCloudSession === session) this.hostedOwnedSpaceIds.add(spaceId);
     try {
@@ -23984,11 +24208,9 @@ var _TinyCloudNode = class _TinyCloudNode {
    * session's recap doesn't cover it and the registry has no record; the host
    * SIWE is idempotent server-side. Must be called after {@link signIn}.
    *
-   * Under `registryPolicy: "fail-closed"`, hosting is refused with
-   * `NodeRegistryEntryExistsError` when the owner's registry record does not
-   * list the host, or `RegistryUnavailableError` when the registry gives no
-   * verdict. {@link hostOwnedSpace} itself is an explicit action and is not
-   * guarded.
+   * Current signed per-space membership is checked before both automatic and
+   * explicit hosting. Registered replicas use the session grant; no-entry
+   * onboarding retains the host-SIWE flow.
    *
    * @param name - The owned space name (e.g. `"secrets"`).
    * @returns The hosted owned-space URI.
@@ -23998,27 +24220,20 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Not signed in. Call signIn() first.");
     }
     const spaceId = this.ownedSpaceId(name);
+    await this.assertMayCreateSpace(spaceId);
     if (this.hostedOwnedSpaceIds.has(spaceId) || await this.isOwnedSpaceRegistered(spaceId)) {
       return spaceId;
     }
-    await this.assertMayCreateSpace();
     return this.hostOwnedSpace(name);
   }
-  /**
-   * Space-creation guard (TC-1443) for the automatic hosting paths: sign-in's
-   * owned spaces, account bootstrap, {@link ensureOwnedSpaceHosted} and
-   * {@link ensurePublicSpace}. Only `registryPolicy: "fail-closed"` consults
-   * the registry ({@link NodeUserAuthorization.assertMayCreateSpace}); the
-   * default policy performs no lookup.
-   */
-  async assertMayCreateSpace() {
-    if (this.config.registryPolicy !== "fail-closed") return;
-    await this.auth.assertMayCreateSpace();
+  /** Refresh full-space membership before any automatic or explicit hosting. */
+  async assertMayCreateSpace(spaceId) {
+    await this.routingDestinations(spaceId, "host");
   }
   /** Registry-policy settings shared by every authorization this client creates. */
   registryPolicyConfig() {
-    const { registryPolicy, newUserHost, registryChainId, registrySequenceStore, onNodeNotFound } = this.config;
-    return { registryPolicy, newUserHost, registryChainId, registrySequenceStore, onNodeNotFound };
+    const { registryPolicy, newUserHost, registryChainId, registrySequenceStore, registryCacheStore, onNodeNotFound, onRegistryFallback } = this.config;
+    return { registryPolicy, newUserHost, registryChainId, registrySequenceStore, registryCacheStore, onNodeNotFound, onRegistryFallback };
   }
   /**
    * Submit the host delegation for an owned space, sharing one in-flight
@@ -24224,12 +24439,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       stagedSessionExpiry = signedExpiry ?? persistedPolicyExpiry ?? persistedExpiry(void 0);
     }
-    const resolvedHost = await this.resolveRestoredHost(
-      sessionData.tinycloudHosts,
-      restoredAddress,
-      sessionData.chainId
-    );
-    const stagedHost = resolvedHost ?? this.config.host;
+    const restoreHints = this.explicitHost ? [this.explicitHost] : sessionData.tinycloudHosts ?? [];
+    const stagedHost = exactHttpOrigin2(restoreHints[0] ?? this.config.host, "restored host hint");
     let restoredNodeFeatures;
     let replicaProtocolMismatch = false;
     if (this.config.replication?.enabled) {
@@ -24346,7 +24557,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.sessionManager = stagedManager;
     this.sessionKeyId = stagedKeyId;
     this.sessionKeyJwk = stagedJwk;
-    if (resolvedHost) this.config.host = resolvedHost;
+    this.config.host = stagedHost;
     if (spaceOwnerKey(serviceSession.spaceId) !== this.currentStorageOwner()) {
       this.storageFull.clear();
       this._requestLog?.clear();
@@ -24413,6 +24624,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (attempt === this.latestSessionAttempt) await this.endSession();
       this.assertSessionEpoch(epoch, "Session restore");
     }
+    if (this.config.replication?.enabled) {
+      if (stagedAddress !== void 0) this.refreshRegistryOwner(pkhDid2(stagedAddress, stagedChainId));
+      this.refreshRegistryForCapabilities(this.getVerifiedSessionCapabilities());
+    }
   }
   stagePrimarySessionState(session, verificationMethod, host, sessionExpiry, recap) {
     if (!session?.siwe) return { cache: void 0, grants: [] };
@@ -24461,7 +24676,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
   }
   stageRestoredServiceGraph(input) {
-    const graph = this.createServiceGraphLifetime();
+    const graph = this.createServiceGraphLifetime(input.serviceSession);
     const core = this.auth ? new TinyCloud(this.auth, {
       invokeAny: graph.invokeAny,
       telemetry: this.config.telemetry,
@@ -24686,56 +24901,6 @@ var _TinyCloudNode = class _TinyCloudNode {
     spaceService.updateConfig({ sharingService });
     return { core, graph, serviceContext, kv, sql, duckdb, hooks, vault, encryption, capabilityRegistry, keyProvider, sharingService, delegationManager, spaceService };
   }
-  /**
-   * Resolve the host a restored session should target.
-   *
-   * Mirrors fresh sign-in host resolution but for the restore path:
-   * an explicit/pinned host always wins, then the hosts the session was
-   * persisted with, then a lazy registry/fallback resolution for sessions
-   * that predate the persisted `tinycloudHosts` field. Returns `undefined`
-   * only when there's nothing to resolve from (no explicit host, no
-   * persisted hosts, and no address/chainId) — in which case the existing
-   * `config.host` (default) is left in place.
-   *
-   * Resolution failures are surfaced, not swallowed: a genuinely broken
-   * registry lookup throws rather than silently falling back to a wrong host.
-   */
-  async resolveRestoredHost(persistedHosts, address, chainId) {
-    if (this.explicitHost) {
-      return this.explicitHost;
-    }
-    if (persistedHosts && persistedHosts.length > 0) {
-      return persistedHosts[0];
-    }
-    if (address === void 0 || chainId === void 0) {
-      return void 0;
-    }
-    if (this.config.registryPolicy === "fail-closed") {
-      const resolved2 = await resolveFailClosedTinyCloudHosts2(address, {
-        registryUrl: this.config.tinycloudRegistryUrl,
-        registryChainId: this.config.registryChainId,
-        newUserHost: this.config.newUserHost,
-        sequenceStore: this.config.registrySequenceStore,
-        onNodeNotFound: this.config.onNodeNotFound,
-        autoDiscoverLocalNode: this.config.autoDiscoverLocalNode,
-        localNodeUrl: this.config.localNodeUrl,
-        localLinkName: this.config.localLinkName,
-        expectedNodeDid: this.config.expectedNodeDid,
-        localNodeIdentityStore: this.config.localNodeIdentityStore
-      });
-      return resolved2.hosts[0];
-    }
-    const resolved = await resolveTinyCloudHosts2(pkhDid2(address, chainId), {
-      registryUrl: this.config.tinycloudRegistryUrl,
-      fallbackHosts: this.config.tinycloudFallbackHosts,
-      autoDiscoverLocalNode: this.config.autoDiscoverLocalNode,
-      localNodeUrl: this.config.localNodeUrl,
-      localLinkName: this.config.localLinkName,
-      expectedNodeDid: this.config.expectedNodeDid,
-      localNodeIdentityStore: this.config.localNodeIdentityStore
-    });
-    return resolved.hosts[0];
-  }
   /**
    * Resolve the currently-active TinyCloudSession, preferring the auth
    * layer's value (wallet mode) and falling back to the node-level
@@ -25210,10 +25375,10 @@ var _TinyCloudNode = class _TinyCloudNode {
    * second time. Only a value recorded for this exact host qualifies; older
    * nodes that omit `nodeId` fall through to the fetch.
    */
-  async fetchNodeId() {
-    const cached = this.auth?.nodeIdForHost(this.config.host);
+  async fetchNodeId(host = this.config.host) {
+    const cached = this.auth?.nodeIdForHost(host);
     if (cached) return cached;
-    const response = await fetch(`${this.config.host}/info`);
+    const response = await fetch(`${host}/info`);
     if (!response.ok) {
       throw await httpResponseError(response, "Failed to fetch node info");
     }
@@ -25261,10 +25426,24 @@ var _TinyCloudNode = class _TinyCloudNode {
       )
     };
   }
-  async fetchEncryptionNetworkAt(host, networkId, fetchFn) {
-    const response = await fetchFn(
-      `${host}/encryption/networks/${encodeURIComponent(networkId)}`
-    );
+  async encryptionDestination(networkId) {
+    const destination = (await this.routingDestinations(networkId, "encryption"))[0];
+    if (!destination) throw new Error("No encryption destination is registered");
+    await verifyResourceDestination2(destination, globalThis.fetch.bind(globalThis));
+    return { ...destination, nodeDid: destination.nodeDid ?? await this.fetchNodeId(destination.url) };
+  }
+  async fetchEncryptionNetworkAt(host, networkId, fetchFn, callerSignal) {
+    let response;
+    const timeout = AbortSignal.timeout(5e3);
+    try {
+      response = await fetchFn(`${host}/encryption/networks/${encodeURIComponent(networkId)}`, {
+        signal: callerSignal ? AbortSignal.any([callerSignal, timeout]) : timeout,
+        redirect: "error"
+      });
+    } catch (error) {
+      if (routingFailure3(error) || callerSignal?.aborted || !timeout.aborted && error instanceof Error && error.name === "AbortError") throw error;
+      throw new NodeNotRespondingError2([host], error);
+    }
     if (response.status === 404) return null;
     if (!response.ok) {
       throw await httpResponseError(response, `Failed to fetch encryption network ${networkId}`);
@@ -25274,18 +25453,18 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   createEncryptionService(binding) {
     const graph = binding?.graph ?? this._serviceGraph;
-    const host = binding?.host ?? this.config.host;
     const session = binding?.session ?? this.requireEncryptionSession();
     const did = binding?.did ?? this.did;
     const address = binding?.address ?? this._address;
     const chainId = binding?.chainId ?? this._chainId;
     const crypto3 = this.createEncryptionCrypto();
-    const descriptorCache = /* @__PURE__ */ new Map();
     const transport = {
-      postDecrypt: async ({ networkId, authorization, canonicalBody, signal }) => {
+      postDecrypt: async ({ targetNode, networkId, authorization, canonicalBody, signal }) => {
         graph.assertActive();
+        const destination = await this.encryptionDestination(networkId);
+        if (destination.nodeDid !== targetNode) throw new NodeIdentityMismatchError(destination.url, destination.nodeDid, targetNode);
         const response = await graph.fetch(
-          `${host}/encryption/networks/${encodeURIComponent(networkId)}/decrypt`,
+          `${destination.url}/encryption/networks/${encodeURIComponent(networkId)}/decrypt`,
           {
             method: "POST",
             headers: {
@@ -25313,6 +25492,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     };
     return new EncryptionService({
+      resolveTargetNode: async (networkId) => (await this.encryptionDestination(networkId)).nodeDid,
       crypto: crypto3,
       signer: {
         signDecryptInvocation: async (input) => {
@@ -25336,18 +25516,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       node: {
         fetchByNetworkId: async (networkId) => {
           graph.assertActive();
-          let pending = descriptorCache.get(networkId);
-          if (!pending) {
-            pending = this.fetchEncryptionNetworkAt(host, networkId, graph.fetch).then((descriptor2) => {
-              if (descriptor2 === null) descriptorCache.delete(networkId);
-              return descriptor2;
-            }).catch((error) => {
-              descriptorCache.delete(networkId);
-              throw error;
-            });
-            descriptorCache.set(networkId, pending);
-          }
-          const descriptor = await pending;
+          const destination = await this.encryptionDestination(networkId);
+          const descriptor = await this.fetchEncryptionNetworkAt(destination.url, networkId, graph.fetch, graph.signal);
           graph.assertActive();
           return descriptor;
         }
@@ -25355,13 +25525,15 @@ var _TinyCloudNode = class _TinyCloudNode {
       wellKnown: {
         fetchWellKnown: async (principal, discoveryKey) => {
           graph.assertActive();
+          const destination = await this.encryptionDestination(this.getDefaultEncryptionNetworkId());
+          if (this.auth?.registryRecordPresent) return null;
           if (!address || !didPrincipalMatches2(principal, did)) {
             return null;
           }
           const publicSpaceId = makePublicSpaceId(address, chainId);
           const encodedKey = discoveryKey.split("/").map(encodeURIComponent).join("/");
           const response = await graph.fetch(
-            `${host}/public/${encodeURIComponent(publicSpaceId)}/kv/${encodedKey}`,
+            `${destination.url}/public/${encodeURIComponent(publicSpaceId)}/kv/${encodedKey}`,
             { method: "GET" }
           );
           graph.assertActive();
@@ -25731,7 +25903,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const signature2 = await this.signer.signMessage(prepared.siwe);
     assertOwnerGraphActive();
     const delegationSession = this.wasmBindings.completeSessionSetup({ ...prepared, signature: signature2 });
-    const activation = await activateSessionWithHost2(host, delegationSession.delegationHeader);
+    const activation = await this.activateSignedSession(delegationSession, prepared.siwe, host);
     assertOwnerGraphActive();
     if (!activation.success) {
       throw Object.assign(
@@ -26050,15 +26222,16 @@ var _TinyCloudNode = class _TinyCloudNode {
   async getEncryptionNetwork(nameOrNetworkId = this.getDefaultEncryptionNetworkId()) {
     const networkId = nameOrNetworkId.startsWith("urn:tinycloud:encryption:") ? nameOrNetworkId : this.getDefaultEncryptionNetworkId(nameOrNetworkId);
     return this.fetchEncryptionNetworkAt(
-      this.config.host,
+      (await this.encryptionDestination(networkId)).url,
       networkId,
       globalThis.fetch.bind(globalThis)
     );
   }
   async createEncryptionNetwork(name = DEFAULT_ENCRYPTION_NETWORK_NAME) {
-    const targetNode = await this.fetchNodeId();
     const ownerDid = this.did;
     const networkId = this.getDefaultEncryptionNetworkId(name);
+    const destination = await this.encryptionDestination(networkId);
+    const targetNode = destination.nodeDid;
     const body = {
       name,
       ownerDid,
@@ -26081,7 +26254,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       action: NETWORK_CREATE_ACTION2,
       facts
     });
-    const response = await fetch(`${this.config.host}/encryption/networks`, {
+    const response = await this._serviceGraph.fetch(`${destination.url}/encryption/networks`, {
       method: "POST",
       headers: {
         Authorization: signed2.authorization,
@@ -26421,6 +26594,97 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return { recap: exactVerifiedRecap(verified), expiresAt };
   }
+  async activateResourceSession(delegationHeader, resources, hostHint, signal) {
+    const targets = /* @__PURE__ */ new Map();
+    const routedSpaces = [];
+    let unserved;
+    let requestedResource;
+    for (const resource of new Set(resources)) {
+      requestedResource ?? (requestedResource = resource);
+      signal?.throwIfAborted();
+      try {
+        const encryption = resource.startsWith("urn:tinycloud:encryption:");
+        const destinations = await this.routingDestinations(
+          resource,
+          encryption ? "encryption" : "host",
+          [hostHint ?? this.config.host]
+        );
+        if (!encryption && destinations.some(({ nodeDid }) => nodeDid !== void 0)) routedSpaces.push(resource);
+        for (const destination of destinations) {
+          let target = targets.get(destination.url);
+          if (!target) {
+            target = { destination, spaces: [] };
+            targets.set(destination.url, target);
+          }
+          if (!encryption && destination.nodeDid !== void 0) target.spaces.push(resource);
+        }
+      } catch (error) {
+        if (!(error instanceof NodeNotFoundError2)) throw error;
+        unserved ?? (unserved = error);
+      }
+    }
+    if (targets.size === 0) throw unserved ?? new ResourceNotRoutedError(requestedResource ?? "session grant");
+    const succeeded = [];
+    const accepted = [];
+    const failed = [];
+    let refusal;
+    for (const { destination: target, spaces } of targets.values()) {
+      signal?.throwIfAborted();
+      try {
+        await verifyResourceDestination2(target, globalThis.fetch.bind(globalThis));
+        const timeout = AbortSignal.timeout(5e3);
+        const result = await activateSessionWithHost2(
+          target.url,
+          delegationHeader,
+          signal ? AbortSignal.any([signal, timeout]) : timeout
+        );
+        this.throwRegistryRefusal(result.status, result.error ?? "");
+        if (result.success) {
+          const skipped = result.skipped?.find((space) => spaces.some((expected) => this.spaceIdsEqual(space, expected)));
+          if (skipped) {
+            failed.push({ url: target.url, status: result.status, cause: new ResourceNotRoutedError(skipped) });
+            continue;
+          }
+          succeeded.push(target.url);
+          accepted.push(result);
+        } else {
+          refusal = result;
+          failed.push({ url: target.url, status: result.status, cause: result });
+        }
+      } catch (error) {
+        if (signal?.aborted) throw error;
+        failed.push({ url: target.url, cause: routingFailure3(error) ? error : new NodeNotRespondingError2([target.url], error) });
+      }
+    }
+    if (failed.length > 0) {
+      if (targets.size > 1) throw new PartialNodeWriteError2(succeeded, failed);
+      if (refusal) return refusal;
+      throw failed[0].cause;
+    }
+    const activated = new Set(accepted.flatMap((result) => result.activated ?? []));
+    return {
+      ...accepted[0],
+      activated: [...activated],
+      skipped: [...new Set(accepted.flatMap((result) => result.skipped ?? []))].filter((space) => !activated.has(space) && !routedSpaces.some((expected) => this.spaceIdsEqual(space, expected)))
+    };
+  }
+  activateRoutedDelegation(delegation, signal) {
+    const resources = this.operationsFromDelegation(delegation).map(
+      (operation) => operation.resource?.startsWith("urn:tinycloud:encryption:") ? operation.resource.split("/")[0] : operation.spaceId ?? delegation.spaceId
+    );
+    return this.activateResourceSession(delegation.delegationHeader, resources, delegation.host, signal);
+  }
+  activateSignedSession(session, siwe, hostHint, signal) {
+    const resources = this.parseRecapWithCaveats(siwe).map(
+      (entry) => this.isEncryptionNetworkOperation(this.invocationServiceName(entry.service), entry.path, entry.space) ? entry.path.split("/")[0] : entry.space.startsWith("tinycloud:") ? entry.space : session.spaceId
+    );
+    return this.activateResourceSession(
+      session.delegationHeader,
+      resources.length > 0 ? resources : [session.spaceId],
+      hostHint,
+      signal
+    );
+  }
   /**
    * Install a portable runtime permission delegation into this SDK instance so
    * matching service calls and downstream `delegateTo()` calls can use it.
@@ -26440,16 +26704,12 @@ var _TinyCloudNode = class _TinyCloudNode {
         `Runtime delegation targets ${delegation.delegateDID} but this session key is ${session.verificationMethod}.`
       );
     }
-    const targetHost = delegation.host ?? this.config.host;
     let activateResult;
     try {
-      activateResult = await activateSessionWithHost2(
-        targetHost,
-        delegation.delegationHeader,
-        graph.signal
-      );
+      activateResult = await this.activateRoutedDelegation(delegation, graph.signal);
     } catch (cause) {
       graph.assertActive();
+      if (routingFailure3(cause)) throw cause;
       throw Object.assign(
         new Error("The TinyCloud host could not be reached to activate the delegation."),
         { code: "ACTIVATION_TRANSPORT_FAILED", cause }
@@ -26605,11 +26865,15 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...prepared,
         signature: signature2
       });
-      const activateResult = await activateSessionWithHost2(
-        this.config.host,
-        delegatedSession.delegationHeader,
-        graph.signal
-      ).catch((error) => {
+      const delegation = this.runtimeDelegationFromSession(
+        delegatedSession,
+        delegatedEntries,
+        spaceId,
+        captured,
+        expiresAt,
+        { siwe: prepared.siwe, signature: signature2 }
+      );
+      const activateResult = await this.activateRoutedDelegation(delegation, graph.signal).catch((error) => {
         graph.assertActive();
         throw error;
       });
@@ -26625,14 +26889,6 @@ var _TinyCloudNode = class _TinyCloudNode {
           { cause: activateResult }
         );
       }
-      const delegation = this.runtimeDelegationFromSession(
-        delegatedSession,
-        delegatedEntries,
-        spaceId,
-        captured,
-        expiresAt,
-        { siwe: prepared.siwe, signature: signature2 }
-      );
       graph.assertActive();
       assertCapturedKey?.();
       this.runtimePermissionGrants.push({
@@ -26777,7 +27033,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!publicSpaceId) {
       throw new Error("Public space not enabled. Set enablePublicSpace: true in config.");
     }
-    await this.assertMayCreateSpace();
+    await this.assertMayCreateSpace(publicSpaceId);
     await this.auth.hostPublicSpace(publicSpaceId);
     const kvActions = [KV3.PUT, KV3.GET, KV3.DEL, KV3.LIST, KV3.METADATA];
     const abilities = { kv: { "": kvActions } };
@@ -26800,10 +27056,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await activateSessionWithHost2(
-      this.config.host,
-      delegationSession.delegationHeader
-    );
+    const activateResult = await this.activateSignedSession(delegationSession, prepared.siwe);
     if (!activateResult.success) {
       throw Object.assign(
         new Error(`Failed to activate public space delegation: ${describeHostFailure2(activateResult)}`),
@@ -27353,10 +27606,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (onPrepared) {
       await onPrepared(delegation);
     }
-    const activateResult = await activateSessionWithHost2(
-      this.config.host,
-      delegationHeader
-    );
+    const activateResult = await this.activateRoutedDelegation(delegation);
     assertDelegationActivated(activateResult, delegation, requireActivation);
     return delegation;
   }
@@ -27390,10 +27640,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (onPrepared) {
       await onPrepared(delegation);
     }
-    const activateResult = await activateSessionWithHost2(
-      targetHost,
-      delegationHeader
-    );
+    const activateResult = await this.activateRoutedDelegation(delegation);
     assertDelegationActivated(activateResult, delegation, requireActivation);
     return delegation;
   }
@@ -28045,10 +28292,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await activateSessionWithHost2(
-      this.config.host,
-      delegationSession.delegationHeader
-    );
+    const activateResult = await this.activateSignedSession(delegationSession, prepared.siwe);
     if (!activateResult.success) {
       throw Object.assign(
         new Error(`Failed to activate delegation: ${describeHostFailure2(activateResult)}`),
@@ -28093,10 +28337,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...publicPrepared,
         signature: publicSignature
       });
-      const publicActivateResult = await activateSessionWithHost2(
-        this.config.host,
-        publicSession.delegationHeader
-      );
+      const publicActivateResult = await this.activateSignedSession(publicSession, publicPrepared.siwe);
       if (publicActivateResult.success) {
         result.publicDelegation = {
           cid: publicSession.delegationCid,
@@ -28202,11 +28443,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await activateSessionWithHost2(
-      targetHost,
-      invokerSession.delegationHeader,
-      graph.signal
-    ).catch((error) => {
+    const activateResult = await this.activateSignedSession(invokerSession, prepared.siwe, targetHost, graph.signal).catch((error) => {
       graph.assertActive();
       throw error;
     });
@@ -28333,10 +28570,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await activateSessionWithHost2(
-      targetHost,
-      subDelegationSession.delegationHeader
-    );
+    const activateResult = await this.activateSignedSession(subDelegationSession, prepared.siwe, targetHost);
     if (!activateResult.success) {
       throw Object.assign(
         new Error(`Failed to activate sub-delegation: ${describeHostFailure2(activateResult)}`),
@@ -28400,6 +28634,7 @@ registerReplicationLoaders({
 
 // src/index.ts
 import { TinyCloud as TinyCloud2 } from "@tinycloud/sdk-core";
+import { NodeNotRespondingError as NodeNotRespondingError3, NodeIdentityMismatchError as NodeIdentityMismatchError2, PartialNodeWriteError as PartialNodeWriteError3 } from "@tinycloud/sdk-services";
 import {
   SilentNotificationHandler as SilentNotificationHandler2,
   AutoApproveSpaceCreationHandler as AutoApproveSpaceCreationHandler2,
@@ -28717,7 +28952,7 @@ import {
   SpaceService as SpaceService2,
   SpaceErrorCodes,
   createSpaceService,
-  parseSpaceUri as parseSpaceUri3,
+  parseSpaceUri as parseSpaceUri4,
   buildSpaceUri,
   makePublicSpaceId as makePublicSpaceId2,
   Space
@@ -31288,8 +31523,11 @@ export {
   MemorySessionStorage,
   NETWORK_NAME_PATTERN,
   NetworkIdError,
+  NodeIdentityMismatchError2 as NodeIdentityMismatchError,
+  NodeNotRespondingError3 as NodeNotRespondingError,
   NodeUserAuthorization,
   NodeWasmBindings,
+  PartialNodeWriteError3 as PartialNodeWriteError,
   PermissionNotInManifestError2 as PermissionNotInManifestError,
   PrefixedKVService,
   PrivateKeySigner,
@@ -31397,7 +31635,7 @@ export {
   parseNetworkId3 as parseNetworkId,
   parsePkhDid,
   parseSecretCatalogKey,
-  parseSpaceUri3 as parseSpaceUri,
+  parseSpaceUri4 as parseSpaceUri,
   pkhDid4 as pkhDid,
   principalDid3 as principalDid,
   principalDidEquals4 as principalDidEquals,