@tinycloud/sdk-services 3.11.0-beta.2 → 3.12.0-beta.10

package/dist/index.d.cts

@@ -1,20 +1,20 @@
-import { g as ServiceError, f as Result, P as PermissionHint, c as IService, S as ServiceSession, I as IServiceContext, j as StorageQuotaInfo } from './types-CSd0RYir.cjs';
-export { k as ErrorCode, l as ErrorCodes, E as EventHandler, F as FetchFunction, d as FetchRequestInit, e as FetchResponse, m as InvocationFact, n as InvocationFacts, o as InvokeAnyEntry, b as InvokeAnyFunction, a as InvokeFunction, R as RetryPolicy, i as RetryStats, p as ServiceErrorEvent, h as ServiceHeaders, q as ServiceRequestEvent, r as ServiceResponseEvent, s as ServiceRetryEvent, T as TelemetryConfig, t as TelemetryEventHandler, u as TelemetryEvents, v as TelemetrySpanEvent, w as defaultRetryPolicy, x as err, y as ok, z as serviceError } from './types-CSd0RYir.cjs';
+import { g as ServiceError, f as Result, P as PermissionHint, c as IService, S as ServiceSession, I as IServiceContext, j as StorageQuotaInfo } from './types-DjAP8dve.cjs';
+export { k as ErrorCode, l as ErrorCodes, E as EventHandler, F as FetchFunction, d as FetchRequestInit, e as FetchResponse, m as InvocationFact, n as InvocationFacts, o as InvokeAnyEntry, b as InvokeAnyFunction, a as InvokeFunction, R as RetryPolicy, i as RetryStats, p as ServiceErrorEvent, h as ServiceHeaders, q as ServiceRequestEvent, r as ServiceResponseEvent, s as ServiceRetryEvent, T as TelemetryConfig, t as TelemetryEventHandler, u as TelemetryEvents, v as TelemetrySpanEvent, w as defaultRetryPolicy, x as err, y as ok, z as serviceError } from './types-DjAP8dve.cjs';
 import { z } from 'zod';
 export { ServiceContext, ServiceContextConfig } from './context.cjs';
+import { D as DecryptCapabilityProof, R as RoutingFailure } from './types-DfqNz9Nu.cjs';
+export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, p as NodeIdentityMismatchError, q as NodeNotRespondingError, P as PartialNodeWriteError, r as ReceiverKeyPair, s as ReceiverKeySigner, t as ResourceAccess, u as ResourceDestination, v as ResourceNodeInfo, w as ResourceNotRoutedError, x as ResourceRoutingConfig, y as ResourceTransport, z as ResourceTransportOptions, A as ResourceTransportTarget, F as base64Decode, G as base64Encode, H as canonicalHashHex, K as canonicalizeEncryptionJson, L as createResourceRoutingFetch, M as createResourceTransportInvocationFetch, O as encryptionError, Q as hexDecode, S as hexEncode, T as routeResourceRequest, U as routingFailure, V as routingResourceOf, W as utf8Decode, X as utf8Encode, Y as verifyResourceDestination } from './types-DfqNz9Nu.cjs';
 export { RequestEvent, RequestLog, RequestLogReader, RequestService, RequestSink } from './telemetry/requestLog.cjs';
-import { B as BaseService } from './BaseService-O0iyuFLk.cjs';
-export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-O0iyuFLk.cjs';
+import { B as BaseService } from './BaseService-CdBkfPGE.cjs';
+export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-CdBkfPGE.cjs';
 import { IKVService } from './kv/index.cjs';
 export { IPrefixedKVService, KVService, PrefixedKVService } from './kv/index.cjs';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aB as KVBatchReadResponse, aC as KVChange, aD as KVChangesAuthority, aE as KVChangesOptions, aF as KVChangesResponse, aG as KVCreateSignedReadUrlOptions, aH as KVDeleteOptions, aI as KVGetOptions, aJ as KVHeadOptions, aK as KVListOptions, b as KVListPage, aL as KVListResponse, aM as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aN as KVResponse, aO as KVResponseHeaders, aP as KVServiceConfig, aQ as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from './scope-DEgc9f-W.cjs';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aB as KVBatchReadResponse, aC as KVChange, aD as KVChangesAuthority, aE as KVChangesOptions, aF as KVChangesResponse, aG as KVCreateSignedReadUrlOptions, aH as KVDeleteOptions, aI as KVGetOptions, aJ as KVHeadOptions, aK as KVListOptions, b as KVListPage, aL as KVListResponse, aM as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aN as KVResponse, aO as KVResponseHeaders, aP as KVServiceConfig, aQ as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from './scope-DtcbyRKY.cjs';
 export { ClampConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, EffectiveGrantExpiryInput, MintRemainingMs, NeedsSilentRenewal, ReplicaConsentAnchor, ReplicaConsentSource, ReplicaGrantPolicy } from './kv/replication/grantPolicyTypes.cjs';
 export { DatabaseHandle, SQLMigrations, SQLService } from './sql/index.cjs';
-export { B as BatchOptions, a as BatchResponse, E as ExecuteOptions, b as ExecuteResponse, I as IDatabaseHandle, c as ISQLMigrations, d as ISQLService, Q as QueryOptions, e as QueryResponse, S as SQLAction, f as SQLActionType, g as SQLServiceConfig, h as SqlMigration, i as SqlMigrationApplyOptions, j as SqlMigrationApplyResponse, k as SqlStatement, l as SqlValue } from './ISQLService-BOgWzHLT.cjs';
-import { I as IHooksService, a as HooksServiceConfig, H as HookSubscription, S as SubscribeOptions, b as HookEvent, c as HookWebhookRegistration, d as HookWebhookRecord, e as HookWebhookListOptions, f as HookWebhookUnregisterOptions } from './IHooksService-4QNODVy6.cjs';
-export { g as HookServiceName, h as HookStreamEvent, i as HookStreamRetryConfig, j as HookWebhookScope } from './IHooksService-4QNODVy6.cjs';
-import { D as DecryptCapabilityProof } from './types-D4XbIfFJ.cjs';
-export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, R as ReceiverKeyPair, p as ReceiverKeySigner, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalizeEncryptionJson, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from './types-D4XbIfFJ.cjs';
+export { B as BatchOptions, a as BatchResponse, E as ExecuteOptions, b as ExecuteResponse, I as IDatabaseHandle, c as ISQLMigrations, d as ISQLService, Q as QueryOptions, e as QueryResponse, S as SQLAction, f as SQLActionType, g as SQLServiceConfig, h as SqlMigration, i as SqlMigrationApplyOptions, j as SqlMigrationApplyResponse, k as SqlStatement, l as SqlValue } from './ISQLService-C6nNpcls.cjs';
+import { I as IHooksService, a as HooksServiceConfig, H as HookSubscription, S as SubscribeOptions, b as HookEvent, c as HookWebhookRegistration, d as HookWebhookRecord, e as HookWebhookListOptions, f as HookWebhookUnregisterOptions } from './IHooksService-C9p3stsB.cjs';
+export { g as HookServiceName, h as HookStreamEvent, i as HookStreamRetryConfig, j as HookWebhookScope } from './IHooksService-C9p3stsB.cjs';
 import { IEncryptionService } from './encryption/index.cjs';
 export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, CanonicalDecryptRequest, DecryptEnvelopeOptions, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionService, EncryptionServiceConfig, NETWORK_NAME_PATTERN, NetworkIdError, NodeDescriptorFetcher, ParsedEncryptionResource, ParsedNetworkId, RandomReceiverKeyInput, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalSignedResponse, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, isNetworkId, networkDiscoveryKey, openWrappedKey, parseEncryptionResource, parseNetworkId, validateEnvelope, verifyDecryptResponse } from './encryption/index.cjs';
 export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
@@ -1804,7 +1804,7 @@ type VaultNetworkReadResult<T> = {
 /**
  * Input types for creating vault errors (service field added automatically).
  */
-type VaultErrorInput = {
+type VaultErrorInput = RoutingFailure | {
     code: "DECRYPTION_FAILED";
     message?: string;
     cause?: Error;
@@ -1982,7 +1982,7 @@ interface IDataVaultService extends IService {
      * @returns Result with the decrypted entry
      */
     get<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<Result<VaultEntry<T>, VaultError>>;
-    /** Read a network-encrypted value with safe, phase-classified failures. */
+    /** Read with safe failure phases; typed routing failures reject instead of losing their code. */
     readNetworkEncrypted<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<VaultNetworkReadResult<T>>;
     /**
      * Delete an encrypted key.
@@ -2239,6 +2239,8 @@ declare class DataVaultService extends BaseService implements IDataVaultService
      * Unlike {@link getNetworkEncrypted}, this is intentionally message-free so
      * an operation layer can distinguish an authorized absence from a failed
      * read without receiving node, envelope, plaintext, or key material.
+     * Typed routing failures reject unchanged rather than becoming an ordinary
+     * read/decrypt failure; the operation boundary projects their safe code.
      */
     readNetworkEncrypted<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<VaultNetworkReadResult<T>>;
     private headNetworkEncrypted;

package/dist/index.d.ts

@@ -1,20 +1,20 @@
-import { g as ServiceError, f as Result, P as PermissionHint, c as IService, S as ServiceSession, I as IServiceContext, j as StorageQuotaInfo } from './types-CSd0RYir.js';
-export { k as ErrorCode, l as ErrorCodes, E as EventHandler, F as FetchFunction, d as FetchRequestInit, e as FetchResponse, m as InvocationFact, n as InvocationFacts, o as InvokeAnyEntry, b as InvokeAnyFunction, a as InvokeFunction, R as RetryPolicy, i as RetryStats, p as ServiceErrorEvent, h as ServiceHeaders, q as ServiceRequestEvent, r as ServiceResponseEvent, s as ServiceRetryEvent, T as TelemetryConfig, t as TelemetryEventHandler, u as TelemetryEvents, v as TelemetrySpanEvent, w as defaultRetryPolicy, x as err, y as ok, z as serviceError } from './types-CSd0RYir.js';
+import { g as ServiceError, f as Result, P as PermissionHint, c as IService, S as ServiceSession, I as IServiceContext, j as StorageQuotaInfo } from './types-DjAP8dve.js';
+export { k as ErrorCode, l as ErrorCodes, E as EventHandler, F as FetchFunction, d as FetchRequestInit, e as FetchResponse, m as InvocationFact, n as InvocationFacts, o as InvokeAnyEntry, b as InvokeAnyFunction, a as InvokeFunction, R as RetryPolicy, i as RetryStats, p as ServiceErrorEvent, h as ServiceHeaders, q as ServiceRequestEvent, r as ServiceResponseEvent, s as ServiceRetryEvent, T as TelemetryConfig, t as TelemetryEventHandler, u as TelemetryEvents, v as TelemetrySpanEvent, w as defaultRetryPolicy, x as err, y as ok, z as serviceError } from './types-DjAP8dve.js';
 import { z } from 'zod';
 export { ServiceContext, ServiceContextConfig } from './context.js';
+import { D as DecryptCapabilityProof, R as RoutingFailure } from './types-Nvi_RckJ.js';
+export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, p as NodeIdentityMismatchError, q as NodeNotRespondingError, P as PartialNodeWriteError, r as ReceiverKeyPair, s as ReceiverKeySigner, t as ResourceAccess, u as ResourceDestination, v as ResourceNodeInfo, w as ResourceNotRoutedError, x as ResourceRoutingConfig, y as ResourceTransport, z as ResourceTransportOptions, A as ResourceTransportTarget, F as base64Decode, G as base64Encode, H as canonicalHashHex, K as canonicalizeEncryptionJson, L as createResourceRoutingFetch, M as createResourceTransportInvocationFetch, O as encryptionError, Q as hexDecode, S as hexEncode, T as routeResourceRequest, U as routingFailure, V as routingResourceOf, W as utf8Decode, X as utf8Encode, Y as verifyResourceDestination } from './types-Nvi_RckJ.js';
 export { RequestEvent, RequestLog, RequestLogReader, RequestService, RequestSink } from './telemetry/requestLog.js';
-import { B as BaseService } from './BaseService-Ma2MwJAd.js';
-export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-Ma2MwJAd.js';
+import { B as BaseService } from './BaseService-BRDG69KR.js';
+export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-BRDG69KR.js';
 import { IKVService } from './kv/index.js';
 export { IPrefixedKVService, KVService, PrefixedKVService } from './kv/index.js';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aB as KVBatchReadResponse, aC as KVChange, aD as KVChangesAuthority, aE as KVChangesOptions, aF as KVChangesResponse, aG as KVCreateSignedReadUrlOptions, aH as KVDeleteOptions, aI as KVGetOptions, aJ as KVHeadOptions, aK as KVListOptions, b as KVListPage, aL as KVListResponse, aM as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aN as KVResponse, aO as KVResponseHeaders, aP as KVServiceConfig, aQ as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from './scope-BZr0QwxX.js';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aB as KVBatchReadResponse, aC as KVChange, aD as KVChangesAuthority, aE as KVChangesOptions, aF as KVChangesResponse, aG as KVCreateSignedReadUrlOptions, aH as KVDeleteOptions, aI as KVGetOptions, aJ as KVHeadOptions, aK as KVListOptions, b as KVListPage, aL as KVListResponse, aM as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aN as KVResponse, aO as KVResponseHeaders, aP as KVServiceConfig, aQ as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from './scope-J20PQP3u.js';
 export { ClampConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, EffectiveGrantExpiryInput, MintRemainingMs, NeedsSilentRenewal, ReplicaConsentAnchor, ReplicaConsentSource, ReplicaGrantPolicy } from './kv/replication/grantPolicyTypes.js';
 export { DatabaseHandle, SQLMigrations, SQLService } from './sql/index.js';
-export { B as BatchOptions, a as BatchResponse, E as ExecuteOptions, b as ExecuteResponse, I as IDatabaseHandle, c as ISQLMigrations, d as ISQLService, Q as QueryOptions, e as QueryResponse, S as SQLAction, f as SQLActionType, g as SQLServiceConfig, h as SqlMigration, i as SqlMigrationApplyOptions, j as SqlMigrationApplyResponse, k as SqlStatement, l as SqlValue } from './ISQLService-Aly1CBsW.js';
-import { I as IHooksService, a as HooksServiceConfig, H as HookSubscription, S as SubscribeOptions, b as HookEvent, c as HookWebhookRegistration, d as HookWebhookRecord, e as HookWebhookListOptions, f as HookWebhookUnregisterOptions } from './IHooksService-CvTpJbQD.js';
-export { g as HookServiceName, h as HookStreamEvent, i as HookStreamRetryConfig, j as HookWebhookScope } from './IHooksService-CvTpJbQD.js';
-import { D as DecryptCapabilityProof } from './types-Bf91gup6.js';
-export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, R as ReceiverKeyPair, p as ReceiverKeySigner, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalizeEncryptionJson, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from './types-Bf91gup6.js';
+export { B as BatchOptions, a as BatchResponse, E as ExecuteOptions, b as ExecuteResponse, I as IDatabaseHandle, c as ISQLMigrations, d as ISQLService, Q as QueryOptions, e as QueryResponse, S as SQLAction, f as SQLActionType, g as SQLServiceConfig, h as SqlMigration, i as SqlMigrationApplyOptions, j as SqlMigrationApplyResponse, k as SqlStatement, l as SqlValue } from './ISQLService-B_4KcGA-.js';
+import { I as IHooksService, a as HooksServiceConfig, H as HookSubscription, S as SubscribeOptions, b as HookEvent, c as HookWebhookRegistration, d as HookWebhookRecord, e as HookWebhookListOptions, f as HookWebhookUnregisterOptions } from './IHooksService-D6eyZat1.js';
+export { g as HookServiceName, h as HookStreamEvent, i as HookStreamRetryConfig, j as HookWebhookScope } from './IHooksService-D6eyZat1.js';
 import { IEncryptionService } from './encryption/index.js';
 export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, CanonicalDecryptRequest, DecryptEnvelopeOptions, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionService, EncryptionServiceConfig, NETWORK_NAME_PATTERN, NetworkIdError, NodeDescriptorFetcher, ParsedEncryptionResource, ParsedNetworkId, RandomReceiverKeyInput, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalSignedResponse, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, isNetworkId, networkDiscoveryKey, openWrappedKey, parseEncryptionResource, parseNetworkId, validateEnvelope, verifyDecryptResponse } from './encryption/index.js';
 export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
@@ -1804,7 +1804,7 @@ type VaultNetworkReadResult<T> = {
 /**
  * Input types for creating vault errors (service field added automatically).
  */
-type VaultErrorInput = {
+type VaultErrorInput = RoutingFailure | {
     code: "DECRYPTION_FAILED";
     message?: string;
     cause?: Error;
@@ -1982,7 +1982,7 @@ interface IDataVaultService extends IService {
      * @returns Result with the decrypted entry
      */
     get<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<Result<VaultEntry<T>, VaultError>>;
-    /** Read a network-encrypted value with safe, phase-classified failures. */
+    /** Read with safe failure phases; typed routing failures reject instead of losing their code. */
     readNetworkEncrypted<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<VaultNetworkReadResult<T>>;
     /**
      * Delete an encrypted key.
@@ -2239,6 +2239,8 @@ declare class DataVaultService extends BaseService implements IDataVaultService
      * Unlike {@link getNetworkEncrypted}, this is intentionally message-free so
      * an operation layer can distinguish an authorized absence from a failed
      * read without receiving node, envelope, plaintext, or key material.
+     * Typed routing failures reject unchanged rather than becoming an ordinary
+     * read/decrypt failure; the operation boundary projects their safe code.
      */
     readNetworkEncrypted<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<VaultNetworkReadResult<T>>;
     private headNetworkEncrypted;