@tinycloud/sdk-services 3.11.0 → 3.12.0-beta.4

package/dist/index.cjs

@@ -51,7 +51,11 @@ __export(src_exports, {
   MAX_SECRET_SCOPE_LENGTH: () => MAX_SECRET_SCOPE_LENGTH,
   NETWORK_NAME_PATTERN: () => NETWORK_NAME_PATTERN,
   NetworkIdError: () => NetworkIdError,
+  NodeIdentityMismatchError: () => NodeIdentityMismatchError,
+  NodeNotRespondingError: () => NodeNotRespondingError,
+  PartialNodeWriteError: () => PartialNodeWriteError,
   PrefixedKVService: () => PrefixedKVService,
+  ResourceNotRoutedError: () => ResourceNotRoutedError,
   RetryPolicySchema: () => RetryPolicySchema,
   SECRET_NAME_RE: () => SECRET_NAME_RE,
   SECRET_SCOPE_RE: () => SECRET_SCOPE_RE,
@@ -99,6 +103,7 @@ __export(src_exports, {
   checkDecryptInvocationInput: () => checkDecryptInvocationInput,
   clearTinyCloudDebugLogs: () => clearTinyCloudDebugLogs,
   createKVResponseSchema: () => createKVResponseSchema,
+  createResourceRoutingFetch: () => createResourceRoutingFetch,
   createResultSchema: () => createResultSchema,
   createVaultCrypto: () => createVaultCrypto,
   decryptEnvelopeWithKey: () => decryptEnvelopeWithKey,
@@ -141,6 +146,7 @@ __export(src_exports, {
   requiresSecretsOptIn: () => requiresSecretsOptIn,
   resolveSecretListPrefix: () => resolveSecretListPrefix,
   resolveSecretPath: () => resolveSecretPath,
+  routingFailure: () => routingFailure,
   serviceError: () => serviceError,
   storageLimitReachedError: () => storageLimitReachedError,
   storageQuotaExceededError: () => storageQuotaExceededError,
@@ -161,6 +167,7 @@ __export(src_exports, {
   validateTelemetrySpanEvent: () => validateTelemetrySpanEvent,
   validatedCapabilityOf: () => validatedCapabilityOf,
   verifyDecryptResponse: () => verifyDecryptResponse,
+  verifyResourceDestination: () => verifyResourceDestination,
   wrapError: () => wrapError
 });
 module.exports = __toCommonJS(src_exports);
@@ -177,6 +184,10 @@ var ErrorCodes = {
   /** HTTP 401: a delegation the cited one rests on was revoked. */
   AUTH_DELEGATION_ANCESTOR_REVOKED: "AUTH_DELEGATION_ANCESTOR_REVOKED",
   NETWORK_ERROR: "NETWORK_ERROR",
+  NODE_NOT_RESPONDING: "NODE_NOT_RESPONDING",
+  NODE_IDENTITY_MISMATCH: "NODE_IDENTITY_MISMATCH",
+  PARTIAL_NODE_WRITE: "PARTIAL_NODE_WRITE",
+  RESOURCE_NOT_ROUTED: "RESOURCE_NOT_ROUTED",
   TIMEOUT: "TIMEOUT",
   ABORTED: "ABORTED",
   INVALID_INPUT: "INVALID_INPUT",
@@ -951,6 +962,196 @@ function networkDiscoveryKey(name) {
 var ENCRYPTION_NETWORK_URN_PREFIX = URN_PREFIX;
 var NETWORK_NAME_PATTERN = NETWORK_NAME_RE;
 
+// src/resourceRouting.ts
+async function verifyResourceDestination(target, fetchFn) {
+  if (!target.nodeDid) return;
+  let info;
+  let keys;
+  try {
+    const signal = AbortSignal.timeout(5e3);
+    const responses = await Promise.all([
+      fetchFn(`${target.url}/info`, { signal, redirect: "error" }),
+      fetchFn(`${target.url}/.well-known/tinycloud/node-keys`, { signal, redirect: "error" })
+    ]);
+    if (responses.some((response) => response.status >= 500)) throw new NodeNotRespondingError([target.url]);
+    if (responses.some((response) => !response.ok)) throw new NodeIdentityMismatchError(target.url, target.nodeDid);
+    try {
+      [info, keys] = await Promise.all(responses.map((response) => response.json()));
+    } catch {
+      throw new NodeIdentityMismatchError(target.url, target.nodeDid);
+    }
+  } catch (error) {
+    if (error instanceof NodeIdentityMismatchError || error instanceof NodeNotRespondingError) throw error;
+    throw new NodeNotRespondingError([target.url], error);
+  }
+  const infoDid = typeof info === "object" && info !== null && "nodeId" in info && typeof info.nodeId === "string" ? info.nodeId : void 0;
+  const keysDid = typeof keys === "object" && keys !== null && "nodeDid" in keys && typeof keys.nodeDid === "string" ? keys.nodeDid : void 0;
+  if (infoDid !== target.nodeDid || keysDid !== target.nodeDid) {
+    throw new NodeIdentityMismatchError(target.url, target.nodeDid, infoDid !== target.nodeDid ? infoDid : keysDid);
+  }
+}
+var NodeNotRespondingError = class extends Error {
+  constructor(hosts, cause) {
+    super("The place your data is stored isn't responding right now. Please try again.");
+    this.hosts = hosts;
+    this.cause = cause;
+    this.code = "NODE_NOT_RESPONDING";
+    this.name = "NodeNotRespondingError";
+  }
+};
+var NodeIdentityMismatchError = class extends Error {
+  constructor(url, expectedDid, actualDid) {
+    super(`TinyCloud node identity does not match the registry at ${url}`);
+    this.url = url;
+    this.expectedDid = expectedDid;
+    this.actualDid = actualDid;
+    this.code = "NODE_IDENTITY_MISMATCH";
+    this.name = "NodeIdentityMismatchError";
+  }
+};
+var ResourceNotRoutedError = class extends Error {
+  constructor(resource) {
+    super(`No registered destination can serve ${resource}`);
+    this.resource = resource;
+    this.code = "RESOURCE_NOT_ROUTED";
+    this.name = "ResourceNotRoutedError";
+  }
+};
+var PartialNodeWriteError = class extends Error {
+  constructor(succeeded, failed) {
+    super("The write did not complete on every registered writable node.");
+    this.succeeded = succeeded;
+    this.failed = failed;
+    this.code = "PARTIAL_NODE_WRITE";
+    this.name = "PartialNodeWriteError";
+  }
+};
+var ROUTING_FAILURE_CODES = {
+  NODE_NOT_RESPONDING: true,
+  PARTIAL_NODE_WRITE: true,
+  NODE_IDENTITY_MISMATCH: true,
+  RESOURCE_NOT_ROUTED: true,
+  DECRYPTION_DEPENDENCY_UNAVAILABLE: true,
+  registry_unavailable: true,
+  node_not_found: true,
+  node_registry_entry_exists: true
+};
+function isRoutingFailureCode(code) {
+  return Object.prototype.hasOwnProperty.call(ROUTING_FAILURE_CODES, code);
+}
+function routingFailure(error) {
+  if (typeof error === "object" && error !== null && "code" in error && "message" in error && typeof error.code === "string" && typeof error.message === "string" && isRoutingFailureCode(error.code)) {
+    const candidate = "meta" in error ? error.meta : void 0;
+    let meta = typeof candidate === "object" && candidate !== null && !Array.isArray(candidate) ? candidate : void 0;
+    if (error.code === "NODE_NOT_RESPONDING" && "hosts" in error && Array.isArray(error.hosts)) {
+      meta = { ...meta, hosts: error.hosts };
+    } else if (error.code === "PARTIAL_NODE_WRITE" && "succeeded" in error && Array.isArray(error.succeeded) && "failed" in error && Array.isArray(error.failed)) {
+      meta = { ...meta, succeeded: error.succeeded, failed: error.failed };
+    }
+    return { code: error.code, message: error.message, ...error instanceof Error ? { cause: error } : {}, ...meta ? { meta } : {} };
+  }
+  return void 0;
+}
+function authorizationOf(headers) {
+  if (headers === void 0) return void 0;
+  return (Array.isArray(headers) ? headers : Object.entries(headers)).find(([name]) => name.toLowerCase() === "authorization")?.[1];
+}
+function invocationResources(authorization) {
+  const encoded = authorization.split(".")[1];
+  if (!encoded) throw new ResourceNotRoutedError("invalid invocation");
+  const payload = JSON.parse(atob(encoded.replace(/-/g, "+").replace(/_/g, "/")));
+  if (typeof payload !== "object" || payload === null || !("att" in payload) || typeof payload.att !== "object" || payload.att === null || Array.isArray(payload.att)) {
+    throw new ResourceNotRoutedError("invalid invocation attenuation");
+  }
+  const resources = [];
+  for (const [uri, abilities] of Object.entries(payload.att)) {
+    if (typeof abilities !== "object" || abilities === null || Array.isArray(abilities)) throw new ResourceNotRoutedError(uri);
+    for (const action of Object.keys(abilities)) {
+      const resource = uri.startsWith("tinycloud:") ? uri.split("/")[0] : uri;
+      if (!resource.startsWith("tinycloud:") && !resource.startsWith("urn:tinycloud:encryption:")) throw new ResourceNotRoutedError(uri);
+      const read2 = /^(tinycloud\.(kv\/(get|list|metadata|head|sync)|sql\/(read|export)|duckdb\/(read|describe|export)|capabilities\/read|space\/(list|info)|hooks\/list))$/.test(action);
+      const access = resource.startsWith("urn:tinycloud:encryption:") ? "encryption" : action === "tinycloud.space/host" ? "host" : read2 ? "read" : "write";
+      if (!resources.some((entry) => entry.resource === resource && entry.access === access)) resources.push({ resource, access });
+    }
+  }
+  if (resources.length === 0) throw new ResourceNotRoutedError("empty invocation");
+  return resources;
+}
+function createResourceRoutingFetch(fetchFn, routing) {
+  return async (url, init) => {
+    const parsed = new URL(url);
+    if (parsed.pathname !== "/invoke") return fetchFn(url, init);
+    const authorization = authorizationOf(init?.headers);
+    if (!authorization) throw new ResourceNotRoutedError("unsigned invocation");
+    const resources = invocationResources(authorization);
+    const routes = await Promise.all(resources.map(({ resource, access }) => routing.resolveResource(resource, access)));
+    if (routes.some((route) => route.length === 0)) throw new ResourceNotRoutedError(resources[routes.findIndex((route) => route.length === 0)].resource);
+    const write = resources.some(({ access }) => access === "write" || access === "host");
+    let targets = routes[0].filter((target) => routes.every((route) => route.some((other) => other.url === target.url && other.nodeDid === target.nodeDid)));
+    if (targets.length === 0 || write && routes.some((route) => route.length !== targets.length)) throw new ResourceNotRoutedError(resources.map(({ resource }) => resource).join(", "));
+    targets = targets.filter((target, index) => targets.findIndex((other) => other.url === target.url) === index);
+    const send = async (target) => {
+      init?.signal?.throwIfAborted();
+      if (routing.verifyDestination) await routing.verifyDestination(target);
+      else await verifyResourceDestination(target, fetchFn);
+      const signed = target.nodeDid ? await routing.bindAudience(authorization, target.nodeDid) : authorization;
+      const headers = (Array.isArray(init?.headers) ? init.headers : Object.entries(init?.headers ?? {})).filter(([name]) => name.toLowerCase() !== "authorization");
+      headers.push(["Authorization", signed]);
+      const timeout = AbortSignal.timeout(5e3);
+      const signal = init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
+      try {
+        return await fetchFn(`${target.url}${parsed.pathname}${parsed.search}`, { ...init, headers, signal, redirect: "error" });
+      } catch (error) {
+        if (init?.signal?.aborted) throw error;
+        if (routingFailure(error)) throw error;
+        throw new NodeNotRespondingError([target.url], error);
+      }
+    };
+    if (!write) {
+      let response2;
+      let failure;
+      for (const target of targets) {
+        try {
+          response2 = await send(target);
+          if (response2.ok || response2.status !== 404) return response2;
+        } catch (error) {
+          if (!(error instanceof NodeNotRespondingError)) throw error;
+          failure = error;
+        }
+      }
+      if (failure) throw new NodeNotRespondingError(targets.map(({ url: url2 }) => url2), failure);
+      if (response2) return response2;
+      throw new NodeNotRespondingError(targets.map(({ url: url2 }) => url2), failure);
+    }
+    const succeeded = [];
+    const failed = [];
+    let response;
+    let failureResponse;
+    for (const target of targets) {
+      try {
+        const result = await send(target);
+        if (result.ok) {
+          succeeded.push(target.url);
+          response ?? (response = result);
+        } else {
+          failed.push({ url: target.url, status: result.status });
+          failureResponse ?? (failureResponse = result);
+        }
+      } catch (error) {
+        if (!routingFailure(error) && succeeded.length === 0) throw error;
+        failed.push({ url: target.url, cause: error });
+      }
+    }
+    if (failed.length > 0) {
+      if (succeeded.length > 0 || targets.length > 1) throw new PartialNodeWriteError(succeeded, failed);
+      if (failureResponse) return failureResponse;
+      if (failed[0]?.cause && !(failed[0].cause instanceof NodeNotRespondingError)) throw failed[0].cause;
+      throw new NodeNotRespondingError(targets.map(({ url: url2 }) => url2), failed[0]?.cause);
+    }
+    return response;
+  };
+}
+
 // src/errors.ts
 function parsePermissionHint(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
@@ -1256,6 +1457,8 @@ function isStorageFullError(error) {
   return error?.code === ErrorCodes.STORAGE_QUOTA_EXCEEDED || error?.code === ErrorCodes.STORAGE_LIMIT_REACHED;
 }
 function wrapError(service, error, defaultCode = ErrorCodes.NETWORK_ERROR) {
+  const routing = routingFailure(error);
+  if (routing) return { ...routing, service };
   if (error instanceof Error) {
     if (isRequestTimeoutError(error)) {
       return timeoutError(service, error.timeoutMs, error);
@@ -6197,6 +6400,8 @@ function defaultVaultMessage(input) {
     case "STORAGE_QUOTA_EXCEEDED":
     case "STORAGE_LIMIT_REACHED":
       return input.message;
+    default:
+      return input.message ?? input.code;
   }
 }
 function vaultError(input) {
@@ -6248,6 +6453,8 @@ function ifMatchWriteError(key, error) {
   });
 }
 function kvWriteError(context, error) {
+  const routing = routingFailure(error);
+  if (routing) return vaultError(routing);
   if (error.code === ErrorCodes.STORAGE_QUOTA_EXCEEDED || error.code === ErrorCodes.STORAGE_LIMIT_REACHED) {
     return vaultError({ code: error.code, message: error.message, meta: error.meta });
   }
@@ -6554,6 +6761,8 @@ var DataVaultService = class extends BaseService {
         { aad, metadata }
       );
       if (!envelopeResult.ok) {
+        const routing = routingFailure(envelopeResult.error);
+        if (routing) return vaultError(routing);
         return vaultError({
           code: "STORAGE_ERROR",
           cause: new Error(envelopeResult.error.message)
@@ -6580,6 +6789,8 @@ var DataVaultService = class extends BaseService {
       }
       return { ok: true, data: void 0 };
     } catch (error) {
+      const routing = routingFailure(error);
+      if (routing) return vaultError(routing);
       return vaultError({
         code: "STORAGE_ERROR",
         cause: toError(error)
@@ -6606,6 +6817,8 @@ var DataVaultService = class extends BaseService {
         ...options?.source === void 0 ? {} : { source: options.source }
       });
       if (!valueResult.ok) {
+        const routing = routingFailure(valueResult.error);
+        if (routing) return vaultError(routing);
         return vaultError({ code: "KEY_NOT_FOUND", key });
       }
       const rawEnvelope = unwrapKVData(valueResult.data);
@@ -6626,6 +6839,8 @@ var DataVaultService = class extends BaseService {
       const proof = await this.decryptCapabilityProof();
       const plaintextResult = await config.service.decryptEnvelope(envelope, proof);
       if (!plaintextResult.ok) {
+        const routing = routingFailure(plaintextResult.error);
+        if (routing) return vaultError(routing);
         return vaultError({
           code: "DECRYPTION_FAILED",
           message: plaintextResult.error.message
@@ -6645,6 +6860,8 @@ var DataVaultService = class extends BaseService {
         data: { value, metadata, keyId, ...etag === void 0 ? {} : { etag } }
       };
     } catch (error) {
+      const routing = routingFailure(error);
+      if (routing) return vaultError(routing);
       return vaultError({
         code: "STORAGE_ERROR",
         cause: toError(error)
@@ -6657,6 +6874,8 @@ var DataVaultService = class extends BaseService {
    * Unlike {@link getNetworkEncrypted}, this is intentionally message-free so
    * an operation layer can distinguish an authorized absence from a failed
    * read without receiving node, envelope, plaintext, or key material.
+   * Typed routing failures reject unchanged rather than becoming an ordinary
+   * read/decrypt failure; the operation boundary projects their safe code.
    */
   async readNetworkEncrypted(key, options) {
     const config = this.networkEncryption;
@@ -6666,10 +6885,12 @@ var DataVaultService = class extends BaseService {
     let valueResult;
     try {
       valueResult = await this.tc.kv.get(`vault/${key}`, { raw: true, source: "network" });
-    } catch {
+    } catch (error) {
+      if (routingFailure(error)) throw error;
       return { status: "node_unreachable" };
     }
     if (!valueResult.ok) {
+      if (routingFailure(valueResult.error)) throw valueResult.error;
       const permissionHint = parsePermissionHint(valueResult.error.meta?.permissionHint);
       if (valueResult.error.code === "AUTH_UNAUTHORIZED" && permissionHint !== void 0) {
         return { status: "permission_required", hint: permissionHint };
@@ -6677,7 +6898,7 @@ var DataVaultService = class extends BaseService {
       if ((valueResult.error.code === "NOT_FOUND" || valueResult.error.code === "KV_NOT_FOUND") && !hasHttpResponse(valueResult.error)) {
         return { status: "not_found" };
       }
-      if (valueResult.error.code === "NETWORK_ERROR" || valueResult.error.code === "TIMEOUT" || valueResult.error.code === "ABORTED") {
+      if (valueResult.error.code === "NODE_NOT_RESPONDING" || valueResult.error.code === "NETWORK_ERROR" || valueResult.error.code === "TIMEOUT" || valueResult.error.code === "ABORTED") {
         return hasHttpResponse(valueResult.error) ? { status: "read_failed" } : { status: "node_unreachable" };
       }
       return { status: "read_failed" };
@@ -6699,10 +6920,12 @@ var DataVaultService = class extends BaseService {
     try {
       const proof = await this.decryptCapabilityProof();
       plaintextResult = await config.service.decryptEnvelope(envelope, proof);
-    } catch {
+    } catch (error) {
+      if (routingFailure(error)) throw error;
       return { status: "decrypt_failed" };
     }
     if (!plaintextResult.ok) {
+      if (routingFailure(plaintextResult.error)) throw plaintextResult.error;
       const permissionHint = parsePermissionHint(
         plaintextResult.error.permissionHint
       );
@@ -6712,7 +6935,7 @@ var DataVaultService = class extends BaseService {
       if (plaintextResult.error.code === "INVALID_ENVELOPE") {
         return { status: "corrupt_envelope" };
       }
-      if (plaintextResult.error.code === "TRANSPORT_ERROR") {
+      if (plaintextResult.error.code === "NODE_NOT_RESPONDING" || plaintextResult.error.code === "TRANSPORT_ERROR") {
         return { status: "node_unreachable" };
       }
       return { status: "decrypt_failed" };
@@ -6964,6 +7187,8 @@ var DataVaultService = class extends BaseService {
         if (this.usesNetworkEncryption) {
           const valueDelResult2 = await this.tc.kv.delete(`vault/${key}`);
           if (!valueDelResult2.ok) {
+            const routing = routingFailure(valueDelResult2.error);
+            if (routing) return vaultError(routing);
             return vaultError({ code: "KEY_NOT_FOUND", key });
           }
           return ok(void 0);
@@ -6973,10 +7198,14 @@ var DataVaultService = class extends BaseService {
           this.tc.kv.delete(`vault/${key}`)
         ]);
         if (!keyDelResult.ok && !valueDelResult.ok) {
+          const routing = routingFailure(keyDelResult.error) ?? routingFailure(valueDelResult.error);
+          if (routing) return vaultError(routing);
           return vaultError({ code: "KEY_NOT_FOUND", key });
         }
         return ok(void 0);
       } catch (error) {
+        const routing = routingFailure(error);
+        if (routing) return vaultError(routing);
         return vaultError({
           code: "STORAGE_ERROR",
           cause: toError(error)
@@ -7018,6 +7247,8 @@ var DataVaultService = class extends BaseService {
           ...options?.cursor === void 0 ? {} : { cursor: options.cursor }
         });
         if (!listResult.ok) {
+          const routing = routingFailure(listResult.error);
+          if (routing) return vaultError(routing);
           return vaultError({
             code: "STORAGE_ERROR",
             cause: new Error(
@@ -7038,6 +7269,8 @@ var DataVaultService = class extends BaseService {
           ...listResult.data.nextCursor === void 0 ? {} : { nextCursor: listResult.data.nextCursor }
         });
       } catch (error) {
+        const routing = routingFailure(error);
+        if (routing) return vaultError(routing);
         return vaultError({
           code: "STORAGE_ERROR",
           cause: toError(error)
@@ -7869,6 +8102,8 @@ function defaultEncryptionMessage(input) {
       return input.message ?? input.cause.message;
     case "INVALID_INPUT":
       return input.message;
+    default:
+      return input.message ?? input.code;
   }
 }
 function encryptionError(input) {
@@ -7933,6 +8168,8 @@ async function discoverNetwork(input) {
         return { ok: true, data: { descriptor: validated.data, source: "node" } };
       }
     } catch (err3) {
+      const routing = routingFailure(err3);
+      if (routing) return { ok: false, error: encryptionError(routing) };
     }
   }
   if (input.wellKnown !== void 0) {
@@ -7950,6 +8187,8 @@ async function discoverNetwork(input) {
         };
       }
     } catch (err3) {
+      const routing = routingFailure(err3);
+      if (routing) return { ok: false, error: encryptionError(routing) };
     }
   }
   return {
@@ -8534,6 +8773,14 @@ function encOk(data) {
 function encErr(error) {
   return { ok: false, error };
 }
+function decryptionError(input) {
+  const unavailable = input.code === "NODE_NOT_RESPONDING" || input.code === "TRANSPORT_ERROR" && input.cause.name !== "AbortError";
+  return encryptionError(unavailable ? {
+    ...input,
+    code: "DECRYPTION_DEPENDENCY_UNAVAILABLE",
+    message: "The decryption service isn't responding right now. Please try again."
+  } : input);
+}
 var EncryptionService = class extends BaseService {
   constructor(config) {
     super();
@@ -8581,6 +8828,8 @@ var EncryptionService = class extends BaseService {
       });
       return encOk(result.envelope);
     } catch (error) {
+      const routing = routingFailure(error);
+      if (routing) return encErr(encryptionError(routing));
       return encErr(
         encryptionError({
           code: "TRANSPORT_ERROR",
@@ -8607,12 +8856,12 @@ var EncryptionService = class extends BaseService {
         descriptor = options.descriptor;
       } else {
         const discovered = await this.discoverNetwork(envelope.networkId);
-        if (!discovered.ok) return discovered;
+        if (!discovered.ok) return encErr(decryptionError(discovered.error));
         descriptor = discovered.data;
       }
       const usable = ensureNetworkUsableForDecrypt(descriptor);
       if (!usable.ok) return usable;
-      const targetNode = options?.targetNode ?? descriptor.members[0]?.nodeId;
+      const targetNode = this._config.resolveTargetNode ? await this._config.resolveTargetNode(envelope.networkId) : options?.targetNode ?? descriptor.members[0]?.nodeId;
       if (targetNode === void 0) {
         return encErr(
           encryptionError({
@@ -8621,6 +8870,9 @@ var EncryptionService = class extends BaseService {
           })
         );
       }
+      if (this._config.resolveTargetNode && (options?.targetNode !== void 0 && options.targetNode !== targetNode || !descriptor.members.some((member) => member.nodeId === targetNode))) {
+        return encErr(encryptionError({ code: "INVALID_INPUT", message: "Encryption destination does not match the registry" }));
+      }
       const receiverKey = generateRandomReceiverKey({ crypto: this.crypto });
       const receiverPublicKey = base64Encode(receiverKey.publicKey);
       const receiverPublicKeyHash = canonicalHashHex(
@@ -8679,6 +8931,8 @@ var EncryptionService = class extends BaseService {
         });
         this.assertActive();
       } catch (error) {
+        const routing = routingFailure(error);
+        if (routing) return encErr(decryptionError(routing));
         if (error instanceof import_decrypt_transport_response_error.DecryptTransportResponseError) {
           return encErr(
             encryptionError(
@@ -8695,7 +8949,7 @@ var EncryptionService = class extends BaseService {
           );
         }
         return encErr(
-          encryptionError({
+          decryptionError({
             code: "TRANSPORT_ERROR",
             cause: toError2(error)
           })
@@ -8722,6 +8976,8 @@ var EncryptionService = class extends BaseService {
       );
       return encOk(plaintext);
     } catch (error) {
+      const routing = routingFailure(error);
+      if (routing) return encErr(decryptionError(routing));
       return encErr(
         encryptionError({
           code: "INVALID_RESPONSE",
@@ -8771,7 +9027,11 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   MAX_SECRET_SCOPE_LENGTH,
   NETWORK_NAME_PATTERN,
   NetworkIdError,
+  NodeIdentityMismatchError,
+  NodeNotRespondingError,
+  PartialNodeWriteError,
   PrefixedKVService,
+  ResourceNotRoutedError,
   RetryPolicySchema,
   SECRET_NAME_RE,
   SECRET_SCOPE_RE,
@@ -8819,6 +9079,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   checkDecryptInvocationInput,
   clearTinyCloudDebugLogs,
   createKVResponseSchema,
+  createResourceRoutingFetch,
   createResultSchema,
   createVaultCrypto,
   decryptEnvelopeWithKey,
@@ -8861,6 +9122,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   requiresSecretsOptIn,
   resolveSecretListPrefix,
   resolveSecretPath,
+  routingFailure,
   serviceError,
   storageLimitReachedError,
   storageQuotaExceededError,
@@ -8881,6 +9143,7 @@ var import_decrypt_transport_response_error3 = require("@tinycloud/sdk-services/
   validateTelemetrySpanEvent,
   validatedCapabilityOf,
   verifyDecryptResponse,
+  verifyResourceDestination,
   wrapError
 });
 //# sourceMappingURL=index.cjs.map