@tinycloud/node-sdk 3.12.0-beta.2 → 3.12.0-beta.4

package/dist/core.cjs

@@ -54,7 +54,10 @@ __export(core_exports, {
   KVService: () => import_sdk_core15.KVService,
   ManifestValidationError: () => import_sdk_core14.ManifestValidationError,
   MemorySessionStorage: () => MemorySessionStorage,
+  NodeIdentityMismatchError: () => import_sdk_services7.NodeIdentityMismatchError,
+  NodeNotRespondingError: () => import_sdk_services7.NodeNotRespondingError,
   NodeUserAuthorization: () => NodeUserAuthorization,
+  PartialNodeWriteError: () => import_sdk_services7.PartialNodeWriteError,
   PermissionNotInManifestError: () => import_sdk_core14.PermissionNotInManifestError,
   PrefixedKVService: () => import_sdk_core15.PrefixedKVService,
   ProtocolMismatchError: () => import_sdk_core22.ProtocolMismatchError,
@@ -138,6 +141,7 @@ __export(core_exports, {
 });
 module.exports = __toCommonJS(core_exports);
 var import_sdk_core12 = require("@tinycloud/sdk-core");
+var import_sdk_services7 = require("@tinycloud/sdk-services");
 
 // src/replication/module-registry.ts
 var nodeLoaders;
@@ -609,11 +613,12 @@ var NodeUserAuthorization = class {
     this.tinycloudHosts = config.tinycloudHosts;
     this.tinycloudRegistryUrl = config.tinycloudRegistryUrl;
     this.tinycloudFallbackHosts = config.tinycloudFallbackHosts;
-    this.registryPolicy = config.registryPolicy;
     this.newUserHost = config.newUserHost;
     this.registryChainId = config.registryChainId;
     this.registrySequenceStore = config.registrySequenceStore ?? (0, import_sdk_core5.createInMemoryRegistrySequenceStore)();
+    this.registryCacheStore = config.registryCacheStore ?? (0, import_sdk_core5.createInMemoryRegistryCacheStore)();
     this.onNodeNotFound = config.onNodeNotFound;
+    this.onRegistryFallback = config.onRegistryFallback;
     this.autoDiscoverLocalNode = config.autoDiscoverLocalNode;
     this.localNodeUrl = config.localNodeUrl;
     this.localLinkName = config.localLinkName;
@@ -681,13 +686,8 @@ var NodeUserAuthorization = class {
    * undefined for missing SIWEs and the SDK then treats the session as
    * expired-at-epoch-zero.
    *
-   * @param hosts - The TinyCloud hosts this session was created against,
-   *   as persisted in {@link PersistedSessionData.tinycloudHosts}. When
-   *   present (and non-empty) they are adopted directly so the restored
-   *   session resolves to the same node as the original sign-in without
-   *   re-running registry/fallback resolution. When absent (old session)
-   *   hosts are resolved lazily on the first host-needing call via
-   *   {@link ensureTinyCloudHosts}.
+   * @param hosts - Persisted host hints for genuine no-entry onboarding.
+   *   Current signed registry membership always takes precedence.
    */
   setRestoredTinyCloudSession(session, hosts) {
     const address = (0, import_sdk_core5.canonicalizeAddress)(session.address);
@@ -749,89 +749,84 @@ var NodeUserAuthorization = class {
       signature: session.signature
     };
   }
-  /**
-   * Ensure `tinycloudHosts` are resolved before a host-needing call.
-   *
-   * Fresh sign-in resolves hosts up front; a restored session may not have
-   * (old persisted sessions predate {@link PersistedSessionData.tinycloudHosts}).
-   * This guard makes a restored session resolve the node exactly like a fresh
-   * sign-in — persisted hosts are preferred (already set by
-   * {@link setRestoredTinyCloudSession}), otherwise the registry/fallback
-   * resolution runs lazily here. Idempotent: {@link resolveTinyCloudHostsForSignIn}
-   * early-returns when hosts are already set.
-   *
-   * Throws if hosts are unset and the restored session has no address/chainId
-   * to resolve from — a real failure that must surface, not be masked.
-   */
+  /** Refresh the primary space's registry destinations, including after restore. */
   async ensureTinyCloudHosts() {
-    if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
-      return;
-    }
     if (this._address === void 0 || this._chainId === void 0) {
-      throw new Error(
-        "Cannot resolve TinyCloud hosts: no address/chainId available. Sign in or restore a session first."
-      );
+      throw new Error("Cannot resolve TinyCloud hosts: sign in or restore a session first.");
+    }
+    await this.resolveTinyCloudHostsForSignIn(this._address, this._chainId, this._tinyCloudSession?.spaceId);
+  }
+  async resolveTinyCloudHostsForSignIn(address, chainId, restoredSpaceId) {
+    const spaceId = restoredSpaceId ?? this.resolveSignInCapabilities(address, chainId).spaceId;
+    const destinations = await this.resolveResourceDestinations(spaceId, "read");
+    for (const destination of destinations) await (0, import_sdk_services2.verifyResourceDestination)(destination, globalThis.fetch.bind(globalThis));
+    this.tinycloudHosts = destinations.map(({ url }) => url);
+  }
+  /** Current full-resource registry routing; saved hosts are only no-entry hints. */
+  async resolveResourceDestinations(resource, access, noEntryHosts = this.tinycloudHosts ?? []) {
+    const owner = resource.startsWith("urn:tinycloud:encryption:") ? (0, import_sdk_services2.parseNetworkId)(resource.split("/")[0]).ownerDid : (0, import_sdk_core5.parseSpaceUri)(resource)?.owner ?? (() => {
+      const key = /^tinycloud:key:(z[^:]+):[^/]+$/.exec(resource);
+      return key ? `did:key:${key[1]}` : void 0;
+    })();
+    if (!owner) throw new Error(`Cannot determine registry owner for ${resource}`);
+    const subject = owner.startsWith("did:pkh:") ? (0, import_sdk_core5.registryOwnerSubjectV1)(owner.slice(owner.lastIndexOf(":") + 1), this.registryChainId) : owner;
+    for (let attempt = 1; ; attempt++) {
+      try {
+        const resolved = await (0, import_sdk_core5.resolveRegistryResource)(subject, resource, access, {
+          registryUrl: this.tinycloudRegistryUrl,
+          registryChainId: this.registryChainId,
+          sequenceStore: this.registrySequenceStore,
+          cacheStore: this.registryCacheStore,
+          onRegistryFallback: this.onRegistryFallback
+        });
+        this.registryVerdict = resolved.verdict;
+        if (resolved.verdict.status === "unregistered") {
+          if (noEntryHosts.length === 0 && (this.autoDiscoverLocalNode ?? true)) {
+            const local = await (0, import_sdk_core5.discoverLocalTinyCloudNode)({
+              localNodeUrl: this.localNodeUrl,
+              localLinkName: this.localLinkName,
+              expectedNodeDid: this.expectedNodeDid,
+              identityStore: this.localNodeIdentityStore
+            });
+            if (local) {
+              (0, import_sdk_core5.warnRegistryDefaultNode)(resolved.verdict, this.registryCacheStore, this.onRegistryFallback);
+              return [{ url: local.url }];
+            }
+          }
+          const host = noEntryHosts[0] ?? this.newUserHost ?? (this.tinycloudFallbackHosts === void 0 ? "https://node.tinycloud.xyz" : this.tinycloudFallbackHosts?.[0]);
+          if (!host || this.newUserHost === null && noEntryHosts.length === 0) throw new import_sdk_core5.NodeNotFoundError(subject, resolved.verdict);
+          const url = (0, import_sdk_core5.exactHttpOrigin)(host, "new-user host");
+          (0, import_sdk_core5.warnRegistryDefaultNode)(resolved.verdict, this.registryCacheStore, this.onRegistryFallback);
+          return [{ url }];
+        }
+        const destinations = resolved.hosts.flatMap((host) => host.urls.map((url) => ({ url, nodeDid: host.nodeDid })));
+        return destinations;
+      } catch (error) {
+        if (!(error instanceof import_sdk_core5.NodeNotFoundError) && !(error instanceof import_sdk_core5.RegistryUnavailableError)) throw error;
+        if (!this.onNodeNotFound) throw error;
+        const decision = await this.onNodeNotFound({ error, attempt });
+        if (decision.action === "retry") continue;
+        if (decision.action === "use-host" && error.verdict?.status === "unregistered") {
+          const url = (0, import_sdk_core5.exactHttpOrigin)(decision.host, "new-user host");
+          (0, import_sdk_core5.warnRegistryDefaultNode)(error.verdict, this.registryCacheStore, this.onRegistryFallback);
+          return [{ url }];
+        }
+        throw error;
+      }
     }
-    await this.resolveTinyCloudHostsForSignIn(this._address, this._chainId);
   }
-  async resolveTinyCloudHostsForSignIn(address, chainId) {
-    if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
-      return;
-    }
-    if (this.registryPolicy === "fail-closed") {
-      const resolved2 = await (0, import_sdk_core5.resolveFailClosedTinyCloudHosts)(address, {
-        registryUrl: this.tinycloudRegistryUrl,
-        registryChainId: this.registryChainId,
-        newUserHost: this.newUserHost,
-        sequenceStore: this.registrySequenceStore,
-        onNodeNotFound: this.onNodeNotFound,
-        autoDiscoverLocalNode: this.autoDiscoverLocalNode,
-        localNodeUrl: this.localNodeUrl,
-        localLinkName: this.localLinkName,
-        expectedNodeDid: this.expectedNodeDid,
-        localNodeIdentityStore: this.localNodeIdentityStore
-      });
-      this.tinycloudHosts = resolved2.hosts;
-      this.registryVerdict = resolved2.verdict;
-      return;
-    }
-    const subject = (0, import_sdk_core5.pkhDid)(address, chainId);
-    const resolved = await (0, import_sdk_core5.resolveTinyCloudHosts)(subject, {
-      registryUrl: this.tinycloudRegistryUrl,
-      fallbackHosts: this.tinycloudFallbackHosts,
-      autoDiscoverLocalNode: this.autoDiscoverLocalNode,
-      localNodeUrl: this.localNodeUrl,
-      localLinkName: this.localLinkName,
-      expectedNodeDid: this.expectedNodeDid,
-      localNodeIdentityStore: this.localNodeIdentityStore
-    });
-    this.tinycloudHosts = resolved.hosts;
+  get registryRecordPresent() {
+    return this.registryVerdict?.status === "registered";
   }
-  /**
-   * Space-creation guard (TC-1443). Under `registryPolicy: "fail-closed"`,
-   * throws unless the owner's registry verdict allows a space on the primary
-   * host: `NodeRegistryEntryExistsError` when the owner's record does not
-   * list it, `RegistryUnavailableError` when the registry gives no
-   * verdict. Reuses this session's sign-in verdict unless it was
-   * `unavailable`, else looks it up now (explicit-host apps). Under the
-   * default policy it returns at once and performs no lookup.
-   */
-  async assertMayCreateSpace() {
-    if (this.registryPolicy !== "fail-closed") return;
-    if (this._address === void 0) {
-      throw new Error("Must be signed in to create a space");
-    }
-    await this.ensureTinyCloudHosts();
-    const subject = (0, import_sdk_core5.registryOwnerSubjectV1)(this._address, this.registryChainId);
-    let verdict = this.registryVerdict;
-    if (verdict?.subject !== subject || verdict.status === "unavailable") {
-      verdict = await (0, import_sdk_core5.lookupOwnerRegistryVerdict)(subject, {
-        registryUrl: this.tinycloudRegistryUrl,
-        sequenceStore: this.registrySequenceStore
-      });
-      this.registryVerdict = verdict;
+  /** Refresh membership before hosting; a saved no-entry verdict never authorizes a later creation. */
+  async assertMayCreateSpace(spaceId = this._tinyCloudSession?.spaceId, host = this.primaryTinyCloudHost) {
+    if (!spaceId) throw new Error("Must be signed in to create a space");
+    const destinations = await this.resolveResourceDestinations(spaceId, "host");
+    if (!destinations.some((destination) => destination.url === host)) {
+      const subject = (0, import_sdk_core5.parseSpaceUri)(spaceId)?.owner;
+      if (!subject || !this.registryVerdict) throw new Error("Cannot resolve space owner");
+      (0, import_sdk_core5.assertSpaceCreationAllowed)(this.registryVerdict, host, spaceId);
     }
-    (0, import_sdk_core5.assertSpaceCreationAllowed)(verdict, this.primaryTinyCloudHost);
   }
   requireTinyCloudHosts() {
     if (!this.tinycloudHosts || this.tinycloudHosts.length === 0) {
@@ -1277,6 +1272,31 @@ var NodeUserAuthorization = class {
     checkCurrent();
     const host = context?.host ?? this.primaryTinyCloudHost;
     const spaceId = context?.spaceId ?? (typeof targetSpaceId === "string" ? targetSpaceId : this._tinyCloudSession.spaceId);
+    const destinations = await this.resolveResourceDestinations(spaceId, "host");
+    if (this.registryVerdict?.status === "registered") {
+      const results = [];
+      for (const destination of destinations) {
+        checkCurrent();
+        try {
+          await (0, import_sdk_services2.verifyResourceDestination)(destination, globalThis.fetch.bind(globalThis));
+          const result = await (0, import_sdk_core5.activateSessionWithHost)(destination.url, this._tinyCloudSession.delegationHeader, signal);
+          results.push(result.skipped?.includes(spaceId) ? { ...result, success: false, status: 403, error: "The session does not activate the requested space" } : result);
+        } catch (error) {
+          if ((0, import_sdk_services2.routingFailure)(error) || signal?.aborted) throw error;
+          throw new import_sdk_services2.NodeNotRespondingError([destination.url], error);
+        }
+      }
+      const failed = results.flatMap((result, index) => result.success ? [] : [{ url: destinations[index].url, status: result.status }]);
+      if (failed.length) {
+        if (destinations.length === 1) return results[0];
+        throw new import_sdk_services2.PartialNodeWriteError(destinations.filter((_, index) => results[index].success).map(({ url }) => url), failed);
+      }
+      return {
+        ...results[0],
+        activated: [...new Set(results.flatMap((result) => result.activated ?? []))],
+        skipped: [...new Set(results.flatMap((result) => result.skipped ?? []))]
+      };
+    }
     const peerId = await (0, import_sdk_core5.fetchPeerId)(host, spaceId, signal);
     checkCurrent();
     const siwe = this.wasm.generateHostSIWEMessage(
@@ -1347,13 +1367,45 @@ var NodeUserAuthorization = class {
     if (!this._tinyCloudSession) {
       throw new Error("Must be signed in to ensure space exists");
     }
-    await this.ensureTinyCloudHosts();
-    const host = this.primaryTinyCloudHost;
     const primarySpaceId = this._tinyCloudSession.spaceId;
-    const result = await (0, import_sdk_core5.activateSessionWithHost)(
-      host,
-      this._tinyCloudSession.delegationHeader
-    );
+    const primary = await this.resolveResourceDestinations(primarySpaceId, "read");
+    this.tinycloudHosts = primary.map(({ url }) => url);
+    const targets = new Map(primary.map((destination) => [destination.url, destination]));
+    if (this.registryVerdict?.status === "registered" && this.registryVerdict.record) {
+      const record = this.registryVerdict.record;
+      const resources = Object.keys((0, import_sdk_core5.extractRecapAttenuations)(this._tinyCloudSession.siwe ?? ""));
+      for (const space of record.spaces) {
+        const registeredSpace = (0, import_sdk_core5.parseSpaceUri)(space.space);
+        if (!resources.some((resource) => {
+          const fullSpace = resource.split("/")[0];
+          const requestedSpace = (0, import_sdk_core5.parseSpaceUri)(fullSpace);
+          return fullSpace === space.space || registeredSpace !== null && requestedSpace !== null && registeredSpace.owner === requestedSpace.owner && registeredSpace.name === requestedSpace.name;
+        })) continue;
+        for (const membership of space.nodes) {
+          const node = record.nodes.find((candidate) => candidate.did === membership.did);
+          targets.set(node.url, { url: node.url, nodeDid: node.did });
+        }
+      }
+      if (record.encryptionNode && resources.some((resource) => resource.startsWith("urn:tinycloud:encryption:"))) {
+        const node = record.nodes.find((candidate) => candidate.did === record.encryptionNode);
+        targets.set(node.url, { url: node.url, nodeDid: node.did });
+      }
+    }
+    let result;
+    for (const destination of targets.values()) {
+      await (0, import_sdk_services2.verifyResourceDestination)(destination, globalThis.fetch.bind(globalThis));
+      let activated;
+      try {
+        activated = await (0, import_sdk_core5.activateSessionWithHost)(destination.url, this._tinyCloudSession.delegationHeader);
+      } catch (error) {
+        throw new import_sdk_services2.NodeNotRespondingError([destination.url], error);
+      }
+      if (!activated.success && activated.status !== 404) {
+        throw Object.assign(new Error(`Failed to activate session: ${describeHostFailure(activated)}`), { cause: activated });
+      }
+      if (destination.url === primary[0].url) result = activated;
+    }
+    if (!result) throw new Error("Primary space activation did not return a result");
     this.recordActivationSkippedSpaces(result, primarySpaceId);
     if (!result.success && result.status !== 404) {
       throw Object.assign(
@@ -1401,7 +1453,7 @@ var NodeUserAuthorization = class {
   /** {@link assertMayCreateSpace}, reporting a refusal to the creation handler before rethrowing it. */
   async guardSpaceCreation(handler, context) {
     try {
-      await this.assertMayCreateSpace();
+      await this.assertMayCreateSpace(context.spaceId, context.host);
     } catch (error) {
       const failure = error instanceof Error ? error : new Error(String(error));
       handler.onSpaceCreationFailed?.(context, failure);
@@ -2545,6 +2597,7 @@ function rememberInvokeAny(invokeAny, sink, pending) {
 
 // src/delegation.ts
 var import_sdk_core6 = require("@tinycloud/sdk-core");
+var import_sdk_services4 = require("@tinycloud/sdk-services");
 var RuntimeDelegationRejectedError = class extends Error {
   constructor(reason, message) {
     super(message);
@@ -2571,7 +2624,8 @@ var SERVICE_BY_SHORT_NAME = {
   kv: "tinycloud.kv",
   sql: "tinycloud.sql",
   duckdb: "tinycloud.duckdb",
-  hooks: "tinycloud.hooks"
+  hooks: "tinycloud.hooks",
+  capabilities: "tinycloud.capabilities"
 };
 function authorizationWithoutBearer(authorization) {
   return authorization.replace(/^Bearer /i, "");
@@ -2702,8 +2756,8 @@ function signedAuthorityFromCompactUcan(authorization) {
       ));
       continue;
     }
-    const match = /^(?:tinycloud:\/\/([^/]+)|(tinycloud:[^/]+))\/(kv|sql|duckdb|hooks)(?:\/|$)(.*)$/.exec(resource);
-    if (!match) {
+    const match = /^(?:tinycloud:\/\/([^/]+)|(tinycloud:[^/]+))\/([^/]+)(?:\/|$)(.*)$/.exec(resource);
+    if (!match || !Object.prototype.hasOwnProperty.call(SERVICE_BY_SHORT_NAME, match[3])) {
       throw new Error(
         `Validated runtime delegation has an unsupported signed resource '${resource}'.`
       );
@@ -2848,13 +2902,8 @@ function resourcesMatch(actual, expected) {
   return JSON.stringify(actual.map(comparable)) === JSON.stringify(expected.map(comparable));
 }
 async function activateValidatedRuntimeDelegation(node, delegation, options) {
-  const host = normalizedHost(options.host);
-  if (delegation.host !== void 0 && normalizedHost(delegation.host) !== host) {
-    reject(
-      "host_mismatch",
-      `Runtime delegation host '${delegation.host}' does not match expected host '${options.host}'.`
-    );
-  }
+  let host = normalizedHost(options.host);
+  const differentHost = delegation.host !== void 0 && normalizedHost(delegation.host) !== host;
   if (!(delegation.expiry instanceof Date) || Number.isNaN(delegation.expiry.getTime())) {
     reject("authority_invalid", "Runtime delegation has an invalid expiry.");
   }
@@ -2898,6 +2947,13 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
   if (options.authorize !== void 0 && !options.authorize(signed.permissions)) {
     throw new Error("Runtime delegation is not authorized for this runtime.");
   }
+  if (differentHost) {
+    const registeredHost = await node.resolveRegisteredDelegationHost?.(signed.permissions, host);
+    if (registeredHost === void 0) {
+      reject("host_mismatch", `Runtime delegation host '${delegation.host}' does not match expected host '${options.host}'.`);
+    }
+    host = normalizedHost(registeredHost);
+  }
   const previouslyInstalled = node.getRuntimePermissionDelegations().find((candidate) => candidate.cid === cid);
   if (previouslyInstalled !== void 0 && previouslyInstalled.delegationHeader.Authorization !== authorization) {
     reject(
@@ -2941,6 +2997,7 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
       await node.useRuntimeDelegation(installedCandidate);
     }
   } catch (error) {
+    if ((0, import_sdk_services4.routingFailure)(error)) throw error;
     reject(
       activationRejectionReason(error),
       error instanceof Error ? error.message : String(error)
@@ -2959,6 +3016,7 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
       "Runtime delegation activation installed authority that differs from the validated authority."
     );
   }
+  node.refreshRegistryForCapabilities?.(signed.permissions);
   return {
     cid,
     delegation: installed,
@@ -3022,10 +3080,11 @@ function deserializeDelegation(data) {
 }
 
 // src/TinyCloudNode.ts
+var import_sdk_services5 = require("@tinycloud/sdk-services");
 var import_siwe2 = require("siwe");
 var import_share_envelope = require("@tinycloud/share-envelope");
 var import_sdk_core11 = require("@tinycloud/sdk-core");
-var import_sdk_services4 = require("@tinycloud/sdk-services");
+var import_sdk_services6 = require("@tinycloud/sdk-services");
 var import_requestLog2 = require("@tinycloud/sdk-services/telemetry/requestLog");
 var import_resource2 = require("@tinycloud/sdk-services/encryption/resource");
 
@@ -4001,6 +4060,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * ```
    */
   constructor(config = {}) {
+    this.registryRefreshOwners = /* @__PURE__ */ new Set();
     this.signer = null;
     this.auth = null;
     this.consumedOpenKeyPendings = /* @__PURE__ */ new WeakSet();
@@ -4164,8 +4224,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.config = {
       ...config,
       host: config.host ?? DEFAULT_HOST,
+      registryPolicy: "fail-closed",
       // One store for every authorization this client creates.
-      registrySequenceStore: config.registrySequenceStore ?? (0, import_sdk_core11.createInMemoryRegistrySequenceStore)()
+      registrySequenceStore: config.registrySequenceStore ?? (0, import_sdk_core11.createInMemoryRegistrySequenceStore)(),
+      registryCacheStore: config.registryCacheStore ?? (0, import_sdk_core11.createInMemoryRegistryCacheStore)()
     };
     if (this.config.replication?.enabled) {
       const runtime = getNodeReplicationLoaders().runtime().then(({ ReplicationRuntime }) => {
@@ -4469,7 +4531,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       // A session saved but never registered on this node is refused: it registers once.
       activate: (signal) => {
         assertCurrent();
-        return (0, import_sdk_core11.activateSessionWithHost)(host, session.delegationHeader, AbortSignal.any([signal, graph.signal]));
+        const activationSignal = AbortSignal.any([signal, graph.signal]);
+        if (primary && primary.delegationCid === session.delegationCid) {
+          return this.activateSignedSession(primary, primary.siwe, host, activationSignal);
+        }
+        return this.activateResourceSession(session.delegationHeader, [spaceId], host, activationSignal);
       }
     });
     assertCurrent();
@@ -4605,14 +4671,38 @@ var _TinyCloudNode = class _TinyCloudNode {
   get requests() {
     return this._requestLog === void 0 ? void 0 : (0, import_requestLog2.readOnlyRequestLog)(this._requestLog);
   }
-  createServiceGraphLifetime() {
+  throwRegistryRefusal(status, text) {
+    if (status !== 403 && status !== 503 || !text.startsWith("registry_unavailable:") && !text.startsWith("registry_hosting_denied:")) return;
+    const code = status === 503 ? "registry_unavailable" : "node_registry_entry_exists";
+    throw Object.assign(new Error(status === 503 ? "The location registry is unavailable for this resource." : "The registry does not authorize this node for the requested resource."), { code, meta: { status } });
+  }
+  createServiceGraphLifetime(session) {
+    const routedFetch = (0, import_sdk_services5.createResourceRoutingFetch)(
+      async (url, init) => {
+        try {
+          const response = await globalThis.fetch(url, init);
+          if (response.status === 403 || response.status === 503) {
+            this.throwRegistryRefusal(response.status, await response.clone().text());
+          }
+          return response;
+        } catch (error) {
+          if ((0, import_sdk_services5.routingFailure)(error)) throw error;
+          if (new URL(url).pathname.startsWith("/encryption/") && !init?.signal?.aborted) {
+            throw new import_sdk_services5.NodeNotRespondingError([new URL(url).origin], error);
+          }
+          throw error;
+        }
+      },
+      {
+        resolveResource: (resource, access) => this.routingDestinations(resource, access),
+        bindAudience: (authorization, nodeDid) => this.bindRoutedAudience(authorization, nodeDid, session),
+        verifyDestination: (target) => (0, import_sdk_services5.verifyResourceDestination)(target, globalThis.fetch.bind(globalThis))
+      }
+    );
     return new ServiceGraphLifetime(
       this.invokeWithRuntimePermissions,
       this.invokeAnyWithRuntimePermissions,
-      // Resolve fetch at request time. This keeps the graph-owned lifetime
-      // signal while preserving the SDK's existing injectable global fetch
-      // behavior (including adapters that install it after construction).
-      (url, init) => globalThis.fetch(url, init),
+      routedFetch,
       (context) => {
         this.storageFull.observe(context);
         if (this._requestLog) (0, import_requestLog2.observeReplicaReads)(context, this._requestLog);
@@ -4620,6 +4710,75 @@ var _TinyCloudNode = class _TinyCloudNode {
       this._requestLog
     );
   }
+  async routingDestinations(resource, access, noEntryHosts) {
+    const session = this.currentTinyCloudSession();
+    if (session) this.refreshRegistryOwner((0, import_sdk_core11.pkhDid)(session.address, session.chainId));
+    if (this.auth) return this.auth.resolveResourceDestinations(resource, access, noEntryHosts);
+    const owner = resource.startsWith("urn:tinycloud:encryption:") ? (0, import_sdk_core11.parseNetworkId)(resource.split("/")[0]).ownerDid : (0, import_sdk_core11.parseSpaceUri)(resource)?.owner ?? (() => {
+      const key = /^tinycloud:key:(z[^:]+):[^/]+$/.exec(resource);
+      return key ? `did:key:${key[1]}` : void 0;
+    })();
+    if (!owner) throw new Error(`Cannot determine registry owner for ${resource}`);
+    const subject = owner.startsWith("did:pkh:") ? (0, import_sdk_core11.pkhDid)(owner.slice(owner.lastIndexOf(":") + 1), this.config.registryChainId ?? 1) : owner;
+    const resolved = await (0, import_sdk_core11.resolveRegistryResource)(subject, resource, access, {
+      registryUrl: this.config.tinycloudRegistryUrl,
+      registryChainId: this.config.registryChainId,
+      sequenceStore: this.config.registrySequenceStore,
+      cacheStore: this.config.registryCacheStore,
+      onRegistryFallback: this.config.onRegistryFallback
+    });
+    if (resolved.verdict.status === "unregistered") {
+      const hint = noEntryHosts === void 0 ? this.explicitHost ?? this.config.host : noEntryHosts[0];
+      const host = hint ?? this.config.newUserHost ?? (this.config.tinycloudFallbackHosts === void 0 ? DEFAULT_HOST : this.config.tinycloudFallbackHosts?.[0]);
+      if (!host || !hint && this.config.newUserHost === null) throw new import_sdk_core11.NodeNotFoundError(subject, resolved.verdict);
+      const url = (0, import_sdk_core11.exactHttpOrigin)(host, "new-user host");
+      (0, import_sdk_core11.warnRegistryDefaultNode)(resolved.verdict, this.config.registryCacheStore, this.config.onRegistryFallback);
+      return [{ url }];
+    }
+    const destinations = resolved.hosts.flatMap((host) => host.urls.map((url) => ({ url, nodeDid: host.nodeDid })));
+    return destinations;
+  }
+  /** Transport hints cannot override verified full-resource registry routing. */
+  async resolveRegisteredDelegationHost(permissions, noEntryHost) {
+    const resources = /* @__PURE__ */ new Map();
+    let hasData = false;
+    for (const permission of permissions) {
+      const encryption = this.isEncryptionNetworkOperation(this.invocationServiceName(permission.service), permission.path, permission.space);
+      const resource = encryption ? permission.path.split("/")[0] : permission.space;
+      if (!resource) throw new import_sdk_services5.ResourceNotRoutedError("delegation");
+      resources.set(resource, encryption ? "encryption" : "host");
+      hasData || (hasData = !encryption);
+    }
+    let dataHost;
+    let encryptionHost;
+    let unserved;
+    for (const [resource, access] of resources) {
+      try {
+        const destinations = await this.routingDestinations(resource, access, [noEntryHost]);
+        if (destinations.some(({ nodeDid }) => nodeDid === void 0)) return void 0;
+        if (access === "host") dataHost ?? (dataHost = destinations[0]?.url);
+        else encryptionHost ?? (encryptionHost = destinations[0]?.url);
+      } catch (error) {
+        if (!(error instanceof import_sdk_core11.NodeNotFoundError) || error.verdict.status !== "registered") throw error;
+        unserved ?? (unserved = error);
+      }
+    }
+    const host = hasData ? dataHost : encryptionHost;
+    if (!host) throw unserved ?? new import_sdk_services5.ResourceNotRoutedError("delegation");
+    return host;
+  }
+  async bindRoutedAudience(authorization, nodeDid, stagedSession) {
+    const payload = JSON.parse(new TextDecoder().decode(base64UrlDecode(authorization.split(".")[1])));
+    const issuer = typeof payload === "object" && payload !== null && "iss" in payload ? payload.iss : void 0;
+    const session = [
+      stagedSession,
+      this._serviceContext?.session,
+      this.auth?.tinyCloudSession,
+      ...this.runtimePermissionGrants.map((grant) => grant.session)
+    ].find((candidate) => candidate?.verificationMethod === issuer);
+    if (!session) throw new Error("Invocation signing session is not active");
+    return rewriteInvocationAudience(authorization, nodeDid, session.jwk);
+  }
   syncResolvedHostFromAuth() {
     const host = this.auth?.hosts[0];
     if (host) {
@@ -4733,6 +4892,29 @@ var _TinyCloudNode = class _TinyCloudNode {
     const session = this.currentTinyCloudSession();
     return session?.siwe ? this.projectSignedRecapCapabilities(session.siwe) : [];
   }
+  /** Start one background refresh for each owner derived from verified authority. */
+  refreshRegistryForCapabilities(permissions) {
+    for (const permission of permissions) {
+      try {
+        const owner = permission.service === "tinycloud.encryption" && permission.path.startsWith("urn:tinycloud:encryption:") ? (0, import_sdk_core11.parseNetworkId)(permission.path.split("/")[0]).ownerDid : permission.space ? this.ownerDidFromSpaceId(permission.space) : void 0;
+        if (owner) this.refreshRegistryOwner(owner);
+      } catch {
+      }
+    }
+  }
+  refreshRegistryOwner(owner) {
+    if (this.config.tinycloudRegistryUrl === null) return;
+    const subject = owner.startsWith("did:pkh:") ? (0, import_sdk_core11.pkhDid)(owner.slice(owner.lastIndexOf(":") + 1), this.config.registryChainId ?? 1) : owner;
+    const key = (0, import_sdk_core11.registryOwnerKeyV2)(subject);
+    if (this.registryRefreshOwners.has(key)) return;
+    this.registryRefreshOwners.add(key);
+    void (0, import_sdk_core11.refreshOwnerRegistry)(subject, {
+      registryUrl: this.config.tinycloudRegistryUrl,
+      registryChainId: this.config.registryChainId,
+      sequenceStore: this.config.registrySequenceStore,
+      cacheStore: this.config.registryCacheStore
+    }).catch(() => void 0);
+  }
   /** Normalize signed capabilities without collapsing nested encryption into raw authority. */
   projectSignedRecapCapabilities(siwe) {
     const projected = this.parseRecapWithCaveats(siwe).map((entry) => {
@@ -5164,6 +5346,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     const primarySession = this.currentTinyCloudSession();
     if (primarySession) {
       this.registerPrimarySessionGrant(primarySession);
+      this.refreshRegistryOwner((0, import_sdk_core11.pkhDid)(primarySession.address, primarySession.chainId));
+      this.refreshRegistryForCapabilities(this.getVerifiedSessionCapabilities());
       if (this.auth?.spaceHosting === "unknown") {
         await this.checkSpaceHosting();
         this.assertSessionEpoch(epoch, "Sign-in");
@@ -5386,8 +5570,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     const primarySession = auth.tinyCloudSession;
     const defaultSpaceId = this.ownedSpaceId("default");
     const canReusePrimaryBootstrapSession = primarySession?.spaceId === defaultSpaceId && auth.capabilityRequest === import_sdk_core11.BOOTSTRAP_SESSION_REQUESTS.default;
-    if (steps.some((step) => step.kind === "host")) {
-      await this.assertMayCreateSpace();
+    for (const step of steps) {
+      if (step.kind === "host") await this.assertMayCreateSpace(step.spaceId);
     }
     for (const step of steps) {
       if (step.kind !== "session") continue;
@@ -5436,10 +5620,20 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (!session) {
         throw new Error(`Missing bootstrap session for ${step.space}`);
       }
-      const activated = await (0, import_sdk_core11.activateSessionWithHost)(host, session.delegationHeader, graph.signal).catch((error) => {
-        graph.assertActive();
-        throw error;
-      });
+      const destinations = await this.routingDestinations(step.spaceId, "host");
+      let activated;
+      for (const destination of destinations) {
+        try {
+          await (0, import_sdk_services5.verifyResourceDestination)(destination, globalThis.fetch.bind(globalThis));
+          const result = await (0, import_sdk_core11.activateSessionWithHost)(destination.url, session.delegationHeader, graph.signal);
+          if (!result.success) throw Object.assign(new Error("Bootstrap activation failed"), { cause: result });
+          activated = result;
+        } catch (error) {
+          graph.assertActive();
+          throw error;
+        }
+      }
+      if (!activated) throw new Error("Bootstrap space has no destination");
       graph.assertActive();
       if (!activated.success || activated.skipped?.includes(step.spaceId)) {
         throw Object.assign(
@@ -5769,7 +5963,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.currentSessionCoversAccountRegistry()) {
       if (!_TinyCloudNode.accountRegistrySkipLogged) {
         _TinyCloudNode.accountRegistrySkipLogged = true;
-        import_sdk_services4.tinyCloudDebugLogger.log("registry.skip");
+        import_sdk_services6.tinyCloudDebugLogger.log("registry.skip");
       }
       return;
     }
@@ -6022,6 +6216,13 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session) {
       throw new Error("Owned space hosting requires an active session");
     }
+    await this.assertMayCreateSpace(spaceId);
+    if (this.auth.registryRecordPresent) {
+      const hosted = await this.hostOwnedSpaceOnce(spaceId, signal);
+      if (!hosted.success) throw Object.assign(new Error(`Failed to activate listed space ${spaceId}: ${describeHostFailure2(hosted)}`), { cause: hosted });
+      if (this.auth.tinyCloudSession === session) this.confirmedHostedSpaceIds.add(spaceId);
+      return;
+    }
     if (this.confirmedHostedSpaceIds.has(spaceId) || this.hostedOwnedSpaceIds.has(spaceId)) {
       return;
     }
@@ -6040,7 +6241,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: activation }
       );
     }
-    await this.assertMayCreateSpace();
+    await this.assertMayCreateSpace(spaceId);
     if (signal?.aborted) throw signal.reason;
     const created = await this.hostOwnedSpaceOnce(spaceId, signal);
     if (!created.success) {
@@ -6101,17 +6302,19 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: hosted }
       );
     }
-    const activation = await (0, import_sdk_core11.activateSessionWithHost)(
-      host,
-      session.delegationHeader
-    );
-    if (!activation.success || activation.skipped?.includes(spaceId)) {
-      throw Object.assign(
-        new Error(
-          `Failed to activate session for owned space ${spaceId}: ${activation.success ? "space was skipped" : describeHostFailure2(activation)}`
-        ),
-        { cause: activation }
+    if (!this.auth.registryRecordPresent) {
+      const activation = await (0, import_sdk_core11.activateSessionWithHost)(
+        host,
+        session.delegationHeader
       );
+      if (!activation.success || activation.skipped?.includes(spaceId)) {
+        throw Object.assign(
+          new Error(
+            `Failed to activate session for owned space ${spaceId}: ${activation.success ? "space was skipped" : describeHostFailure2(activation)}`
+          ),
+          { cause: activation }
+        );
+      }
     }
     if (this.auth?.tinyCloudSession === session) this.hostedOwnedSpaceIds.add(spaceId);
     try {
@@ -6155,11 +6358,9 @@ var _TinyCloudNode = class _TinyCloudNode {
    * session's recap doesn't cover it and the registry has no record; the host
    * SIWE is idempotent server-side. Must be called after {@link signIn}.
    *
-   * Under `registryPolicy: "fail-closed"`, hosting is refused with
-   * `NodeRegistryEntryExistsError` when the owner's registry record does not
-   * list the host, or `RegistryUnavailableError` when the registry gives no
-   * verdict. {@link hostOwnedSpace} itself is an explicit action and is not
-   * guarded.
+   * Current signed per-space membership is checked before both automatic and
+   * explicit hosting. Registered replicas use the session grant; no-entry
+   * onboarding retains the host-SIWE flow.
    *
    * @param name - The owned space name (e.g. `"secrets"`).
    * @returns The hosted owned-space URI.
@@ -6169,27 +6370,20 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Not signed in. Call signIn() first.");
     }
     const spaceId = this.ownedSpaceId(name);
+    await this.assertMayCreateSpace(spaceId);
     if (this.hostedOwnedSpaceIds.has(spaceId) || await this.isOwnedSpaceRegistered(spaceId)) {
       return spaceId;
     }
-    await this.assertMayCreateSpace();
     return this.hostOwnedSpace(name);
   }
-  /**
-   * Space-creation guard (TC-1443) for the automatic hosting paths: sign-in's
-   * owned spaces, account bootstrap, {@link ensureOwnedSpaceHosted} and
-   * {@link ensurePublicSpace}. Only `registryPolicy: "fail-closed"` consults
-   * the registry ({@link NodeUserAuthorization.assertMayCreateSpace}); the
-   * default policy performs no lookup.
-   */
-  async assertMayCreateSpace() {
-    if (this.config.registryPolicy !== "fail-closed") return;
-    await this.auth.assertMayCreateSpace();
+  /** Refresh full-space membership before any automatic or explicit hosting. */
+  async assertMayCreateSpace(spaceId) {
+    await this.routingDestinations(spaceId, "host");
   }
   /** Registry-policy settings shared by every authorization this client creates. */
   registryPolicyConfig() {
-    const { registryPolicy, newUserHost, registryChainId, registrySequenceStore, onNodeNotFound } = this.config;
-    return { registryPolicy, newUserHost, registryChainId, registrySequenceStore, onNodeNotFound };
+    const { registryPolicy, newUserHost, registryChainId, registrySequenceStore, registryCacheStore, onNodeNotFound, onRegistryFallback } = this.config;
+    return { registryPolicy, newUserHost, registryChainId, registrySequenceStore, registryCacheStore, onNodeNotFound, onRegistryFallback };
   }
   /**
    * Submit the host delegation for an owned space, sharing one in-flight
@@ -6395,12 +6589,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       stagedSessionExpiry = signedExpiry ?? persistedPolicyExpiry ?? persistedExpiry(void 0);
     }
-    const resolvedHost = await this.resolveRestoredHost(
-      sessionData.tinycloudHosts,
-      restoredAddress,
-      sessionData.chainId
-    );
-    const stagedHost = resolvedHost ?? this.config.host;
+    const restoreHints = this.explicitHost ? [this.explicitHost] : sessionData.tinycloudHosts ?? [];
+    const stagedHost = (0, import_sdk_core11.exactHttpOrigin)(restoreHints[0] ?? this.config.host, "restored host hint");
     let restoredNodeFeatures;
     let replicaProtocolMismatch = false;
     if (this.config.replication?.enabled) {
@@ -6517,7 +6707,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.sessionManager = stagedManager;
     this.sessionKeyId = stagedKeyId;
     this.sessionKeyJwk = stagedJwk;
-    if (resolvedHost) this.config.host = resolvedHost;
+    this.config.host = stagedHost;
     if (spaceOwnerKey(serviceSession.spaceId) !== this.currentStorageOwner()) {
       this.storageFull.clear();
       this._requestLog?.clear();
@@ -6584,6 +6774,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (attempt === this.latestSessionAttempt) await this.endSession();
       this.assertSessionEpoch(epoch, "Session restore");
     }
+    if (this.config.replication?.enabled) {
+      if (stagedAddress !== void 0) this.refreshRegistryOwner((0, import_sdk_core11.pkhDid)(stagedAddress, stagedChainId));
+      this.refreshRegistryForCapabilities(this.getVerifiedSessionCapabilities());
+    }
   }
   stagePrimarySessionState(session, verificationMethod, host, sessionExpiry, recap) {
     if (!session?.siwe) return { cache: void 0, grants: [] };
@@ -6632,7 +6826,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
   }
   stageRestoredServiceGraph(input) {
-    const graph = this.createServiceGraphLifetime();
+    const graph = this.createServiceGraphLifetime(input.serviceSession);
     const core = this.auth ? new import_sdk_core11.TinyCloud(this.auth, {
       invokeAny: graph.invokeAny,
       telemetry: this.config.telemetry,
@@ -6857,56 +7051,6 @@ var _TinyCloudNode = class _TinyCloudNode {
     spaceService.updateConfig({ sharingService });
     return { core, graph, serviceContext, kv, sql, duckdb, hooks, vault, encryption, capabilityRegistry, keyProvider, sharingService, delegationManager, spaceService };
   }
-  /**
-   * Resolve the host a restored session should target.
-   *
-   * Mirrors fresh sign-in host resolution but for the restore path:
-   * an explicit/pinned host always wins, then the hosts the session was
-   * persisted with, then a lazy registry/fallback resolution for sessions
-   * that predate the persisted `tinycloudHosts` field. Returns `undefined`
-   * only when there's nothing to resolve from (no explicit host, no
-   * persisted hosts, and no address/chainId) — in which case the existing
-   * `config.host` (default) is left in place.
-   *
-   * Resolution failures are surfaced, not swallowed: a genuinely broken
-   * registry lookup throws rather than silently falling back to a wrong host.
-   */
-  async resolveRestoredHost(persistedHosts, address, chainId) {
-    if (this.explicitHost) {
-      return this.explicitHost;
-    }
-    if (persistedHosts && persistedHosts.length > 0) {
-      return persistedHosts[0];
-    }
-    if (address === void 0 || chainId === void 0) {
-      return void 0;
-    }
-    if (this.config.registryPolicy === "fail-closed") {
-      const resolved2 = await (0, import_sdk_core11.resolveFailClosedTinyCloudHosts)(address, {
-        registryUrl: this.config.tinycloudRegistryUrl,
-        registryChainId: this.config.registryChainId,
-        newUserHost: this.config.newUserHost,
-        sequenceStore: this.config.registrySequenceStore,
-        onNodeNotFound: this.config.onNodeNotFound,
-        autoDiscoverLocalNode: this.config.autoDiscoverLocalNode,
-        localNodeUrl: this.config.localNodeUrl,
-        localLinkName: this.config.localLinkName,
-        expectedNodeDid: this.config.expectedNodeDid,
-        localNodeIdentityStore: this.config.localNodeIdentityStore
-      });
-      return resolved2.hosts[0];
-    }
-    const resolved = await (0, import_sdk_core11.resolveTinyCloudHosts)((0, import_sdk_core11.pkhDid)(address, chainId), {
-      registryUrl: this.config.tinycloudRegistryUrl,
-      fallbackHosts: this.config.tinycloudFallbackHosts,
-      autoDiscoverLocalNode: this.config.autoDiscoverLocalNode,
-      localNodeUrl: this.config.localNodeUrl,
-      localLinkName: this.config.localLinkName,
-      expectedNodeDid: this.config.expectedNodeDid,
-      localNodeIdentityStore: this.config.localNodeIdentityStore
-    });
-    return resolved.hosts[0];
-  }
   /**
    * Resolve the currently-active TinyCloudSession, preferring the auth
    * layer's value (wallet mode) and falling back to the node-level
@@ -7381,10 +7525,10 @@ var _TinyCloudNode = class _TinyCloudNode {
    * second time. Only a value recorded for this exact host qualifies; older
    * nodes that omit `nodeId` fall through to the fetch.
    */
-  async fetchNodeId() {
-    const cached = this.auth?.nodeIdForHost(this.config.host);
+  async fetchNodeId(host = this.config.host) {
+    const cached = this.auth?.nodeIdForHost(host);
     if (cached) return cached;
-    const response = await fetch(`${this.config.host}/info`);
+    const response = await fetch(`${host}/info`);
     if (!response.ok) {
       throw await (0, import_sdk_core11.httpResponseError)(response, "Failed to fetch node info");
     }
@@ -7432,10 +7576,24 @@ var _TinyCloudNode = class _TinyCloudNode {
       )
     };
   }
-  async fetchEncryptionNetworkAt(host, networkId, fetchFn) {
-    const response = await fetchFn(
-      `${host}/encryption/networks/${encodeURIComponent(networkId)}`
-    );
+  async encryptionDestination(networkId) {
+    const destination = (await this.routingDestinations(networkId, "encryption"))[0];
+    if (!destination) throw new Error("No encryption destination is registered");
+    await (0, import_sdk_services5.verifyResourceDestination)(destination, globalThis.fetch.bind(globalThis));
+    return { ...destination, nodeDid: destination.nodeDid ?? await this.fetchNodeId(destination.url) };
+  }
+  async fetchEncryptionNetworkAt(host, networkId, fetchFn, callerSignal) {
+    let response;
+    const timeout = AbortSignal.timeout(5e3);
+    try {
+      response = await fetchFn(`${host}/encryption/networks/${encodeURIComponent(networkId)}`, {
+        signal: callerSignal ? AbortSignal.any([callerSignal, timeout]) : timeout,
+        redirect: "error"
+      });
+    } catch (error) {
+      if ((0, import_sdk_services5.routingFailure)(error) || callerSignal?.aborted || !timeout.aborted && error instanceof Error && error.name === "AbortError") throw error;
+      throw new import_sdk_services5.NodeNotRespondingError([host], error);
+    }
     if (response.status === 404) return null;
     if (!response.ok) {
       throw await (0, import_sdk_core11.httpResponseError)(response, `Failed to fetch encryption network ${networkId}`);
@@ -7445,18 +7603,18 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   createEncryptionService(binding) {
     const graph = binding?.graph ?? this._serviceGraph;
-    const host = binding?.host ?? this.config.host;
     const session = binding?.session ?? this.requireEncryptionSession();
     const did = binding?.did ?? this.did;
     const address = binding?.address ?? this._address;
     const chainId = binding?.chainId ?? this._chainId;
     const crypto2 = this.createEncryptionCrypto();
-    const descriptorCache = /* @__PURE__ */ new Map();
     const transport = {
-      postDecrypt: async ({ networkId, authorization, canonicalBody, signal }) => {
+      postDecrypt: async ({ targetNode, networkId, authorization, canonicalBody, signal }) => {
         graph.assertActive();
+        const destination = await this.encryptionDestination(networkId);
+        if (destination.nodeDid !== targetNode) throw new import_sdk_services5.NodeIdentityMismatchError(destination.url, destination.nodeDid, targetNode);
         const response = await graph.fetch(
-          `${host}/encryption/networks/${encodeURIComponent(networkId)}/decrypt`,
+          `${destination.url}/encryption/networks/${encodeURIComponent(networkId)}/decrypt`,
           {
             method: "POST",
             headers: {
@@ -7469,7 +7627,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         );
         graph.assertActive();
         if (!response.ok) {
-          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services4.parsePermissionHint)({
+          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services6.parsePermissionHint)({
             service: "tinycloud.encryption",
             path: networkId,
             actions: ["tinycloud.encryption/decrypt"]
@@ -7484,6 +7642,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     };
     return new import_sdk_core11.EncryptionService({
+      resolveTargetNode: async (networkId) => (await this.encryptionDestination(networkId)).nodeDid,
       crypto: crypto2,
       signer: {
         signDecryptInvocation: async (input) => {
@@ -7507,18 +7666,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       node: {
         fetchByNetworkId: async (networkId) => {
           graph.assertActive();
-          let pending = descriptorCache.get(networkId);
-          if (!pending) {
-            pending = this.fetchEncryptionNetworkAt(host, networkId, graph.fetch).then((descriptor2) => {
-              if (descriptor2 === null) descriptorCache.delete(networkId);
-              return descriptor2;
-            }).catch((error) => {
-              descriptorCache.delete(networkId);
-              throw error;
-            });
-            descriptorCache.set(networkId, pending);
-          }
-          const descriptor = await pending;
+          const destination = await this.encryptionDestination(networkId);
+          const descriptor = await this.fetchEncryptionNetworkAt(destination.url, networkId, graph.fetch, graph.signal);
           graph.assertActive();
           return descriptor;
         }
@@ -7526,13 +7675,15 @@ var _TinyCloudNode = class _TinyCloudNode {
       wellKnown: {
         fetchWellKnown: async (principal, discoveryKey) => {
           graph.assertActive();
+          const destination = await this.encryptionDestination(this.getDefaultEncryptionNetworkId());
+          if (this.auth?.registryRecordPresent) return null;
           if (!address || !didPrincipalMatches2(principal, did)) {
             return null;
           }
           const publicSpaceId = (0, import_sdk_core11.makePublicSpaceId)(address, chainId);
           const encodedKey = discoveryKey.split("/").map(encodeURIComponent).join("/");
           const response = await graph.fetch(
-            `${host}/public/${encodeURIComponent(publicSpaceId)}/kv/${encodedKey}`,
+            `${destination.url}/public/${encodeURIComponent(publicSpaceId)}/kv/${encodedKey}`,
             { method: "GET" }
           );
           graph.assertActive();
@@ -7902,7 +8053,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const signature = await this.signer.signMessage(prepared.siwe);
     assertOwnerGraphActive();
     const delegationSession = this.wasmBindings.completeSessionSetup({ ...prepared, signature });
-    const activation = await (0, import_sdk_core11.activateSessionWithHost)(host, delegationSession.delegationHeader);
+    const activation = await this.activateSignedSession(delegationSession, prepared.siwe, host);
     assertOwnerGraphActive();
     if (!activation.success) {
       throw Object.assign(
@@ -8221,15 +8372,16 @@ var _TinyCloudNode = class _TinyCloudNode {
   async getEncryptionNetwork(nameOrNetworkId = this.getDefaultEncryptionNetworkId()) {
     const networkId = nameOrNetworkId.startsWith("urn:tinycloud:encryption:") ? nameOrNetworkId : this.getDefaultEncryptionNetworkId(nameOrNetworkId);
     return this.fetchEncryptionNetworkAt(
-      this.config.host,
+      (await this.encryptionDestination(networkId)).url,
       networkId,
       globalThis.fetch.bind(globalThis)
     );
   }
   async createEncryptionNetwork(name = DEFAULT_ENCRYPTION_NETWORK_NAME) {
-    const targetNode = await this.fetchNodeId();
     const ownerDid = this.did;
     const networkId = this.getDefaultEncryptionNetworkId(name);
+    const destination = await this.encryptionDestination(networkId);
+    const targetNode = destination.nodeDid;
     const body = {
       name,
       ownerDid,
@@ -8252,7 +8404,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       action: NETWORK_CREATE_ACTION2,
       facts
     });
-    const response = await fetch(`${this.config.host}/encryption/networks`, {
+    const response = await this._serviceGraph.fetch(`${destination.url}/encryption/networks`, {
       method: "POST",
       headers: {
         Authorization: signed.authorization,
@@ -8345,7 +8497,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     );
     if (result.status !== "ok") {
       if (result.status === "permission_required") {
-        const hint = (0, import_sdk_services4.parsePermissionHint)(result.hint);
+        const hint = (0, import_sdk_services6.parsePermissionHint)(result.hint);
         if (hint === void 0) return { status: "read_failed" };
         return {
           status: "permission_required",
@@ -8592,6 +8744,97 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return { recap: exactVerifiedRecap(verified), expiresAt };
   }
+  async activateResourceSession(delegationHeader, resources, hostHint, signal) {
+    const targets = /* @__PURE__ */ new Map();
+    const routedSpaces = [];
+    let unserved;
+    let requestedResource;
+    for (const resource of new Set(resources)) {
+      requestedResource ?? (requestedResource = resource);
+      signal?.throwIfAborted();
+      try {
+        const encryption = resource.startsWith("urn:tinycloud:encryption:");
+        const destinations = await this.routingDestinations(
+          resource,
+          encryption ? "encryption" : "host",
+          [hostHint ?? this.config.host]
+        );
+        if (!encryption && destinations.some(({ nodeDid }) => nodeDid !== void 0)) routedSpaces.push(resource);
+        for (const destination of destinations) {
+          let target = targets.get(destination.url);
+          if (!target) {
+            target = { destination, spaces: [] };
+            targets.set(destination.url, target);
+          }
+          if (!encryption && destination.nodeDid !== void 0) target.spaces.push(resource);
+        }
+      } catch (error) {
+        if (!(error instanceof import_sdk_core11.NodeNotFoundError)) throw error;
+        unserved ?? (unserved = error);
+      }
+    }
+    if (targets.size === 0) throw unserved ?? new import_sdk_services5.ResourceNotRoutedError(requestedResource ?? "session grant");
+    const succeeded = [];
+    const accepted = [];
+    const failed = [];
+    let refusal;
+    for (const { destination: target, spaces } of targets.values()) {
+      signal?.throwIfAborted();
+      try {
+        await (0, import_sdk_services5.verifyResourceDestination)(target, globalThis.fetch.bind(globalThis));
+        const timeout = AbortSignal.timeout(5e3);
+        const result = await (0, import_sdk_core11.activateSessionWithHost)(
+          target.url,
+          delegationHeader,
+          signal ? AbortSignal.any([signal, timeout]) : timeout
+        );
+        this.throwRegistryRefusal(result.status, result.error ?? "");
+        if (result.success) {
+          const skipped = result.skipped?.find((space) => spaces.some((expected) => this.spaceIdsEqual(space, expected)));
+          if (skipped) {
+            failed.push({ url: target.url, status: result.status, cause: new import_sdk_services5.ResourceNotRoutedError(skipped) });
+            continue;
+          }
+          succeeded.push(target.url);
+          accepted.push(result);
+        } else {
+          refusal = result;
+          failed.push({ url: target.url, status: result.status, cause: result });
+        }
+      } catch (error) {
+        if (signal?.aborted) throw error;
+        failed.push({ url: target.url, cause: (0, import_sdk_services5.routingFailure)(error) ? error : new import_sdk_services5.NodeNotRespondingError([target.url], error) });
+      }
+    }
+    if (failed.length > 0) {
+      if (targets.size > 1) throw new import_sdk_services5.PartialNodeWriteError(succeeded, failed);
+      if (refusal) return refusal;
+      throw failed[0].cause;
+    }
+    const activated = new Set(accepted.flatMap((result) => result.activated ?? []));
+    return {
+      ...accepted[0],
+      activated: [...activated],
+      skipped: [...new Set(accepted.flatMap((result) => result.skipped ?? []))].filter((space) => !activated.has(space) && !routedSpaces.some((expected) => this.spaceIdsEqual(space, expected)))
+    };
+  }
+  activateRoutedDelegation(delegation, signal) {
+    const resources = this.operationsFromDelegation(delegation).map(
+      (operation) => operation.resource?.startsWith("urn:tinycloud:encryption:") ? operation.resource.split("/")[0] : operation.spaceId ?? delegation.spaceId
+    );
+    return this.activateResourceSession(delegation.delegationHeader, resources, delegation.host, signal);
+  }
+  activateSignedSession(session, siwe, hostHint, signal) {
+    const resources = this.parseRecapWithCaveats(siwe).map(
+      (entry) => this.isEncryptionNetworkOperation(this.invocationServiceName(entry.service), entry.path, entry.space) ? entry.path.split("/")[0] : entry.space.startsWith("tinycloud:") ? entry.space : session.spaceId
+    );
+    return this.activateResourceSession(
+      session.delegationHeader,
+      resources.length > 0 ? resources : [session.spaceId],
+      hostHint,
+      signal
+    );
+  }
   /**
    * Install a portable runtime permission delegation into this SDK instance so
    * matching service calls and downstream `delegateTo()` calls can use it.
@@ -8611,16 +8854,12 @@ var _TinyCloudNode = class _TinyCloudNode {
         `Runtime delegation targets ${delegation.delegateDID} but this session key is ${session.verificationMethod}.`
       );
     }
-    const targetHost = delegation.host ?? this.config.host;
     let activateResult;
     try {
-      activateResult = await (0, import_sdk_core11.activateSessionWithHost)(
-        targetHost,
-        delegation.delegationHeader,
-        graph.signal
-      );
+      activateResult = await this.activateRoutedDelegation(delegation, graph.signal);
     } catch (cause) {
       graph.assertActive();
+      if ((0, import_sdk_services5.routingFailure)(cause)) throw cause;
       throw Object.assign(
         new Error("The TinyCloud host could not be reached to activate the delegation."),
         { code: "ACTIVATION_TRANSPORT_FAILED", cause }
@@ -8776,11 +9015,15 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...prepared,
         signature
       });
-      const activateResult = await (0, import_sdk_core11.activateSessionWithHost)(
-        this.config.host,
-        delegatedSession.delegationHeader,
-        graph.signal
-      ).catch((error) => {
+      const delegation = this.runtimeDelegationFromSession(
+        delegatedSession,
+        delegatedEntries,
+        spaceId,
+        captured,
+        expiresAt,
+        { siwe: prepared.siwe, signature }
+      );
+      const activateResult = await this.activateRoutedDelegation(delegation, graph.signal).catch((error) => {
         graph.assertActive();
         throw error;
       });
@@ -8796,14 +9039,6 @@ var _TinyCloudNode = class _TinyCloudNode {
           { cause: activateResult }
         );
       }
-      const delegation = this.runtimeDelegationFromSession(
-        delegatedSession,
-        delegatedEntries,
-        spaceId,
-        captured,
-        expiresAt,
-        { siwe: prepared.siwe, signature }
-      );
       graph.assertActive();
       assertCapturedKey?.();
       this.runtimePermissionGrants.push({
@@ -8948,7 +9183,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!publicSpaceId) {
       throw new Error("Public space not enabled. Set enablePublicSpace: true in config.");
     }
-    await this.assertMayCreateSpace();
+    await this.assertMayCreateSpace(publicSpaceId);
     await this.auth.hostPublicSpace(publicSpaceId);
     const kvActions = [import_sdk_core11.KV.PUT, import_sdk_core11.KV.GET, import_sdk_core11.KV.DEL, import_sdk_core11.KV.LIST, import_sdk_core11.KV.METADATA];
     const abilities = { kv: { "": kvActions } };
@@ -8971,10 +9206,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature
     });
-    const activateResult = await (0, import_sdk_core11.activateSessionWithHost)(
-      this.config.host,
-      delegationSession.delegationHeader
-    );
+    const activateResult = await this.activateSignedSession(delegationSession, prepared.siwe);
     if (!activateResult.success) {
       throw Object.assign(
         new Error(`Failed to activate public space delegation: ${describeHostFailure2(activateResult)}`),
@@ -9524,10 +9756,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (onPrepared) {
       await onPrepared(delegation);
     }
-    const activateResult = await (0, import_sdk_core11.activateSessionWithHost)(
-      this.config.host,
-      delegationHeader
-    );
+    const activateResult = await this.activateRoutedDelegation(delegation);
     assertDelegationActivated(activateResult, delegation, requireActivation);
     return delegation;
   }
@@ -9561,10 +9790,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (onPrepared) {
       await onPrepared(delegation);
     }
-    const activateResult = await (0, import_sdk_core11.activateSessionWithHost)(
-      targetHost,
-      delegationHeader
-    );
+    const activateResult = await this.activateRoutedDelegation(delegation);
     assertDelegationActivated(activateResult, delegation, requireActivation);
     return delegation;
   }
@@ -10216,10 +10442,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature
     });
-    const activateResult = await (0, import_sdk_core11.activateSessionWithHost)(
-      this.config.host,
-      delegationSession.delegationHeader
-    );
+    const activateResult = await this.activateSignedSession(delegationSession, prepared.siwe);
     if (!activateResult.success) {
       throw Object.assign(
         new Error(`Failed to activate delegation: ${describeHostFailure2(activateResult)}`),
@@ -10264,10 +10487,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...publicPrepared,
         signature: publicSignature
       });
-      const publicActivateResult = await (0, import_sdk_core11.activateSessionWithHost)(
-        this.config.host,
-        publicSession.delegationHeader
-      );
+      const publicActivateResult = await this.activateSignedSession(publicSession, publicPrepared.siwe);
       if (publicActivateResult.success) {
         result.publicDelegation = {
           cid: publicSession.delegationCid,
@@ -10373,11 +10593,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature
     });
-    const activateResult = await (0, import_sdk_core11.activateSessionWithHost)(
-      targetHost,
-      invokerSession.delegationHeader,
-      graph.signal
-    ).catch((error) => {
+    const activateResult = await this.activateSignedSession(invokerSession, prepared.siwe, targetHost, graph.signal).catch((error) => {
       graph.assertActive();
       throw error;
     });
@@ -10504,10 +10720,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature
     });
-    const activateResult = await (0, import_sdk_core11.activateSessionWithHost)(
-      targetHost,
-      subDelegationSession.delegationHeader
-    );
+    const activateResult = await this.activateSignedSession(subDelegationSession, prepared.siwe, targetHost);
     if (!activateResult.success) {
       throw Object.assign(
         new Error(`Failed to activate sub-delegation: ${describeHostFailure2(activateResult)}`),
@@ -10587,7 +10800,10 @@ var import_sdk_core23 = require("@tinycloud/sdk-core");
   KVService,
   ManifestValidationError,
   MemorySessionStorage,
+  NodeIdentityMismatchError,
+  NodeNotRespondingError,
   NodeUserAuthorization,
+  PartialNodeWriteError,
   PermissionNotInManifestError,
   PrefixedKVService,
   ProtocolMismatchError,