@tinycloud/node-sdk 3.12.0-beta.2 → 3.12.0-beta.4

package/dist/index.cjs

@@ -17045,7 +17045,7 @@ function augmentSignInEntriesWithReplication(input) {
   for (const prefix of replication.prefixes) {
     (0, import_prefix.assertFolderPrefix)(prefix);
     const path = prefix === "/" ? "" : prefix;
-    if ((0, import_sdk_services2.requiresSecretsOptIn)(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
+    if ((0, import_sdk_services3.requiresSecretsOptIn)(input.primarySpaceId, prefix) && replication.allowSecrets !== true) {
       continue;
     }
     if (!hasUnrestrictedGetCoverage(input.entries, input.primarySpaceId, path)) {
@@ -17071,12 +17071,12 @@ function augmentSignInEntriesWithReplication(input) {
   }
   return out;
 }
-var import_sdk_core2, import_sdk_services2, import_prefix, KV_GET, KV_SYNC, KV_SERVICE;
+var import_sdk_core2, import_sdk_services3, import_prefix, KV_GET, KV_SYNC, KV_SERVICE;
 var init_authority_sign_in = __esm({
   "src/replication/authority-sign-in.ts"() {
     "use strict";
     import_sdk_core2 = require("@tinycloud/sdk-core");
-    import_sdk_services2 = require("@tinycloud/sdk-services");
+    import_sdk_services3 = require("@tinycloud/sdk-services");
     import_prefix = require("@tinycloud/sdk-services/kv/replication/prefix");
     KV_GET = import_sdk_core2.KV.GET;
     KV_SYNC = import_sdk_core2.KV.SYNC;
@@ -17875,8 +17875,11 @@ __export(src_exports, {
   MemorySessionStorage: () => MemorySessionStorage,
   NETWORK_NAME_PATTERN: () => import_sdk_core22.NETWORK_NAME_PATTERN,
   NetworkIdError: () => import_sdk_core22.NetworkIdError,
+  NodeIdentityMismatchError: () => import_sdk_services8.NodeIdentityMismatchError,
+  NodeNotRespondingError: () => import_sdk_services8.NodeNotRespondingError,
   NodeUserAuthorization: () => NodeUserAuthorization,
   NodeWasmBindings: () => NodeWasmBindings,
+  PartialNodeWriteError: () => import_sdk_services8.PartialNodeWriteError,
   PermissionNotInManifestError: () => import_sdk_core17.PermissionNotInManifestError,
   PrefixedKVService: () => import_sdk_core18.PrefixedKVService,
   PrivateKeySigner: () => PrivateKeySigner,
@@ -18275,6 +18278,7 @@ function rememberInvokeAny(invokeAny2, sink, pending) {
 
 // src/delegation.ts
 var import_sdk_core = require("@tinycloud/sdk-core");
+var import_sdk_services2 = require("@tinycloud/sdk-services");
 var RUNTIME_DELEGATION_REJECTIONS = [
   "host_mismatch",
   "expired",
@@ -18316,7 +18320,8 @@ var SERVICE_BY_SHORT_NAME = {
   kv: "tinycloud.kv",
   sql: "tinycloud.sql",
   duckdb: "tinycloud.duckdb",
-  hooks: "tinycloud.hooks"
+  hooks: "tinycloud.hooks",
+  capabilities: "tinycloud.capabilities"
 };
 function authorizationWithoutBearer(authorization) {
   return authorization.replace(/^Bearer /i, "");
@@ -18447,8 +18452,8 @@ function signedAuthorityFromCompactUcan(authorization) {
       ));
       continue;
     }
-    const match = /^(?:tinycloud:\/\/([^/]+)|(tinycloud:[^/]+))\/(kv|sql|duckdb|hooks)(?:\/|$)(.*)$/.exec(resource);
-    if (!match) {
+    const match = /^(?:tinycloud:\/\/([^/]+)|(tinycloud:[^/]+))\/([^/]+)(?:\/|$)(.*)$/.exec(resource);
+    if (!match || !Object.prototype.hasOwnProperty.call(SERVICE_BY_SHORT_NAME, match[3])) {
       throw new Error(
         `Validated runtime delegation has an unsupported signed resource '${resource}'.`
       );
@@ -18593,13 +18598,8 @@ function resourcesMatch(actual, expected) {
   return JSON.stringify(actual.map(comparable)) === JSON.stringify(expected.map(comparable));
 }
 async function activateValidatedRuntimeDelegation(node, delegation, options) {
-  const host = normalizedHost(options.host);
-  if (delegation.host !== void 0 && normalizedHost(delegation.host) !== host) {
-    reject(
-      "host_mismatch",
-      `Runtime delegation host '${delegation.host}' does not match expected host '${options.host}'.`
-    );
-  }
+  let host = normalizedHost(options.host);
+  const differentHost = delegation.host !== void 0 && normalizedHost(delegation.host) !== host;
   if (!(delegation.expiry instanceof Date) || Number.isNaN(delegation.expiry.getTime())) {
     reject("authority_invalid", "Runtime delegation has an invalid expiry.");
   }
@@ -18643,6 +18643,13 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
   if (options.authorize !== void 0 && !options.authorize(signed2.permissions)) {
     throw new Error("Runtime delegation is not authorized for this runtime.");
   }
+  if (differentHost) {
+    const registeredHost = await node.resolveRegisteredDelegationHost?.(signed2.permissions, host);
+    if (registeredHost === void 0) {
+      reject("host_mismatch", `Runtime delegation host '${delegation.host}' does not match expected host '${options.host}'.`);
+    }
+    host = normalizedHost(registeredHost);
+  }
   const previouslyInstalled = node.getRuntimePermissionDelegations().find((candidate) => candidate.cid === cid);
   if (previouslyInstalled !== void 0 && previouslyInstalled.delegationHeader.Authorization !== authorization) {
     reject(
@@ -18686,6 +18693,7 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
       await node.useRuntimeDelegation(installedCandidate);
     }
   } catch (error) {
+    if ((0, import_sdk_services2.routingFailure)(error)) throw error;
     reject(
       activationRejectionReason(error),
       error instanceof Error ? error.message : String(error)
@@ -18704,6 +18712,7 @@ async function activateValidatedRuntimeDelegation(node, delegation, options) {
       "Runtime delegation activation installed authority that differs from the validated authority."
     );
   }
+  node.refreshRegistryForCapabilities?.(signed2.permissions);
   return {
     cid,
     delegation: installed,
@@ -18813,6 +18822,7 @@ function deserializeDelegation(data) {
 }
 
 // src/TinyCloudNode.ts
+var import_sdk_services5 = require("@tinycloud/sdk-services");
 var import_siwe2 = require("siwe");
 var import_share_envelope = require("@tinycloud/share-envelope");
 
@@ -18830,7 +18840,7 @@ function getNodeReplicationLoaders() {
 
 // src/TinyCloudNode.ts
 var import_sdk_core10 = require("@tinycloud/sdk-core");
-var import_sdk_services4 = require("@tinycloud/sdk-services");
+var import_sdk_services6 = require("@tinycloud/sdk-services");
 var import_requestLog2 = require("@tinycloud/sdk-services/telemetry/requestLog");
 var import_resource2 = require("@tinycloud/sdk-services/encryption/resource");
 
@@ -18839,7 +18849,7 @@ var import_node_crypto = require("crypto");
 var import_siwe = require("siwe");
 var import_sdk_core5 = require("@tinycloud/sdk-core");
 var import_resource = require("@tinycloud/sdk-services/encryption/resource");
-var import_sdk_services3 = require("@tinycloud/sdk-services");
+var import_sdk_services4 = require("@tinycloud/sdk-services");
 
 // src/authorization/appKeyHostBinding.ts
 var DOMAIN_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -19114,11 +19124,12 @@ var NodeUserAuthorization = class {
     this.tinycloudHosts = config.tinycloudHosts;
     this.tinycloudRegistryUrl = config.tinycloudRegistryUrl;
     this.tinycloudFallbackHosts = config.tinycloudFallbackHosts;
-    this.registryPolicy = config.registryPolicy;
     this.newUserHost = config.newUserHost;
     this.registryChainId = config.registryChainId;
     this.registrySequenceStore = config.registrySequenceStore ?? (0, import_sdk_core5.createInMemoryRegistrySequenceStore)();
+    this.registryCacheStore = config.registryCacheStore ?? (0, import_sdk_core5.createInMemoryRegistryCacheStore)();
     this.onNodeNotFound = config.onNodeNotFound;
+    this.onRegistryFallback = config.onRegistryFallback;
     this.autoDiscoverLocalNode = config.autoDiscoverLocalNode;
     this.localNodeUrl = config.localNodeUrl;
     this.localLinkName = config.localLinkName;
@@ -19186,13 +19197,8 @@ var NodeUserAuthorization = class {
    * undefined for missing SIWEs and the SDK then treats the session as
    * expired-at-epoch-zero.
    *
-   * @param hosts - The TinyCloud hosts this session was created against,
-   *   as persisted in {@link PersistedSessionData.tinycloudHosts}. When
-   *   present (and non-empty) they are adopted directly so the restored
-   *   session resolves to the same node as the original sign-in without
-   *   re-running registry/fallback resolution. When absent (old session)
-   *   hosts are resolved lazily on the first host-needing call via
-   *   {@link ensureTinyCloudHosts}.
+   * @param hosts - Persisted host hints for genuine no-entry onboarding.
+   *   Current signed registry membership always takes precedence.
    */
   setRestoredTinyCloudSession(session, hosts) {
     const address = (0, import_sdk_core5.canonicalizeAddress)(session.address);
@@ -19254,89 +19260,84 @@ var NodeUserAuthorization = class {
       signature: session.signature
     };
   }
-  /**
-   * Ensure `tinycloudHosts` are resolved before a host-needing call.
-   *
-   * Fresh sign-in resolves hosts up front; a restored session may not have
-   * (old persisted sessions predate {@link PersistedSessionData.tinycloudHosts}).
-   * This guard makes a restored session resolve the node exactly like a fresh
-   * sign-in — persisted hosts are preferred (already set by
-   * {@link setRestoredTinyCloudSession}), otherwise the registry/fallback
-   * resolution runs lazily here. Idempotent: {@link resolveTinyCloudHostsForSignIn}
-   * early-returns when hosts are already set.
-   *
-   * Throws if hosts are unset and the restored session has no address/chainId
-   * to resolve from — a real failure that must surface, not be masked.
-   */
+  /** Refresh the primary space's registry destinations, including after restore. */
   async ensureTinyCloudHosts() {
-    if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
-      return;
-    }
     if (this._address === void 0 || this._chainId === void 0) {
-      throw new Error(
-        "Cannot resolve TinyCloud hosts: no address/chainId available. Sign in or restore a session first."
-      );
+      throw new Error("Cannot resolve TinyCloud hosts: sign in or restore a session first.");
     }
-    await this.resolveTinyCloudHostsForSignIn(this._address, this._chainId);
+    await this.resolveTinyCloudHostsForSignIn(this._address, this._chainId, this._tinyCloudSession?.spaceId);
   }
-  async resolveTinyCloudHostsForSignIn(address, chainId) {
-    if (this.tinycloudHosts && this.tinycloudHosts.length > 0) {
-      return;
-    }
-    if (this.registryPolicy === "fail-closed") {
-      const resolved2 = await (0, import_sdk_core5.resolveFailClosedTinyCloudHosts)(address, {
-        registryUrl: this.tinycloudRegistryUrl,
-        registryChainId: this.registryChainId,
-        newUserHost: this.newUserHost,
-        sequenceStore: this.registrySequenceStore,
-        onNodeNotFound: this.onNodeNotFound,
-        autoDiscoverLocalNode: this.autoDiscoverLocalNode,
-        localNodeUrl: this.localNodeUrl,
-        localLinkName: this.localLinkName,
-        expectedNodeDid: this.expectedNodeDid,
-        localNodeIdentityStore: this.localNodeIdentityStore
-      });
-      this.tinycloudHosts = resolved2.hosts;
-      this.registryVerdict = resolved2.verdict;
-      return;
-    }
-    const subject = (0, import_sdk_core5.pkhDid)(address, chainId);
-    const resolved = await (0, import_sdk_core5.resolveTinyCloudHosts)(subject, {
-      registryUrl: this.tinycloudRegistryUrl,
-      fallbackHosts: this.tinycloudFallbackHosts,
-      autoDiscoverLocalNode: this.autoDiscoverLocalNode,
-      localNodeUrl: this.localNodeUrl,
-      localLinkName: this.localLinkName,
-      expectedNodeDid: this.expectedNodeDid,
-      localNodeIdentityStore: this.localNodeIdentityStore
-    });
-    this.tinycloudHosts = resolved.hosts;
+  async resolveTinyCloudHostsForSignIn(address, chainId, restoredSpaceId) {
+    const spaceId = restoredSpaceId ?? this.resolveSignInCapabilities(address, chainId).spaceId;
+    const destinations = await this.resolveResourceDestinations(spaceId, "read");
+    for (const destination of destinations) await (0, import_sdk_services4.verifyResourceDestination)(destination, globalThis.fetch.bind(globalThis));
+    this.tinycloudHosts = destinations.map(({ url }) => url);
   }
-  /**
-   * Space-creation guard (TC-1443). Under `registryPolicy: "fail-closed"`,
-   * throws unless the owner's registry verdict allows a space on the primary
-   * host: `NodeRegistryEntryExistsError` when the owner's record does not
-   * list it, `RegistryUnavailableError` when the registry gives no
-   * verdict. Reuses this session's sign-in verdict unless it was
-   * `unavailable`, else looks it up now (explicit-host apps). Under the
-   * default policy it returns at once and performs no lookup.
-   */
-  async assertMayCreateSpace() {
-    if (this.registryPolicy !== "fail-closed") return;
-    if (this._address === void 0) {
-      throw new Error("Must be signed in to create a space");
+  /** Current full-resource registry routing; saved hosts are only no-entry hints. */
+  async resolveResourceDestinations(resource, access, noEntryHosts = this.tinycloudHosts ?? []) {
+    const owner = resource.startsWith("urn:tinycloud:encryption:") ? (0, import_sdk_services4.parseNetworkId)(resource.split("/")[0]).ownerDid : (0, import_sdk_core5.parseSpaceUri)(resource)?.owner ?? (() => {
+      const key2 = /^tinycloud:key:(z[^:]+):[^/]+$/.exec(resource);
+      return key2 ? `did:key:${key2[1]}` : void 0;
+    })();
+    if (!owner) throw new Error(`Cannot determine registry owner for ${resource}`);
+    const subject = owner.startsWith("did:pkh:") ? (0, import_sdk_core5.registryOwnerSubjectV1)(owner.slice(owner.lastIndexOf(":") + 1), this.registryChainId) : owner;
+    for (let attempt = 1; ; attempt++) {
+      try {
+        const resolved = await (0, import_sdk_core5.resolveRegistryResource)(subject, resource, access, {
+          registryUrl: this.tinycloudRegistryUrl,
+          registryChainId: this.registryChainId,
+          sequenceStore: this.registrySequenceStore,
+          cacheStore: this.registryCacheStore,
+          onRegistryFallback: this.onRegistryFallback
+        });
+        this.registryVerdict = resolved.verdict;
+        if (resolved.verdict.status === "unregistered") {
+          if (noEntryHosts.length === 0 && (this.autoDiscoverLocalNode ?? true)) {
+            const local = await (0, import_sdk_core5.discoverLocalTinyCloudNode)({
+              localNodeUrl: this.localNodeUrl,
+              localLinkName: this.localLinkName,
+              expectedNodeDid: this.expectedNodeDid,
+              identityStore: this.localNodeIdentityStore
+            });
+            if (local) {
+              (0, import_sdk_core5.warnRegistryDefaultNode)(resolved.verdict, this.registryCacheStore, this.onRegistryFallback);
+              return [{ url: local.url }];
+            }
+          }
+          const host = noEntryHosts[0] ?? this.newUserHost ?? (this.tinycloudFallbackHosts === void 0 ? "https://node.tinycloud.xyz" : this.tinycloudFallbackHosts?.[0]);
+          if (!host || this.newUserHost === null && noEntryHosts.length === 0) throw new import_sdk_core5.NodeNotFoundError(subject, resolved.verdict);
+          const url = (0, import_sdk_core5.exactHttpOrigin)(host, "new-user host");
+          (0, import_sdk_core5.warnRegistryDefaultNode)(resolved.verdict, this.registryCacheStore, this.onRegistryFallback);
+          return [{ url }];
+        }
+        const destinations = resolved.hosts.flatMap((host) => host.urls.map((url) => ({ url, nodeDid: host.nodeDid })));
+        return destinations;
+      } catch (error) {
+        if (!(error instanceof import_sdk_core5.NodeNotFoundError) && !(error instanceof import_sdk_core5.RegistryUnavailableError)) throw error;
+        if (!this.onNodeNotFound) throw error;
+        const decision = await this.onNodeNotFound({ error, attempt });
+        if (decision.action === "retry") continue;
+        if (decision.action === "use-host" && error.verdict?.status === "unregistered") {
+          const url = (0, import_sdk_core5.exactHttpOrigin)(decision.host, "new-user host");
+          (0, import_sdk_core5.warnRegistryDefaultNode)(error.verdict, this.registryCacheStore, this.onRegistryFallback);
+          return [{ url }];
+        }
+        throw error;
+      }
     }
-    await this.ensureTinyCloudHosts();
-    const subject = (0, import_sdk_core5.registryOwnerSubjectV1)(this._address, this.registryChainId);
-    let verdict = this.registryVerdict;
-    if (verdict?.subject !== subject || verdict.status === "unavailable") {
-      verdict = await (0, import_sdk_core5.lookupOwnerRegistryVerdict)(subject, {
-        registryUrl: this.tinycloudRegistryUrl,
-        sequenceStore: this.registrySequenceStore
-      });
-      this.registryVerdict = verdict;
+  }
+  get registryRecordPresent() {
+    return this.registryVerdict?.status === "registered";
+  }
+  /** Refresh membership before hosting; a saved no-entry verdict never authorizes a later creation. */
+  async assertMayCreateSpace(spaceId = this._tinyCloudSession?.spaceId, host = this.primaryTinyCloudHost) {
+    if (!spaceId) throw new Error("Must be signed in to create a space");
+    const destinations = await this.resolveResourceDestinations(spaceId, "host");
+    if (!destinations.some((destination) => destination.url === host)) {
+      const subject = (0, import_sdk_core5.parseSpaceUri)(spaceId)?.owner;
+      if (!subject || !this.registryVerdict) throw new Error("Cannot resolve space owner");
+      (0, import_sdk_core5.assertSpaceCreationAllowed)(this.registryVerdict, host, spaceId);
     }
-    (0, import_sdk_core5.assertSpaceCreationAllowed)(verdict, this.primaryTinyCloudHost);
   }
   requireTinyCloudHosts() {
     if (!this.tinycloudHosts || this.tinycloudHosts.length === 0) {
@@ -19653,7 +19654,7 @@ var NodeUserAuthorization = class {
       if (entry.service !== import_sdk_core5.ENCRYPTION_PERMISSION_SERVICE) {
         return true;
       }
-      const parsed = entry.path.includes("/") ? (0, import_resource.parseEncryptionResource)(entry.path) : { ...(0, import_sdk_services3.parseNetworkId)(entry.path), kind: "network" };
+      const parsed = entry.path.includes("/") ? (0, import_resource.parseEncryptionResource)(entry.path) : { ...(0, import_sdk_services4.parseNetworkId)(entry.path), kind: "network" };
       const sharePrefix = parsed.kind === "prefix" && parsed.network === "default" && parsed.prefix === "share" && entry.actions.length > 0 && entry.actions.every((action) => action === DECRYPT_ACTION || action === KEY_CREATE_ACTION) && didPrincipalMatches(parsed.ownerDid, currentDid);
       if (parsed.kind !== "network" && !sharePrefix) {
         throw new import_sdk_core5.ManifestValidationError("named keys go in manifest.keys");
@@ -19782,6 +19783,31 @@ var NodeUserAuthorization = class {
     checkCurrent();
     const host = context?.host ?? this.primaryTinyCloudHost;
     const spaceId = context?.spaceId ?? (typeof targetSpaceId === "string" ? targetSpaceId : this._tinyCloudSession.spaceId);
+    const destinations = await this.resolveResourceDestinations(spaceId, "host");
+    if (this.registryVerdict?.status === "registered") {
+      const results = [];
+      for (const destination of destinations) {
+        checkCurrent();
+        try {
+          await (0, import_sdk_services4.verifyResourceDestination)(destination, globalThis.fetch.bind(globalThis));
+          const result = await (0, import_sdk_core5.activateSessionWithHost)(destination.url, this._tinyCloudSession.delegationHeader, signal);
+          results.push(result.skipped?.includes(spaceId) ? { ...result, success: false, status: 403, error: "The session does not activate the requested space" } : result);
+        } catch (error) {
+          if ((0, import_sdk_services4.routingFailure)(error) || signal?.aborted) throw error;
+          throw new import_sdk_services4.NodeNotRespondingError([destination.url], error);
+        }
+      }
+      const failed = results.flatMap((result, index) => result.success ? [] : [{ url: destinations[index].url, status: result.status }]);
+      if (failed.length) {
+        if (destinations.length === 1) return results[0];
+        throw new import_sdk_services4.PartialNodeWriteError(destinations.filter((_, index) => results[index].success).map(({ url }) => url), failed);
+      }
+      return {
+        ...results[0],
+        activated: [...new Set(results.flatMap((result) => result.activated ?? []))],
+        skipped: [...new Set(results.flatMap((result) => result.skipped ?? []))]
+      };
+    }
     const peerId = await (0, import_sdk_core5.fetchPeerId)(host, spaceId, signal);
     checkCurrent();
     const siwe = this.wasm.generateHostSIWEMessage(
@@ -19852,13 +19878,45 @@ var NodeUserAuthorization = class {
     if (!this._tinyCloudSession) {
       throw new Error("Must be signed in to ensure space exists");
     }
-    await this.ensureTinyCloudHosts();
-    const host = this.primaryTinyCloudHost;
     const primarySpaceId = this._tinyCloudSession.spaceId;
-    const result = await (0, import_sdk_core5.activateSessionWithHost)(
-      host,
-      this._tinyCloudSession.delegationHeader
-    );
+    const primary = await this.resolveResourceDestinations(primarySpaceId, "read");
+    this.tinycloudHosts = primary.map(({ url }) => url);
+    const targets = new Map(primary.map((destination) => [destination.url, destination]));
+    if (this.registryVerdict?.status === "registered" && this.registryVerdict.record) {
+      const record = this.registryVerdict.record;
+      const resources = Object.keys((0, import_sdk_core5.extractRecapAttenuations)(this._tinyCloudSession.siwe ?? ""));
+      for (const space of record.spaces) {
+        const registeredSpace = (0, import_sdk_core5.parseSpaceUri)(space.space);
+        if (!resources.some((resource) => {
+          const fullSpace = resource.split("/")[0];
+          const requestedSpace = (0, import_sdk_core5.parseSpaceUri)(fullSpace);
+          return fullSpace === space.space || registeredSpace !== null && requestedSpace !== null && registeredSpace.owner === requestedSpace.owner && registeredSpace.name === requestedSpace.name;
+        })) continue;
+        for (const membership of space.nodes) {
+          const node = record.nodes.find((candidate) => candidate.did === membership.did);
+          targets.set(node.url, { url: node.url, nodeDid: node.did });
+        }
+      }
+      if (record.encryptionNode && resources.some((resource) => resource.startsWith("urn:tinycloud:encryption:"))) {
+        const node = record.nodes.find((candidate) => candidate.did === record.encryptionNode);
+        targets.set(node.url, { url: node.url, nodeDid: node.did });
+      }
+    }
+    let result;
+    for (const destination of targets.values()) {
+      await (0, import_sdk_services4.verifyResourceDestination)(destination, globalThis.fetch.bind(globalThis));
+      let activated;
+      try {
+        activated = await (0, import_sdk_core5.activateSessionWithHost)(destination.url, this._tinyCloudSession.delegationHeader);
+      } catch (error) {
+        throw new import_sdk_services4.NodeNotRespondingError([destination.url], error);
+      }
+      if (!activated.success && activated.status !== 404) {
+        throw Object.assign(new Error(`Failed to activate session: ${describeHostFailure(activated)}`), { cause: activated });
+      }
+      if (destination.url === primary[0].url) result = activated;
+    }
+    if (!result) throw new Error("Primary space activation did not return a result");
     this.recordActivationSkippedSpaces(result, primarySpaceId);
     if (!result.success && result.status !== 404) {
       throw Object.assign(
@@ -19906,7 +19964,7 @@ var NodeUserAuthorization = class {
   /** {@link assertMayCreateSpace}, reporting a refusal to the creation handler before rethrowing it. */
   async guardSpaceCreation(handler, context) {
     try {
-      await this.assertMayCreateSpace();
+      await this.assertMayCreateSpace(context.spaceId, context.host);
     } catch (error) {
       const failure = error instanceof Error ? error : new Error(String(error));
       handler.onSpaceCreationFailed?.(context, failure);
@@ -21813,6 +21871,7 @@ var _TinyCloudNode = class _TinyCloudNode {
    * ```
    */
   constructor(config = {}) {
+    this.registryRefreshOwners = /* @__PURE__ */ new Set();
     this.signer = null;
     this.auth = null;
     this.consumedOpenKeyPendings = /* @__PURE__ */ new WeakSet();
@@ -21976,8 +22035,10 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.config = {
       ...config,
       host: config.host ?? DEFAULT_HOST,
+      registryPolicy: "fail-closed",
       // One store for every authorization this client creates.
-      registrySequenceStore: config.registrySequenceStore ?? (0, import_sdk_core10.createInMemoryRegistrySequenceStore)()
+      registrySequenceStore: config.registrySequenceStore ?? (0, import_sdk_core10.createInMemoryRegistrySequenceStore)(),
+      registryCacheStore: config.registryCacheStore ?? (0, import_sdk_core10.createInMemoryRegistryCacheStore)()
     };
     if (this.config.replication?.enabled) {
       const runtime = getNodeReplicationLoaders().runtime().then(({ ReplicationRuntime: ReplicationRuntime2 }) => {
@@ -22281,7 +22342,11 @@ var _TinyCloudNode = class _TinyCloudNode {
       // A session saved but never registered on this node is refused: it registers once.
       activate: (signal) => {
         assertCurrent();
-        return (0, import_sdk_core10.activateSessionWithHost)(host, session.delegationHeader, AbortSignal.any([signal, graph.signal]));
+        const activationSignal = AbortSignal.any([signal, graph.signal]);
+        if (primary && primary.delegationCid === session.delegationCid) {
+          return this.activateSignedSession(primary, primary.siwe, host, activationSignal);
+        }
+        return this.activateResourceSession(session.delegationHeader, [spaceId], host, activationSignal);
       }
     });
     assertCurrent();
@@ -22417,14 +22482,38 @@ var _TinyCloudNode = class _TinyCloudNode {
   get requests() {
     return this._requestLog === void 0 ? void 0 : (0, import_requestLog2.readOnlyRequestLog)(this._requestLog);
   }
-  createServiceGraphLifetime() {
+  throwRegistryRefusal(status, text) {
+    if (status !== 403 && status !== 503 || !text.startsWith("registry_unavailable:") && !text.startsWith("registry_hosting_denied:")) return;
+    const code = status === 503 ? "registry_unavailable" : "node_registry_entry_exists";
+    throw Object.assign(new Error(status === 503 ? "The location registry is unavailable for this resource." : "The registry does not authorize this node for the requested resource."), { code, meta: { status } });
+  }
+  createServiceGraphLifetime(session) {
+    const routedFetch = (0, import_sdk_services5.createResourceRoutingFetch)(
+      async (url, init2) => {
+        try {
+          const response = await globalThis.fetch(url, init2);
+          if (response.status === 403 || response.status === 503) {
+            this.throwRegistryRefusal(response.status, await response.clone().text());
+          }
+          return response;
+        } catch (error) {
+          if ((0, import_sdk_services5.routingFailure)(error)) throw error;
+          if (new URL(url).pathname.startsWith("/encryption/") && !init2?.signal?.aborted) {
+            throw new import_sdk_services5.NodeNotRespondingError([new URL(url).origin], error);
+          }
+          throw error;
+        }
+      },
+      {
+        resolveResource: (resource, access) => this.routingDestinations(resource, access),
+        bindAudience: (authorization, nodeDid) => this.bindRoutedAudience(authorization, nodeDid, session),
+        verifyDestination: (target) => (0, import_sdk_services5.verifyResourceDestination)(target, globalThis.fetch.bind(globalThis))
+      }
+    );
     return new ServiceGraphLifetime(
       this.invokeWithRuntimePermissions,
       this.invokeAnyWithRuntimePermissions,
-      // Resolve fetch at request time. This keeps the graph-owned lifetime
-      // signal while preserving the SDK's existing injectable global fetch
-      // behavior (including adapters that install it after construction).
-      (url, init2) => globalThis.fetch(url, init2),
+      routedFetch,
       (context) => {
         this.storageFull.observe(context);
         if (this._requestLog) (0, import_requestLog2.observeReplicaReads)(context, this._requestLog);
@@ -22432,6 +22521,75 @@ var _TinyCloudNode = class _TinyCloudNode {
       this._requestLog
     );
   }
+  async routingDestinations(resource, access, noEntryHosts) {
+    const session = this.currentTinyCloudSession();
+    if (session) this.refreshRegistryOwner((0, import_sdk_core10.pkhDid)(session.address, session.chainId));
+    if (this.auth) return this.auth.resolveResourceDestinations(resource, access, noEntryHosts);
+    const owner = resource.startsWith("urn:tinycloud:encryption:") ? (0, import_sdk_core10.parseNetworkId)(resource.split("/")[0]).ownerDid : (0, import_sdk_core10.parseSpaceUri)(resource)?.owner ?? (() => {
+      const key2 = /^tinycloud:key:(z[^:]+):[^/]+$/.exec(resource);
+      return key2 ? `did:key:${key2[1]}` : void 0;
+    })();
+    if (!owner) throw new Error(`Cannot determine registry owner for ${resource}`);
+    const subject = owner.startsWith("did:pkh:") ? (0, import_sdk_core10.pkhDid)(owner.slice(owner.lastIndexOf(":") + 1), this.config.registryChainId ?? 1) : owner;
+    const resolved = await (0, import_sdk_core10.resolveRegistryResource)(subject, resource, access, {
+      registryUrl: this.config.tinycloudRegistryUrl,
+      registryChainId: this.config.registryChainId,
+      sequenceStore: this.config.registrySequenceStore,
+      cacheStore: this.config.registryCacheStore,
+      onRegistryFallback: this.config.onRegistryFallback
+    });
+    if (resolved.verdict.status === "unregistered") {
+      const hint = noEntryHosts === void 0 ? this.explicitHost ?? this.config.host : noEntryHosts[0];
+      const host = hint ?? this.config.newUserHost ?? (this.config.tinycloudFallbackHosts === void 0 ? DEFAULT_HOST : this.config.tinycloudFallbackHosts?.[0]);
+      if (!host || !hint && this.config.newUserHost === null) throw new import_sdk_core10.NodeNotFoundError(subject, resolved.verdict);
+      const url = (0, import_sdk_core10.exactHttpOrigin)(host, "new-user host");
+      (0, import_sdk_core10.warnRegistryDefaultNode)(resolved.verdict, this.config.registryCacheStore, this.config.onRegistryFallback);
+      return [{ url }];
+    }
+    const destinations = resolved.hosts.flatMap((host) => host.urls.map((url) => ({ url, nodeDid: host.nodeDid })));
+    return destinations;
+  }
+  /** Transport hints cannot override verified full-resource registry routing. */
+  async resolveRegisteredDelegationHost(permissions, noEntryHost) {
+    const resources = /* @__PURE__ */ new Map();
+    let hasData = false;
+    for (const permission of permissions) {
+      const encryption = this.isEncryptionNetworkOperation(this.invocationServiceName(permission.service), permission.path, permission.space);
+      const resource = encryption ? permission.path.split("/")[0] : permission.space;
+      if (!resource) throw new import_sdk_services5.ResourceNotRoutedError("delegation");
+      resources.set(resource, encryption ? "encryption" : "host");
+      hasData || (hasData = !encryption);
+    }
+    let dataHost;
+    let encryptionHost;
+    let unserved;
+    for (const [resource, access] of resources) {
+      try {
+        const destinations = await this.routingDestinations(resource, access, [noEntryHost]);
+        if (destinations.some(({ nodeDid }) => nodeDid === void 0)) return void 0;
+        if (access === "host") dataHost ?? (dataHost = destinations[0]?.url);
+        else encryptionHost ?? (encryptionHost = destinations[0]?.url);
+      } catch (error) {
+        if (!(error instanceof import_sdk_core10.NodeNotFoundError) || error.verdict.status !== "registered") throw error;
+        unserved ?? (unserved = error);
+      }
+    }
+    const host = hasData ? dataHost : encryptionHost;
+    if (!host) throw unserved ?? new import_sdk_services5.ResourceNotRoutedError("delegation");
+    return host;
+  }
+  async bindRoutedAudience(authorization, nodeDid, stagedSession) {
+    const payload = JSON.parse(new TextDecoder().decode(base64UrlDecode(authorization.split(".")[1])));
+    const issuer = typeof payload === "object" && payload !== null && "iss" in payload ? payload.iss : void 0;
+    const session = [
+      stagedSession,
+      this._serviceContext?.session,
+      this.auth?.tinyCloudSession,
+      ...this.runtimePermissionGrants.map((grant) => grant.session)
+    ].find((candidate) => candidate?.verificationMethod === issuer);
+    if (!session) throw new Error("Invocation signing session is not active");
+    return rewriteInvocationAudience(authorization, nodeDid, session.jwk);
+  }
   syncResolvedHostFromAuth() {
     const host = this.auth?.hosts[0];
     if (host) {
@@ -22545,6 +22703,29 @@ var _TinyCloudNode = class _TinyCloudNode {
     const session = this.currentTinyCloudSession();
     return session?.siwe ? this.projectSignedRecapCapabilities(session.siwe) : [];
   }
+  /** Start one background refresh for each owner derived from verified authority. */
+  refreshRegistryForCapabilities(permissions) {
+    for (const permission of permissions) {
+      try {
+        const owner = permission.service === "tinycloud.encryption" && permission.path.startsWith("urn:tinycloud:encryption:") ? (0, import_sdk_core10.parseNetworkId)(permission.path.split("/")[0]).ownerDid : permission.space ? this.ownerDidFromSpaceId(permission.space) : void 0;
+        if (owner) this.refreshRegistryOwner(owner);
+      } catch {
+      }
+    }
+  }
+  refreshRegistryOwner(owner) {
+    if (this.config.tinycloudRegistryUrl === null) return;
+    const subject = owner.startsWith("did:pkh:") ? (0, import_sdk_core10.pkhDid)(owner.slice(owner.lastIndexOf(":") + 1), this.config.registryChainId ?? 1) : owner;
+    const key2 = (0, import_sdk_core10.registryOwnerKeyV2)(subject);
+    if (this.registryRefreshOwners.has(key2)) return;
+    this.registryRefreshOwners.add(key2);
+    void (0, import_sdk_core10.refreshOwnerRegistry)(subject, {
+      registryUrl: this.config.tinycloudRegistryUrl,
+      registryChainId: this.config.registryChainId,
+      sequenceStore: this.config.registrySequenceStore,
+      cacheStore: this.config.registryCacheStore
+    }).catch(() => void 0);
+  }
   /** Normalize signed capabilities without collapsing nested encryption into raw authority. */
   projectSignedRecapCapabilities(siwe) {
     const projected = this.parseRecapWithCaveats(siwe).map((entry) => {
@@ -22976,6 +23157,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     const primarySession = this.currentTinyCloudSession();
     if (primarySession) {
       this.registerPrimarySessionGrant(primarySession);
+      this.refreshRegistryOwner((0, import_sdk_core10.pkhDid)(primarySession.address, primarySession.chainId));
+      this.refreshRegistryForCapabilities(this.getVerifiedSessionCapabilities());
       if (this.auth?.spaceHosting === "unknown") {
         await this.checkSpaceHosting();
         this.assertSessionEpoch(epoch, "Sign-in");
@@ -23198,8 +23381,8 @@ var _TinyCloudNode = class _TinyCloudNode {
     const primarySession = auth.tinyCloudSession;
     const defaultSpaceId = this.ownedSpaceId("default");
     const canReusePrimaryBootstrapSession = primarySession?.spaceId === defaultSpaceId && auth.capabilityRequest === import_sdk_core10.BOOTSTRAP_SESSION_REQUESTS.default;
-    if (steps.some((step) => step.kind === "host")) {
-      await this.assertMayCreateSpace();
+    for (const step of steps) {
+      if (step.kind === "host") await this.assertMayCreateSpace(step.spaceId);
     }
     for (const step of steps) {
       if (step.kind !== "session") continue;
@@ -23248,10 +23431,20 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (!session) {
         throw new Error(`Missing bootstrap session for ${step.space}`);
       }
-      const activated = await (0, import_sdk_core10.activateSessionWithHost)(host, session.delegationHeader, graph.signal).catch((error) => {
-        graph.assertActive();
-        throw error;
-      });
+      const destinations = await this.routingDestinations(step.spaceId, "host");
+      let activated;
+      for (const destination of destinations) {
+        try {
+          await (0, import_sdk_services5.verifyResourceDestination)(destination, globalThis.fetch.bind(globalThis));
+          const result = await (0, import_sdk_core10.activateSessionWithHost)(destination.url, session.delegationHeader, graph.signal);
+          if (!result.success) throw Object.assign(new Error("Bootstrap activation failed"), { cause: result });
+          activated = result;
+        } catch (error) {
+          graph.assertActive();
+          throw error;
+        }
+      }
+      if (!activated) throw new Error("Bootstrap space has no destination");
       graph.assertActive();
       if (!activated.success || activated.skipped?.includes(step.spaceId)) {
         throw Object.assign(
@@ -23581,7 +23774,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!this.currentSessionCoversAccountRegistry()) {
       if (!_TinyCloudNode.accountRegistrySkipLogged) {
         _TinyCloudNode.accountRegistrySkipLogged = true;
-        import_sdk_services4.tinyCloudDebugLogger.log("registry.skip");
+        import_sdk_services6.tinyCloudDebugLogger.log("registry.skip");
       }
       return;
     }
@@ -23834,6 +24027,13 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!session) {
       throw new Error("Owned space hosting requires an active session");
     }
+    await this.assertMayCreateSpace(spaceId);
+    if (this.auth.registryRecordPresent) {
+      const hosted = await this.hostOwnedSpaceOnce(spaceId, signal);
+      if (!hosted.success) throw Object.assign(new Error(`Failed to activate listed space ${spaceId}: ${describeHostFailure2(hosted)}`), { cause: hosted });
+      if (this.auth.tinyCloudSession === session) this.confirmedHostedSpaceIds.add(spaceId);
+      return;
+    }
     if (this.confirmedHostedSpaceIds.has(spaceId) || this.hostedOwnedSpaceIds.has(spaceId)) {
       return;
     }
@@ -23852,7 +24052,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: activation }
       );
     }
-    await this.assertMayCreateSpace();
+    await this.assertMayCreateSpace(spaceId);
     if (signal?.aborted) throw signal.reason;
     const created = await this.hostOwnedSpaceOnce(spaceId, signal);
     if (!created.success) {
@@ -23913,17 +24113,19 @@ var _TinyCloudNode = class _TinyCloudNode {
         { cause: hosted }
       );
     }
-    const activation = await (0, import_sdk_core10.activateSessionWithHost)(
-      host,
-      session.delegationHeader
-    );
-    if (!activation.success || activation.skipped?.includes(spaceId)) {
-      throw Object.assign(
-        new Error(
-          `Failed to activate session for owned space ${spaceId}: ${activation.success ? "space was skipped" : describeHostFailure2(activation)}`
-        ),
-        { cause: activation }
+    if (!this.auth.registryRecordPresent) {
+      const activation = await (0, import_sdk_core10.activateSessionWithHost)(
+        host,
+        session.delegationHeader
       );
+      if (!activation.success || activation.skipped?.includes(spaceId)) {
+        throw Object.assign(
+          new Error(
+            `Failed to activate session for owned space ${spaceId}: ${activation.success ? "space was skipped" : describeHostFailure2(activation)}`
+          ),
+          { cause: activation }
+        );
+      }
     }
     if (this.auth?.tinyCloudSession === session) this.hostedOwnedSpaceIds.add(spaceId);
     try {
@@ -23967,11 +24169,9 @@ var _TinyCloudNode = class _TinyCloudNode {
    * session's recap doesn't cover it and the registry has no record; the host
    * SIWE is idempotent server-side. Must be called after {@link signIn}.
    *
-   * Under `registryPolicy: "fail-closed"`, hosting is refused with
-   * `NodeRegistryEntryExistsError` when the owner's registry record does not
-   * list the host, or `RegistryUnavailableError` when the registry gives no
-   * verdict. {@link hostOwnedSpace} itself is an explicit action and is not
-   * guarded.
+   * Current signed per-space membership is checked before both automatic and
+   * explicit hosting. Registered replicas use the session grant; no-entry
+   * onboarding retains the host-SIWE flow.
    *
    * @param name - The owned space name (e.g. `"secrets"`).
    * @returns The hosted owned-space URI.
@@ -23981,27 +24181,20 @@ var _TinyCloudNode = class _TinyCloudNode {
       throw new Error("Not signed in. Call signIn() first.");
     }
     const spaceId = this.ownedSpaceId(name);
+    await this.assertMayCreateSpace(spaceId);
     if (this.hostedOwnedSpaceIds.has(spaceId) || await this.isOwnedSpaceRegistered(spaceId)) {
       return spaceId;
     }
-    await this.assertMayCreateSpace();
     return this.hostOwnedSpace(name);
   }
-  /**
-   * Space-creation guard (TC-1443) for the automatic hosting paths: sign-in's
-   * owned spaces, account bootstrap, {@link ensureOwnedSpaceHosted} and
-   * {@link ensurePublicSpace}. Only `registryPolicy: "fail-closed"` consults
-   * the registry ({@link NodeUserAuthorization.assertMayCreateSpace}); the
-   * default policy performs no lookup.
-   */
-  async assertMayCreateSpace() {
-    if (this.config.registryPolicy !== "fail-closed") return;
-    await this.auth.assertMayCreateSpace();
+  /** Refresh full-space membership before any automatic or explicit hosting. */
+  async assertMayCreateSpace(spaceId) {
+    await this.routingDestinations(spaceId, "host");
   }
   /** Registry-policy settings shared by every authorization this client creates. */
   registryPolicyConfig() {
-    const { registryPolicy, newUserHost, registryChainId, registrySequenceStore, onNodeNotFound } = this.config;
-    return { registryPolicy, newUserHost, registryChainId, registrySequenceStore, onNodeNotFound };
+    const { registryPolicy, newUserHost, registryChainId, registrySequenceStore, registryCacheStore, onNodeNotFound, onRegistryFallback } = this.config;
+    return { registryPolicy, newUserHost, registryChainId, registrySequenceStore, registryCacheStore, onNodeNotFound, onRegistryFallback };
   }
   /**
    * Submit the host delegation for an owned space, sharing one in-flight
@@ -24207,12 +24400,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
       stagedSessionExpiry = signedExpiry ?? persistedPolicyExpiry ?? persistedExpiry(void 0);
     }
-    const resolvedHost = await this.resolveRestoredHost(
-      sessionData.tinycloudHosts,
-      restoredAddress,
-      sessionData.chainId
-    );
-    const stagedHost = resolvedHost ?? this.config.host;
+    const restoreHints = this.explicitHost ? [this.explicitHost] : sessionData.tinycloudHosts ?? [];
+    const stagedHost = (0, import_sdk_core10.exactHttpOrigin)(restoreHints[0] ?? this.config.host, "restored host hint");
     let restoredNodeFeatures;
     let replicaProtocolMismatch = false;
     if (this.config.replication?.enabled) {
@@ -24329,7 +24518,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     this.sessionManager = stagedManager;
     this.sessionKeyId = stagedKeyId;
     this.sessionKeyJwk = stagedJwk;
-    if (resolvedHost) this.config.host = resolvedHost;
+    this.config.host = stagedHost;
     if (spaceOwnerKey(serviceSession.spaceId) !== this.currentStorageOwner()) {
       this.storageFull.clear();
       this._requestLog?.clear();
@@ -24396,6 +24585,10 @@ var _TinyCloudNode = class _TinyCloudNode {
       if (attempt === this.latestSessionAttempt) await this.endSession();
       this.assertSessionEpoch(epoch, "Session restore");
     }
+    if (this.config.replication?.enabled) {
+      if (stagedAddress !== void 0) this.refreshRegistryOwner((0, import_sdk_core10.pkhDid)(stagedAddress, stagedChainId));
+      this.refreshRegistryForCapabilities(this.getVerifiedSessionCapabilities());
+    }
   }
   stagePrimarySessionState(session, verificationMethod, host, sessionExpiry, recap) {
     if (!session?.siwe) return { cache: void 0, grants: [] };
@@ -24444,7 +24637,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     };
   }
   stageRestoredServiceGraph(input) {
-    const graph = this.createServiceGraphLifetime();
+    const graph = this.createServiceGraphLifetime(input.serviceSession);
     const core = this.auth ? new import_sdk_core10.TinyCloud(this.auth, {
       invokeAny: graph.invokeAny,
       telemetry: this.config.telemetry,
@@ -24669,56 +24862,6 @@ var _TinyCloudNode = class _TinyCloudNode {
     spaceService.updateConfig({ sharingService });
     return { core, graph, serviceContext, kv, sql, duckdb, hooks, vault, encryption, capabilityRegistry, keyProvider, sharingService, delegationManager, spaceService };
   }
-  /**
-   * Resolve the host a restored session should target.
-   *
-   * Mirrors fresh sign-in host resolution but for the restore path:
-   * an explicit/pinned host always wins, then the hosts the session was
-   * persisted with, then a lazy registry/fallback resolution for sessions
-   * that predate the persisted `tinycloudHosts` field. Returns `undefined`
-   * only when there's nothing to resolve from (no explicit host, no
-   * persisted hosts, and no address/chainId) — in which case the existing
-   * `config.host` (default) is left in place.
-   *
-   * Resolution failures are surfaced, not swallowed: a genuinely broken
-   * registry lookup throws rather than silently falling back to a wrong host.
-   */
-  async resolveRestoredHost(persistedHosts, address, chainId) {
-    if (this.explicitHost) {
-      return this.explicitHost;
-    }
-    if (persistedHosts && persistedHosts.length > 0) {
-      return persistedHosts[0];
-    }
-    if (address === void 0 || chainId === void 0) {
-      return void 0;
-    }
-    if (this.config.registryPolicy === "fail-closed") {
-      const resolved2 = await (0, import_sdk_core10.resolveFailClosedTinyCloudHosts)(address, {
-        registryUrl: this.config.tinycloudRegistryUrl,
-        registryChainId: this.config.registryChainId,
-        newUserHost: this.config.newUserHost,
-        sequenceStore: this.config.registrySequenceStore,
-        onNodeNotFound: this.config.onNodeNotFound,
-        autoDiscoverLocalNode: this.config.autoDiscoverLocalNode,
-        localNodeUrl: this.config.localNodeUrl,
-        localLinkName: this.config.localLinkName,
-        expectedNodeDid: this.config.expectedNodeDid,
-        localNodeIdentityStore: this.config.localNodeIdentityStore
-      });
-      return resolved2.hosts[0];
-    }
-    const resolved = await (0, import_sdk_core10.resolveTinyCloudHosts)((0, import_sdk_core10.pkhDid)(address, chainId), {
-      registryUrl: this.config.tinycloudRegistryUrl,
-      fallbackHosts: this.config.tinycloudFallbackHosts,
-      autoDiscoverLocalNode: this.config.autoDiscoverLocalNode,
-      localNodeUrl: this.config.localNodeUrl,
-      localLinkName: this.config.localLinkName,
-      expectedNodeDid: this.config.expectedNodeDid,
-      localNodeIdentityStore: this.config.localNodeIdentityStore
-    });
-    return resolved.hosts[0];
-  }
   /**
    * Resolve the currently-active TinyCloudSession, preferring the auth
    * layer's value (wallet mode) and falling back to the node-level
@@ -25193,10 +25336,10 @@ var _TinyCloudNode = class _TinyCloudNode {
    * second time. Only a value recorded for this exact host qualifies; older
    * nodes that omit `nodeId` fall through to the fetch.
    */
-  async fetchNodeId() {
-    const cached = this.auth?.nodeIdForHost(this.config.host);
+  async fetchNodeId(host = this.config.host) {
+    const cached = this.auth?.nodeIdForHost(host);
     if (cached) return cached;
-    const response = await fetch(`${this.config.host}/info`);
+    const response = await fetch(`${host}/info`);
     if (!response.ok) {
       throw await (0, import_sdk_core10.httpResponseError)(response, "Failed to fetch node info");
     }
@@ -25244,10 +25387,24 @@ var _TinyCloudNode = class _TinyCloudNode {
       )
     };
   }
-  async fetchEncryptionNetworkAt(host, networkId, fetchFn) {
-    const response = await fetchFn(
-      `${host}/encryption/networks/${encodeURIComponent(networkId)}`
-    );
+  async encryptionDestination(networkId) {
+    const destination = (await this.routingDestinations(networkId, "encryption"))[0];
+    if (!destination) throw new Error("No encryption destination is registered");
+    await (0, import_sdk_services5.verifyResourceDestination)(destination, globalThis.fetch.bind(globalThis));
+    return { ...destination, nodeDid: destination.nodeDid ?? await this.fetchNodeId(destination.url) };
+  }
+  async fetchEncryptionNetworkAt(host, networkId, fetchFn, callerSignal) {
+    let response;
+    const timeout = AbortSignal.timeout(5e3);
+    try {
+      response = await fetchFn(`${host}/encryption/networks/${encodeURIComponent(networkId)}`, {
+        signal: callerSignal ? AbortSignal.any([callerSignal, timeout]) : timeout,
+        redirect: "error"
+      });
+    } catch (error) {
+      if ((0, import_sdk_services5.routingFailure)(error) || callerSignal?.aborted || !timeout.aborted && error instanceof Error && error.name === "AbortError") throw error;
+      throw new import_sdk_services5.NodeNotRespondingError([host], error);
+    }
     if (response.status === 404) return null;
     if (!response.ok) {
       throw await (0, import_sdk_core10.httpResponseError)(response, `Failed to fetch encryption network ${networkId}`);
@@ -25257,18 +25414,18 @@ var _TinyCloudNode = class _TinyCloudNode {
   }
   createEncryptionService(binding) {
     const graph = binding?.graph ?? this._serviceGraph;
-    const host = binding?.host ?? this.config.host;
     const session = binding?.session ?? this.requireEncryptionSession();
     const did = binding?.did ?? this.did;
     const address = binding?.address ?? this._address;
     const chainId = binding?.chainId ?? this._chainId;
     const crypto3 = this.createEncryptionCrypto();
-    const descriptorCache = /* @__PURE__ */ new Map();
     const transport = {
-      postDecrypt: async ({ networkId, authorization, canonicalBody, signal }) => {
+      postDecrypt: async ({ targetNode, networkId, authorization, canonicalBody, signal }) => {
         graph.assertActive();
+        const destination = await this.encryptionDestination(networkId);
+        if (destination.nodeDid !== targetNode) throw new import_sdk_services5.NodeIdentityMismatchError(destination.url, destination.nodeDid, targetNode);
         const response = await graph.fetch(
-          `${host}/encryption/networks/${encodeURIComponent(networkId)}/decrypt`,
+          `${destination.url}/encryption/networks/${encodeURIComponent(networkId)}/decrypt`,
           {
             method: "POST",
             headers: {
@@ -25281,7 +25438,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         );
         graph.assertActive();
         if (!response.ok) {
-          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services4.parsePermissionHint)({
+          const permissionHint = response.status === 401 || response.status === 403 ? (0, import_sdk_services6.parsePermissionHint)({
             service: "tinycloud.encryption",
             path: networkId,
             actions: ["tinycloud.encryption/decrypt"]
@@ -25296,6 +25453,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       }
     };
     return new import_sdk_core10.EncryptionService({
+      resolveTargetNode: async (networkId) => (await this.encryptionDestination(networkId)).nodeDid,
       crypto: crypto3,
       signer: {
         signDecryptInvocation: async (input) => {
@@ -25319,18 +25477,8 @@ var _TinyCloudNode = class _TinyCloudNode {
       node: {
         fetchByNetworkId: async (networkId) => {
           graph.assertActive();
-          let pending = descriptorCache.get(networkId);
-          if (!pending) {
-            pending = this.fetchEncryptionNetworkAt(host, networkId, graph.fetch).then((descriptor2) => {
-              if (descriptor2 === null) descriptorCache.delete(networkId);
-              return descriptor2;
-            }).catch((error) => {
-              descriptorCache.delete(networkId);
-              throw error;
-            });
-            descriptorCache.set(networkId, pending);
-          }
-          const descriptor = await pending;
+          const destination = await this.encryptionDestination(networkId);
+          const descriptor = await this.fetchEncryptionNetworkAt(destination.url, networkId, graph.fetch, graph.signal);
           graph.assertActive();
           return descriptor;
         }
@@ -25338,13 +25486,15 @@ var _TinyCloudNode = class _TinyCloudNode {
       wellKnown: {
         fetchWellKnown: async (principal, discoveryKey) => {
           graph.assertActive();
+          const destination = await this.encryptionDestination(this.getDefaultEncryptionNetworkId());
+          if (this.auth?.registryRecordPresent) return null;
           if (!address || !didPrincipalMatches2(principal, did)) {
             return null;
           }
           const publicSpaceId = (0, import_sdk_core10.makePublicSpaceId)(address, chainId);
           const encodedKey = discoveryKey.split("/").map(encodeURIComponent).join("/");
           const response = await graph.fetch(
-            `${host}/public/${encodeURIComponent(publicSpaceId)}/kv/${encodedKey}`,
+            `${destination.url}/public/${encodeURIComponent(publicSpaceId)}/kv/${encodedKey}`,
             { method: "GET" }
           );
           graph.assertActive();
@@ -25714,7 +25864,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     const signature2 = await this.signer.signMessage(prepared.siwe);
     assertOwnerGraphActive();
     const delegationSession = this.wasmBindings.completeSessionSetup({ ...prepared, signature: signature2 });
-    const activation = await (0, import_sdk_core10.activateSessionWithHost)(host, delegationSession.delegationHeader);
+    const activation = await this.activateSignedSession(delegationSession, prepared.siwe, host);
     assertOwnerGraphActive();
     if (!activation.success) {
       throw Object.assign(
@@ -26033,15 +26183,16 @@ var _TinyCloudNode = class _TinyCloudNode {
   async getEncryptionNetwork(nameOrNetworkId = this.getDefaultEncryptionNetworkId()) {
     const networkId = nameOrNetworkId.startsWith("urn:tinycloud:encryption:") ? nameOrNetworkId : this.getDefaultEncryptionNetworkId(nameOrNetworkId);
     return this.fetchEncryptionNetworkAt(
-      this.config.host,
+      (await this.encryptionDestination(networkId)).url,
       networkId,
       globalThis.fetch.bind(globalThis)
     );
   }
   async createEncryptionNetwork(name = DEFAULT_ENCRYPTION_NETWORK_NAME) {
-    const targetNode = await this.fetchNodeId();
     const ownerDid = this.did;
     const networkId = this.getDefaultEncryptionNetworkId(name);
+    const destination = await this.encryptionDestination(networkId);
+    const targetNode = destination.nodeDid;
     const body = {
       name,
       ownerDid,
@@ -26064,7 +26215,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       action: NETWORK_CREATE_ACTION2,
       facts
     });
-    const response = await fetch(`${this.config.host}/encryption/networks`, {
+    const response = await this._serviceGraph.fetch(`${destination.url}/encryption/networks`, {
       method: "POST",
       headers: {
         Authorization: signed2.authorization,
@@ -26157,7 +26308,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     );
     if (result.status !== "ok") {
       if (result.status === "permission_required") {
-        const hint = (0, import_sdk_services4.parsePermissionHint)(result.hint);
+        const hint = (0, import_sdk_services6.parsePermissionHint)(result.hint);
         if (hint === void 0) return { status: "read_failed" };
         return {
           status: "permission_required",
@@ -26404,6 +26555,97 @@ var _TinyCloudNode = class _TinyCloudNode {
     }
     return { recap: exactVerifiedRecap(verified), expiresAt };
   }
+  async activateResourceSession(delegationHeader, resources, hostHint, signal) {
+    const targets = /* @__PURE__ */ new Map();
+    const routedSpaces = [];
+    let unserved;
+    let requestedResource;
+    for (const resource of new Set(resources)) {
+      requestedResource ?? (requestedResource = resource);
+      signal?.throwIfAborted();
+      try {
+        const encryption = resource.startsWith("urn:tinycloud:encryption:");
+        const destinations = await this.routingDestinations(
+          resource,
+          encryption ? "encryption" : "host",
+          [hostHint ?? this.config.host]
+        );
+        if (!encryption && destinations.some(({ nodeDid }) => nodeDid !== void 0)) routedSpaces.push(resource);
+        for (const destination of destinations) {
+          let target = targets.get(destination.url);
+          if (!target) {
+            target = { destination, spaces: [] };
+            targets.set(destination.url, target);
+          }
+          if (!encryption && destination.nodeDid !== void 0) target.spaces.push(resource);
+        }
+      } catch (error) {
+        if (!(error instanceof import_sdk_core10.NodeNotFoundError)) throw error;
+        unserved ?? (unserved = error);
+      }
+    }
+    if (targets.size === 0) throw unserved ?? new import_sdk_services5.ResourceNotRoutedError(requestedResource ?? "session grant");
+    const succeeded = [];
+    const accepted = [];
+    const failed = [];
+    let refusal;
+    for (const { destination: target, spaces } of targets.values()) {
+      signal?.throwIfAborted();
+      try {
+        await (0, import_sdk_services5.verifyResourceDestination)(target, globalThis.fetch.bind(globalThis));
+        const timeout = AbortSignal.timeout(5e3);
+        const result = await (0, import_sdk_core10.activateSessionWithHost)(
+          target.url,
+          delegationHeader,
+          signal ? AbortSignal.any([signal, timeout]) : timeout
+        );
+        this.throwRegistryRefusal(result.status, result.error ?? "");
+        if (result.success) {
+          const skipped = result.skipped?.find((space) => spaces.some((expected) => this.spaceIdsEqual(space, expected)));
+          if (skipped) {
+            failed.push({ url: target.url, status: result.status, cause: new import_sdk_services5.ResourceNotRoutedError(skipped) });
+            continue;
+          }
+          succeeded.push(target.url);
+          accepted.push(result);
+        } else {
+          refusal = result;
+          failed.push({ url: target.url, status: result.status, cause: result });
+        }
+      } catch (error) {
+        if (signal?.aborted) throw error;
+        failed.push({ url: target.url, cause: (0, import_sdk_services5.routingFailure)(error) ? error : new import_sdk_services5.NodeNotRespondingError([target.url], error) });
+      }
+    }
+    if (failed.length > 0) {
+      if (targets.size > 1) throw new import_sdk_services5.PartialNodeWriteError(succeeded, failed);
+      if (refusal) return refusal;
+      throw failed[0].cause;
+    }
+    const activated = new Set(accepted.flatMap((result) => result.activated ?? []));
+    return {
+      ...accepted[0],
+      activated: [...activated],
+      skipped: [...new Set(accepted.flatMap((result) => result.skipped ?? []))].filter((space) => !activated.has(space) && !routedSpaces.some((expected) => this.spaceIdsEqual(space, expected)))
+    };
+  }
+  activateRoutedDelegation(delegation, signal) {
+    const resources = this.operationsFromDelegation(delegation).map(
+      (operation) => operation.resource?.startsWith("urn:tinycloud:encryption:") ? operation.resource.split("/")[0] : operation.spaceId ?? delegation.spaceId
+    );
+    return this.activateResourceSession(delegation.delegationHeader, resources, delegation.host, signal);
+  }
+  activateSignedSession(session, siwe, hostHint, signal) {
+    const resources = this.parseRecapWithCaveats(siwe).map(
+      (entry) => this.isEncryptionNetworkOperation(this.invocationServiceName(entry.service), entry.path, entry.space) ? entry.path.split("/")[0] : entry.space.startsWith("tinycloud:") ? entry.space : session.spaceId
+    );
+    return this.activateResourceSession(
+      session.delegationHeader,
+      resources.length > 0 ? resources : [session.spaceId],
+      hostHint,
+      signal
+    );
+  }
   /**
    * Install a portable runtime permission delegation into this SDK instance so
    * matching service calls and downstream `delegateTo()` calls can use it.
@@ -26423,16 +26665,12 @@ var _TinyCloudNode = class _TinyCloudNode {
         `Runtime delegation targets ${delegation.delegateDID} but this session key is ${session.verificationMethod}.`
       );
     }
-    const targetHost = delegation.host ?? this.config.host;
     let activateResult;
     try {
-      activateResult = await (0, import_sdk_core10.activateSessionWithHost)(
-        targetHost,
-        delegation.delegationHeader,
-        graph.signal
-      );
+      activateResult = await this.activateRoutedDelegation(delegation, graph.signal);
     } catch (cause) {
       graph.assertActive();
+      if ((0, import_sdk_services5.routingFailure)(cause)) throw cause;
       throw Object.assign(
         new Error("The TinyCloud host could not be reached to activate the delegation."),
         { code: "ACTIVATION_TRANSPORT_FAILED", cause }
@@ -26588,11 +26826,15 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...prepared,
         signature: signature2
       });
-      const activateResult = await (0, import_sdk_core10.activateSessionWithHost)(
-        this.config.host,
-        delegatedSession.delegationHeader,
-        graph.signal
-      ).catch((error) => {
+      const delegation = this.runtimeDelegationFromSession(
+        delegatedSession,
+        delegatedEntries,
+        spaceId,
+        captured,
+        expiresAt,
+        { siwe: prepared.siwe, signature: signature2 }
+      );
+      const activateResult = await this.activateRoutedDelegation(delegation, graph.signal).catch((error) => {
         graph.assertActive();
         throw error;
       });
@@ -26608,14 +26850,6 @@ var _TinyCloudNode = class _TinyCloudNode {
           { cause: activateResult }
         );
       }
-      const delegation = this.runtimeDelegationFromSession(
-        delegatedSession,
-        delegatedEntries,
-        spaceId,
-        captured,
-        expiresAt,
-        { siwe: prepared.siwe, signature: signature2 }
-      );
       graph.assertActive();
       assertCapturedKey?.();
       this.runtimePermissionGrants.push({
@@ -26760,7 +26994,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (!publicSpaceId) {
       throw new Error("Public space not enabled. Set enablePublicSpace: true in config.");
     }
-    await this.assertMayCreateSpace();
+    await this.assertMayCreateSpace(publicSpaceId);
     await this.auth.hostPublicSpace(publicSpaceId);
     const kvActions = [import_sdk_core10.KV.PUT, import_sdk_core10.KV.GET, import_sdk_core10.KV.DEL, import_sdk_core10.KV.LIST, import_sdk_core10.KV.METADATA];
     const abilities = { kv: { "": kvActions } };
@@ -26783,10 +27017,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core10.activateSessionWithHost)(
-      this.config.host,
-      delegationSession.delegationHeader
-    );
+    const activateResult = await this.activateSignedSession(delegationSession, prepared.siwe);
     if (!activateResult.success) {
       throw Object.assign(
         new Error(`Failed to activate public space delegation: ${describeHostFailure2(activateResult)}`),
@@ -27336,10 +27567,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (onPrepared) {
       await onPrepared(delegation);
     }
-    const activateResult = await (0, import_sdk_core10.activateSessionWithHost)(
-      this.config.host,
-      delegationHeader
-    );
+    const activateResult = await this.activateRoutedDelegation(delegation);
     assertDelegationActivated(activateResult, delegation, requireActivation);
     return delegation;
   }
@@ -27373,10 +27601,7 @@ var _TinyCloudNode = class _TinyCloudNode {
     if (onPrepared) {
       await onPrepared(delegation);
     }
-    const activateResult = await (0, import_sdk_core10.activateSessionWithHost)(
-      targetHost,
-      delegationHeader
-    );
+    const activateResult = await this.activateRoutedDelegation(delegation);
     assertDelegationActivated(activateResult, delegation, requireActivation);
     return delegation;
   }
@@ -28028,10 +28253,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core10.activateSessionWithHost)(
-      this.config.host,
-      delegationSession.delegationHeader
-    );
+    const activateResult = await this.activateSignedSession(delegationSession, prepared.siwe);
     if (!activateResult.success) {
       throw Object.assign(
         new Error(`Failed to activate delegation: ${describeHostFailure2(activateResult)}`),
@@ -28076,10 +28298,7 @@ var _TinyCloudNode = class _TinyCloudNode {
         ...publicPrepared,
         signature: publicSignature
       });
-      const publicActivateResult = await (0, import_sdk_core10.activateSessionWithHost)(
-        this.config.host,
-        publicSession.delegationHeader
-      );
+      const publicActivateResult = await this.activateSignedSession(publicSession, publicPrepared.siwe);
       if (publicActivateResult.success) {
         result.publicDelegation = {
           cid: publicSession.delegationCid,
@@ -28185,11 +28404,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core10.activateSessionWithHost)(
-      targetHost,
-      invokerSession.delegationHeader,
-      graph.signal
-    ).catch((error) => {
+    const activateResult = await this.activateSignedSession(invokerSession, prepared.siwe, targetHost, graph.signal).catch((error) => {
       graph.assertActive();
       throw error;
     });
@@ -28316,10 +28531,7 @@ var _TinyCloudNode = class _TinyCloudNode {
       ...prepared,
       signature: signature2
     });
-    const activateResult = await (0, import_sdk_core10.activateSessionWithHost)(
-      targetHost,
-      subDelegationSession.delegationHeader
-    );
+    const activateResult = await this.activateSignedSession(subDelegationSession, prepared.siwe, targetHost);
     if (!activateResult.success) {
       throw Object.assign(
         new Error(`Failed to activate sub-delegation: ${describeHostFailure2(activateResult)}`),
@@ -28383,6 +28595,7 @@ registerReplicationLoaders({
 
 // src/index.ts
 var import_sdk_core15 = require("@tinycloud/sdk-core");
+var import_sdk_services8 = require("@tinycloud/sdk-services");
 var import_sdk_core16 = require("@tinycloud/sdk-core");
 
 // src/storage/FileSessionStorage.ts
@@ -28582,7 +28795,7 @@ var import_node_fs = require("fs");
 var import_promises = require("fs/promises");
 var import_node_path = require("path");
 var import_sdk_core14 = require("@tinycloud/sdk-core");
-var import_sdk_services5 = require("@tinycloud/sdk-services");
+var import_sdk_services7 = require("@tinycloud/sdk-services");
 var import_contractConstants = require("@tinycloud/sdk-services/kv/replication/contractConstants");
 init_authority();
 var REPLICA_LOGOUT_PENDING_FILE = "replica-logout-pending.json";
@@ -29144,7 +29357,7 @@ function sha256Base32(material) {
   return out.slice(0, 26);
 }
 function partitionDirOf(root, identity) {
-  return (0, import_node_path.join)(root, sha256Base32((0, import_sdk_services5.replicationIdentityKey)(identity)));
+  return (0, import_node_path.join)(root, sha256Base32((0, import_sdk_services7.replicationIdentityKey)(identity)));
 }
 function replicaHashOf(prefix, deviceDid) {
   return sha256Base32(`${prefix}
@@ -29218,8 +29431,8 @@ function deviceRecordOf(value) {
 }
 function sameIdentity(a, b) {
   try {
-    const left = (0, import_sdk_services5.canonicalReplicationIdentity)(a);
-    const right = (0, import_sdk_services5.canonicalReplicationIdentity)(b);
+    const left = (0, import_sdk_services7.canonicalReplicationIdentity)(a);
+    const right = (0, import_sdk_services7.canonicalReplicationIdentity)(b);
     return left.host === right.host && left.space === right.space && left.principal === right.principal;
   } catch {
     return false;
@@ -29235,7 +29448,7 @@ async function ensurePartitionIdentity(dir, identity, dirSync) {
   const file = (0, import_node_path.join)(dir, "identity.json");
   const existing = await readJsonFile(file);
   if (existing === void 0) {
-    await writeJsonAtomic(file, { v: 1, ...(0, import_sdk_services5.canonicalReplicationIdentity)(identity) }, dirSync);
+    await writeJsonAtomic(file, { v: 1, ...(0, import_sdk_services7.canonicalReplicationIdentity)(identity) }, dirSync);
     return;
   }
   const record = identityRecordOf(existing);
@@ -29334,7 +29547,7 @@ withGate_fn = async function(section) {
   if (snapshot === void 0) throw gated("gate_unavailable");
   const [principalHash, identityKeyHash] = await Promise.all([
     gate.principalHashOf(snapshot.salt, this.identity.principal),
-    gate.identityHashOf(snapshot.salt, (0, import_sdk_services5.replicationIdentityKey)(this.identity))
+    gate.identityHashOf(snapshot.salt, (0, import_sdk_services7.replicationIdentityKey)(this.identity))
   ]);
   const access = {
     stamp: __privateGet(this, _stamp),
@@ -29835,7 +30048,7 @@ function createSqliteReplicaStorage(options) {
     if (snapshot === void 0) throw gated("gate_unavailable");
     const [principalHash, identityKeyHash] = await Promise.all([
       gate.principalHashOf(snapshot.salt, principal),
-      identity === void 0 ? Promise.resolve(void 0) : gate.identityHashOf(snapshot.salt, (0, import_sdk_services5.replicationIdentityKey)(identity))
+      identity === void 0 ? Promise.resolve(void 0) : gate.identityHashOf(snapshot.salt, (0, import_sdk_services7.replicationIdentityKey)(identity))
     ]);
     return profileSection(async () => {
       assertLogoutClear(options.logoutPendingFile);
@@ -29858,7 +30071,7 @@ function createSqliteReplicaStorage(options) {
     if (snapshot === void 0) throw gated("gate_unavailable");
     const [principalHash, identityKeyHash] = await Promise.all([
       gate.principalHashOf(snapshot.salt, spec.identity.principal),
-      gate.identityHashOf(snapshot.salt, (0, import_sdk_services5.replicationIdentityKey)(spec.identity))
+      gate.identityHashOf(snapshot.salt, (0, import_sdk_services7.replicationIdentityKey)(spec.identity))
     ]);
     const access = {
       stamp: spec.stamp,
@@ -29942,7 +30155,7 @@ function createSqliteReplicaStorage(options) {
       const identity = identityRecordOf(await readJsonFile((0, import_node_path.join)(idDir, "identity.json")));
       if (identity === void 0) throw new ReplicaStorageError("STORAGE_ERROR", `Missing identity at ${idDir}.`);
       if (await gate.principalHashOf(salt, identity.principal) !== principalHash) continue;
-      const identityKeyHash = await gate.identityHashOf(salt, (0, import_sdk_services5.replicationIdentityKey)(identity));
+      const identityKeyHash = await gate.identityHashOf(salt, (0, import_sdk_services7.replicationIdentityKey)(identity));
       const recordedAt = Date.now();
       if (await pathExists((0, import_node_path.join)(idDir, "pending.json")) || await pathExists((0, import_node_path.join)(idDir, "device.jwk"))) {
         intents.push({ id: `pending:${identityKeyHash}`, kind: "pending", identityKeyHash, principalHash, recordedAt });
@@ -30620,7 +30833,7 @@ function createSqliteReplicaStorage(options) {
           for (const dir of await identityDirs()) {
             const identity = identityRecordOf(await readJsonFile((0, import_node_path.join)(dir, "identity.json")));
             if (identity === void 0) throw new ReplicaStorageError("STORAGE_ERROR", `Missing identity at ${dir}.`);
-            const hash3 = await gate.identityHashOf(state.salt, (0, import_sdk_services5.replicationIdentityKey)(identity));
+            const hash3 = await gate.identityHashOf(state.salt, (0, import_sdk_services7.replicationIdentityKey)(identity));
             if (intent.kind === "pending" ? hash3 === intent.identityKeyHash : intent.partitionId.startsWith(`${hash3}:`)) {
               idDir = dir;
               break;
@@ -30766,7 +30979,7 @@ function createSqliteReplicaStorage(options) {
     const gate = await fileGate();
     const snapshot = await gate.readGateSnapshot(profileDir);
     if (snapshot === void 0) throw gated("gate_unavailable");
-    const identityKeyHash = await gate.identityHashOf(snapshot.salt, (0, import_sdk_services5.replicationIdentityKey)(spec.identity));
+    const identityKeyHash = await gate.identityHashOf(snapshot.salt, (0, import_sdk_services7.replicationIdentityKey)(spec.identity));
     const resolvePolicy = async (at, recordFirst) => {
       const policy = spec.grantPolicy;
       if (!Number.isSafeInteger(policy.grantTtlMs) || policy.grantTtlMs <= 0 || policy.grantTtlMs > import_contractConstants.MAX_GRANT_TTL_MS) {
@@ -30788,7 +31001,7 @@ function createSqliteReplicaStorage(options) {
     let partitionId;
     const storeGuard = (section) => guarded(spec.identity.principal, spec.stamp, spec.identity, partitionId, section);
     return guarded(spec.identity.principal, spec.stamp, spec.identity, void 0, async () => {
-      if ((0, import_sdk_services5.requiresSecretsOptIn)(spec.space, spec.prefix) && spec.allowSecrets !== true) {
+      if ((0, import_sdk_services7.requiresSecretsOptIn)(spec.space, spec.prefix) && spec.allowSecrets !== true) {
         throw new replica.ReplicaError(
           replica.ReplicaErrorCode.SECRETS_OPT_IN_REQUIRED,
           `Replicating ${spec.space}/kv/${spec.prefix} copies secret material to disk; pass allowSecrets to opt in.`
@@ -31034,7 +31247,7 @@ function createSqliteReplicaStorage(options) {
               const gate = await fileGate();
               const currentGate = await gate.readGateSnapshot(profileDir);
               if (currentGate !== void 0 && currentGate.principalHash !== null && currentGate.principalHash === await gate.principalHashOf(currentGate.salt, target.identity.principal)) {
-                const identityKeyHash = await gate.identityHashOf(currentGate.salt, (0, import_sdk_services5.replicationIdentityKey)(target.identity));
+                const identityKeyHash = await gate.identityHashOf(currentGate.salt, (0, import_sdk_services7.replicationIdentityKey)(target.identity));
                 await retainGrantInstalls(gate, currentGate, identityKeyHash, store);
               }
               if (state.revoked === null) {
@@ -31130,8 +31343,11 @@ function sqliteReplicaStorage(options) {
   MemorySessionStorage,
   NETWORK_NAME_PATTERN,
   NetworkIdError,
+  NodeIdentityMismatchError,
+  NodeNotRespondingError,
   NodeUserAuthorization,
   NodeWasmBindings,
+  PartialNodeWriteError,
   PermissionNotInManifestError,
   PrefixedKVService,
   PrivateKeySigner,