@tinycloud/sdk-services 3.8.0-beta.1 → 3.8.0-beta.16

package/dist/index.d.cts

@@ -7,13 +7,13 @@ import { B as BaseService } from './BaseService-D-29xShG.cjs';
 export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-D-29xShG.cjs';
 import { IKVService } from './kv/index.cjs';
 export { IPrefixedKVService, KVService, PrefixedKVService } from './kv/index.cjs';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, aq as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, ar as KVAction, as as KVActionType, at as KVBatchPutItem, au as KVBatchPutOptions, av as KVBatchPutResponse, aw as KVBatchReadResponse, ax as KVChange, ay as KVChangesAuthority, az as KVChangesOptions, aA as KVChangesResponse, aB as KVCreateSignedReadUrlOptions, aC as KVDeleteOptions, aD as KVGetOptions, aE as KVHeadOptions, aF as KVListOptions, b as KVListPage, aG as KVListResponse, aH as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aI as KVResponse, aJ as KVResponseHeaders, aK as KVServiceConfig, aL as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaPageAdmission, a3 as ReplicaPartitionEraser, a4 as ReplicaPartitionIndexEntry, a5 as ReplicaPeerCommit, a6 as ReplicaPrivateGateHash, a7 as ReplicaPurgeIntent, a8 as ReplicaQuotaLedger, a9 as ReplicaQuotaSpec, aa as ReplicaSessionStamp, ab as ReplicaStampedReply, ac as ReplicaState, ad as ReplicaStatusEntry, ae as ReplicationAuthority, af as ReplicationControl, ag as ReplicationEvent, R as ReplicationIdentity, ah as ReplicationOptions, ai as ReplicationPurgeReport, aj as ReplicationReason, ak as ReplicationScheduler, al as ResolvedReplicationOptions, am as SaltedHash, an as canonicalReplicationIdentity, ao as replicationIdentityKey, ap as requiresSecretsOptIn } from './scope-Cjo4O0uO.cjs';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aB as KVBatchReadResponse, aC as KVChange, aD as KVChangesAuthority, aE as KVChangesOptions, aF as KVChangesResponse, aG as KVCreateSignedReadUrlOptions, aH as KVDeleteOptions, aI as KVGetOptions, aJ as KVHeadOptions, aK as KVListOptions, b as KVListPage, aL as KVListResponse, aM as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aN as KVResponse, aO as KVResponseHeaders, aP as KVServiceConfig, aQ as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from './scope-Dv3IAXMr.cjs';
 export { ClampConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, EffectiveGrantExpiryInput, MintRemainingMs, NeedsSilentRenewal, ReplicaConsentAnchor, ReplicaConsentSource, ReplicaGrantPolicy } from './kv/replication/grantPolicyTypes.cjs';
 export { BatchOptions, BatchResponse, DatabaseHandle, ExecuteOptions, ExecuteResponse, IDatabaseHandle, ISQLMigrations, ISQLService, QueryOptions, QueryResponse, SQLAction, SQLActionType, SQLMigrations, SQLService, SQLServiceConfig, SqlMigration, SqlMigrationApplyOptions, SqlMigrationApplyResponse, SqlStatement, SqlValue } from './sql/index.cjs';
-import { D as DecryptCapabilityProof } from './types-B_rbS4XE.cjs';
-export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, R as ReceiverKeyPair, p as ReceiverKeySigner, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalizeEncryptionJson, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from './types-B_rbS4XE.cjs';
+import { D as DecryptCapabilityProof } from './types-CBKrdtP8.cjs';
+export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, R as ReceiverKeyPair, p as ReceiverKeySigner, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalizeEncryptionJson, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from './types-CBKrdtP8.cjs';
 import { IEncryptionService } from './encryption/index.cjs';
-export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, CanonicalDecryptRequest, DecryptEnvelopeOptions, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionService, EncryptionServiceConfig, NETWORK_NAME_PATTERN, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, RandomReceiverKeyInput, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalSignedResponse, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, isNetworkId, networkDiscoveryKey, openWrappedKey, parseNetworkId, validateEnvelope, verifyDecryptResponse } from './encryption/index.cjs';
+export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, CanonicalDecryptRequest, DecryptEnvelopeOptions, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionService, EncryptionServiceConfig, NETWORK_NAME_PATTERN, NetworkIdError, NodeDescriptorFetcher, ParsedEncryptionResource, ParsedNetworkId, RandomReceiverKeyInput, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalSignedResponse, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, isNetworkId, networkDiscoveryKey, openWrappedKey, parseEncryptionResource, parseNetworkId, validateEnvelope, verifyDecryptResponse } from './encryption/index.cjs';
 export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
 export { kvPrefixCovers } from './kv/replication/prefix.cjs';
 import './kv/replication/contractConstants.cjs';

package/dist/index.d.ts

@@ -7,13 +7,13 @@ import { B as BaseService } from './BaseService-DO7vZ67k.js';
 export { a as BaseServiceOptions, R as RequestSignal, S as ServiceConstructor, b as ServiceRegistration } from './BaseService-DO7vZ67k.js';
 import { IKVService } from './kv/index.js';
 export { IPrefixedKVService, KVService, PrefixedKVService } from './kv/index.js';
-export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, aq as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, ar as KVAction, as as KVActionType, at as KVBatchPutItem, au as KVBatchPutOptions, av as KVBatchPutResponse, aw as KVBatchReadResponse, ax as KVChange, ay as KVChangesAuthority, az as KVChangesOptions, aA as KVChangesResponse, aB as KVCreateSignedReadUrlOptions, aC as KVDeleteOptions, aD as KVGetOptions, aE as KVHeadOptions, aF as KVListOptions, b as KVListPage, aG as KVListResponse, aH as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aI as KVResponse, aJ as KVResponseHeaders, aK as KVServiceConfig, aL as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaPageAdmission, a3 as ReplicaPartitionEraser, a4 as ReplicaPartitionIndexEntry, a5 as ReplicaPeerCommit, a6 as ReplicaPrivateGateHash, a7 as ReplicaPurgeIntent, a8 as ReplicaQuotaLedger, a9 as ReplicaQuotaSpec, aa as ReplicaSessionStamp, ab as ReplicaStampedReply, ac as ReplicaState, ad as ReplicaStatusEntry, ae as ReplicationAuthority, af as ReplicationControl, ag as ReplicationEvent, R as ReplicationIdentity, ah as ReplicationOptions, ai as ReplicationPurgeReport, aj as ReplicationReason, ak as ReplicationScheduler, al as ResolvedReplicationOptions, am as SaltedHash, an as canonicalReplicationIdentity, ao as replicationIdentityKey, ap as requiresSecretsOptIn } from './scope-Cg00IaWk.js';
+export { A as AuthorityRefusal, C as CLEAR_PENDING_WARNING, av as DEFAULT_SIGNED_READ_URL_EXPIRY_MS, aw as KVAction, ax as KVActionType, ay as KVBatchPutItem, az as KVBatchPutOptions, aA as KVBatchPutResponse, aB as KVBatchReadResponse, aC as KVChange, aD as KVChangesAuthority, aE as KVChangesOptions, aF as KVChangesResponse, aG as KVCreateSignedReadUrlOptions, aH as KVDeleteOptions, aI as KVGetOptions, aJ as KVHeadOptions, aK as KVListOptions, b as KVListPage, aL as KVListResponse, aM as KVPutOptions, c as KVReadThrough, d as KVReplicaHandle, e as KVReplicaSpec, f as KVReplicaStorage, a as KVReplicationController, K as KVReplicationDeps, aN as KVResponse, aO as KVResponseHeaders, aP as KVServiceConfig, aQ as KVSignedReadUrlResponse, L as LocalGetResult, g as LocalListResult, h as LocalReadMeta, i as LocalReplicaStatus, j as LocalSyncResult, k as PendingWriteRecord, l as PendingWriteState, P as PendingWriteStore, m as PinnedKey, w as PurgeTarget, x as ReplicaAccountGate, y as ReplicaAdmitHook, z as ReplicaAuthorityState, B as ReplicaBrowserGateAccess, D as ReplicaBrowserGateSnapshot, E as ReplicaBrowserGateTx, F as ReplicaBrowserPageAdmission, G as ReplicaClock, H as ReplicaCoverage, I as ReplicaDeliveryDecision, J as ReplicaDenyInput, M as ReplicaDenyOutcome, N as ReplicaDevice, O as ReplicaEraseReport, Q as ReplicaGateAccess, S as ReplicaGateReason, T as ReplicaGateScope, U as ReplicaGateSnapshot, V as ReplicaGateTx, W as ReplicaGatedError, X as ReplicaGatedHandle, Y as ReplicaGatedSpec, Z as ReplicaGatedStorage, _ as ReplicaGrantInfo, $ as ReplicaGuardedStore, a0 as ReplicaInspectedStatus, a1 as ReplicaLifecycleGate, a2 as ReplicaLocalEraseOutcome, a3 as ReplicaPageAdmission, a4 as ReplicaPartitionEraser, a5 as ReplicaPartitionIndexEntry, a6 as ReplicaPeerCommit, a7 as ReplicaPrivateGateHash, a8 as ReplicaPurgeError, a9 as ReplicaPurgeFailedEvent, aa as ReplicaPurgeIntent, ab as ReplicaPurgeLocalCopyResult, ac as ReplicaPurgeTrigger, ad as ReplicaQuotaLedger, ae as ReplicaQuotaSpec, af as ReplicaSessionStamp, ag as ReplicaStampedReply, ah as ReplicaState, ai as ReplicaStatusEntry, aj as ReplicationAuthority, ak as ReplicationControl, al as ReplicationEvent, R as ReplicationIdentity, am as ReplicationOptions, an as ReplicationPurgeReport, ao as ReplicationReason, ap as ReplicationScheduler, aq as ResolvedReplicationOptions, ar as SaltedHash, as as canonicalReplicationIdentity, at as replicationIdentityKey, au as requiresSecretsOptIn } from './scope-1-8skVDk.js';
 export { ClampConsentAnchor, ConsentDeadlineMs, EffectiveGrantExpiry, EffectiveGrantExpiryInput, MintRemainingMs, NeedsSilentRenewal, ReplicaConsentAnchor, ReplicaConsentSource, ReplicaGrantPolicy } from './kv/replication/grantPolicyTypes.js';
 export { BatchOptions, BatchResponse, DatabaseHandle, ExecuteOptions, ExecuteResponse, IDatabaseHandle, ISQLMigrations, ISQLService, QueryOptions, QueryResponse, SQLAction, SQLActionType, SQLMigrations, SQLService, SQLServiceConfig, SqlMigration, SqlMigrationApplyOptions, SqlMigrationApplyResponse, SqlStatement, SqlValue } from './sql/index.js';
-import { D as DecryptCapabilityProof } from './types-BGRzS1ob.js';
-export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, R as ReceiverKeyPair, p as ReceiverKeySigner, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalizeEncryptionJson, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from './types-BGRzS1ob.js';
+import { D as DecryptCapabilityProof } from './types-DZBExWAf.js';
+export { B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation, C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, g as DecryptInvocationFact, h as DecryptInvocationSigner, i as DecryptRequestBody, j as DecryptResponseBody, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, E as EncryptionCrypto, n as EncryptionError, o as EncryptionErrorInput, I as InlineEncryptedEnvelope, J as Json, N as NetworkDescriptor, R as ReceiverKeyPair, p as ReceiverKeySigner, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalizeEncryptionJson, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from './types-DZBExWAf.js';
 import { IEncryptionService } from './encryption/index.js';
-export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, CanonicalDecryptRequest, DecryptEnvelopeOptions, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionService, EncryptionServiceConfig, NETWORK_NAME_PATTERN, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, RandomReceiverKeyInput, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalSignedResponse, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, isNetworkId, networkDiscoveryKey, openWrappedKey, parseNetworkId, validateEnvelope, verifyDecryptResponse } from './encryption/index.js';
+export { BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, CanonicalDecryptRequest, DecryptEnvelopeOptions, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionService, EncryptionServiceConfig, NETWORK_NAME_PATTERN, NetworkIdError, NodeDescriptorFetcher, ParsedEncryptionResource, ParsedNetworkId, RandomReceiverKeyInput, SignedReceiverKeyInput, VerifyDecryptResponseInput, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalSignedResponse, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, isNetworkId, networkDiscoveryKey, openWrappedKey, parseEncryptionResource, parseNetworkId, validateEnvelope, verifyDecryptResponse } from './encryption/index.js';
 export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
 export { kvPrefixCovers } from './kv/replication/prefix.js';
 import './kv/replication/contractConstants.js';

package/dist/index.js

@@ -713,6 +713,26 @@ function parseNetworkId(networkId) {
   }
   return { networkId, ownerDid, name };
 }
+function parseEncryptionResource(resource) {
+  const networkSeparator = resource.lastIndexOf(":");
+  const nameAndPath = resource.slice(networkSeparator + 1);
+  const pathSeparator = nameAndPath.indexOf("/");
+  const name = pathSeparator === -1 ? nameAndPath : nameAndPath.slice(0, pathSeparator);
+  const networkId = pathSeparator === -1 ? resource : `${resource.slice(0, networkSeparator + 1)}${name}`;
+  const parsed = parseNetworkId(networkId);
+  if (pathSeparator === -1) return parsed;
+  const keyPath = nameAndPath.slice(pathSeparator + 1);
+  const segments = keyPath.split("/");
+  const prefix = keyPath.endsWith("/");
+  if (keyPath.length === 0 || /[\u0000-\u001f\u007f\\]/.test(keyPath) || segments.some(
+    (segment, index) => segment === "." || segment === ".." || segment.length === 0 && !(prefix && index === segments.length - 1)
+  )) {
+    throw new NetworkIdError(
+      `encryption resource has an invalid keyPath (got ${JSON.stringify(resource)})`
+    );
+  }
+  return { ...parsed, keyPath };
+}
 function buildNetworkId(ownerDid, name) {
   if (typeof ownerDid !== "string" || !ownerDid.startsWith("did:")) {
     throw new NetworkIdError("ownerDid must be a DID");
@@ -7810,7 +7830,12 @@ function ensureNetworkUsableForDecrypt(descriptor) {
 
 // src/encryption/envelope.ts
 function encryptToNetwork(crypto2, input) {
-  parseNetworkId(input.networkId);
+  const parsedResource = parseEncryptionResource(
+    input.keyPath === void 0 ? input.networkId : `${input.networkId}/${input.keyPath}`
+  );
+  if (parsedResource.keyPath !== input.keyPath || input.keyPath?.endsWith("/")) {
+    throw new NetworkIdError("keyPath must name an exact encryption key");
+  }
   const alg = input.alg ?? DEFAULT_ENCRYPTION_ALG;
   const keyVersion = input.keyVersion ?? DEFAULT_KEY_VERSION;
   const symmetricKey = crypto2.randomBytes(32);
@@ -7824,6 +7849,7 @@ function encryptToNetwork(crypto2, input) {
   const envelope = {
     v: ENVELOPE_VERSION,
     networkId: input.networkId,
+    ...input.keyPath !== void 0 ? { keyPath: input.keyPath } : {},
     alg,
     keyVersion,
     encryptedSymmetricKey,
@@ -7855,13 +7881,24 @@ function validateEnvelope(crypto2, envelope) {
     };
   }
   try {
-    parseNetworkId(e.networkId);
+    if (parseEncryptionResource(e.networkId).keyPath !== void 0) {
+      throw new Error("networkId must identify the network root");
+    }
+    if (e.keyPath !== void 0) {
+      if (typeof e.keyPath !== "string") {
+        throw new Error("keyPath must be a string");
+      }
+      const parsed = parseEncryptionResource(`${e.networkId}/${e.keyPath}`);
+      if (parsed.keyPath !== e.keyPath || e.keyPath.endsWith("/")) {
+        throw new Error("keyPath must name an exact encryption key");
+      }
+    }
   } catch (err3) {
     return {
       ok: false,
       error: encryptionError({
         code: "INVALID_ENVELOPE",
-        message: `envelope.networkId is malformed: ${err3 instanceof Error ? err3.message : String(err3)}`
+        message: `envelope encryption resource is malformed: ${err3 instanceof Error ? err3.message : String(err3)}`
       })
     };
   }
@@ -7934,6 +7971,7 @@ function buildDecryptFacts(input) {
     type: DECRYPT_FACT_TYPE,
     targetNode: input.body.targetNode,
     networkId: input.body.networkId,
+    ...input.body.keyPath !== void 0 ? { keyPath: input.body.keyPath } : {},
     bodyHash,
     encryptedSymmetricKeyHash: input.encryptedSymmetricKeyHash,
     receiverPublicKeyHash,
@@ -7941,10 +7979,14 @@ function buildDecryptFacts(input) {
     keyVersion: input.body.keyVersion
   };
 }
-function buildDecryptAttenuation(networkId) {
-  parseNetworkId(networkId);
+function buildDecryptAttenuation(networkId, keyPath) {
+  const resource = keyPath === void 0 ? networkId : `${networkId}/${keyPath}`;
+  const parsed = parseEncryptionResource(resource);
+  if (parsed.networkId !== networkId || parsed.keyPath !== keyPath || keyPath?.endsWith("/")) {
+    throw new NetworkIdError("keyPath must name an exact encryption key");
+  }
   return {
-    [networkId]: {
+    [resource]: {
       [DECRYPT_ACTION]: {}
     }
   };
@@ -8004,6 +8046,15 @@ function checkDecryptInvocationInput(crypto2, input) {
       })
     };
   }
+  if (input.facts.keyPath !== input.body.keyPath) {
+    return {
+      ok: false,
+      error: encryptionError({
+        code: "INVALID_INPUT",
+        message: "facts.keyPath must equal body.keyPath"
+      })
+    };
+  }
   if (input.facts.alg !== input.body.alg) {
     return {
       ok: false,
@@ -8041,7 +8092,9 @@ function checkDecryptInvocationInput(crypto2, input) {
     };
   }
   try {
-    parseNetworkId(input.networkId);
+    if (parseEncryptionResource(input.networkId).keyPath !== void 0) {
+      throw new NetworkIdError("networkId must identify the network root");
+    }
   } catch (err3) {
     return {
       ok: false,
@@ -8051,6 +8104,22 @@ function checkDecryptInvocationInput(crypto2, input) {
       })
     };
   }
+  try {
+    const resource = parseEncryptionResource(
+      input.body.keyPath === void 0 ? input.body.networkId : `${input.body.networkId}/${input.body.keyPath}`
+    );
+    if (resource.keyPath !== input.body.keyPath || input.body.keyPath?.endsWith("/")) {
+      throw new NetworkIdError("keyPath must name an exact encryption key");
+    }
+  } catch (err3) {
+    return {
+      ok: false,
+      error: encryptionError({
+        code: "INVALID_INPUT",
+        message: err3 instanceof Error ? err3.message : String(err3)
+      })
+    };
+  }
   const canonicalBody = canonicalize(
     input.body
   );
@@ -8291,6 +8360,7 @@ var EncryptionService = class extends BaseService {
         // that spelling in the envelope so a later response can be compared
         // byte-for-byte (notably for checksummed did:pkh principals).
         networkId: descriptor.networkId,
+        ...options?.keyPath !== void 0 ? { keyPath: options.keyPath } : {},
         networkPublicKey,
         plaintext,
         ...options?.aad !== void 0 ? { aad: options.aad } : {},
@@ -8350,6 +8420,7 @@ var EncryptionService = class extends BaseService {
         type: DECRYPT_FACT_TYPE,
         targetNode,
         networkId: envelope.networkId,
+        ...envelope.keyPath !== void 0 ? { keyPath: envelope.keyPath } : {},
         alg: envelope.alg,
         keyVersion: envelope.keyVersion,
         encryptedSymmetricKey: envelope.encryptedSymmetricKey,
@@ -8565,6 +8636,7 @@ export {
   openWrappedKey,
   parseAuthError,
   parseCapabilityResource,
+  parseEncryptionResource,
   parseNetworkId,
   parsePermissionHint,
   parsePermissionHintFromErrorText,