@tinycloud/sdk-services 3.11.0 → 3.12.0-beta.3

package/dist/index.d.cts

@@ -1,20 +1,20 @@
-import { g as ServiceError, f as Result, P as PermissionHint, c as IService, S as ServiceSession, I as IServiceContext, j as StorageQuotaInfo } from './types-CSd0RYir.cjs';
-export { k as ErrorCode, l as ErrorCodes, E as EventHandler, F as FetchFunction, d as FetchRequestInit, e as FetchResponse, m as InvocationFact, n as InvocationFacts, o as InvokeAnyEntry, b as InvokeAnyFunction, a as InvokeFunction, R as RetryPolicy, i as RetryStats, p as ServiceErrorEvent, h as ServiceHeaders, q as ServiceRequestEvent, r as ServiceResponseEvent, s as ServiceRetryEvent, T as TelemetryConfig, t as TelemetryEventHandler, u as TelemetryEvents, v as TelemetrySpanEvent, w as defaultRetryPolicy, x as err, y as ok, z as serviceError } from './types-CSd0RYir.cjs';
+import { g as ServiceError, f as Result, P as PermissionHint, c as IService, S as ServiceSession, I as IServiceContext, j as StorageQuotaInfo } from './types-DjAP8dve.cjs';
+export { k as ErrorCode, l as ErrorCodes, E as EventHandler, F as FetchFunction, d as FetchRequestInit, e as FetchResponse, m as InvocationFact, n as InvocationFacts, o as InvokeAnyEntry, b as InvokeAnyFunction, a as InvokeFunction, R as RetryPolicy, i as RetryStats, p as ServiceErrorEvent, h as ServiceHeaders, q as ServiceRequestEvent, r as ServiceResponseEvent, s as ServiceRetryEvent, T as TelemetryConfig, t as TelemetryEventHandler, u as TelemetryEvents, v as TelemetrySpanEvent, w as defaultRetryPolicy, x as err, y as ok, z as serviceError } from './types-DjAP8dve.cjs';
 import { z } from 'zod';
 export { ServiceContext, ServiceContextConfig } from './context.cjs';
+import { D as DecryptCapabilityProof, R as RoutingFailure } from './types-cWtQmCCw.cjs';
+export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, p as NodeIdentityMismatchError, q as NodeNotRespondingError, P as PartialNodeWriteError, r as ReceiverKeyPair, s as ReceiverKeySigner, t as ResourceAccess, u as ResourceDestination, v as ResourceNotRoutedError, w as ResourceRoutingConfig, x as base64Decode, y as base64Encode, z as canonicalHashHex, A as canonicalizeEncryptionJson, F as createResourceRoutingFetch, G as encryptionError, H as hexDecode, K as hexEncode, L as routingFailure, M as utf8Decode, O as utf8Encode, Q as verifyResourceDestination } from './types-cWtQmCCw.cjs';
 export { RequestEvent, RequestLog, RequestLogReader, RequestService, RequestSink } from './telemetry/requestLog.cjs';
-import { B as BaseService } from './BaseService-O0iyuFLk.cjs';
-export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-O0iyuFLk.cjs';
+import { B as BaseService } from './BaseService-CdBkfPGE.cjs';
+export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-CdBkfPGE.cjs';
 import { IKVService } from './kv/index.cjs';
 export { IPrefixedKVService, KVService, PrefixedKVService } from './kv/index.cjs';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aB as KVBatchReadResponse, aC as KVChange, aD as KVChangesAuthority, aE as KVChangesOptions, aF as KVChangesResponse, aG as KVCreateSignedReadUrlOptions, aH as KVDeleteOptions, aI as KVGetOptions, aJ as KVHeadOptions, aK as KVListOptions, b as KVListPage, aL as KVListResponse, aM as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aN as KVResponse, aO as KVResponseHeaders, aP as KVServiceConfig, aQ as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from './scope-DEgc9f-W.cjs';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aB as KVBatchReadResponse, aC as KVChange, aD as KVChangesAuthority, aE as KVChangesOptions, aF as KVChangesResponse, aG as KVCreateSignedReadUrlOptions, aH as KVDeleteOptions, aI as KVGetOptions, aJ as KVHeadOptions, aK as KVListOptions, b as KVListPage, aL as KVListResponse, aM as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aN as KVResponse, aO as KVResponseHeaders, aP as KVServiceConfig, aQ as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from './scope-DtcbyRKY.cjs';
 export { ClampConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, EffectiveGrantExpiryInput, MintRemainingMs, NeedsSilentRenewal, ReplicaConsentAnchor, ReplicaConsentSource, ReplicaGrantPolicy } from './kv/replication/grantPolicyTypes.cjs';
 export { DatabaseHandle, SQLMigrations, SQLService } from './sql/index.cjs';
-export { B as BatchOptions, a as BatchResponse, E as ExecuteOptions, b as ExecuteResponse, I as IDatabaseHandle, c as ISQLMigrations, d as ISQLService, Q as QueryOptions, e as QueryResponse, S as SQLAction, f as SQLActionType, g as SQLServiceConfig, h as SqlMigration, i as SqlMigrationApplyOptions, j as SqlMigrationApplyResponse, k as SqlStatement, l as SqlValue } from './ISQLService-BOgWzHLT.cjs';
-import { I as IHooksService, a as HooksServiceConfig, H as HookSubscription, S as SubscribeOptions, b as HookEvent, c as HookWebhookRegistration, d as HookWebhookRecord, e as HookWebhookListOptions, f as HookWebhookUnregisterOptions } from './IHooksService-4QNODVy6.cjs';
-export { g as HookServiceName, h as HookStreamEvent, i as HookStreamRetryConfig, j as HookWebhookScope } from './IHooksService-4QNODVy6.cjs';
-import { D as DecryptCapabilityProof } from './types-D4XbIfFJ.cjs';
-export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, R as ReceiverKeyPair, p as ReceiverKeySigner, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalizeEncryptionJson, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from './types-D4XbIfFJ.cjs';
+export { B as BatchOptions, a as BatchResponse, E as ExecuteOptions, b as ExecuteResponse, I as IDatabaseHandle, c as ISQLMigrations, d as ISQLService, Q as QueryOptions, e as QueryResponse, S as SQLAction, f as SQLActionType, g as SQLServiceConfig, h as SqlMigration, i as SqlMigrationApplyOptions, j as SqlMigrationApplyResponse, k as SqlStatement, l as SqlValue } from './ISQLService-C6nNpcls.cjs';
+import { I as IHooksService, a as HooksServiceConfig, H as HookSubscription, S as SubscribeOptions, b as HookEvent, c as HookWebhookRegistration, d as HookWebhookRecord, e as HookWebhookListOptions, f as HookWebhookUnregisterOptions } from './IHooksService-C9p3stsB.cjs';
+export { g as HookServiceName, h as HookStreamEvent, i as HookStreamRetryConfig, j as HookWebhookScope } from './IHooksService-C9p3stsB.cjs';
 import { IEncryptionService } from './encryption/index.cjs';
 export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, CanonicalDecryptRequest, DecryptEnvelopeOptions, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionService, EncryptionServiceConfig, NETWORK_NAME_PATTERN, NetworkIdError, NodeDescriptorFetcher, ParsedEncryptionResource, ParsedNetworkId, RandomReceiverKeyInput, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalSignedResponse, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, isNetworkId, networkDiscoveryKey, openWrappedKey, parseEncryptionResource, parseNetworkId, validateEnvelope, verifyDecryptResponse } from './encryption/index.cjs';
 export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
@@ -1804,7 +1804,7 @@ type VaultNetworkReadResult<T> = {
 /**
  * Input types for creating vault errors (service field added automatically).
  */
-type VaultErrorInput = {
+type VaultErrorInput = RoutingFailure | {
     code: "DECRYPTION_FAILED";
     message?: string;
     cause?: Error;
@@ -1982,7 +1982,7 @@ interface IDataVaultService extends IService {
      * @returns Result with the decrypted entry
      */
     get<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<Result<VaultEntry<T>, VaultError>>;
-    /** Read a network-encrypted value with safe, phase-classified failures. */
+    /** Read with safe failure phases; typed routing failures reject instead of losing their code. */
     readNetworkEncrypted<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<VaultNetworkReadResult<T>>;
     /**
      * Delete an encrypted key.
@@ -2239,6 +2239,8 @@ declare class DataVaultService extends BaseService implements IDataVaultService
      * Unlike {@link getNetworkEncrypted}, this is intentionally message-free so
      * an operation layer can distinguish an authorized absence from a failed
      * read without receiving node, envelope, plaintext, or key material.
+     * Typed routing failures reject unchanged rather than becoming an ordinary
+     * read/decrypt failure; the operation boundary projects their safe code.
      */
     readNetworkEncrypted<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<VaultNetworkReadResult<T>>;
     private headNetworkEncrypted;

package/dist/index.d.ts

@@ -1,20 +1,20 @@
-import { g as ServiceError, f as Result, P as PermissionHint, c as IService, S as ServiceSession, I as IServiceContext, j as StorageQuotaInfo } from './types-CSd0RYir.js';
-export { k as ErrorCode, l as ErrorCodes, E as EventHandler, F as FetchFunction, d as FetchRequestInit, e as FetchResponse, m as InvocationFact, n as InvocationFacts, o as InvokeAnyEntry, b as InvokeAnyFunction, a as InvokeFunction, R as RetryPolicy, i as RetryStats, p as ServiceErrorEvent, h as ServiceHeaders, q as ServiceRequestEvent, r as ServiceResponseEvent, s as ServiceRetryEvent, T as TelemetryConfig, t as TelemetryEventHandler, u as TelemetryEvents, v as TelemetrySpanEvent, w as defaultRetryPolicy, x as err, y as ok, z as serviceError } from './types-CSd0RYir.js';
+import { g as ServiceError, f as Result, P as PermissionHint, c as IService, S as ServiceSession, I as IServiceContext, j as StorageQuotaInfo } from './types-DjAP8dve.js';
+export { k as ErrorCode, l as ErrorCodes, E as EventHandler, F as FetchFunction, d as FetchRequestInit, e as FetchResponse, m as InvocationFact, n as InvocationFacts, o as InvokeAnyEntry, b as InvokeAnyFunction, a as InvokeFunction, R as RetryPolicy, i as RetryStats, p as ServiceErrorEvent, h as ServiceHeaders, q as ServiceRequestEvent, r as ServiceResponseEvent, s as ServiceRetryEvent, T as TelemetryConfig, t as TelemetryEventHandler, u as TelemetryEvents, v as TelemetrySpanEvent, w as defaultRetryPolicy, x as err, y as ok, z as serviceError } from './types-DjAP8dve.js';
 import { z } from 'zod';
 export { ServiceContext, ServiceContextConfig } from './context.js';
+import { D as DecryptCapabilityProof, R as RoutingFailure } from './types-XE4tyBLH.js';
+export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, p as NodeIdentityMismatchError, q as NodeNotRespondingError, P as PartialNodeWriteError, r as ReceiverKeyPair, s as ReceiverKeySigner, t as ResourceAccess, u as ResourceDestination, v as ResourceNotRoutedError, w as ResourceRoutingConfig, x as base64Decode, y as base64Encode, z as canonicalHashHex, A as canonicalizeEncryptionJson, F as createResourceRoutingFetch, G as encryptionError, H as hexDecode, K as hexEncode, L as routingFailure, M as utf8Decode, O as utf8Encode, Q as verifyResourceDestination } from './types-XE4tyBLH.js';
 export { RequestEvent, RequestLog, RequestLogReader, RequestService, RequestSink } from './telemetry/requestLog.js';
-import { B as BaseService } from './BaseService-Ma2MwJAd.js';
-export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-Ma2MwJAd.js';
+import { B as BaseService } from './BaseService-BRDG69KR.js';
+export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-BRDG69KR.js';
 import { IKVService } from './kv/index.js';
 export { IPrefixedKVService, KVService, PrefixedKVService } from './kv/index.js';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aB as KVBatchReadResponse, aC as KVChange, aD as KVChangesAuthority, aE as KVChangesOptions, aF as KVChangesResponse, aG as KVCreateSignedReadUrlOptions, aH as KVDeleteOptions, aI as KVGetOptions, aJ as KVHeadOptions, aK as KVListOptions, b as KVListPage, aL as KVListResponse, aM as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aN as KVResponse, aO as KVResponseHeaders, aP as KVServiceConfig, aQ as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from './scope-BZr0QwxX.js';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aB as KVBatchReadResponse, aC as KVChange, aD as KVChangesAuthority, aE as KVChangesOptions, aF as KVChangesResponse, aG as KVCreateSignedReadUrlOptions, aH as KVDeleteOptions, aI as KVGetOptions, aJ as KVHeadOptions, aK as KVListOptions, b as KVListPage, aL as KVListResponse, aM as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aN as KVResponse, aO as KVResponseHeaders, aP as KVServiceConfig, aQ as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from './scope-J20PQP3u.js';
 export { ClampConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, EffectiveGrantExpiryInput, MintRemainingMs, NeedsSilentRenewal, ReplicaConsentAnchor, ReplicaConsentSource, ReplicaGrantPolicy } from './kv/replication/grantPolicyTypes.js';
 export { DatabaseHandle, SQLMigrations, SQLService } from './sql/index.js';
-export { B as BatchOptions, a as BatchResponse, E as ExecuteOptions, b as ExecuteResponse, I as IDatabaseHandle, c as ISQLMigrations, d as ISQLService, Q as QueryOptions, e as QueryResponse, S as SQLAction, f as SQLActionType, g as SQLServiceConfig, h as SqlMigration, i as SqlMigrationApplyOptions, j as SqlMigrationApplyResponse, k as SqlStatement, l as SqlValue } from './ISQLService-Aly1CBsW.js';
-import { I as IHooksService, a as HooksServiceConfig, H as HookSubscription, S as SubscribeOptions, b as HookEvent, c as HookWebhookRegistration, d as HookWebhookRecord, e as HookWebhookListOptions, f as HookWebhookUnregisterOptions } from './IHooksService-CvTpJbQD.js';
-export { g as HookServiceName, h as HookStreamEvent, i as HookStreamRetryConfig, j as HookWebhookScope } from './IHooksService-CvTpJbQD.js';
-import { D as DecryptCapabilityProof } from './types-Bf91gup6.js';
-export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, R as ReceiverKeyPair, p as ReceiverKeySigner, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalizeEncryptionJson, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from './types-Bf91gup6.js';
+export { B as BatchOptions, a as BatchResponse, E as ExecuteOptions, b as ExecuteResponse, I as IDatabaseHandle, c as ISQLMigrations, d as ISQLService, Q as QueryOptions, e as QueryResponse, S as SQLAction, f as SQLActionType, g as SQLServiceConfig, h as SqlMigration, i as SqlMigrationApplyOptions, j as SqlMigrationApplyResponse, k as SqlStatement, l as SqlValue } from './ISQLService-B_4KcGA-.js';
+import { I as IHooksService, a as HooksServiceConfig, H as HookSubscription, S as SubscribeOptions, b as HookEvent, c as HookWebhookRegistration, d as HookWebhookRecord, e as HookWebhookListOptions, f as HookWebhookUnregisterOptions } from './IHooksService-D6eyZat1.js';
+export { g as HookServiceName, h as HookStreamEvent, i as HookStreamRetryConfig, j as HookWebhookScope } from './IHooksService-D6eyZat1.js';
 import { IEncryptionService } from './encryption/index.js';
 export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, CanonicalDecryptRequest, DecryptEnvelopeOptions, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionService, EncryptionServiceConfig, NETWORK_NAME_PATTERN, NetworkIdError, NodeDescriptorFetcher, ParsedEncryptionResource, ParsedNetworkId, RandomReceiverKeyInput, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalSignedResponse, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, isNetworkId, networkDiscoveryKey, openWrappedKey, parseEncryptionResource, parseNetworkId, validateEnvelope, verifyDecryptResponse } from './encryption/index.js';
 export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
@@ -1804,7 +1804,7 @@ type VaultNetworkReadResult<T> = {
 /**
  * Input types for creating vault errors (service field added automatically).
  */
-type VaultErrorInput = {
+type VaultErrorInput = RoutingFailure | {
     code: "DECRYPTION_FAILED";
     message?: string;
     cause?: Error;
@@ -1982,7 +1982,7 @@ interface IDataVaultService extends IService {
      * @returns Result with the decrypted entry
      */
     get<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<Result<VaultEntry<T>, VaultError>>;
-    /** Read a network-encrypted value with safe, phase-classified failures. */
+    /** Read with safe failure phases; typed routing failures reject instead of losing their code. */
     readNetworkEncrypted<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<VaultNetworkReadResult<T>>;
     /**
      * Delete an encrypted key.
@@ -2239,6 +2239,8 @@ declare class DataVaultService extends BaseService implements IDataVaultService
      * Unlike {@link getNetworkEncrypted}, this is intentionally message-free so
      * an operation layer can distinguish an authorized absence from a failed
      * read without receiving node, envelope, plaintext, or key material.
+     * Typed routing failures reject unchanged rather than becoming an ordinary
+     * read/decrypt failure; the operation boundary projects their safe code.
      */
     readNetworkEncrypted<T = unknown>(key: string, options?: VaultGetOptions<T>): Promise<VaultNetworkReadResult<T>>;
     private headNetworkEncrypted;

package/dist/index.js

@@ -10,6 +10,10 @@ var ErrorCodes = {
   /** HTTP 401: a delegation the cited one rests on was revoked. */
   AUTH_DELEGATION_ANCESTOR_REVOKED: "AUTH_DELEGATION_ANCESTOR_REVOKED",
   NETWORK_ERROR: "NETWORK_ERROR",
+  NODE_NOT_RESPONDING: "NODE_NOT_RESPONDING",
+  NODE_IDENTITY_MISMATCH: "NODE_IDENTITY_MISMATCH",
+  PARTIAL_NODE_WRITE: "PARTIAL_NODE_WRITE",
+  RESOURCE_NOT_ROUTED: "RESOURCE_NOT_ROUTED",
   TIMEOUT: "TIMEOUT",
   ABORTED: "ABORTED",
   INVALID_INPUT: "INVALID_INPUT",
@@ -784,6 +788,196 @@ function networkDiscoveryKey(name) {
 var ENCRYPTION_NETWORK_URN_PREFIX = URN_PREFIX;
 var NETWORK_NAME_PATTERN = NETWORK_NAME_RE;
 
+// src/resourceRouting.ts
+async function verifyResourceDestination(target, fetchFn) {
+  if (!target.nodeDid) return;
+  let info;
+  let keys;
+  try {
+    const signal = AbortSignal.timeout(5e3);
+    const responses = await Promise.all([
+      fetchFn(`${target.url}/info`, { signal, redirect: "error" }),
+      fetchFn(`${target.url}/.well-known/tinycloud/node-keys`, { signal, redirect: "error" })
+    ]);
+    if (responses.some((response) => response.status >= 500)) throw new NodeNotRespondingError([target.url]);
+    if (responses.some((response) => !response.ok)) throw new NodeIdentityMismatchError(target.url, target.nodeDid);
+    try {
+      [info, keys] = await Promise.all(responses.map((response) => response.json()));
+    } catch {
+      throw new NodeIdentityMismatchError(target.url, target.nodeDid);
+    }
+  } catch (error) {
+    if (error instanceof NodeIdentityMismatchError || error instanceof NodeNotRespondingError) throw error;
+    throw new NodeNotRespondingError([target.url], error);
+  }
+  const infoDid = typeof info === "object" && info !== null && "nodeId" in info && typeof info.nodeId === "string" ? info.nodeId : void 0;
+  const keysDid = typeof keys === "object" && keys !== null && "nodeDid" in keys && typeof keys.nodeDid === "string" ? keys.nodeDid : void 0;
+  if (infoDid !== target.nodeDid || keysDid !== target.nodeDid) {
+    throw new NodeIdentityMismatchError(target.url, target.nodeDid, infoDid !== target.nodeDid ? infoDid : keysDid);
+  }
+}
+var NodeNotRespondingError = class extends Error {
+  constructor(hosts, cause) {
+    super("The place your data is stored isn't responding right now. Please try again.");
+    this.hosts = hosts;
+    this.cause = cause;
+    this.code = "NODE_NOT_RESPONDING";
+    this.name = "NodeNotRespondingError";
+  }
+};
+var NodeIdentityMismatchError = class extends Error {
+  constructor(url, expectedDid, actualDid) {
+    super(`TinyCloud node identity does not match the registry at ${url}`);
+    this.url = url;
+    this.expectedDid = expectedDid;
+    this.actualDid = actualDid;
+    this.code = "NODE_IDENTITY_MISMATCH";
+    this.name = "NodeIdentityMismatchError";
+  }
+};
+var ResourceNotRoutedError = class extends Error {
+  constructor(resource) {
+    super(`No registered destination can serve ${resource}`);
+    this.resource = resource;
+    this.code = "RESOURCE_NOT_ROUTED";
+    this.name = "ResourceNotRoutedError";
+  }
+};
+var PartialNodeWriteError = class extends Error {
+  constructor(succeeded, failed) {
+    super("The write did not complete on every registered writable node.");
+    this.succeeded = succeeded;
+    this.failed = failed;
+    this.code = "PARTIAL_NODE_WRITE";
+    this.name = "PartialNodeWriteError";
+  }
+};
+var ROUTING_FAILURE_CODES = {
+  NODE_NOT_RESPONDING: true,
+  PARTIAL_NODE_WRITE: true,
+  NODE_IDENTITY_MISMATCH: true,
+  RESOURCE_NOT_ROUTED: true,
+  DECRYPTION_DEPENDENCY_UNAVAILABLE: true,
+  registry_unavailable: true,
+  node_not_found: true,
+  node_registry_entry_exists: true
+};
+function isRoutingFailureCode(code) {
+  return Object.prototype.hasOwnProperty.call(ROUTING_FAILURE_CODES, code);
+}
+function routingFailure(error) {
+  if (typeof error === "object" && error !== null && "code" in error && "message" in error && typeof error.code === "string" && typeof error.message === "string" && isRoutingFailureCode(error.code)) {
+    const candidate = "meta" in error ? error.meta : void 0;
+    let meta = typeof candidate === "object" && candidate !== null && !Array.isArray(candidate) ? candidate : void 0;
+    if (error.code === "NODE_NOT_RESPONDING" && "hosts" in error && Array.isArray(error.hosts)) {
+      meta = { ...meta, hosts: error.hosts };
+    } else if (error.code === "PARTIAL_NODE_WRITE" && "succeeded" in error && Array.isArray(error.succeeded) && "failed" in error && Array.isArray(error.failed)) {
+      meta = { ...meta, succeeded: error.succeeded, failed: error.failed };
+    }
+    return { code: error.code, message: error.message, ...error instanceof Error ? { cause: error } : {}, ...meta ? { meta } : {} };
+  }
+  return void 0;
+}
+function authorizationOf(headers) {
+  if (headers === void 0) return void 0;
+  return (Array.isArray(headers) ? headers : Object.entries(headers)).find(([name]) => name.toLowerCase() === "authorization")?.[1];
+}
+function invocationResources(authorization) {
+  const encoded = authorization.split(".")[1];
+  if (!encoded) throw new ResourceNotRoutedError("invalid invocation");
+  const payload = JSON.parse(atob(encoded.replace(/-/g, "+").replace(/_/g, "/")));
+  if (typeof payload !== "object" || payload === null || !("att" in payload) || typeof payload.att !== "object" || payload.att === null || Array.isArray(payload.att)) {
+    throw new ResourceNotRoutedError("invalid invocation attenuation");
+  }
+  const resources = [];
+  for (const [uri, abilities] of Object.entries(payload.att)) {
+    if (typeof abilities !== "object" || abilities === null || Array.isArray(abilities)) throw new ResourceNotRoutedError(uri);
+    for (const action of Object.keys(abilities)) {
+      const resource = uri.startsWith("tinycloud:") ? uri.split("/")[0] : uri;
+      if (!resource.startsWith("tinycloud:") && !resource.startsWith("urn:tinycloud:encryption:")) throw new ResourceNotRoutedError(uri);
+      const read2 = /^(tinycloud\.(kv\/(get|list|metadata|head|sync)|sql\/(read|export)|duckdb\/(read|describe|export)|capabilities\/read|space\/(list|info)|hooks\/list))$/.test(action);
+      const access = resource.startsWith("urn:tinycloud:encryption:") ? "encryption" : action === "tinycloud.space/host" ? "host" : read2 ? "read" : "write";
+      if (!resources.some((entry) => entry.resource === resource && entry.access === access)) resources.push({ resource, access });
+    }
+  }
+  if (resources.length === 0) throw new ResourceNotRoutedError("empty invocation");
+  return resources;
+}
+function createResourceRoutingFetch(fetchFn, routing) {
+  return async (url, init) => {
+    const parsed = new URL(url);
+    if (parsed.pathname !== "/invoke") return fetchFn(url, init);
+    const authorization = authorizationOf(init?.headers);
+    if (!authorization) throw new ResourceNotRoutedError("unsigned invocation");
+    const resources = invocationResources(authorization);
+    const routes = await Promise.all(resources.map(({ resource, access }) => routing.resolveResource(resource, access)));
+    if (routes.some((route) => route.length === 0)) throw new ResourceNotRoutedError(resources[routes.findIndex((route) => route.length === 0)].resource);
+    const write = resources.some(({ access }) => access === "write" || access === "host");
+    let targets = routes[0].filter((target) => routes.every((route) => route.some((other) => other.url === target.url && other.nodeDid === target.nodeDid)));
+    if (targets.length === 0 || write && routes.some((route) => route.length !== targets.length)) throw new ResourceNotRoutedError(resources.map(({ resource }) => resource).join(", "));
+    targets = targets.filter((target, index) => targets.findIndex((other) => other.url === target.url) === index);
+    const send = async (target) => {
+      init?.signal?.throwIfAborted();
+      if (routing.verifyDestination) await routing.verifyDestination(target);
+      else await verifyResourceDestination(target, fetchFn);
+      const signed = target.nodeDid ? await routing.bindAudience(authorization, target.nodeDid) : authorization;
+      const headers = (Array.isArray(init?.headers) ? init.headers : Object.entries(init?.headers ?? {})).filter(([name]) => name.toLowerCase() !== "authorization");
+      headers.push(["Authorization", signed]);
+      const timeout = AbortSignal.timeout(5e3);
+      const signal = init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
+      try {
+        return await fetchFn(`${target.url}${parsed.pathname}${parsed.search}`, { ...init, headers, signal, redirect: "error" });
+      } catch (error) {
+        if (init?.signal?.aborted) throw error;
+        if (routingFailure(error)) throw error;
+        throw new NodeNotRespondingError([target.url], error);
+      }
+    };
+    if (!write) {
+      let response2;
+      let failure;
+      for (const target of targets) {
+        try {
+          response2 = await send(target);
+          if (response2.ok || response2.status !== 404) return response2;
+        } catch (error) {
+          if (!(error instanceof NodeNotRespondingError)) throw error;
+          failure = error;
+        }
+      }
+      if (failure) throw new NodeNotRespondingError(targets.map(({ url: url2 }) => url2), failure);
+      if (response2) return response2;
+      throw new NodeNotRespondingError(targets.map(({ url: url2 }) => url2), failure);
+    }
+    const succeeded = [];
+    const failed = [];
+    let response;
+    let failureResponse;
+    for (const target of targets) {
+      try {
+        const result = await send(target);
+        if (result.ok) {
+          succeeded.push(target.url);
+          response ?? (response = result);
+        } else {
+          failed.push({ url: target.url, status: result.status });
+          failureResponse ?? (failureResponse = result);
+        }
+      } catch (error) {
+        if (!routingFailure(error) && succeeded.length === 0) throw error;
+        failed.push({ url: target.url, cause: error });
+      }
+    }
+    if (failed.length > 0) {
+      if (succeeded.length > 0 || targets.length > 1) throw new PartialNodeWriteError(succeeded, failed);
+      if (failureResponse) return failureResponse;
+      if (failed[0]?.cause && !(failed[0].cause instanceof NodeNotRespondingError)) throw failed[0].cause;
+      throw new NodeNotRespondingError(targets.map(({ url: url2 }) => url2), failed[0]?.cause);
+    }
+    return response;
+  };
+}
+
 // src/errors.ts
 function parsePermissionHint(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
@@ -1089,6 +1283,8 @@ function isStorageFullError(error) {
   return error?.code === ErrorCodes.STORAGE_QUOTA_EXCEEDED || error?.code === ErrorCodes.STORAGE_LIMIT_REACHED;
 }
 function wrapError(service, error, defaultCode = ErrorCodes.NETWORK_ERROR) {
+  const routing = routingFailure(error);
+  if (routing) return { ...routing, service };
   if (error instanceof Error) {
     if (isRequestTimeoutError(error)) {
       return timeoutError(service, error.timeoutMs, error);
@@ -6030,6 +6226,8 @@ function defaultVaultMessage(input) {
     case "STORAGE_QUOTA_EXCEEDED":
     case "STORAGE_LIMIT_REACHED":
       return input.message;
+    default:
+      return input.message ?? input.code;
   }
 }
 function vaultError(input) {
@@ -6081,6 +6279,8 @@ function ifMatchWriteError(key, error) {
   });
 }
 function kvWriteError(context, error) {
+  const routing = routingFailure(error);
+  if (routing) return vaultError(routing);
   if (error.code === ErrorCodes.STORAGE_QUOTA_EXCEEDED || error.code === ErrorCodes.STORAGE_LIMIT_REACHED) {
     return vaultError({ code: error.code, message: error.message, meta: error.meta });
   }
@@ -6387,6 +6587,8 @@ var DataVaultService = class extends BaseService {
         { aad, metadata }
       );
       if (!envelopeResult.ok) {
+        const routing = routingFailure(envelopeResult.error);
+        if (routing) return vaultError(routing);
         return vaultError({
           code: "STORAGE_ERROR",
           cause: new Error(envelopeResult.error.message)
@@ -6413,6 +6615,8 @@ var DataVaultService = class extends BaseService {
       }
       return { ok: true, data: void 0 };
     } catch (error) {
+      const routing = routingFailure(error);
+      if (routing) return vaultError(routing);
       return vaultError({
         code: "STORAGE_ERROR",
         cause: toError(error)
@@ -6439,6 +6643,8 @@ var DataVaultService = class extends BaseService {
         ...options?.source === void 0 ? {} : { source: options.source }
       });
       if (!valueResult.ok) {
+        const routing = routingFailure(valueResult.error);
+        if (routing) return vaultError(routing);
         return vaultError({ code: "KEY_NOT_FOUND", key });
       }
       const rawEnvelope = unwrapKVData(valueResult.data);
@@ -6459,6 +6665,8 @@ var DataVaultService = class extends BaseService {
       const proof = await this.decryptCapabilityProof();
       const plaintextResult = await config.service.decryptEnvelope(envelope, proof);
       if (!plaintextResult.ok) {
+        const routing = routingFailure(plaintextResult.error);
+        if (routing) return vaultError(routing);
         return vaultError({
           code: "DECRYPTION_FAILED",
           message: plaintextResult.error.message
@@ -6478,6 +6686,8 @@ var DataVaultService = class extends BaseService {
         data: { value, metadata, keyId, ...etag === void 0 ? {} : { etag } }
       };
     } catch (error) {
+      const routing = routingFailure(error);
+      if (routing) return vaultError(routing);
       return vaultError({
         code: "STORAGE_ERROR",
         cause: toError(error)
@@ -6490,6 +6700,8 @@ var DataVaultService = class extends BaseService {
    * Unlike {@link getNetworkEncrypted}, this is intentionally message-free so
    * an operation layer can distinguish an authorized absence from a failed
    * read without receiving node, envelope, plaintext, or key material.
+   * Typed routing failures reject unchanged rather than becoming an ordinary
+   * read/decrypt failure; the operation boundary projects their safe code.
    */
   async readNetworkEncrypted(key, options) {
     const config = this.networkEncryption;
@@ -6499,10 +6711,12 @@ var DataVaultService = class extends BaseService {
     let valueResult;
     try {
       valueResult = await this.tc.kv.get(`vault/${key}`, { raw: true, source: "network" });
-    } catch {
+    } catch (error) {
+      if (routingFailure(error)) throw error;
       return { status: "node_unreachable" };
     }
     if (!valueResult.ok) {
+      if (routingFailure(valueResult.error)) throw valueResult.error;
       const permissionHint = parsePermissionHint(valueResult.error.meta?.permissionHint);
       if (valueResult.error.code === "AUTH_UNAUTHORIZED" && permissionHint !== void 0) {
         return { status: "permission_required", hint: permissionHint };
@@ -6510,7 +6724,7 @@ var DataVaultService = class extends BaseService {
       if ((valueResult.error.code === "NOT_FOUND" || valueResult.error.code === "KV_NOT_FOUND") && !hasHttpResponse(valueResult.error)) {
         return { status: "not_found" };
       }
-      if (valueResult.error.code === "NETWORK_ERROR" || valueResult.error.code === "TIMEOUT" || valueResult.error.code === "ABORTED") {
+      if (valueResult.error.code === "NODE_NOT_RESPONDING" || valueResult.error.code === "NETWORK_ERROR" || valueResult.error.code === "TIMEOUT" || valueResult.error.code === "ABORTED") {
         return hasHttpResponse(valueResult.error) ? { status: "read_failed" } : { status: "node_unreachable" };
       }
       return { status: "read_failed" };
@@ -6532,10 +6746,12 @@ var DataVaultService = class extends BaseService {
     try {
       const proof = await this.decryptCapabilityProof();
       plaintextResult = await config.service.decryptEnvelope(envelope, proof);
-    } catch {
+    } catch (error) {
+      if (routingFailure(error)) throw error;
       return { status: "decrypt_failed" };
     }
     if (!plaintextResult.ok) {
+      if (routingFailure(plaintextResult.error)) throw plaintextResult.error;
       const permissionHint = parsePermissionHint(
         plaintextResult.error.permissionHint
       );
@@ -6545,7 +6761,7 @@ var DataVaultService = class extends BaseService {
       if (plaintextResult.error.code === "INVALID_ENVELOPE") {
         return { status: "corrupt_envelope" };
       }
-      if (plaintextResult.error.code === "TRANSPORT_ERROR") {
+      if (plaintextResult.error.code === "NODE_NOT_RESPONDING" || plaintextResult.error.code === "TRANSPORT_ERROR") {
         return { status: "node_unreachable" };
       }
       return { status: "decrypt_failed" };
@@ -7702,6 +7918,8 @@ function defaultEncryptionMessage(input) {
       return input.message ?? input.cause.message;
     case "INVALID_INPUT":
       return input.message;
+    default:
+      return input.message ?? input.code;
   }
 }
 function encryptionError(input) {
@@ -7766,6 +7984,8 @@ async function discoverNetwork(input) {
         return { ok: true, data: { descriptor: validated.data, source: "node" } };
       }
     } catch (err3) {
+      const routing = routingFailure(err3);
+      if (routing) return { ok: false, error: encryptionError(routing) };
     }
   }
   if (input.wellKnown !== void 0) {
@@ -7783,6 +8003,8 @@ async function discoverNetwork(input) {
         };
       }
     } catch (err3) {
+      const routing = routingFailure(err3);
+      if (routing) return { ok: false, error: encryptionError(routing) };
     }
   }
   return {
@@ -8367,6 +8589,14 @@ function encOk(data) {
 function encErr(error) {
   return { ok: false, error };
 }
+function decryptionError(input) {
+  const unavailable = input.code === "NODE_NOT_RESPONDING" || input.code === "TRANSPORT_ERROR" && input.cause.name !== "AbortError";
+  return encryptionError(unavailable ? {
+    ...input,
+    code: "DECRYPTION_DEPENDENCY_UNAVAILABLE",
+    message: "The decryption service isn't responding right now. Please try again."
+  } : input);
+}
 var EncryptionService = class extends BaseService {
   constructor(config) {
     super();
@@ -8414,6 +8644,8 @@ var EncryptionService = class extends BaseService {
       });
       return encOk(result.envelope);
     } catch (error) {
+      const routing = routingFailure(error);
+      if (routing) return encErr(encryptionError(routing));
       return encErr(
         encryptionError({
           code: "TRANSPORT_ERROR",
@@ -8440,12 +8672,12 @@ var EncryptionService = class extends BaseService {
         descriptor = options.descriptor;
       } else {
         const discovered = await this.discoverNetwork(envelope.networkId);
-        if (!discovered.ok) return discovered;
+        if (!discovered.ok) return encErr(decryptionError(discovered.error));
         descriptor = discovered.data;
       }
       const usable = ensureNetworkUsableForDecrypt(descriptor);
       if (!usable.ok) return usable;
-      const targetNode = options?.targetNode ?? descriptor.members[0]?.nodeId;
+      const targetNode = this._config.resolveTargetNode ? await this._config.resolveTargetNode(envelope.networkId) : options?.targetNode ?? descriptor.members[0]?.nodeId;
       if (targetNode === void 0) {
         return encErr(
           encryptionError({
@@ -8454,6 +8686,9 @@ var EncryptionService = class extends BaseService {
           })
         );
       }
+      if (this._config.resolveTargetNode && (options?.targetNode !== void 0 && options.targetNode !== targetNode || !descriptor.members.some((member) => member.nodeId === targetNode))) {
+        return encErr(encryptionError({ code: "INVALID_INPUT", message: "Encryption destination does not match the registry" }));
+      }
       const receiverKey = generateRandomReceiverKey({ crypto: this.crypto });
       const receiverPublicKey = base64Encode(receiverKey.publicKey);
       const receiverPublicKeyHash = canonicalHashHex(
@@ -8512,6 +8747,8 @@ var EncryptionService = class extends BaseService {
         });
         this.assertActive();
       } catch (error) {
+        const routing = routingFailure(error);
+        if (routing) return encErr(decryptionError(routing));
         if (error instanceof DecryptTransportResponseError) {
           return encErr(
             encryptionError(
@@ -8528,7 +8765,7 @@ var EncryptionService = class extends BaseService {
           );
         }
         return encErr(
-          encryptionError({
+          decryptionError({
             code: "TRANSPORT_ERROR",
             cause: toError2(error)
           })
@@ -8555,6 +8792,8 @@ var EncryptionService = class extends BaseService {
       );
       return encOk(plaintext);
     } catch (error) {
+      const routing = routingFailure(error);
+      if (routing) return encErr(decryptionError(routing));
       return encErr(
         encryptionError({
           code: "INVALID_RESPONSE",
@@ -8603,7 +8842,11 @@ export {
   MAX_SECRET_SCOPE_LENGTH,
   NETWORK_NAME_PATTERN,
   NetworkIdError,
+  NodeIdentityMismatchError,
+  NodeNotRespondingError,
+  PartialNodeWriteError,
   PrefixedKVService,
+  ResourceNotRoutedError,
   RetryPolicySchema,
   SECRET_NAME_RE,
   SECRET_SCOPE_RE,
@@ -8651,6 +8894,7 @@ export {
   checkDecryptInvocationInput,
   clearTinyCloudDebugLogs,
   createKVResponseSchema,
+  createResourceRoutingFetch,
   createResultSchema,
   createVaultCrypto,
   decryptEnvelopeWithKey,
@@ -8693,6 +8937,7 @@ export {
   requiresSecretsOptIn,
   resolveSecretListPrefix,
   resolveSecretPath,
+  routingFailure,
   serviceError,
   storageLimitReachedError,
   storageQuotaExceededError,
@@ -8713,6 +8958,7 @@ export {
   validateTelemetrySpanEvent,
   validatedCapabilityOf,
   verifyDecryptResponse,
+  verifyResourceDestination,
   wrapError
 };
 //# sourceMappingURL=index.js.map