@enbox/dwn-sdk-js 0.4.14 → 0.4.16

package/dist/types/src/types/protocols-types.d.ts

@@ -46,7 +46,8 @@ export type ProtocolType = {
      * DID must have an X25519 keyAgreement key; protocol installation will
      * fail if it does not.
      *
-     * When `false` or omitted, encryption is not required for this type.
+     * When `false` or omitted, records of this type **must** be plaintext at the
+     * DWN record level. Applications cannot override this protocol policy per write.
      */
     encryptionRequired?: boolean;
 };

package/dist/types/src/types/protocols-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocols-types.d.ts","sourceRoot":"","sources":["../../../../src/types/protocols-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAExF,MAAM,MAAM,4BAA4B,GAAG;IACzC,SAAS,EAAG,gBAAgB,CAAC,SAAS,CAAC;IACvC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;OAEG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;IAEpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE;QACT,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAC;KAChC,CAAA;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC;CAC7B,CAAC;AAEF,oBAAY,aAAa;IACvB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,SAAS,cAAc;CACxB;AAED,oBAAY,cAAc;IACxB,QAAQ,cAAc;IACtB,OAAO,aAAa;IACpB,QAAQ,cAAc;IACtB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,aAAa,GAAG,GAAG,aAAa,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAEzD;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;;;OAIG;IACH,GAAG,EAAE,CAAC,cAAc,GAAG,GAAG,cAAc,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;CAC/D,CAAC;AACF;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;GAEG;AACH,oBAAY,2BAA2B;IACrC,yFAAyF;IACzF,MAAM,WAAW;IACjB,iGAAiG;IACjG,WAAW,gBAAgB;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,mGAAmG;IACnG,GAAG,EAAE,MAAM,CAAC;IAEZ;;;;OAIG;IACH,QAAQ,EAAE,2BAA2B,GAAG,GAAG,2BAA2B,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;CAC1F,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE9D;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,uEAAuE;IACvE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,mDAAmD;IACnD,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,GAAG,MAAM,EAAE,GAAG,OAAO,GAAG,SAAS,CAAC;CACnE,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IAC5D,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;KAAE,CAAC;IAClD,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;KAAE,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;GAKG;AACH,KAAK,oBAAoB,GACrB,eAAe,GACf,kBAAkB,EAAE,GACpB,oBAAoB,GACpB,sBAAsB,GACtB,sBAAsB,GACtB,6BAA6B,GAG7B,OAAO,GACP,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,MAAM,eAAe,GAAG;IAC5B;;OAEG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAEhC;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAE/B;;OAEG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAE/B;;;;OAIG;IACH,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAE7C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,wBAAwB,CAAC;IAErC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,cAAc,GAAG;IACvD,aAAa,EAAE,kBAAkB,CAAC;IAClC,UAAU,EAAE,4BAA4B,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAG,gBAAgB,CAAC,SAAS,CAAC;IACvC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,cAAc,GAAG;IACnD,UAAU,EAAE,wBAAwB,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,GAAG;IACtD,OAAO,CAAC,EAAE,yBAAyB,EAAE,CAAC;CACvC,CAAC"}
+{"version":3,"file":"protocols-types.d.ts","sourceRoot":"","sources":["../../../../src/types/protocols-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAExF,MAAM,MAAM,4BAA4B,GAAG;IACzC,SAAS,EAAG,gBAAgB,CAAC,SAAS,CAAC;IACvC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;OAEG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;IAEpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE;QACT,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAC;KAChC,CAAA;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC;CAC7B,CAAC;AAEF,oBAAY,aAAa;IACvB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,SAAS,cAAc;CACxB;AAED,oBAAY,cAAc;IACxB,QAAQ,cAAc;IACtB,OAAO,aAAa;IACpB,QAAQ,cAAc;IACtB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,aAAa,GAAG,GAAG,aAAa,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAEzD;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;;;OAIG;IACH,GAAG,EAAE,CAAC,cAAc,GAAG,GAAG,cAAc,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;CAC/D,CAAC;AACF;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;GAEG;AACH,oBAAY,2BAA2B;IACrC,yFAAyF;IACzF,MAAM,WAAW;IACjB,iGAAiG;IACjG,WAAW,gBAAgB;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,mGAAmG;IACnG,GAAG,EAAE,MAAM,CAAC;IAEZ;;;;OAIG;IACH,QAAQ,EAAE,2BAA2B,GAAG,GAAG,2BAA2B,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;CAC1F,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE9D;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,uEAAuE;IACvE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,mDAAmD;IACnD,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,GAAG,MAAM,EAAE,GAAG,OAAO,GAAG,SAAS,CAAC;CACnE,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IAC5D,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;KAAE,CAAC;IAClD,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;KAAE,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;GAKG;AACH,KAAK,oBAAoB,GACrB,eAAe,GACf,kBAAkB,EAAE,GACpB,oBAAoB,GACpB,sBAAsB,GACtB,sBAAsB,GACtB,6BAA6B,GAG7B,OAAO,GACP,MAAM,GACN,SAAS,CAAC;AAEd,MAAM,MAAM,eAAe,GAAG;IAC5B;;OAEG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAEhC;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAE/B;;OAEG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAE/B;;;;OAIG;IACH,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAE7C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,wBAAwB,CAAC;IAErC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,cAAc,GAAG;IACvD,aAAa,EAAE,kBAAkB,CAAC;IAClC,UAAU,EAAE,4BAA4B,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAG,gBAAgB,CAAC,SAAS,CAAC;IACvC,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,cAAc,GAAG;IACnD,UAAU,EAAE,wBAAwB,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,GAAG;IACtD,OAAO,CAAC,EAAE,yBAAyB,EAAE,CAAC;CACvC,CAAC"}

package/dist/types/src/utils/messages.d.ts

@@ -36,6 +36,14 @@ export declare class Messages {
      * (including cursor-based subscriptions) also apply to the shadow filter.
      */
     private static constructProtocolConfigureShadowFilter;
+    /**
+     * Maps a filter set onto the replication fingerprint domains it covers, or
+     * `undefined` when the filters do not correspond to fingerprint domains.
+     * An empty filter set covers the global domain; a set of protocol-only
+     * filters covers each protocol's domain plus its tagged core-protocol
+     * domains. Any other filter shape has no domain mapping.
+     */
+    static computeFingerprintScopes(filters: MessagesFilter[]): string[] | undefined;
     /**
      * Returns a copy of a RecordsWrite message without inline encodedData, and the
      * detached encodedData value for wire surfaces that carry data beside the message.

package/dist/types/src/utils/messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../../src/utils/messages.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAUjE;;GAEG;AACH,qBAAa,QAAQ;IACnB;;OAEG;WACW,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;IAwB3E;;;;;;;;;;OAUG;WACW,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,aAAa,CAAC,EAAE,oBAAoB,GAAG,MAAM,EAAE;IAoBvG;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,4BAA4B;IAgB3C;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,sCAAsC;IAqBrD;;;OAGG;WACW,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG;QAAE,OAAO,EAAE,cAAc,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAY3G;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAmC5B,OAAO,CAAC,MAAM,CAAC,cAAc;CAG9B"}
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../../src/utils/messages.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAWjE;;GAEG;AACH,qBAAa,QAAQ;IACnB;;OAEG;WACW,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,cAAc,EAAE;IAwB3E;;;;;;;;;;OAUG;WACW,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,aAAa,CAAC,EAAE,oBAAoB,GAAG,MAAM,EAAE;IAoBvG;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,4BAA4B;IAgB3C;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,sCAAsC;IAqBrD;;;;;;OAMG;WACW,wBAAwB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS;IAqCvF;;;OAGG;WACW,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG;QAAE,OAAO,EAAE,cAAc,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;IAY3G;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,aAAa;IAmC5B,OAAO,CAAC,MAAM,CAAC,cAAc;CAG9B"}

package/dist/types/src/utils/replication.d.ts

@@ -1,5 +1,6 @@
 import type { GenericMessage } from '../types/message-types.js';
 import type { KeyValues } from '../types/query-types.js';
+import type { ReplicationFeedReader } from '../types/subscriptions.js';
 /**
  * Shared helpers for the replication log substrate.
  */
@@ -9,12 +10,18 @@ export declare class Replication {
     static permissionDomain(protocolUri: string): string;
     static encryptionDomain(protocolUri: string): string;
     static taggedCoreProtocolDomains(protocolUri: string, protocolsInScope?: ReadonlySet<string>): string[];
+    /**
+     * Narrows a message store to its replication feed surface when it implements
+     * one. Returns `undefined` for stores without replication feed support.
+     */
+    static asFeedReader(candidate: unknown): ReplicationFeedReader | undefined;
     static deriveStreamId(tenant: string): Promise<string>;
     static computeFingerprintScopes(message: GenericMessage, indexes: KeyValues): string[];
     static assertFingerprintScopesUntouched(persistedScopes: string[], message: GenericMessage, messageCid: string, newIndexes: KeyValues): void;
     private static scopeSetsMatch;
     private static throwFingerprintScopeMutation;
-    private static isCoreProtocolUri;
+    /** Whether a protocol URI is one of the core protocols (permissions, encryption). */
+    static isCoreProtocolUri(protocolUri: string): boolean;
     static hashMessageCid(messageCid: string): Promise<Uint8Array>;
     static emptyFingerprint(): Uint8Array;
     static xorFingerprint(fingerprint: Uint8Array, contribution: Uint8Array): Uint8Array;

package/dist/types/src/utils/replication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replication.d.ts","sourceRoot":"","sources":["../../../../src/utils/replication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAYzD;;GAEG;AACH,qBAAa,WAAW;IACtB,gBAAuB,YAAY,MAAM;WAE3B,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAI3C,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAI7C,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAI7C,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,GAAE,WAAW,CAAC,MAAM,CAAa,GAAG,MAAM,EAAE;WAerG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;WAOrD,wBAAwB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,EAAE;WAsB/E,gCAAgC,CAC5C,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,SAAS,GACpB,IAAI;IAOP,OAAO,CAAC,MAAM,CAAC,cAAc;IAQ7B,OAAO,CAAC,MAAM,CAAC,6BAA6B;IAO5C,OAAO,CAAC,MAAM,CAAC,iBAAiB;WAIZ,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;WAM7D,gBAAgB,IAAI,UAAU;WAI9B,cAAc,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,GAAG,UAAU;WAQ7E,gBAAgB,CAAC,WAAW,EAAE,UAAU,GAAG,MAAM;WAIjD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU;WAQzC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;CAW1D"}
+{"version":3,"file":"replication.d.ts","sourceRoot":"","sources":["../../../../src/utils/replication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAYvE;;GAEG;AACH,qBAAa,WAAW;IACtB,gBAAuB,YAAY,MAAM;WAE3B,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAI3C,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAI7C,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAI7C,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,GAAE,WAAW,CAAC,MAAM,CAAa,GAAG,MAAM,EAAE;IAezH;;;OAGG;WACW,YAAY,CAAC,SAAS,EAAE,OAAO,GAAG,qBAAqB,GAAG,SAAS;WAY7D,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;WAOrD,wBAAwB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,EAAE;WAsB/E,gCAAgC,CAC5C,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,SAAS,GACpB,IAAI;IAOP,OAAO,CAAC,MAAM,CAAC,cAAc;IAQ7B,OAAO,CAAC,MAAM,CAAC,6BAA6B;IAO5C,qFAAqF;WACvE,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;WAIzC,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;WAM7D,gBAAgB,IAAI,UAAU;WAI9B,cAAc,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,GAAG,UAAU;WAQ7E,gBAAgB,CAAC,WAAW,EAAE,UAAU,GAAG,MAAM;WAIjD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU;WAQzC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;CAW1D"}

package/dist/types/tests/features/protocol-composition.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol-composition.spec.d.ts","sourceRoot":"","sources":["../../../../tests/features/protocol-composition.spec.ts"],"names":[],"mappings":"AAyBA;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAm+E9C"}
+{"version":3,"file":"protocol-composition.spec.d.ts","sourceRoot":"","sources":["../../../../tests/features/protocol-composition.spec.ts"],"names":[],"mappings":"AAyBA;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CA0+E9C"}

package/dist/types/tests/handlers/messages-query.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messages-query.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/messages-query.spec.ts"],"names":[],"mappings":"AAoCA,wBAAgB,wBAAwB,IAAI,IAAI,CAsb/C"}
+{"version":3,"file":"messages-query.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/messages-query.spec.ts"],"names":[],"mappings":"AAoCA,wBAAgB,wBAAwB,IAAI,IAAI,CA8a/C"}

package/dist/types/tests/handlers/messages-subscribe.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messages-subscribe.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/messages-subscribe.spec.ts"],"names":[],"mappings":"AA6BA,wBAAgB,4BAA4B,IAAI,IAAI,CA23CnD"}
+{"version":3,"file":"messages-subscribe.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/messages-subscribe.spec.ts"],"names":[],"mappings":"AA6BA,wBAAgB,4BAA4B,IAAI,IAAI,CAohDnD"}

package/dist/types/tests/handlers/protocols-configure.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocols-configure.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/protocols-configure.spec.ts"],"names":[],"mappings":"AAgCA,wBAAgB,6BAA6B,IAAI,IAAI,CAkkEpD"}
+{"version":3,"file":"protocols-configure.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/protocols-configure.spec.ts"],"names":[],"mappings":"AAwEA,wBAAgB,6BAA6B,IAAI,IAAI,CA+zEpD"}

package/dist/types/tests/handlers/records-read.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"records-read.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/records-read.spec.ts"],"names":[],"mappings":"AAqCA,wBAAgB,sBAAsB,IAAI,IAAI,CAkpE7C"}
+{"version":3,"file":"records-read.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/records-read.spec.ts"],"names":[],"mappings":"AAqCA,wBAAgB,sBAAsB,IAAI,IAAI,CAmpE7C"}

package/dist/types/tests/handlers/records-write.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"records-write.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/records-write.spec.ts"],"names":[],"mappings":"AA+DA,wBAAgB,uBAAuB,IAAI,IAAI,CA6yM9C"}
+{"version":3,"file":"records-write.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/records-write.spec.ts"],"names":[],"mappings":"AA+DA,wBAAgB,uBAAuB,IAAI,IAAI,CAg1M9C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enbox/dwn-sdk-js",
-  "version": "0.4.14",
+  "version": "0.4.16",
   "description": "A reference implementation of https://identity.foundation/decentralized-web-node/spec/",
   "repository": {
     "type": "git",

package/src/core/constants.ts

@@ -19,6 +19,8 @@ export const PERMISSIONS_PROTOCOL_URI = 'https://identity.foundation/dwn/permiss
  * The DWN Encryption protocol URI.
  */
 export const ENCRYPTION_PROTOCOL_URI = 'https://identity.foundation/dwn/protocols/encryption';
+export const ENCRYPTION_PROTOCOL_GRANT_KEY_PATH = 'grantKey';
+export const ENCRYPTION_PROTOCOL_WRAPPED_GRANT_KEY_PATH = 'wrappedGrantKey';
 
 /**
  * Reserved virtual protocol path root for source-protocol-native encryption

package/src/core/dwn-error.ts

@@ -145,6 +145,7 @@ export enum DwnErrorCode {
   ProtocolAuthorizationIncorrectProtocolPath = 'ProtocolAuthorizationIncorrectProtocolPath',
   ProtocolAuthorizationInitialWriteRevalidationNotInitial = 'ProtocolAuthorizationInitialWriteRevalidationNotInitial',
   ProtocolAuthorizationDuplicateRoleRecipient = 'ProtocolAuthorizationDuplicateRoleRecipient',
+  ProtocolAuthorizationEncryptionNotAllowed = 'ProtocolAuthorizationEncryptionNotAllowed',
   ProtocolAuthorizationEncryptionRequired = 'ProtocolAuthorizationEncryptionRequired',
   ProtocolAuthorizationEncryptionKeyAgreementMissing = 'ProtocolAuthorizationEncryptionKeyAgreementMissing',
   ProtocolAuthorizationEncryptionProtocolPathEntryMissing = 'ProtocolAuthorizationEncryptionProtocolPathEntryMissing',
@@ -196,6 +197,7 @@ export enum DwnErrorCode {
   ProtocolsConfigureInvalidEncryptedRoleMissingKeyAgreement = 'ProtocolsConfigureInvalidEncryptedRoleMissingKeyAgreement',
   ProtocolsConfigureMissingEncryptedPathKeyAgreement = 'ProtocolsConfigureMissingEncryptedPathKeyAgreement',
   ProtocolsConfigureMissingTopLevelKeyAgreement = 'ProtocolsConfigureMissingTopLevelKeyAgreement',
+  ProtocolsConfigureEncryptionPolicyImmutable = 'ProtocolsConfigureEncryptionPolicyImmutable',
   ProtocolsConfigureInvalidRecipientOfAction = 'ProtocolsConfigureInvalidRecipientOfAction',
   ProtocolsConfigureInvalidRuleSetRecordType = 'ProtocolsConfigureInvalidRuleSetRecordType',
   ProtocolsConfigureInvalidTagSchema = 'ProtocolsConfigureInvalidTagSchema',

package/src/core/protocol-authorization-validation.ts

@@ -9,6 +9,7 @@ import { Records } from '../utils/records.js';
 import { validateProtocolTags } from '../utils/protocol-tags.js';
 import { DwnError, DwnErrorCode } from './dwn-error.js';
 import { Encryption, ROLE_AUDIENCE_DERIVATION_SCHEME } from '../utils/encryption.js';
+import { ENCRYPTION_PROTOCOL_GRANT_KEY_PATH, ENCRYPTION_PROTOCOL_URI } from './constants.js';
 import { getRoleAudienceContextId, getRuleSetAtPath, getTypeName, parseCrossProtocolRef } from '../utils/protocols.js';
 import { ProtocolAction, ProtocolRecordLimitStrategy } from '../types/protocols-types.js';
 
@@ -275,6 +276,13 @@ export function verifyType(
     );
   }
 
+  if (protocolType.encryptionRequired !== true && inboundMessage.encryption !== undefined) {
+    throw new DwnError(
+      DwnErrorCode.ProtocolAuthorizationEncryptionNotAllowed,
+      `type '${declaredTypeName}' requires plaintext but message has encryption metadata`
+    );
+  }
+
   return protocolType;
 }
 
@@ -291,6 +299,12 @@ async function verifyProtocolPathEncryptionIfNeeded(
 
   const ruleSet = getRuleSetAtPath(inboundMessage.descriptor.protocolPath, protocolDefinition.structure);
   if (ruleSet?.$keyAgreement?.publicKeyJwk === undefined) {
+    const usesDynamicCoreRecipientKey = protocolDefinition.protocol === ENCRYPTION_PROTOCOL_URI &&
+      inboundMessage.descriptor.protocolPath === ENCRYPTION_PROTOCOL_GRANT_KEY_PATH;
+    if (usesDynamicCoreRecipientKey) {
+      return;
+    }
+
     throw new DwnError(
       DwnErrorCode.ProtocolAuthorizationEncryptionKeyAgreementMissing,
       `encrypted protocol path '${inboundMessage.descriptor.protocolPath}' has no $keyAgreement`

package/src/handlers/messages-query.ts

@@ -1,4 +1,4 @@
-import type { EventLogEntry, ProgressGapInfo, ReplicationFeedReader } from '../types/subscriptions.js';
+import type { EventLogEntry, ProgressGapInfo } from '../types/subscriptions.js';
 import type { Filter, KeyValues } from '../types/query-types.js';
 import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 import type { MessagesFilter, MessagesQueryMessage, MessagesQueryReply, MessagesQueryReplyEntry } from '../types/messages-types.js';
@@ -31,7 +31,7 @@ export class MessagesQueryHandler implements MethodHandler {
       return messageReplyFromError(e, 401);
     }
 
-    const replicationFeedReader = MessagesQueryHandler.asReplicationFeedReader(this.deps.messageStore);
+    const replicationFeedReader = Replication.asFeedReader(this.deps.messageStore);
     if (replicationFeedReader === undefined) {
       return {
         status: {
@@ -56,7 +56,7 @@ export class MessagesQueryHandler implements MethodHandler {
         drained : result.drained,
       };
 
-      const fingerprintScopes = MessagesQueryHandler.computeFingerprintScopes(message.descriptor.filters);
+      const fingerprintScopes = Messages.computeFingerprintScopes(message.descriptor.filters);
       if (fingerprintScopes !== undefined) {
         reply.fingerprint = await replicationFeedReader.fingerprint(tenant, fingerprintScopes);
       }
@@ -87,18 +87,6 @@ export class MessagesQueryHandler implements MethodHandler {
     });
   }
 
-  private static asReplicationFeedReader(candidate: unknown): ReplicationFeedReader | undefined {
-    const partial = candidate as Partial<ReplicationFeedReader>;
-    if (
-      typeof partial.logRead === 'function' &&
-      typeof partial.logBounds === 'function' &&
-      typeof partial.fingerprint === 'function' &&
-      typeof partial.epoch === 'function'
-    ) {
-      return partial as ReplicationFeedReader;
-    }
-  }
-
   private static convertFilters(filters: MessagesFilter[], deps: HandlerDependencies): Filter[] | undefined {
     if (filters.length === 0) {
       return undefined;
@@ -155,32 +143,6 @@ export class MessagesQueryHandler implements MethodHandler {
     return indexes.isLatestBaseState === true || indexes.isLatestBaseState === 'true';
   }
 
-  private static computeFingerprintScopes(filters: MessagesFilter[]): string[] | undefined {
-    if (filters.length === 0) {
-      return [Replication.globalDomain];
-    }
-
-    const protocols = new Set<string>();
-    for (const filter of filters) {
-      const keys = Object.keys(filter);
-      if (keys.length !== 1 || typeof filter.protocol !== 'string') {
-        return undefined;
-      }
-
-      protocols.add(filter.protocol);
-    }
-
-    const scopes: string[] = [];
-    for (const protocol of protocols) {
-      scopes.push(
-        Replication.protocolDomain(protocol),
-        ...Replication.taggedCoreProtocolDomains(protocol, protocols),
-      );
-    }
-
-    return scopes;
-  }
-
   private static getProgressGapInfo(error: DwnError): ProgressGapInfo | undefined {
     const gapInfo = (error as DwnError & { gapInfo?: ProgressGapInfo }).gapInfo;
     return gapInfo;

package/src/handlers/messages-subscribe.ts

@@ -1,7 +1,7 @@
 import type { PermissionGrant } from '../protocols/permission-grant.js';
-import type { EventSubscription, ProgressGapInfo, SubscriptionEvent, SubscriptionListener, SubscriptionMessage } from '../types/subscriptions.js';
+import type { EventSubscription, ProgressGapInfo, ProgressToken, ReplicationFeedReader, SubscriptionEvent, SubscriptionListener, SubscriptionMessage } from '../types/subscriptions.js';
 import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
-import type { MessagesSubscribeMessage, MessagesSubscribeReply } from '../types/messages-types.js';
+import type { MessagesFilter, MessagesSubscribeMessage, MessagesSubscribeReply } from '../types/messages-types.js';
 
 import { authenticate } from '../core/auth.js';
 import { Message } from '../core/message.js';
@@ -9,6 +9,7 @@ import { messageReplyFromError } from '../core/message-reply.js';
 import { Messages } from '../utils/messages.js';
 import { MessagesGrantAuthorization } from '../core/messages-grant-authorization.js';
 import { MessagesSubscribe } from '../interfaces/messages-subscribe.js';
+import { Replication } from '../utils/replication.js';
 import { Time } from '../utils/time.js';
 import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 
@@ -79,10 +80,20 @@ export class MessagesSubscribeHandler implements MethodHandler {
       });
       await guardedHandler.setSubscription(subscription);
 
-      return {
+      const reply: MessagesSubscribeReply = {
         status: { code: 200, detail: 'OK' },
         subscription,
       };
+      try {
+        await MessagesSubscribeHandler.attachFeedSnapshot(reply, tenant, filters, this.deps);
+      } catch {
+        // Best-effort enrichment: the subscription is live and correct
+        // without the snapshot — consumers feature-detect the fields. A
+        // failure reply here would orphan the just-installed listener, since
+        // close handles are registered only from successful replies.
+      }
+
+      return reply;
     } catch (error) {
       if (error instanceof DwnError && error.code === DwnErrorCode.EventLogProgressGap) {
         const gapInfo = (error as any).gapInfo as ProgressGapInfo | undefined;
@@ -95,6 +106,59 @@ export class MessagesSubscribeHandler implements MethodHandler {
     }
   }
 
+  /**
+   * Attaches the replication feed's `head` token and scope `fingerprint` to a
+   * successful subscribe reply, when the message store exposes the feed.
+   *
+   * Ordering is load-bearing: both values are observed AFTER the subscription
+   * became active, so every event past `head` is either replayable from it or
+   * already flowing on the live stream — a caller that verifies `fingerprint`
+   * against its local feed may adopt `head` as a checkpoint without a delivery
+   * gap. The head is captured before the fingerprint, mirroring MessagesQuery's
+   * cursor-then-fingerprint order: an event landing between the two captures
+   * makes the fingerprint read ahead of the head, which a consumer observes as
+   * a mismatch (one redundant reconcile), never as a silently skipped event.
+   */
+  private static async attachFeedSnapshot(
+    reply: MessagesSubscribeReply,
+    tenant: string,
+    filters: MessagesFilter[],
+    deps: HandlerDependencies,
+  ): Promise<void> {
+    const feedReader = Replication.asFeedReader(deps.messageStore);
+    if (feedReader === undefined) {
+      return;
+    }
+
+    // Build the complete snapshot before attaching anything: a partial
+    // snapshot (a head without its fingerprint) would read to consumers as
+    // a fingerprint-less server rather than as a failed capture.
+    const bounds = await feedReader.logBounds(tenant);
+    const head = bounds?.latest ?? await MessagesSubscribeHandler.buildAnchorToken(tenant, feedReader);
+
+    const fingerprintScopes = Messages.computeFingerprintScopes(filters);
+    const fingerprint = fingerprintScopes === undefined
+      ? undefined
+      : await feedReader.fingerprint(tenant, fingerprintScopes);
+
+    reply.head = head;
+    if (fingerprint !== undefined) {
+      reply.fingerprint = fingerprint;
+    }
+  }
+
+  /** Builds the position-zero anchor token for a tenant log with no events. */
+  private static async buildAnchorToken(
+    tenant: string,
+    feedReader: ReplicationFeedReader,
+  ): Promise<ProgressToken> {
+    return {
+      streamId : await Replication.deriveStreamId(tenant),
+      epoch    : await feedReader.epoch(),
+      position : '0',
+    };
+  }
+
   private static async authorizeMessagesSubscribe(
     tenant: string,
     messagesSubscribe: MessagesSubscribe,