@tinycloud/sdk-services 3.8.0-beta.9 → 3.8.0

package/dist/encryption/index.d.cts

@@ -1,7 +1,7 @@
-import { B as BaseService } from '../BaseService-D-29xShG.cjs';
-import { c as IService, h as Result } from '../types-DAOyIbXu.cjs';
-import { N as NetworkDescriptor, n as EncryptionError, I as InlineEncryptedEnvelope, D as DecryptCapabilityProof, j as DecryptResponseBody, E as EncryptionCrypto, h as DecryptInvocationSigner, p as ReceiverKeySigner, R as ReceiverKeyPair, i as DecryptRequestBody, g as DecryptInvocationFact, B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation } from '../types-B_rbS4XE.cjs';
-export { C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, o as EncryptionErrorInput, J as Json, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalize, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from '../types-B_rbS4XE.cjs';
+import { B as BaseService } from '../BaseService-O0iyuFLk.cjs';
+import { c as IService, f as Result } from '../types-CSd0RYir.cjs';
+import { N as NetworkDescriptor, n as EncryptionError, I as InlineEncryptedEnvelope, D as DecryptCapabilityProof, j as DecryptResponseBody, E as EncryptionCrypto, h as DecryptInvocationSigner, p as ReceiverKeySigner, R as ReceiverKeyPair, i as DecryptRequestBody, g as DecryptInvocationFact, B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation } from '../types-D4XbIfFJ.cjs';
+export { C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, o as EncryptionErrorInput, J as Json, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalize, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from '../types-D4XbIfFJ.cjs';
 export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
 
 /**
@@ -85,6 +85,8 @@ declare function ensureNetworkUsableForDecrypt(descriptor: NetworkDescriptor): {
  */
 
 interface EncryptToNetworkOptions {
+    /** Exact named-key path to bind into the returned envelope. */
+    keyPath?: string;
     /** Optional associated authenticated data (bytes). */
     aad?: Uint8Array;
     /** Ciphersuite override. Defaults to the network's alg. */
@@ -217,6 +219,17 @@ declare class NetworkIdError extends Error {
  * malformed, or when the network name fails {@link NETWORK_NAME_RE}.
  */
 declare function parseNetworkId(networkId: string): ParsedNetworkId;
+interface ParsedEncryptionResource extends ParsedNetworkId {
+    /** Named-key path, if the resource is scoped below a network. */
+    keyPath?: string;
+}
+/**
+ * Parse a network-root or named-key encryption resource.
+ *
+ * A trailing slash on keyPath denotes a prefix grant; empty and traversal
+ * segments are rejected so resource matching cannot escape the named path.
+ */
+declare function parseEncryptionResource(resource: string): ParsedEncryptionResource;
 /**
  * Construct a network id URN from an owner DID and a network name.
  * Validates inputs and throws {@link NetworkIdError} on bad shape.
@@ -254,6 +267,8 @@ declare const NETWORK_NAME_PATTERN: RegExp;
 interface EncryptToNetworkInput {
     /** Target network id URN. */
     networkId: string;
+    /** Exact named-key path; omitted for a network-root key. */
+    keyPath?: string;
     /** Network public key bytes (already discovered). */
     networkPublicKey: Uint8Array;
     /** Payload bytes to encrypt. Callers serialize objects to bytes themselves. */
@@ -396,13 +411,10 @@ interface BuildDecryptFactsInput {
  */
 declare function buildDecryptFacts(input: BuildDecryptFactsInput): DecryptInvocationFact;
 /**
- * Recap-shaped attenuation for the decrypt invocation. The resource
- * key is the networkId URN; the ability is the long-form
- * `tinycloud.encryption/decrypt`. This is intentionally distinct from
- * the existing space-shaped invocation map so callers cannot
- * accidentally fake a space prefix.
+ * Attenuate decrypt to the network root for legacy envelopes or to the
+ * exact named-key leaf for path-scoped envelopes.
  */
-declare function buildDecryptAttenuation(networkId: string): Record<string, Record<string, Record<string, never>>>;
+declare function buildDecryptAttenuation(networkId: string, keyPath?: string): Record<string, Record<string, Record<string, never>>>;
 /**
  * Validate a {@link BuildDecryptInvocationInput} payload — the body
  * shape, the facts bindings, and the audience contract — without
@@ -484,4 +496,4 @@ declare function verifyDecryptResponse(input: VerifyDecryptResponseInput): {
  */
 declare function openWrappedKey(crypto: EncryptionCrypto, receiverPrivateKey: Uint8Array, response: DecryptResponseBody): Uint8Array;
 
-export { type BuildCanonicalDecryptRequestInput, type BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, type CanonicalDecryptRequest, DecryptCapabilityProof, type DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, type DecryptTransport, type DiscoverNetworkInput, type DiscoveredNetwork, type DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, type EncryptToNetworkInput, type EncryptToNetworkOptions, type EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionService, type EncryptionServiceConfig, type IEncryptionService, InlineEncryptedEnvelope, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, type NodeDescriptorFetcher, type ParsedNetworkId, type RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, type SignedReceiverKeyInput, type VerifyDecryptResponseInput, type WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalSignedResponse, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, isNetworkId, networkDiscoveryKey, openWrappedKey, parseNetworkId, validateEnvelope, verifyDecryptResponse };
+export { type BuildCanonicalDecryptRequestInput, type BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, type CanonicalDecryptRequest, DecryptCapabilityProof, type DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, type DecryptTransport, type DiscoverNetworkInput, type DiscoveredNetwork, type DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, type EncryptToNetworkInput, type EncryptToNetworkOptions, type EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionService, type EncryptionServiceConfig, type IEncryptionService, InlineEncryptedEnvelope, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, type NodeDescriptorFetcher, type ParsedEncryptionResource, type ParsedNetworkId, type RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, type SignedReceiverKeyInput, type VerifyDecryptResponseInput, type WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalSignedResponse, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, isNetworkId, networkDiscoveryKey, openWrappedKey, parseEncryptionResource, parseNetworkId, validateEnvelope, verifyDecryptResponse };

package/dist/encryption/index.d.ts

@@ -1,7 +1,7 @@
-import { B as BaseService } from '../BaseService-DO7vZ67k.js';
-import { c as IService, h as Result } from '../types-DAOyIbXu.js';
-import { N as NetworkDescriptor, n as EncryptionError, I as InlineEncryptedEnvelope, D as DecryptCapabilityProof, j as DecryptResponseBody, E as EncryptionCrypto, h as DecryptInvocationSigner, p as ReceiverKeySigner, R as ReceiverKeyPair, i as DecryptRequestBody, g as DecryptInvocationFact, B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation } from '../types-BGRzS1ob.js';
-export { C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, o as EncryptionErrorInput, J as Json, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalize, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from '../types-BGRzS1ob.js';
+import { B as BaseService } from '../BaseService-Ma2MwJAd.js';
+import { c as IService, f as Result } from '../types-CSd0RYir.js';
+import { N as NetworkDescriptor, n as EncryptionError, I as InlineEncryptedEnvelope, D as DecryptCapabilityProof, j as DecryptResponseBody, E as EncryptionCrypto, h as DecryptInvocationSigner, p as ReceiverKeySigner, R as ReceiverKeyPair, i as DecryptRequestBody, g as DecryptInvocationFact, B as BuildDecryptInvocationInput, a as BuiltDecryptInvocation } from '../types-Bf91gup6.js';
+export { C as CanonicalJson, b as DECRYPT_ACTION, c as DECRYPT_FACT_TYPE, d as DECRYPT_RESULT_TYPE, e as DEFAULT_ENCRYPTION_ALG, f as DEFAULT_KEY_VERSION, k as ENCRYPTION_SERVICE, l as ENCRYPTION_SERVICE_SHORT, m as ENVELOPE_VERSION, o as EncryptionErrorInput, J as Json, q as base64Decode, r as base64Encode, s as canonicalHashHex, t as canonicalize, u as encryptionError, v as hexDecode, w as hexEncode, x as utf8Decode, y as utf8Encode } from '../types-Bf91gup6.js';
 export { DecryptTransportResponseError } from '@tinycloud/sdk-services/internal/decrypt-transport-response-error';
 
 /**
@@ -85,6 +85,8 @@ declare function ensureNetworkUsableForDecrypt(descriptor: NetworkDescriptor): {
  */
 
 interface EncryptToNetworkOptions {
+    /** Exact named-key path to bind into the returned envelope. */
+    keyPath?: string;
     /** Optional associated authenticated data (bytes). */
     aad?: Uint8Array;
     /** Ciphersuite override. Defaults to the network's alg. */
@@ -217,6 +219,17 @@ declare class NetworkIdError extends Error {
  * malformed, or when the network name fails {@link NETWORK_NAME_RE}.
  */
 declare function parseNetworkId(networkId: string): ParsedNetworkId;
+interface ParsedEncryptionResource extends ParsedNetworkId {
+    /** Named-key path, if the resource is scoped below a network. */
+    keyPath?: string;
+}
+/**
+ * Parse a network-root or named-key encryption resource.
+ *
+ * A trailing slash on keyPath denotes a prefix grant; empty and traversal
+ * segments are rejected so resource matching cannot escape the named path.
+ */
+declare function parseEncryptionResource(resource: string): ParsedEncryptionResource;
 /**
  * Construct a network id URN from an owner DID and a network name.
  * Validates inputs and throws {@link NetworkIdError} on bad shape.
@@ -254,6 +267,8 @@ declare const NETWORK_NAME_PATTERN: RegExp;
 interface EncryptToNetworkInput {
     /** Target network id URN. */
     networkId: string;
+    /** Exact named-key path; omitted for a network-root key. */
+    keyPath?: string;
     /** Network public key bytes (already discovered). */
     networkPublicKey: Uint8Array;
     /** Payload bytes to encrypt. Callers serialize objects to bytes themselves. */
@@ -396,13 +411,10 @@ interface BuildDecryptFactsInput {
  */
 declare function buildDecryptFacts(input: BuildDecryptFactsInput): DecryptInvocationFact;
 /**
- * Recap-shaped attenuation for the decrypt invocation. The resource
- * key is the networkId URN; the ability is the long-form
- * `tinycloud.encryption/decrypt`. This is intentionally distinct from
- * the existing space-shaped invocation map so callers cannot
- * accidentally fake a space prefix.
+ * Attenuate decrypt to the network root for legacy envelopes or to the
+ * exact named-key leaf for path-scoped envelopes.
  */
-declare function buildDecryptAttenuation(networkId: string): Record<string, Record<string, Record<string, never>>>;
+declare function buildDecryptAttenuation(networkId: string, keyPath?: string): Record<string, Record<string, Record<string, never>>>;
 /**
  * Validate a {@link BuildDecryptInvocationInput} payload — the body
  * shape, the facts bindings, and the audience contract — without
@@ -484,4 +496,4 @@ declare function verifyDecryptResponse(input: VerifyDecryptResponseInput): {
  */
 declare function openWrappedKey(crypto: EncryptionCrypto, receiverPrivateKey: Uint8Array, response: DecryptResponseBody): Uint8Array;
 
-export { type BuildCanonicalDecryptRequestInput, type BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, type CanonicalDecryptRequest, DecryptCapabilityProof, type DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, type DecryptTransport, type DiscoverNetworkInput, type DiscoveredNetwork, type DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, type EncryptToNetworkInput, type EncryptToNetworkOptions, type EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionService, type EncryptionServiceConfig, type IEncryptionService, InlineEncryptedEnvelope, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, type NodeDescriptorFetcher, type ParsedNetworkId, type RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, type SignedReceiverKeyInput, type VerifyDecryptResponseInput, type WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalSignedResponse, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, isNetworkId, networkDiscoveryKey, openWrappedKey, parseNetworkId, validateEnvelope, verifyDecryptResponse };
+export { type BuildCanonicalDecryptRequestInput, type BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, type CanonicalDecryptRequest, DecryptCapabilityProof, type DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, type DecryptTransport, type DiscoverNetworkInput, type DiscoveredNetwork, type DiscoverySource, ENCRYPTION_NETWORK_URN_PREFIX, type EncryptToNetworkInput, type EncryptToNetworkOptions, type EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionService, type EncryptionServiceConfig, type IEncryptionService, InlineEncryptedEnvelope, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, type NodeDescriptorFetcher, type ParsedEncryptionResource, type ParsedNetworkId, type RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, type SignedReceiverKeyInput, type VerifyDecryptResponseInput, type WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalSignedResponse, checkDecryptInvocationInput, decryptEnvelopeWithKey, deriveSignedReceiverKey, discoverNetwork, encryptToNetwork, ensureNetworkUsableForDecrypt, generateRandomReceiverKey, isNetworkId, networkDiscoveryKey, openWrappedKey, parseEncryptionResource, parseNetworkId, validateEnvelope, verifyDecryptResponse };

package/dist/encryption/index.js

@@ -135,6 +135,26 @@ function parseNetworkId(networkId) {
   }
   return { networkId, ownerDid, name };
 }
+function parseEncryptionResource(resource) {
+  const networkSeparator = resource.lastIndexOf(":");
+  const nameAndPath = resource.slice(networkSeparator + 1);
+  const pathSeparator = nameAndPath.indexOf("/");
+  const name = pathSeparator === -1 ? nameAndPath : nameAndPath.slice(0, pathSeparator);
+  const networkId = pathSeparator === -1 ? resource : `${resource.slice(0, networkSeparator + 1)}${name}`;
+  const parsed = parseNetworkId(networkId);
+  if (pathSeparator === -1) return parsed;
+  const keyPath = nameAndPath.slice(pathSeparator + 1);
+  const segments = keyPath.split("/");
+  const prefix = keyPath.endsWith("/");
+  if (keyPath.length === 0 || /[\u0000-\u001f\u007f\\]/.test(keyPath) || segments.some(
+    (segment, index) => segment === "." || segment === ".." || segment.length === 0 && !(prefix && index === segments.length - 1)
+  )) {
+    throw new NetworkIdError(
+      `encryption resource has an invalid keyPath (got ${JSON.stringify(resource)})`
+    );
+  }
+  return { ...parsed, keyPath };
+}
 function buildNetworkId(ownerDid, name) {
   if (typeof ownerDid !== "string" || !ownerDid.startsWith("did:")) {
     throw new NetworkIdError("ownerDid must be a DID");
@@ -847,7 +867,12 @@ function ensureNetworkUsableForDecrypt(descriptor) {
 
 // src/encryption/envelope.ts
 function encryptToNetwork(crypto, input) {
-  parseNetworkId(input.networkId);
+  const parsedResource = parseEncryptionResource(
+    input.keyPath === void 0 ? input.networkId : `${input.networkId}/${input.keyPath}`
+  );
+  if (parsedResource.keyPath !== input.keyPath || input.keyPath?.endsWith("/")) {
+    throw new NetworkIdError("keyPath must name an exact encryption key");
+  }
   const alg = input.alg ?? DEFAULT_ENCRYPTION_ALG;
   const keyVersion = input.keyVersion ?? DEFAULT_KEY_VERSION;
   const symmetricKey = crypto.randomBytes(32);
@@ -861,6 +886,7 @@ function encryptToNetwork(crypto, input) {
   const envelope = {
     v: ENVELOPE_VERSION,
     networkId: input.networkId,
+    ...input.keyPath !== void 0 ? { keyPath: input.keyPath } : {},
     alg,
     keyVersion,
     encryptedSymmetricKey,
@@ -892,13 +918,24 @@ function validateEnvelope(crypto, envelope) {
     };
   }
   try {
-    parseNetworkId(e.networkId);
+    if (parseEncryptionResource(e.networkId).keyPath !== void 0) {
+      throw new Error("networkId must identify the network root");
+    }
+    if (e.keyPath !== void 0) {
+      if (typeof e.keyPath !== "string") {
+        throw new Error("keyPath must be a string");
+      }
+      const parsed = parseEncryptionResource(`${e.networkId}/${e.keyPath}`);
+      if (parsed.keyPath !== e.keyPath || e.keyPath.endsWith("/")) {
+        throw new Error("keyPath must name an exact encryption key");
+      }
+    }
   } catch (err2) {
     return {
       ok: false,
       error: encryptionError({
         code: "INVALID_ENVELOPE",
-        message: `envelope.networkId is malformed: ${err2 instanceof Error ? err2.message : String(err2)}`
+        message: `envelope encryption resource is malformed: ${err2 instanceof Error ? err2.message : String(err2)}`
       })
     };
   }
@@ -971,6 +1008,7 @@ function buildDecryptFacts(input) {
     type: DECRYPT_FACT_TYPE,
     targetNode: input.body.targetNode,
     networkId: input.body.networkId,
+    ...input.body.keyPath !== void 0 ? { keyPath: input.body.keyPath } : {},
     bodyHash,
     encryptedSymmetricKeyHash: input.encryptedSymmetricKeyHash,
     receiverPublicKeyHash,
@@ -978,10 +1016,14 @@ function buildDecryptFacts(input) {
     keyVersion: input.body.keyVersion
   };
 }
-function buildDecryptAttenuation(networkId) {
-  parseNetworkId(networkId);
+function buildDecryptAttenuation(networkId, keyPath) {
+  const resource = keyPath === void 0 ? networkId : `${networkId}/${keyPath}`;
+  const parsed = parseEncryptionResource(resource);
+  if (parsed.networkId !== networkId || parsed.keyPath !== keyPath || keyPath?.endsWith("/")) {
+    throw new NetworkIdError("keyPath must name an exact encryption key");
+  }
   return {
-    [networkId]: {
+    [resource]: {
       [DECRYPT_ACTION]: {}
     }
   };
@@ -1041,6 +1083,15 @@ function checkDecryptInvocationInput(crypto, input) {
       })
     };
   }
+  if (input.facts.keyPath !== input.body.keyPath) {
+    return {
+      ok: false,
+      error: encryptionError({
+        code: "INVALID_INPUT",
+        message: "facts.keyPath must equal body.keyPath"
+      })
+    };
+  }
   if (input.facts.alg !== input.body.alg) {
     return {
       ok: false,
@@ -1078,7 +1129,9 @@ function checkDecryptInvocationInput(crypto, input) {
     };
   }
   try {
-    parseNetworkId(input.networkId);
+    if (parseEncryptionResource(input.networkId).keyPath !== void 0) {
+      throw new NetworkIdError("networkId must identify the network root");
+    }
   } catch (err2) {
     return {
       ok: false,
@@ -1088,6 +1141,22 @@ function checkDecryptInvocationInput(crypto, input) {
       })
     };
   }
+  try {
+    const resource = parseEncryptionResource(
+      input.body.keyPath === void 0 ? input.body.networkId : `${input.body.networkId}/${input.body.keyPath}`
+    );
+    if (resource.keyPath !== input.body.keyPath || input.body.keyPath?.endsWith("/")) {
+      throw new NetworkIdError("keyPath must name an exact encryption key");
+    }
+  } catch (err2) {
+    return {
+      ok: false,
+      error: encryptionError({
+        code: "INVALID_INPUT",
+        message: err2 instanceof Error ? err2.message : String(err2)
+      })
+    };
+  }
   const canonicalBody = canonicalize(
     input.body
   );
@@ -1328,6 +1397,7 @@ var EncryptionService = class extends BaseService {
         // that spelling in the envelope so a later response can be compared
         // byte-for-byte (notably for checksummed did:pkh principals).
         networkId: descriptor.networkId,
+        ...options?.keyPath !== void 0 ? { keyPath: options.keyPath } : {},
         networkPublicKey,
         plaintext,
         ...options?.aad !== void 0 ? { aad: options.aad } : {},
@@ -1387,6 +1457,7 @@ var EncryptionService = class extends BaseService {
         type: DECRYPT_FACT_TYPE,
         targetNode,
         networkId: envelope.networkId,
+        ...envelope.keyPath !== void 0 ? { keyPath: envelope.keyPath } : {},
         alg: envelope.alg,
         keyVersion: envelope.keyVersion,
         encryptedSymmetricKey: envelope.encryptedSymmetricKey,
@@ -1530,6 +1601,7 @@ export {
   isNetworkId,
   networkDiscoveryKey,
   openWrappedKey,
+  parseEncryptionResource,
   parseNetworkId,
   utf8Decode,
   utf8Encode,