@enbox/dwn-sdk-js 0.0.2 → 0.0.4

package/src/store/storage-controller.ts

@@ -1,8 +1,8 @@
 import type { DataStore } from '../types/data-store.js';
-import type { EventLog } from '../types/event-log.js';
 import type { EventStream } from '../types/subscriptions.js';
 import type { GenericMessage } from '../types/message-types.js';
 import type { MessageStore } from '../types/message-store.js';
+import type { StateIndex } from '../types/state-index.js';
 import type { RecordsDeleteMessage, RecordsQueryReplyEntry, RecordsWriteMessage } from '../types/records-types.js';
 
 import { DwnConstant } from '../core/dwn-constant.js';
@@ -19,24 +19,24 @@ export type ResumableRecordsDeleteData = {
 };
 
 /**
- * A class that provides an abstraction for the usage of MessageStore, DataStore, and EventLog.
+ * A class that provides an abstraction for the usage of MessageStore, DataStore, and StateIndex.
  */
 export class StorageController {
 
   private messageStore: MessageStore;
   private dataStore: DataStore;
-  private eventLog: EventLog;
+  private stateIndex: StateIndex;
   private eventStream?: EventStream;
 
-  public constructor({ messageStore, dataStore, eventLog, eventStream }: {
+  public constructor({ messageStore, dataStore, stateIndex, eventStream }: {
     messageStore: MessageStore,
     dataStore: DataStore,
-    eventLog: EventLog,
+    stateIndex: StateIndex,
     eventStream?: EventStream}
   ) {
     this.messageStore = messageStore;
     this.dataStore = dataStore;
-    this.eventLog = eventLog;
+    this.stateIndex = stateIndex;
     this.eventStream = eventStream;
   }
 
@@ -64,7 +64,7 @@ export class StorageController {
     const indexes = recordsDelete.constructIndexes(initialWrite);
     const messageCid = await Message.getCid(message);
     await this.messageStore.put(tenant, message, indexes);
-    await this.eventLog.append(tenant, messageCid, indexes);
+    await this.stateIndex.insert(tenant, messageCid, indexes);
 
     // only emit if the event stream is set
     if (this.eventStream !== undefined) {
@@ -73,12 +73,12 @@ export class StorageController {
 
     if (message.descriptor.prune) {
       // purge/hard-delete all descendent records
-      await StorageController.purgeRecordDescendants(tenant, message.descriptor.recordId, this.messageStore, this.dataStore, this.eventLog);
+      await StorageController.purgeRecordDescendants(tenant, message.descriptor.recordId, this.messageStore, this.dataStore, this.stateIndex);
     }
 
     // delete all existing messages that are not newest, except for the initial write
     await StorageController.deleteAllOlderMessagesButKeepInitialWrite(
-      tenant, existingMessages, message, this.messageStore, this.dataStore, this.eventLog
+      tenant, existingMessages, message, this.messageStore, this.dataStore, this.stateIndex
     );
   }
 
@@ -121,7 +121,7 @@ export class StorageController {
     recordId: string,
     messageStore: MessageStore,
     dataStore: DataStore,
-    eventLog: EventLog
+    stateIndex: StateIndex
   ): Promise<void> {
     const filter = {
       interface : DwnInterfaceName.Records,
@@ -140,21 +140,23 @@ export class StorageController {
         recordId = (message as RecordsDeleteMessage).descriptor.recordId;
       }
 
-      if (!recordIdToMessagesMap.has(recordId)) {
-        recordIdToMessagesMap.set(recordId, []);
+      const existingMessages = recordIdToMessagesMap.get(recordId);
+      if (existingMessages) {
+        existingMessages.push(message);
+      } else {
+        recordIdToMessagesMap.set(recordId, [message]);
       }
-      recordIdToMessagesMap.get(recordId)!.push(message);
     }
 
     // purge all child's descendants first
     for (const childRecordId of recordIdToMessagesMap.keys()) {
       // purge the child's descendent messages first
-      await StorageController.purgeRecordDescendants(tenant, childRecordId, messageStore, dataStore, eventLog);
+      await StorageController.purgeRecordDescendants(tenant, childRecordId, messageStore, dataStore, stateIndex);
     }
 
     // then purge the child messages themselves
     for (const childRecordId of recordIdToMessagesMap.keys()) {
-      await StorageController.purgeRecordMessages(tenant, recordIdToMessagesMap.get(childRecordId)!, messageStore, dataStore, eventLog);
+      await StorageController.purgeRecordMessages(tenant, recordIdToMessagesMap.get(childRecordId)!, messageStore, dataStore, stateIndex);
     }
   }
 
@@ -167,7 +169,7 @@ export class StorageController {
     recordMessages: GenericMessage[],
     messageStore: MessageStore,
     dataStore: DataStore,
-    eventLog: EventLog
+    stateIndex: StateIndex
   ): Promise<void> {
     // delete the data from the data store first so no chance of orphaned data (not having a message referencing it) in case of server crash
     // NOTE: only the `RecordsWrite` with latest timestamp can possibly have data associated with it so we do this filtering as an optimization
@@ -183,7 +185,7 @@ export class StorageController {
 
     // then delete all events associated with the record messages before deleting the messages so we don't have orphaned events
     const messageCids = await Promise.all(recordMessages.map((message) => Message.getCid(message)));
-    await eventLog.deleteEventsByCid(tenant, messageCids);
+    await stateIndex.delete(tenant, messageCids);
 
     // finally delete all record messages
     await Promise.all(messageCids.map((messageCid) => messageStore.delete(tenant, messageCid)));
@@ -199,7 +201,7 @@ export class StorageController {
     newestMessage: GenericMessage,
     messageStore: MessageStore,
     dataStore: DataStore,
-    eventLog: EventLog
+    stateIndex: StateIndex
   ): Promise<void> {
     const deletedMessageCids: string[] = [];
 
@@ -234,7 +236,7 @@ export class StorageController {
         }
       }
 
-      await eventLog.deleteEventsByCid(tenant, deletedMessageCids);
+      await stateIndex.delete(tenant, deletedMessageCids);
     }
   }
 }

package/src/types/data-store.ts

@@ -1,5 +1,3 @@
-import type { Readable } from 'readable-stream';
-
 /**
  * The interface that defines how to store and fetch data associated with a message.
  */
@@ -19,7 +17,7 @@ export interface DataStore {
    * @param recordId The logical ID of the record that references the data.
    * @param dataCid The IPFS CID of the data.
    */
-  put(tenant: string, recordId: string, dataCid: string, dataStream: Readable): Promise<DataStorePutResult>;
+  put(tenant: string, recordId: string, dataCid: string, dataStream: ReadableStream<Uint8Array>): Promise<DataStorePutResult>;
 
   /**
    * Fetches the specified data.
@@ -60,5 +58,5 @@ export type DataStoreGetResult = {
    * The number of bytes of the data stored.
    */
   dataSize: number;
-  dataStream: Readable;
+  dataStream: ReadableStream<Uint8Array>;
 };

package/src/types/encryption-types.ts

@@ -0,0 +1,52 @@
+import type { EciesEncryptionOutput } from '../utils/encryption.js';
+import type { KeyDerivationScheme } from '../utils/hd-key.js';
+import type { PublicKeyJwk } from './jose-types.js';
+
+/**
+ * A callback interface for deriving HD public encryption keys.
+ * The implementor performs HKDF key derivation and public key computation
+ * internally — the private key never leaves the implementation boundary.
+ *
+ * Analogous to `MessageSigner` for signing operations.
+ */
+export interface EncryptionKeyDeriver {
+  /** Fully qualified key ID (e.g. did:example:alice#enc) */
+  rootKeyId: string;
+  /** The derivation scheme (e.g. KeyDerivationScheme.ProtocolPath) */
+  derivationScheme: KeyDerivationScheme;
+  /**
+   * Derives an HD child public key for the given full derivation path.
+   * The private key material stays within the implementor's boundary.
+   *
+   * @param fullDerivationPath - The complete HKDF path segments
+   *   (e.g. ['protocolPath', 'https://chat.example', 'thread', 'message'])
+   * @returns The derived child public key as a JWK
+   */
+  derivePublicKey(fullDerivationPath: string[]): Promise<PublicKeyJwk>;
+}
+
+/**
+ * A callback interface for decrypting ECIES-encrypted data encryption keys.
+ * The implementor performs HKDF key derivation and ECIES decryption
+ * internally — the private key never leaves the implementation boundary.
+ *
+ * Analogous to `MessageSigner` for signing operations.
+ */
+export interface KeyDecrypter {
+  /** Fully qualified key ID (e.g. did:example:alice#enc) */
+  rootKeyId: string;
+  /** The derivation scheme (e.g. KeyDerivationScheme.ProtocolPath) */
+  derivationScheme: KeyDerivationScheme;
+  /**
+   * Decrypts an ECIES-SECP256K1 encrypted payload after deriving the
+   * leaf decryption key via HKDF through the given derivation path.
+   *
+   * @param fullDerivationPath - The complete HKDF path to derive the leaf key
+   * @param eciesEncryptedPayload - The ECIES ciphertext components
+   * @returns The decrypted plaintext bytes (typically a 32-byte DEK)
+   */
+  decrypt(
+    fullDerivationPath: string[],
+    eciesEncryptedPayload: EciesEncryptionOutput,
+  ): Promise<Uint8Array>;
+}

package/src/types/jose-types.ts

@@ -1,45 +1,13 @@
+import type { Jwk, PrivateKeyJwk, PublicKeyJwk } from '@enbox/crypto';
+
+export type { Jwk, PrivateKeyJwk, PublicKeyJwk };
+
 /**
  * Contains a public-private key pair and the associated key ID.
  */
 export type KeyMaterial = {
   keyId: string,
-  keyPair: { publicJwk: PublicJwk, privateJwk: PrivateJwk }
-};
-
-export type Jwk = {
-  /** The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. */
-  alg?: string;
-  /** The "alg" (algorithm) parameter identifies the algorithm intended for use with the key. */
-  kid?: string;
-  /** identifies the cryptographic algorithm family used with the key, such "EC". */
-  kty: string;
-};
-
-export type PublicJwk = Jwk & {
-  /** The "crv" (curve) parameter identifies the cryptographic curve used with the key.
-   * MUST be present for all EC public keys
-   */
-  crv: 'Ed25519' | 'secp256k1' | 'P-256';
-  /**
-   * the x coordinate for the Elliptic Curve point.
-   * Represented as the base64url encoding of the octet string representation of the coordinate.
-   * MUST be present for all EC public keys
-   */
-  x: string;
-  /**
-   * the y coordinate for the Elliptic Curve point.
-   * Represented as the base64url encoding of the octet string representation of the coordinate.
-   */
-  y?: string;
-};
-
-export type PrivateJwk = PublicJwk & {
-  /**
-   * the Elliptic Curve private key value.
-   * It is represented as the base64url encoding of the octet string representation of the private key value
-   * MUST be present to represent Elliptic Curve private keys.
-   */
-  d: string;
+  keyPair: { publicJwk: PublicKeyJwk, privateJwk: PrivateKeyJwk }
 };
 
 export interface SignatureAlgorithm {
@@ -49,7 +17,7 @@ export interface SignatureAlgorithm {
    * @param privateJwk - the key to sign with
    * @returns the signed content (aka signature)
    */
-  sign(content: Uint8Array, privateJwk: PrivateJwk): Promise<Uint8Array>;
+  sign(content: Uint8Array, privateJwk: PrivateKeyJwk): Promise<Uint8Array>;
 
   /**
    * Verifies a signature against the provided payload hash and public key.
@@ -58,13 +26,13 @@ export interface SignatureAlgorithm {
    * @param publicJwk - the key to verify with
    * @returns a boolean indicating whether the signature matches
    */
-  verify(content: Uint8Array, signature: Uint8Array, publicJwk: PublicJwk): Promise<boolean>;
+  verify(content: Uint8Array, signature: Uint8Array, publicJwk: PublicKeyJwk): Promise<boolean>;
 
   /**
    * generates a random key pair
    * @returns the public and private keys as JWKs
    */
-  generateKeyPair(): Promise<{ publicJwk: PublicJwk, privateJwk: PrivateJwk }>
+  generateKeyPair(): Promise<{ publicJwk: PublicKeyJwk, privateJwk: PrivateKeyJwk }>
 
 
   /**
@@ -72,5 +40,5 @@ export interface SignatureAlgorithm {
    * @param publicKeyBytes - the public key to convert into JWK
    * @returns the public key in JWK format
    */
-  publicKeyToJwk(publicKeyBytes: Uint8Array): Promise<PublicJwk>
-}
+  publicKeyToJwk(publicKeyBytes: Uint8Array): Promise<PublicKeyJwk>
+}

package/src/types/message-store.ts

@@ -45,6 +45,17 @@ export interface MessageStore {
     options?: MessageStoreOptions
   ): Promise<{ messages: GenericMessage[], cursor?: PaginationCursor}>;
 
+  /**
+   * Counts the number of messages matching the provided filters without loading full message data.
+   * More efficient than query() when only the count is needed, especially when compound indexes are available.
+   */
+  count(
+    tenant: string,
+    filters: Filter[],
+    messageSort?: MessageSort,
+    options?: MessageStoreOptions
+  ): Promise<number>;
+
   /**
    * Deletes the message associated with the id provided.
    */

package/src/types/message-types.ts

@@ -1,4 +1,5 @@
 import type { GeneralJws } from './jws-types.js';
+import type { PublicKeyJwk } from './jose-types.js';
 import type { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
 import type { PaginationCursor, SortDirection } from './query-types.js';
 
@@ -8,6 +9,13 @@ import type { PaginationCursor, SortDirection } from './query-types.js';
 export type GenericMessage = {
   descriptor: Descriptor;
   authorization?: AuthorizationModel;
+
+  /**
+   * Base64url-encoded data that the message store may attach to small RecordsWrite messages.
+   * This is a runtime-only property — it is stripped before CID computation and not part of the
+   * canonical message schema, but it flows through the store layer for performance optimisation.
+   */
+  encodedData?: string;
 };
 
 /**
@@ -34,6 +42,19 @@ export type AuthorizationModel = {
    * The delegated grant required when the message is signed by an owner-delegate.
    */
   ownerDelegatedGrant?: DelegatedGrantRecordsWriteMessage;
+
+  /**
+   * The author's ProtocolPath-derived public key for the key-delivery protocol's
+   * `contextKey` path.  Included by external authors on cross-DWN encrypted
+   * protocol records so the DWN owner can encrypt a context key back to them
+   * without needing to query the author's DWN.
+   */
+  authorKeyDeliveryPublicKey?: {
+    /** Fully-qualified verification method ID (e.g. `did:example:bob#enc`). */
+    rootKeyId: string;
+    /** The author's ProtocolPath-derived public key in JWK format. */
+    publicKeyJwk: PublicKeyJwk;
+  };
 };
 
 export type DelegatedGrantRecordsWriteMessage = {

package/src/types/messages-types.ts

@@ -1,8 +1,7 @@
 import type { MessageEvent } from './subscriptions.js';
-import type { Readable } from 'readable-stream';
+import type { RangeCriterion } from './query-types.js';
 import type { AuthorizationModel, GenericMessage, GenericMessageReply, MessageSubscription } from './message-types.js';
 import type { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
-import type { PaginationCursor, RangeCriterion } from './query-types.js';
 
 /**
  * filters used when filtering for any type of Message across interfaces
@@ -19,6 +18,7 @@ export type MessagesReadDescriptor = {
   method: DwnMethodName.Read;
   messageCid: string;
   messageTimestamp: string;
+  permissionGrantId?: string;
 };
 
 export type MessagesReadMessage = GenericMessage & {
@@ -29,29 +29,34 @@ export type MessagesReadMessage = GenericMessage & {
 export type MessagesReadReplyEntry = {
   messageCid: string;
   message: GenericMessage;
-  data?: Readable;
+  data?: ReadableStream<Uint8Array>;
 };
 
 export type MessagesReadReply = GenericMessageReply & {
   entry?: MessagesReadReplyEntry;
 };
 
-export type MessagesQueryDescriptor = {
-  interface: DwnInterfaceName.Messages;
-  method: DwnMethodName.Query;
-  messageTimestamp: string;
-  filters: MessagesFilter[];
-  cursor?: PaginationCursor;
+export type MessagesSyncAction = 'root' | 'subtree' | 'leaves';
+
+export type MessagesSyncDescriptor = {
+  interface : DwnInterfaceName.Messages;
+  method : DwnMethodName.Sync;
+  messageTimestamp : string;
+  action : MessagesSyncAction;
+  protocol? : string; // optional protocol scope
+  prefix? : string; // bit path for subtree/leaves (e.g. "0110101...")
+  permissionGrantId? : string;
 };
 
-export type MessagesQueryMessage = GenericMessage & {
-  authorization: AuthorizationModel;
-  descriptor: MessagesQueryDescriptor;
+export type MessagesSyncMessage = GenericMessage & {
+  authorization : AuthorizationModel; // overriding `GenericMessage` with `authorization` being required
+  descriptor : MessagesSyncDescriptor;
 };
 
-export type MessagesQueryReply = GenericMessageReply & {
-  entries?: string[];
-  cursor?: PaginationCursor;
+export type MessagesSyncReply = GenericMessageReply & {
+  root? : string; // hex-encoded root hash (for 'root' action)
+  hash? : string; // hex-encoded subtree hash (for 'subtree' action)
+  entries? : string[]; // messageCid[] (for 'leaves' action)
 };
 
 export type MessageSubscriptionHandler = (event: MessageEvent) => void;
@@ -74,4 +79,5 @@ export type MessagesSubscribeDescriptor = {
   method: DwnMethodName.Subscribe;
   messageTimestamp: string;
   filters: MessagesFilter[];
+  permissionGrantId?: string;
 };

package/src/types/method-handler.ts

@@ -1,5 +1,4 @@
 import type { MessageSubscriptionHandler } from './messages-types.js';
-import type { Readable } from 'readable-stream';
 import type { RecordSubscriptionHandler } from './records-types.js';
 import type { GenericMessage, GenericMessageReply } from './message-types.js';
 
@@ -13,7 +12,7 @@ export interface MethodHandler {
   handle(input: {
     tenant: string;
     message: GenericMessage;
-    dataStream?: Readable
+    dataStream?: ReadableStream<Uint8Array>
     subscriptionHandler?: MessageSubscriptionHandler | RecordSubscriptionHandler;
   }): Promise<GenericMessageReply>;
 }

package/src/types/permission-types.ts

@@ -78,7 +78,7 @@ export type ProtocolPermissionScope = {
 
 export type MessagesPermissionScope = {
   interface: DwnInterfaceName.Messages;
-  method: DwnMethodName.Query | DwnMethodName.Read | DwnMethodName.Subscribe;
+  method: DwnMethodName.Read | DwnMethodName.Subscribe | DwnMethodName.Sync;
   protocol?: string;
 };
 
@@ -87,7 +87,7 @@ export type MessagesPermissionScope = {
  */
 export type RecordsPermissionScope = {
   interface: DwnInterfaceName.Records;
-  method: DwnMethodName.Read | DwnMethodName.Write | DwnMethodName.Query | DwnMethodName.Subscribe | DwnMethodName.Delete;
+  method: DwnMethodName.Count | DwnMethodName.Read | DwnMethodName.Write | DwnMethodName.Query | DwnMethodName.Subscribe | DwnMethodName.Delete;
   protocol: string;
   /** May only be present when `protocol` is defined and `protocolPath` is undefined */
   contextId?: string;

package/src/types/protocols-types.ts

@@ -1,4 +1,4 @@
-import type { PublicJwk } from './jose-types.js';
+import type { PublicKeyJwk } from './jose-types.js';
 import type { AuthorizationModel, GenericMessage, GenericMessageReply } from './message-types.js';
 import type { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
 
@@ -7,6 +7,7 @@ export type ProtocolsConfigureDescriptor = {
   method: DwnMethodName.Configure;
   messageTimestamp: string;
   definition: ProtocolDefinition;
+  permissionGrantId?: string;
 };
 
 export type ProtocolDefinition = {
@@ -15,15 +16,45 @@ export type ProtocolDefinition = {
    * Denotes if this Protocol Definition can be returned by unauthenticated or unauthorized `ProtocolsQuery`.
    */
   published: boolean;
+
+  /**
+   * Maps alias names to external protocol URIs that this protocol composes with.
+   * Each alias can be used in `$ref` values and cross-protocol `role`/`of` references
+   * using the `alias:path` syntax.
+   *
+   * Example:
+   * ```
+   * "uses": { "threads": "https://threads.example.com" }
+   * ```
+   */
+  uses?: ProtocolUses;
+
   types: ProtocolTypes;
   structure: {
     [key: string]: ProtocolRuleSet;
   }
 };
 
+/**
+ * Maps alias names to external protocol URIs for composition.
+ */
+export type ProtocolUses = {
+  [alias: string]: string;
+};
+
 export type ProtocolType = {
   schema?: string,
   dataFormats?: string[],
+
+  /**
+   * When `true`, records of this type **must** be encrypted at the DWN record
+   * level using the tenant's ProtocolPath-derived encryption key. The tenant
+   * DID must have a secp256k1 keyAgreement key; protocol installation will
+   * fail if it does not.
+   *
+   * When `false` or omitted, encryption is not required for this type.
+   */
+  encryptionRequired?: boolean,
 };
 
 export type ProtocolTypes = {
@@ -43,9 +74,7 @@ export enum ProtocolAction {
   Create = 'create',
   Delete = 'delete',
   Prune = 'prune',
-  Query = 'query',
   Read = 'read',
-  Subscribe = 'subscribe',
   Update = 'update'
 }
 
@@ -95,7 +124,7 @@ export type ProtocolActionRule = {
   /**
    * Array of actions that the actor/role can perform.
    * See {ProtocolAction} for possible values.
-   * 'query' and 'subscribe' are only supported for `role` rules.
+   * 'read' authorizes read, query, and subscribe access.
    */
   can: string[];
 };
@@ -112,7 +141,7 @@ export type ProtocolPathEncryption = {
   /**
    * Public key for encrypting the symmetric key used for data encryption.
    */
-  publicKeyJwk: PublicJwk;
+  publicKeyJwk: PublicKeyJwk;
 };
 
 export type ProtocolRuleSet = {
@@ -128,6 +157,25 @@ export type ProtocolRuleSet = {
    */
   $role?: boolean;
 
+  /**
+   * References a type from an external protocol declared in `uses`.
+   * Format: `"alias:typePath"` where `alias` is a key in the protocol definition's `uses` map
+   * and `typePath` is the protocol path of the type in the external protocol's structure.
+   *
+   * A `$ref` node is a pure attachment point — it must NOT have `$actions`, `$role`, `$size`,
+   * `$tags`, or `$encryption`. Authorization for the referenced type is governed by its own
+   * protocol. Only children defined under the `$ref` node get `$actions` from the composing protocol.
+   *
+   * Example:
+   * ```
+   * "thread": {
+   *   "$ref": "threads:thread",
+   *   "comment": { "$actions": [{ "who": "anyone", "can": ["create", "read"] }] }
+   * }
+   * ```
+   */
+  $ref?: string;
+
   /**
    * If $size is set, the record size in bytes must be within the limits.
    */
@@ -165,7 +213,8 @@ export type ProtocolsQueryDescriptor = {
   interface : DwnInterfaceName.Protocols,
   method: DwnMethodName.Query;
   messageTimestamp: string;
-  filter?: ProtocolsQueryFilter
+  filter?: ProtocolsQueryFilter;
+  permissionGrantId?: string;
 };
 
 export type ProtocolsQueryMessage = GenericMessage & {

package/src/types/records-types.ts

@@ -1,8 +1,7 @@
 import type { EncryptionAlgorithm } from '../utils/encryption.js';
 import type { GeneralJws } from './jws-types.js';
 import type { KeyDerivationScheme } from '../utils/hd-key.js';
-import type { PublicJwk } from './jose-types.js';
-import type { Readable } from 'readable-stream';
+import type { PublicKeyJwk } from './jose-types.js';
 import type { AuthorizationModel, GenericMessage, GenericMessageReply, GenericSignaturePayload, MessageSubscription, Pagination } from './message-types.js';
 import type { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
 import type { PaginationCursor, RangeCriterion, RangeFilter, StartsWithFilter } from './query-types.js';
@@ -11,7 +10,9 @@ export enum DateSort {
   CreatedAscending = 'createdAscending',
   CreatedDescending = 'createdDescending',
   PublishedAscending = 'publishedAscending',
-  PublishedDescending = 'publishedDescending'
+  PublishedDescending = 'publishedDescending',
+  UpdatedAscending = 'updatedAscending',
+  UpdatedDescending = 'updatedDescending'
 }
 
 export type RecordsWriteTagValue = string | number | boolean | string[] | number[];
@@ -37,10 +38,11 @@ export type RecordsWriteDescriptor = {
   published?: boolean;
   datePublished?: string;
   dataFormat: string;
+  permissionGrantId?: string;
 };
 
 export type RecordsWriteMessageOptions = {
-  dataStream?: Readable;
+  dataStream?: ReadableStream<Uint8Array>;
 };
 
 /**
@@ -78,11 +80,11 @@ export type EncryptedKey = {
   /**
    * The actual derived public key.
    */
-  derivedPublicKey?: PublicJwk;
+  derivedPublicKey?: PublicKeyJwk;
   derivationScheme: KeyDerivationScheme;
   algorithm: EncryptionAlgorithm;
   initializationVector: string;
-  ephemeralPublicKey: PublicJwk;
+  ephemeralPublicKey: PublicKeyJwk;
   messageAuthenticationCode: string;
   encryptedKey: string;
 };
@@ -115,6 +117,21 @@ export type DataEncodedRecordsWriteMessage = RecordsWriteMessage & {
   encodedData: string;
 };
 
+export type RecordsCountDescriptor = {
+  interface: DwnInterfaceName.Records;
+  method: DwnMethodName.Count;
+  messageTimestamp: string;
+  filter: RecordsFilter;
+};
+
+export type RecordsCountMessage = GenericMessage & {
+  descriptor: RecordsCountDescriptor;
+};
+
+export type RecordsCountReply = GenericMessageReply & {
+  count?: number;
+};
+
 export type RecordsQueryDescriptor = {
   interface: DwnInterfaceName.Records;
   method: DwnMethodName.Query;
@@ -235,7 +252,7 @@ export type RecordsReadReplyEntry = {
   /**
    * The data stream associated with the record if the records exists (not deleted).
    */
-  data?: Readable;
+  data?: ReadableStream<Uint8Array>;
 };
 
 export type RecordsReadDescriptor = {
@@ -243,6 +260,8 @@ export type RecordsReadDescriptor = {
   method: DwnMethodName.Read;
   filter: RecordsFilter;
   messageTimestamp: string;
+  permissionGrantId?: string;
+  dateSort?: DateSort;
 };
 
 export type RecordsDeleteMessage = GenericMessage & {

package/src/types/signer.ts

@@ -1,7 +1,7 @@
 /**
  * A signer that is capable of generating a digital signature over any given bytes.
  */
-export interface Signer {
+export interface MessageSigner {
   /**
    * The ID of the key used by this signer.
    * This needs to be a fully-qualified ID (ie. prefixed with DID) so that author can be parsed out for processing such as `recordId` computation.