@enbox/dwn-sdk-js 0.4.3 → 0.4.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/browser.mjs +15 -15
- package/dist/browser.mjs.map +4 -4
- package/dist/esm/generated/precompiled-validators.js +5406 -2200
- package/dist/esm/generated/precompiled-validators.js.map +1 -1
- package/dist/esm/json-schemas/definitions.json +18 -0
- package/dist/esm/src/core/constants.js +3 -3
- package/dist/esm/src/core/constants.js.map +1 -1
- package/dist/esm/src/core/dwn-error.js +29 -1
- package/dist/esm/src/core/dwn-error.js.map +1 -1
- package/dist/esm/src/core/messages-grant-authorization.js +20 -0
- package/dist/esm/src/core/messages-grant-authorization.js.map +1 -1
- package/dist/esm/src/core/protocol-authorization-validation.js +80 -3
- package/dist/esm/src/core/protocol-authorization-validation.js.map +1 -1
- package/dist/esm/src/core/recording-validation-state-reader.js +5 -0
- package/dist/esm/src/core/recording-validation-state-reader.js.map +1 -1
- package/dist/esm/src/core/replication-apply.js +163 -7
- package/dist/esm/src/core/replication-apply.js.map +1 -1
- package/dist/esm/src/core/validation-state-reader.js +20 -0
- package/dist/esm/src/core/validation-state-reader.js.map +1 -1
- package/dist/esm/src/dwn.js +19 -2
- package/dist/esm/src/dwn.js.map +1 -1
- package/dist/esm/src/handlers/messages-query.js +3 -5
- package/dist/esm/src/handlers/messages-query.js.map +1 -1
- package/dist/esm/src/handlers/protocols-configure.js +10 -4
- package/dist/esm/src/handlers/protocols-configure.js.map +1 -1
- package/dist/esm/src/handlers/records-write.js +1 -1
- package/dist/esm/src/handlers/records-write.js.map +1 -1
- package/dist/esm/src/index.js +2 -1
- package/dist/esm/src/index.js.map +1 -1
- package/dist/esm/src/interfaces/protocols-configure.js +23 -10
- package/dist/esm/src/interfaces/protocols-configure.js.map +1 -1
- package/dist/esm/src/interfaces/records-write-signing.js +2 -8
- package/dist/esm/src/interfaces/records-write-signing.js.map +1 -1
- package/dist/esm/src/interfaces/records-write.js +43 -65
- package/dist/esm/src/interfaces/records-write.js.map +1 -1
- package/dist/esm/src/protocols/encryption.js +411 -0
- package/dist/esm/src/protocols/encryption.js.map +1 -0
- package/dist/esm/src/protocols/permission-grant.js +3 -3
- package/dist/esm/src/protocols/permission-grant.js.map +1 -1
- package/dist/esm/src/protocols/permissions.js +1 -0
- package/dist/esm/src/protocols/permissions.js.map +1 -1
- package/dist/esm/src/types/message-types.js.map +1 -1
- package/dist/esm/src/types/permission-types.js.map +1 -1
- package/dist/esm/src/types/protocols-types.js.map +1 -1
- package/dist/esm/src/utils/encryption.js +135 -187
- package/dist/esm/src/utils/encryption.js.map +1 -1
- package/dist/esm/src/utils/hd-key.js +0 -1
- package/dist/esm/src/utils/hd-key.js.map +1 -1
- package/dist/esm/src/utils/permission-scope.js +9 -6
- package/dist/esm/src/utils/permission-scope.js.map +1 -1
- package/dist/esm/src/utils/protocols.js +12 -9
- package/dist/esm/src/utils/protocols.js.map +1 -1
- package/dist/esm/src/utils/records.js +54 -56
- package/dist/esm/src/utils/records.js.map +1 -1
- package/dist/esm/src/utils/replication.js +27 -4
- package/dist/esm/src/utils/replication.js.map +1 -1
- package/dist/esm/tests/core/replication-apply.spec.js +141 -1
- package/dist/esm/tests/core/replication-apply.spec.js.map +1 -1
- package/dist/esm/tests/core/replication-replay-property.spec.js +1 -0
- package/dist/esm/tests/core/replication-replay-property.spec.js.map +1 -1
- package/dist/esm/tests/core/validation-read-closure.spec.js +111 -0
- package/dist/esm/tests/core/validation-read-closure.spec.js.map +1 -1
- package/dist/esm/tests/core/validation-state-reader.spec.js +89 -0
- package/dist/esm/tests/core/validation-state-reader.spec.js.map +1 -1
- package/dist/esm/tests/features/protocol-composition.spec.js +30 -31
- package/dist/esm/tests/features/protocol-composition.spec.js.map +1 -1
- package/dist/esm/tests/fuzz/encryption.fuzz.spec.js +29 -121
- package/dist/esm/tests/fuzz/encryption.fuzz.spec.js.map +1 -1
- package/dist/esm/tests/handlers/messages-query.spec.js +71 -3
- package/dist/esm/tests/handlers/messages-query.spec.js.map +1 -1
- package/dist/esm/tests/handlers/messages-read.spec.js +2 -2
- package/dist/esm/tests/handlers/messages-read.spec.js.map +1 -1
- package/dist/esm/tests/handlers/records-read.spec.js +9 -135
- package/dist/esm/tests/handlers/records-read.spec.js.map +1 -1
- package/dist/esm/tests/handlers/records-write.spec.js +279 -19
- package/dist/esm/tests/handlers/records-write.spec.js.map +1 -1
- package/dist/esm/tests/interfaces/protocols-configure.spec.js +17 -22
- package/dist/esm/tests/interfaces/protocols-configure.spec.js.map +1 -1
- package/dist/esm/tests/interfaces/records-write.spec.js +170 -150
- package/dist/esm/tests/interfaces/records-write.spec.js.map +1 -1
- package/dist/esm/tests/protocols/encryption.spec.js +914 -0
- package/dist/esm/tests/protocols/encryption.spec.js.map +1 -0
- package/dist/esm/tests/protocols/permission-grant.spec.js +55 -0
- package/dist/esm/tests/protocols/permission-grant.spec.js.map +1 -1
- package/dist/esm/tests/scenarios/end-to-end-tests.spec.js +100 -100
- package/dist/esm/tests/scenarios/end-to-end-tests.spec.js.map +1 -1
- package/dist/esm/tests/store/message-store-level.spec.js +20 -2
- package/dist/esm/tests/store/message-store-level.spec.js.map +1 -1
- package/dist/esm/tests/utils/encryption-callbacks.spec.js +88 -125
- package/dist/esm/tests/utils/encryption-callbacks.spec.js.map +1 -1
- package/dist/esm/tests/utils/encryption.spec.js +125 -255
- package/dist/esm/tests/utils/encryption.spec.js.map +1 -1
- package/dist/esm/tests/utils/permission-scope.spec.js +5 -1
- package/dist/esm/tests/utils/permission-scope.spec.js.map +1 -1
- package/dist/esm/tests/utils/records.spec.js +15 -5
- package/dist/esm/tests/utils/records.spec.js.map +1 -1
- package/dist/esm/tests/utils/test-data-generator.js +7 -44
- package/dist/esm/tests/utils/test-data-generator.js.map +1 -1
- package/dist/esm/tests/validation/json-schemas/encryption/grant-key.spec.js +63 -0
- package/dist/esm/tests/validation/json-schemas/encryption/grant-key.spec.js.map +1 -0
- package/dist/types/generated/precompiled-validators.d.ts +140 -92
- package/dist/types/generated/precompiled-validators.d.ts.map +1 -1
- package/dist/types/src/core/constants.d.ts +2 -2
- package/dist/types/src/core/constants.d.ts.map +1 -1
- package/dist/types/src/core/core-protocol.d.ts +1 -1
- package/dist/types/src/core/core-protocol.d.ts.map +1 -1
- package/dist/types/src/core/dwn-error.d.ts +29 -1
- package/dist/types/src/core/dwn-error.d.ts.map +1 -1
- package/dist/types/src/core/messages-grant-authorization.d.ts +2 -0
- package/dist/types/src/core/messages-grant-authorization.d.ts.map +1 -1
- package/dist/types/src/core/protocol-authorization-validation.d.ts +2 -2
- package/dist/types/src/core/protocol-authorization-validation.d.ts.map +1 -1
- package/dist/types/src/core/recording-validation-state-reader.d.ts +9 -0
- package/dist/types/src/core/recording-validation-state-reader.d.ts.map +1 -1
- package/dist/types/src/core/replication-apply.d.ts +4 -3
- package/dist/types/src/core/replication-apply.d.ts.map +1 -1
- package/dist/types/src/core/validation-state-reader.d.ts +9 -0
- package/dist/types/src/core/validation-state-reader.d.ts.map +1 -1
- package/dist/types/src/dwn.d.ts +1 -0
- package/dist/types/src/dwn.d.ts.map +1 -1
- package/dist/types/src/handlers/messages-query.d.ts.map +1 -1
- package/dist/types/src/handlers/protocols-configure.d.ts.map +1 -1
- package/dist/types/src/index.d.ts +6 -5
- package/dist/types/src/index.d.ts.map +1 -1
- package/dist/types/src/interfaces/protocols-configure.d.ts +1 -1
- package/dist/types/src/interfaces/protocols-configure.d.ts.map +1 -1
- package/dist/types/src/interfaces/records-write-signing.d.ts +4 -8
- package/dist/types/src/interfaces/records-write-signing.d.ts.map +1 -1
- package/dist/types/src/interfaces/records-write.d.ts +10 -26
- package/dist/types/src/interfaces/records-write.d.ts.map +1 -1
- package/dist/types/src/protocols/encryption.d.ts +43 -0
- package/dist/types/src/protocols/encryption.d.ts.map +1 -0
- package/dist/types/src/protocols/permission-grant.d.ts +3 -6
- package/dist/types/src/protocols/permission-grant.d.ts.map +1 -1
- package/dist/types/src/protocols/permissions.d.ts +2 -1
- package/dist/types/src/protocols/permissions.d.ts.map +1 -1
- package/dist/types/src/types/encryption-types.d.ts +5 -38
- package/dist/types/src/types/encryption-types.d.ts.map +1 -1
- package/dist/types/src/types/message-types.d.ts +0 -13
- package/dist/types/src/types/message-types.d.ts.map +1 -1
- package/dist/types/src/types/permission-types.d.ts +44 -9
- package/dist/types/src/types/permission-types.d.ts.map +1 -1
- package/dist/types/src/types/protocols-types.d.ts +9 -14
- package/dist/types/src/types/protocols-types.d.ts.map +1 -1
- package/dist/types/src/types/records-types.d.ts +3 -3
- package/dist/types/src/types/records-types.d.ts.map +1 -1
- package/dist/types/src/types/validation-state-reader.d.ts +12 -0
- package/dist/types/src/types/validation-state-reader.d.ts.map +1 -1
- package/dist/types/src/utils/encryption.d.ts +54 -145
- package/dist/types/src/utils/encryption.d.ts.map +1 -1
- package/dist/types/src/utils/hd-key.d.ts +1 -1
- package/dist/types/src/utils/hd-key.d.ts.map +1 -1
- package/dist/types/src/utils/permission-scope.d.ts +4 -3
- package/dist/types/src/utils/permission-scope.d.ts.map +1 -1
- package/dist/types/src/utils/protocols.d.ts +3 -5
- package/dist/types/src/utils/protocols.d.ts.map +1 -1
- package/dist/types/src/utils/records.d.ts +5 -13
- package/dist/types/src/utils/records.d.ts.map +1 -1
- package/dist/types/src/utils/replication.d.ts +3 -0
- package/dist/types/src/utils/replication.d.ts.map +1 -1
- package/dist/types/tests/features/protocol-composition.spec.d.ts.map +1 -1
- package/dist/types/tests/handlers/messages-query.spec.d.ts.map +1 -1
- package/dist/types/tests/handlers/records-read.spec.d.ts.map +1 -1
- package/dist/types/tests/handlers/records-write.spec.d.ts.map +1 -1
- package/dist/types/tests/protocols/encryption.spec.d.ts +2 -0
- package/dist/types/tests/protocols/encryption.spec.d.ts.map +1 -0
- package/dist/types/tests/scenarios/end-to-end-tests.spec.d.ts.map +1 -1
- package/dist/types/tests/utils/test-data-generator.d.ts +0 -5
- package/dist/types/tests/utils/test-data-generator.d.ts.map +1 -1
- package/dist/types/tests/validation/json-schemas/encryption/grant-key.spec.d.ts +2 -0
- package/dist/types/tests/validation/json-schemas/encryption/grant-key.spec.d.ts.map +1 -0
- package/package.json +3 -3
- package/src/core/constants.ts +3 -3
- package/src/core/core-protocol.ts +1 -1
- package/src/core/dwn-error.ts +29 -1
- package/src/core/messages-grant-authorization.ts +27 -0
- package/src/core/protocol-authorization-validation.ts +145 -6
- package/src/core/recording-validation-state-reader.ts +13 -0
- package/src/core/replication-apply.ts +222 -8
- package/src/core/validation-state-reader.ts +30 -0
- package/src/dwn.ts +24 -2
- package/src/handlers/messages-query.ts +6 -5
- package/src/handlers/protocols-configure.ts +19 -3
- package/src/handlers/records-write.ts +1 -1
- package/src/index.ts +15 -5
- package/src/interfaces/protocols-configure.ts +39 -12
- package/src/interfaces/records-write-signing.ts +5 -12
- package/src/interfaces/records-write.ts +75 -92
- package/src/protocols/encryption.ts +649 -0
- package/src/protocols/permission-grant.ts +4 -5
- package/src/protocols/permissions.ts +8 -6
- package/src/types/encryption-types.ts +9 -38
- package/src/types/message-types.ts +0 -13
- package/src/types/permission-types.ts +57 -9
- package/src/types/protocols-types.ts +9 -16
- package/src/types/records-types.ts +3 -3
- package/src/types/validation-state-reader.ts +13 -0
- package/src/utils/encryption.ts +213 -283
- package/src/utils/hd-key.ts +1 -1
- package/src/utils/permission-scope.ts +10 -6
- package/src/utils/protocols.ts +16 -15
- package/src/utils/records.ts +86 -71
- package/src/utils/replication.ts +30 -4
- package/dist/esm/tests/vectors/protocol-definitions/chat.json +0 -70
|
@@ -1,172 +1,81 @@
|
|
|
1
1
|
import type { Jwk } from '@enbox/crypto';
|
|
2
2
|
import type { PublicKeyJwk } from '../types/jose-types.js';
|
|
3
3
|
import { KeyDerivationScheme } from './hd-key.js';
|
|
4
|
-
/**
|
|
5
|
-
* Content encryption algorithms supported by the DWN.
|
|
6
|
-
* Both are AEAD (Authenticated Encryption with Associated Data) ciphers.
|
|
7
|
-
*/
|
|
8
4
|
export declare enum ContentEncryptionAlgorithm {
|
|
9
|
-
|
|
10
|
-
A256GCM = "A256GCM",
|
|
11
|
-
/** XChaCha20-Poly1305. 192-bit nonce (safe to randomize). Constant-time. */
|
|
12
|
-
XC20P = "XC20P"
|
|
5
|
+
A256CTR = "A256CTR"
|
|
13
6
|
}
|
|
14
|
-
/**
|
|
15
|
-
* Key agreement algorithm used by the DWN.
|
|
16
|
-
* ECDH-ES with X25519 key agreement and AES-256 Key Wrap.
|
|
17
|
-
*/
|
|
18
7
|
export declare enum KeyAgreementAlgorithm {
|
|
19
|
-
|
|
8
|
+
X25519HkdfSha256A256Kw = "X25519-HKDF-SHA256+A256KW"
|
|
20
9
|
}
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
10
|
+
export declare const ROLE_AUDIENCE_DERIVATION_SCHEME = "roleAudience";
|
|
11
|
+
export type ProtocolPathKeyEncryption = {
|
|
12
|
+
algorithm: KeyAgreementAlgorithm.X25519HkdfSha256A256Kw;
|
|
13
|
+
keyId: string;
|
|
14
|
+
derivationScheme: KeyDerivationScheme.ProtocolPath;
|
|
15
|
+
ephemeralPublicKey: PublicKeyJwk;
|
|
16
|
+
encryptedKey: string;
|
|
27
17
|
};
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
derivationScheme: KeyDerivationScheme;
|
|
38
|
-
/** Derived public key. Present when derivationScheme is 'protocolContext'. */
|
|
39
|
-
derivedPublicKey?: PublicKeyJwk;
|
|
18
|
+
export type RoleAudienceKeyEncryption = {
|
|
19
|
+
algorithm: KeyAgreementAlgorithm.X25519HkdfSha256A256Kw;
|
|
20
|
+
keyId: string;
|
|
21
|
+
derivationScheme: typeof ROLE_AUDIENCE_DERIVATION_SCHEME;
|
|
22
|
+
protocol: string;
|
|
23
|
+
role: string;
|
|
24
|
+
epoch: number;
|
|
25
|
+
ephemeralPublicKey: PublicKeyJwk;
|
|
26
|
+
encryptedKey: string;
|
|
40
27
|
};
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
encrypted_key: string;
|
|
28
|
+
export type KeyEncryption = ProtocolPathKeyEncryption | RoleAudienceKeyEncryption;
|
|
29
|
+
export type DwnEncryption = {
|
|
30
|
+
algorithm: ContentEncryptionAlgorithm.A256CTR;
|
|
31
|
+
initializationVector: string;
|
|
32
|
+
keyEncryption: KeyEncryption[];
|
|
47
33
|
};
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
* the `ciphertext` is NOT included here because the encrypted record data is stored separately
|
|
53
|
-
* in the DataStore (or as inline `encodedData`). Only the key wrapping metadata, IV, and
|
|
54
|
-
* authentication tag are stored in this structure.
|
|
55
|
-
*/
|
|
56
|
-
export type JweEncryption = {
|
|
57
|
-
/** Base64url-encoded JWE Protected Header. */
|
|
58
|
-
protected: string;
|
|
59
|
-
/** Base64url-encoded initialization vector for content encryption. */
|
|
60
|
-
iv: string;
|
|
61
|
-
/** Base64url-encoded authentication tag from the AEAD cipher. */
|
|
62
|
-
tag: string;
|
|
63
|
-
/** Array of recipient entries, one per recipient or derivation path. */
|
|
64
|
-
recipients: JweRecipient[];
|
|
34
|
+
export type ProtocolPathKeyEncryptionInput = {
|
|
35
|
+
keyId: string;
|
|
36
|
+
publicKey: PublicKeyJwk;
|
|
37
|
+
derivationScheme: KeyDerivationScheme.ProtocolPath;
|
|
65
38
|
};
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
*/
|
|
69
|
-
export type KeyEncryptionInput = {
|
|
70
|
-
/** Fully qualified key ID of the recipient's root encryption key. */
|
|
71
|
-
publicKeyId: string;
|
|
72
|
-
/** The recipient's derived X25519 public key. */
|
|
39
|
+
export type RoleAudienceKeyEncryptionInput = {
|
|
40
|
+
keyId: string;
|
|
73
41
|
publicKey: PublicKeyJwk;
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
42
|
+
derivationScheme: typeof ROLE_AUDIENCE_DERIVATION_SCHEME;
|
|
43
|
+
protocol: string;
|
|
44
|
+
role: string;
|
|
45
|
+
epoch: number;
|
|
78
46
|
};
|
|
79
|
-
|
|
80
|
-
* Input describing how to encrypt record data.
|
|
81
|
-
*/
|
|
47
|
+
export type KeyEncryptionInput = ProtocolPathKeyEncryptionInput | RoleAudienceKeyEncryptionInput;
|
|
82
48
|
export type EncryptionInput = {
|
|
83
|
-
/** Content encryption algorithm. Defaults to A256GCM. */
|
|
84
49
|
algorithm?: ContentEncryptionAlgorithm;
|
|
85
|
-
/** The Content Encryption Key (CEK). Must be 32 bytes (256-bit). */
|
|
86
50
|
key: Uint8Array;
|
|
87
|
-
/** Initialization vector. 12 bytes for A256GCM, 24 bytes for XC20P. */
|
|
88
51
|
initializationVector: Uint8Array;
|
|
89
|
-
/** Authentication tag from the AEAD encryption of the record data. */
|
|
90
|
-
authenticationTag: Uint8Array;
|
|
91
|
-
/** Recipient key encryption inputs. */
|
|
92
52
|
keyEncryptionInputs: KeyEncryptionInput[];
|
|
93
53
|
};
|
|
94
|
-
|
|
95
|
-
* Payload passed to a KeyDecrypter callback for JWE-based key unwrapping.
|
|
96
|
-
*/
|
|
97
|
-
export type JweKeyUnwrapPayload = {
|
|
98
|
-
/** The wrapped CEK bytes. */
|
|
54
|
+
export type KeyUnwrapPayload = {
|
|
99
55
|
encryptedKey: Uint8Array;
|
|
100
|
-
/** The ephemeral X25519 public key used for ECDH. */
|
|
101
56
|
ephemeralPublicKey: PublicKeyJwk;
|
|
57
|
+
keyEncryption: KeyEncryption;
|
|
102
58
|
};
|
|
103
|
-
/**
|
|
104
|
-
* Utility class for DWN encryption operations using JWE (RFC 7516).
|
|
105
|
-
* Uses ECDH-ES+A256KW key agreement with X25519 and either AES-256-GCM or XChaCha20-Poly1305
|
|
106
|
-
* for authenticated content encryption.
|
|
107
|
-
*/
|
|
108
59
|
export declare class Encryption {
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
static
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
}>;
|
|
117
|
-
/**
|
|
118
|
-
* Decrypts data using an AEAD cipher (A256GCM or XC20P).
|
|
119
|
-
* Expects ciphertext and tag as separate inputs.
|
|
120
|
-
*/
|
|
121
|
-
static aeadDecrypt(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, iv: Uint8Array, ciphertext: Uint8Array, tag: Uint8Array): Promise<Uint8Array>;
|
|
122
|
-
/**
|
|
123
|
-
* Encrypts data as a ReadableStream using an AEAD cipher.
|
|
124
|
-
* Collects all chunks, encrypts, and returns a new stream of ciphertext || tag.
|
|
125
|
-
* The iv and tag are NOT embedded in the stream — they are stored in the JWE structure.
|
|
126
|
-
*/
|
|
127
|
-
static aeadEncryptStream(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, iv: Uint8Array, plaintextStream: ReadableStream<Uint8Array>): Promise<{
|
|
128
|
-
ciphertextStream: ReadableStream<Uint8Array>;
|
|
129
|
-
tag: Uint8Array;
|
|
60
|
+
static encrypt(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, initializationVector: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array>;
|
|
61
|
+
static decrypt(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, initializationVector: Uint8Array, ciphertext: Uint8Array): Promise<Uint8Array>;
|
|
62
|
+
static encryptStream(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, initializationVector: Uint8Array, plaintextStream: ReadableStream<Uint8Array>): Promise<ReadableStream<Uint8Array>>;
|
|
63
|
+
static decryptStream(algorithm: ContentEncryptionAlgorithm, keyBytes: Uint8Array, initializationVector: Uint8Array, ciphertextStream: ReadableStream<Uint8Array>): Promise<ReadableStream<Uint8Array>>;
|
|
64
|
+
static wrapKey(recipientPublicKey: PublicKeyJwk, cek: Uint8Array, keyInput: KeyEncryptionInput, ephemeralPrivateKey?: Jwk): Promise<{
|
|
65
|
+
encryptedKey: Uint8Array;
|
|
66
|
+
ephemeralPublicKey: PublicKeyJwk;
|
|
130
67
|
}>;
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
static
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
* @param cek - The Content Encryption Key to wrap.
|
|
142
|
-
* @returns The wrapped CEK bytes.
|
|
143
|
-
*/
|
|
144
|
-
static ecdhEsWrapKey(ephemeralPrivateKey: Jwk, recipientPublicKey: Jwk, cek: Uint8Array): Promise<Uint8Array>;
|
|
145
|
-
/**
|
|
146
|
-
* Performs ECDH-ES key agreement with X25519 and unwraps the CEK using AES-256 Key Unwrap.
|
|
147
|
-
*
|
|
148
|
-
* @param recipientPrivateKey - Recipient's X25519 private key (JWK).
|
|
149
|
-
* @param ephemeralPublicKey - Ephemeral X25519 public key from the JWE recipient header (JWK).
|
|
150
|
-
* @param wrappedKey - The wrapped CEK bytes.
|
|
151
|
-
* @returns The unwrapped CEK bytes.
|
|
152
|
-
*/
|
|
153
|
-
static ecdhEsUnwrapKey(recipientPrivateKey: Jwk, ephemeralPublicKey: Jwk, wrappedKey: Uint8Array): Promise<Uint8Array>;
|
|
154
|
-
/**
|
|
155
|
-
* Builds a JWE encryption property structure from encryption input.
|
|
156
|
-
* The ciphertext (encrypted record data) is stored separately in the DataStore,
|
|
157
|
-
* so only the key wrapping metadata, IV, and authentication tag are included here.
|
|
158
|
-
*
|
|
159
|
-
* @param encryptionInput - Describes the CEK, IV, and recipient key encryption inputs.
|
|
160
|
-
* @param tag - The authentication tag produced by the AEAD cipher during data encryption.
|
|
161
|
-
*/
|
|
162
|
-
static buildJwe(encryptionInput: EncryptionInput, tag: Uint8Array): Promise<JweEncryption>;
|
|
163
|
-
/**
|
|
164
|
-
* Parses the JWE protected header from its base64url encoding.
|
|
165
|
-
*/
|
|
166
|
-
static parseProtectedHeader(protectedBase64url: string): JweProtectedHeader;
|
|
167
|
-
/**
|
|
168
|
-
* Reads a ReadableStream to completion and returns all bytes concatenated.
|
|
169
|
-
*/
|
|
68
|
+
static unwrapKey(recipientPrivateKey: Jwk, keyEncryption: KeyEncryption): Promise<Uint8Array>;
|
|
69
|
+
static buildEncryptionProperty(encryptionInput: EncryptionInput): Promise<DwnEncryption>;
|
|
70
|
+
static getKeyId(publicKeyJwk: PublicKeyJwk): Promise<string>;
|
|
71
|
+
static validateEncryptionProperty(encryption: DwnEncryption): void;
|
|
72
|
+
private static deriveKek;
|
|
73
|
+
private static getKekInfo;
|
|
74
|
+
private static validateContentEncryptionParameters;
|
|
75
|
+
private static validateContentEncryptionKey;
|
|
76
|
+
private static validateSharedSecret;
|
|
77
|
+
private static toA256CtrJwk;
|
|
170
78
|
private static readStream;
|
|
79
|
+
private static toStream;
|
|
171
80
|
}
|
|
172
81
|
//# sourceMappingURL=encryption.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../../../src/utils/encryption.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../../../src/utils/encryption.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAM3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGlD,oBAAY,0BAA0B;IACpC,OAAO,YAAY;CACpB;AAED,oBAAY,qBAAqB;IAC/B,sBAAsB,8BAA8B;CACrD;AAED,eAAO,MAAM,+BAA+B,iBAAiB,CAAC;AAO9D,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,qBAAqB,CAAC,sBAAsB,CAAC;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,mBAAmB,CAAC,YAAY,CAAC;IACnD,kBAAkB,EAAE,YAAY,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,qBAAqB,CAAC,sBAAsB,CAAC;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,OAAO,+BAA+B,CAAC;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,EAAE,YAAY,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,yBAAyB,GAAG,yBAAyB,CAAC;AAElF,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,0BAA0B,CAAC,OAAO,CAAC;IAC9C,oBAAoB,EAAE,MAAM,CAAC;IAC7B,aAAa,EAAE,aAAa,EAAE,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,YAAY,CAAC;IACxB,gBAAgB,EAAE,mBAAmB,CAAC,YAAY,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,YAAY,CAAC;IACxB,gBAAgB,EAAE,OAAO,+BAA+B,CAAC;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,8BAA8B,GAAG,8BAA8B,CAAC;AAEjG,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,CAAC,EAAE,0BAA0B,CAAC;IACvC,GAAG,EAAE,UAAU,CAAC;IAChB,oBAAoB,EAAE,UAAU,CAAC;IACjC,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,YAAY,EAAE,UAAU,CAAC;IACzB,kBAAkB,EAAE,YAAY,CAAC;IACjC,aAAa,EAAE,aAAa,CAAC;CAC9B,CAAC;AAEF,qBAAa,UAAU;WACD,OAAO,CACzB,SAAS,EAAE,0BAA0B,EACrC,QAAQ,EAAE,UAAU,EACpB,oBAAoB,EAAE,UAAU,EAChC,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC;WAUF,OAAO,CACzB,SAAS,EAAE,0BAA0B,EACrC,QAAQ,EAAE,UAAU,EACpB,oBAAoB,EAAE,UAAU,EAChC,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,UAAU,CAAC;WAUF,aAAa,CAC/B,SAAS,EAAE,0BAA0B,EACrC,QAAQ,EAAE,UAAU,EACpB,oBAAoB,EAAE,UAAU,EAChC,eAAe,EAAE,cAAc,CAAC,UAAU,CAAC,GAC1C,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;WAMlB,aAAa,CAC/B,SAAS,EAAE,0BAA0B,EACrC,QAAQ,EAAE,UAAU,EACpB,oBAAoB,EAAE,UAAU,EAChC,gBAAgB,EAAE,cAAc,CAAC,UAAU,CAAC,GAC3C,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;WAMlB,OAAO,CACzB,kBAAkB,EAAE,YAAY,EAChC,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,kBAAkB,EAC5B,mBAAmB,CAAC,EAAE,GAAG,GACxB,OAAO,CAAC;QAAE,YAAY,EAAE,UAAU,CAAC;QAAC,kBAAkB,EAAE,YAAY,CAAA;KAAE,CAAC;WAiBtD,SAAS,CAC3B,mBAAmB,EAAE,GAAG,EACxB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,UAAU,CAAC;WAgBF,uBAAuB,CACzC,eAAe,EAAE,eAAe,GAC/B,OAAO,CAAC,aAAa,CAAC;WAwCL,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;WAI3D,0BAA0B,CAAC,UAAU,EAAE,aAAa,GAAG,IAAI;mBAmBpD,SAAS;IAe9B,OAAO,CAAC,MAAM,CAAC,UAAU;IAQzB,OAAO,CAAC,MAAM,CAAC,mCAAmC;IAgBlD,OAAO,CAAC,MAAM,CAAC,4BAA4B;IAM3C,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAMnC,OAAO,CAAC,MAAM,CAAC,YAAY;mBAIN,UAAU;IAa/B,OAAO,CAAC,MAAM,CAAC,QAAQ;CAQxB"}
|
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
import type { PrivateKeyJwk, PublicKeyJwk } from '../types/jose-types.js';
|
|
2
2
|
export declare enum KeyDerivationScheme {
|
|
3
|
-
ProtocolContext = "protocolContext",
|
|
4
3
|
ProtocolPath = "protocolPath"
|
|
5
4
|
}
|
|
6
5
|
export type DerivedPrivateJwk = {
|
|
7
6
|
rootKeyId: string;
|
|
7
|
+
keyId?: string;
|
|
8
8
|
derivationScheme: KeyDerivationScheme;
|
|
9
9
|
derivationPath?: string[];
|
|
10
10
|
derivedPrivateKey: PrivateKeyJwk;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hd-key.d.ts","sourceRoot":"","sources":["../../../../src/utils/hd-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAO1E,oBAAY,mBAAmB;IAC7B,
|
|
1
|
+
{"version":3,"file":"hd-key.d.ts","sourceRoot":"","sources":["../../../../src/utils/hd-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAO1E,oBAAY,mBAAmB;IAC7B,YAAY,iBAAiB;CAC9B;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,aAAa,CAAC;CAClC,CAAC;AAEF;;GAEG;AACH,qBAAa,KAAK;IAChB;;;OAGG;WACiB,gBAAgB,CAAC,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAe7H;;;OAGG;WACiB,eAAe,CAAC,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAOvH;;OAEG;WACiB,qBAAqB,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAiB9G;;OAEG;WACiB,kBAAkB,CAAC,MAAM,EAAE;QAC7C,aAAa,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;QACjD,kBAAkB,EAAE,UAAU,CAAC;QAC/B,IAAI,EAAE,UAAU,CAAC;QACjB,gBAAgB,EAAE,MAAM,CAAA;KACzB,GAAG,OAAO,CAAC,UAAU,CAAC;IAyBvB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,yBAAyB;CAKzC"}
|
|
@@ -15,9 +15,9 @@ export type ProtocolScope = {
|
|
|
15
15
|
*
|
|
16
16
|
* Matching fails closed for invalid combinations: `protocolPath` and
|
|
17
17
|
* `contextId` are mutually exclusive, and either field requires `protocol`.
|
|
18
|
-
* `protocol`
|
|
19
|
-
* match
|
|
20
|
-
*
|
|
18
|
+
* `protocol` matches by exact equality. `protocolPath` and `contextId` scopes
|
|
19
|
+
* match subtrees: the target value must equal the scoped value or begin with the
|
|
20
|
+
* scoped value followed by `/`.
|
|
21
21
|
*/
|
|
22
22
|
export declare class PermissionScopeMatcher {
|
|
23
23
|
/**
|
|
@@ -25,5 +25,6 @@ export declare class PermissionScopeMatcher {
|
|
|
25
25
|
*/
|
|
26
26
|
static matches(scope: ProtocolScope, target: ProtocolScope): boolean;
|
|
27
27
|
private static matchesContextId;
|
|
28
|
+
private static matchesSubtree;
|
|
28
29
|
}
|
|
29
30
|
//# sourceMappingURL=permission-scope.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permission-scope.d.ts","sourceRoot":"","sources":["../../../../src/utils/permission-scope.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC;;OAEG;WACW,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO;IAwB3E,OAAO,CAAC,MAAM,CAAC,gBAAgB;
|
|
1
|
+
{"version":3,"file":"permission-scope.d.ts","sourceRoot":"","sources":["../../../../src/utils/permission-scope.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC;;OAEG;WACW,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO;IAwB3E,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAI/B,OAAO,CAAC,MAAM,CAAC,cAAc;CAI9B"}
|
|
@@ -41,11 +41,10 @@ export declare function getRuleSetAtPath(protocolPath: string, structure: {
|
|
|
41
41
|
*/
|
|
42
42
|
export declare class Protocols {
|
|
43
43
|
/**
|
|
44
|
-
* Derives public
|
|
45
|
-
* then returns the final encryption-enabled protocol definition.
|
|
44
|
+
* Derives public encryption keys and injects them in `$keyAgreement`.
|
|
46
45
|
* NOTE: The original definition passed in is unmodified.
|
|
47
46
|
*
|
|
48
|
-
* `$ref` nodes (cross-protocol attachment points) are skipped during `$
|
|
47
|
+
* `$ref` nodes (cross-protocol attachment points) are skipped during `$keyAgreement` injection
|
|
49
48
|
* because their records belong to the referenced protocol, whose own encryption keys govern them.
|
|
50
49
|
* Children of `$ref` nodes are still processed because they belong to the composing protocol.
|
|
51
50
|
*
|
|
@@ -54,8 +53,7 @@ export declare class Protocols {
|
|
|
54
53
|
*/
|
|
55
54
|
static deriveAndInjectPublicEncryptionKeys(protocolDefinition: ProtocolDefinition, keyDeriver: EncryptionKeyDeriver): Promise<ProtocolDefinition>;
|
|
56
55
|
/**
|
|
57
|
-
* Overload 2 (raw-key
|
|
58
|
-
* Preserved for backward compatibility with tests and non-KMS callers.
|
|
56
|
+
* Overload 2 (raw-key): Takes rootKeyId and raw PrivateKeyJwk directly.
|
|
59
57
|
*/
|
|
60
58
|
static deriveAndInjectPublicEncryptionKeys(protocolDefinition: ProtocolDefinition, rootKeyId: string, privateJwk: PrivateKeyJwk): Promise<ProtocolDefinition>;
|
|
61
59
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"protocols.d.ts","sourceRoot":"","sources":["../../../../src/utils/protocols.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,wBAAwB,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAKvF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAU/E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAA;CAAE,GAAG,eAAe,GAAG,SAAS,CAcjI;AAED;;GAEG;AACH,qBAAa,SAAS;IACpB
|
|
1
|
+
{"version":3,"file":"protocols.d.ts","sourceRoot":"","sources":["../../../../src/utils/protocols.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,wBAAwB,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAKvF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAU/E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAA;CAAE,GAAG,eAAe,GAAG,SAAS,CAcjI;AAED;;GAEG;AACH,qBAAa,SAAS;IACpB;;;;;;;;;;OAUG;WACiB,mCAAmC,CACrD,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IAE9B;;OAEG;WACiB,mCAAmC,CACrD,kBAAkB,EAAE,kBAAkB,EACtC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,aAAa,GACxB,OAAO,CAAC,kBAAkB,CAAC;CAqF/B"}
|
|
@@ -5,6 +5,7 @@ import type { GenericMessage, GenericSignaturePayload, MessageSort } from '../ty
|
|
|
5
5
|
import type { RecordsCountMessage, RecordsDeleteMessage, RecordsFilter, RecordsQueryMessage, RecordsReadMessage, RecordsSubscribeMessage, RecordsWriteDescriptor, RecordsWriteMessage, RecordsWriteTags, RecordsWriteTagsFilter } from '../types/records-types.js';
|
|
6
6
|
import { DateSort } from '../types/records-types.js';
|
|
7
7
|
import { DwnErrorCode } from '../core/dwn-error.js';
|
|
8
|
+
import { ROLE_AUDIENCE_DERIVATION_SCHEME } from './encryption.js';
|
|
8
9
|
import { KeyDerivationScheme } from './hd-key.js';
|
|
9
10
|
/**
|
|
10
11
|
* Class containing useful utilities related to the Records interface.
|
|
@@ -26,7 +27,7 @@ export declare class Records {
|
|
|
26
27
|
* Decrypts the encrypted data in a message reply.
|
|
27
28
|
*
|
|
28
29
|
* Overload 1 (callback-based): Accepts a KeyDecrypter that performs
|
|
29
|
-
* HKDF
|
|
30
|
+
* X25519-HKDF key agreement + AES Key Unwrap internally.
|
|
30
31
|
*/
|
|
31
32
|
static decrypt(recordsWrite: RecordsWriteMessage, keyDecrypter: KeyDecrypter, cipherStream: ReadableStream<Uint8Array>): Promise<ReadableStream<Uint8Array>>;
|
|
32
33
|
/**
|
|
@@ -34,10 +35,12 @@ export declare class Records {
|
|
|
34
35
|
* @param ancestorPrivateKey Any ancestor private key in the key derivation path.
|
|
35
36
|
*/
|
|
36
37
|
static decrypt(recordsWrite: RecordsWriteMessage, ancestorPrivateKey: DerivedPrivateJwk, cipherStream: ReadableStream<Uint8Array>): Promise<ReadableStream<Uint8Array>>;
|
|
38
|
+
private static findMatchingKeyEncryption;
|
|
39
|
+
private static validateEncryptedDataIntegrity;
|
|
37
40
|
/**
|
|
38
41
|
* Constructs full key derivation path using the specified scheme.
|
|
39
42
|
*/
|
|
40
|
-
static constructKeyDerivationPath(keyDerivationScheme: KeyDerivationScheme, recordsWriteMessage: RecordsWriteMessage): string[];
|
|
43
|
+
static constructKeyDerivationPath(keyDerivationScheme: KeyDerivationScheme | typeof ROLE_AUDIENCE_DERIVATION_SCHEME, recordsWriteMessage: RecordsWriteMessage): string[];
|
|
41
44
|
/**
|
|
42
45
|
* Constructs the full key derivation path using `protocolPath` scheme.
|
|
43
46
|
*
|
|
@@ -47,17 +50,6 @@ export declare class Records {
|
|
|
47
50
|
* its children (composing protocol) use different protocol URIs and thus different key trees.
|
|
48
51
|
*/
|
|
49
52
|
static constructKeyDerivationPathUsingProtocolPathScheme(descriptor: RecordsWriteDescriptor): string[];
|
|
50
|
-
/**
|
|
51
|
-
* Constructs the full key derivation path using `protocolContext` scheme.
|
|
52
|
-
*
|
|
53
|
-
* NOTE on protocol composition: When a context tree spans two protocols via `$ref` composition,
|
|
54
|
-
* the root `contextId` segment (the `$ref` parent record's ID) is shared across both protocols.
|
|
55
|
-
* This means ProtocolContext-encrypted records from the composing protocol and the referenced
|
|
56
|
-
* protocol derive the same context key. This is by design — it enables multi-party access within
|
|
57
|
-
* a shared context (e.g., thread participants can decrypt messages from both the threads protocol
|
|
58
|
-
* and composing protocols that attach to those threads).
|
|
59
|
-
*/
|
|
60
|
-
static constructKeyDerivationPathUsingProtocolContextScheme(contextId: string): string[];
|
|
61
53
|
/**
|
|
62
54
|
* Derives a descendant private key given an ancestor private key and the full absolute derivation path.
|
|
63
55
|
* Uses X25519 keys for encryption key derivation.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../../../src/utils/records.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;
|
|
1
|
+
{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../../../src/utils/records.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAGjE,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAInQ,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AASrD,OAAO,EAAY,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAc,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAS,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGzD;;GAEG;AACH,qBAAa,OAAO;IAElB;;OAEG;WACW,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,IAAI,mBAAmB;IAQrF;;OAEG;WACiB,qBAAqB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAM/G;;OAEG;WACiB,sBAAsB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAQjH;;;;;OAKG;WACiB,OAAO,CACzB,YAAY,EAAE,mBAAmB,EACjC,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,cAAc,CAAC,UAAU,CAAC,GACvC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAEtC;;;OAGG;WACiB,OAAO,CACzB,YAAY,EAAE,mBAAmB,EACjC,kBAAkB,EAAE,iBAAiB,EACrC,YAAY,EAAE,cAAc,CAAC,UAAU,CAAC,GACvC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;mBAiDjB,yBAAyB;IAiC9C,OAAO,CAAC,MAAM,CAAC,8BAA8B;IAqB7C;;OAEG;WACW,0BAA0B,CACtC,mBAAmB,EAAE,mBAAmB,GAAG,OAAO,+BAA+B,EACjF,mBAAmB,EAAE,mBAAmB,GACvC,MAAM,EAAE;IAiBX;;;;;;;OAOG;WACW,iDAAiD,CAAC,UAAU,EAAE,sBAAsB,GAAG,MAAM,EAAE;IAW7G;;;OAGG;WACiB,gBAAgB,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAoBxI;;;OAGG;WACW,oDAAoD,CAChE,yBAAyB,EAAE,MAAM,EAAE,EACnC,2BAA2B,EAAE,MAAM,EAAE,GACpC,IAAI;IAYP;;OAEG;WACW,+BAA+B,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS;IAkBhG;;;;;OAKG;WACW,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa;IAyBnE;;;OAGG;WACW,oCAAoC,CAChD,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,YAAY,EACvB,aAAa,EAAE,MAAM,GACpB,IAAI;WAsBO,kBAAkB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,IAAI,gBAAgB;IAI5F;;OAEG;WACW,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS;IAShE;;OAEG;WACW,iBAAiB,CAAE,IAAI,EAAE;QAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAAA;KAAC,GAAG,MAAM;IAS7F;;;;;OAKG;WACW,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM;IA0D/E;;;;;;OAMG;WACiB,0CAA0C,CAC5D,OAAO,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,uBAAuB,EAC9I,sBAAsB,EAAE,uBAAuB,GAAG,SAAS,EAC3D,qBAAqB,CAAC,EAAE,uBAAuB,GAAG,SAAS,GAC1D,OAAO,CAAC,IAAI,CAAC;IAwFhB;;;;;;OAMG;WACW,eAAe,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,WAAW;IAmB/D;;OAEG;WACW,uBAAuB,CAAC,gBAAgB,EAAE,uBAAuB,GAAG,OAAO;IAIzF;;OAEG;WACW,8BAA8B,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO;IAK5E;;OAEG;WACW,gCAAgC,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO;IAQ9E;;;;;;;;;;OAUG;WACiB,iCAAiC,CACnD,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,cAAc,GACpC,OAAO,CAAC,OAAO,CAAC;IAenB;;;;;;OAMG;IACH,MAAM,CAAC,qCAAqC,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;IAQ/F;;;;;;OAMG;IACH,MAAM,CAAC,kCAAkC,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;CAO1F"}
|
|
@@ -7,11 +7,14 @@ export declare class Replication {
|
|
|
7
7
|
static readonly globalDomain = "";
|
|
8
8
|
static protocolDomain(protocolUri: string): string;
|
|
9
9
|
static permissionDomain(protocolUri: string): string;
|
|
10
|
+
static encryptionDomain(protocolUri: string): string;
|
|
11
|
+
static taggedCoreProtocolDomains(protocolUri: string, protocolsInScope?: ReadonlySet<string>): string[];
|
|
10
12
|
static deriveStreamId(tenant: string): Promise<string>;
|
|
11
13
|
static computeFingerprintScopes(message: GenericMessage, indexes: KeyValues): string[];
|
|
12
14
|
static assertFingerprintScopesUntouched(persistedScopes: string[], message: GenericMessage, messageCid: string, newIndexes: KeyValues): void;
|
|
13
15
|
private static scopeSetsMatch;
|
|
14
16
|
private static throwFingerprintScopeMutation;
|
|
17
|
+
private static isCoreProtocolUri;
|
|
15
18
|
static hashMessageCid(messageCid: string): Promise<Uint8Array>;
|
|
16
19
|
static emptyFingerprint(): Uint8Array;
|
|
17
20
|
static xorFingerprint(fingerprint: Uint8Array, contribution: Uint8Array): Uint8Array;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"replication.d.ts","sourceRoot":"","sources":["../../../../src/utils/replication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"replication.d.ts","sourceRoot":"","sources":["../../../../src/utils/replication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAYzD;;GAEG;AACH,qBAAa,WAAW;IACtB,gBAAuB,YAAY,MAAM;WAE3B,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAI3C,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAI7C,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAI7C,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,GAAE,WAAW,CAAC,MAAM,CAAa,GAAG,MAAM,EAAE;WAerG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;WAOrD,wBAAwB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,EAAE;WAsB/E,gCAAgC,CAC5C,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,SAAS,GACpB,IAAI;IAOP,OAAO,CAAC,MAAM,CAAC,cAAc;IAQ7B,OAAO,CAAC,MAAM,CAAC,6BAA6B;IAO5C,OAAO,CAAC,MAAM,CAAC,iBAAiB;WAIZ,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;WAM7D,gBAAgB,IAAI,UAAU;WAI9B,cAAc,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,GAAG,UAAU;WAQ7E,gBAAgB,CAAC,WAAW,EAAE,UAAU,GAAG,MAAM;WAIjD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU;WAQzC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;CAW1D"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"protocol-composition.spec.d.ts","sourceRoot":"","sources":["../../../../tests/features/protocol-composition.spec.ts"],"names":[],"mappings":"AAyBA;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,
|
|
1
|
+
{"version":3,"file":"protocol-composition.spec.d.ts","sourceRoot":"","sources":["../../../../tests/features/protocol-composition.spec.ts"],"names":[],"mappings":"AAyBA;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CA4hF9C"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"messages-query.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/messages-query.spec.ts"],"names":[],"mappings":"AAyBA,wBAAgB,wBAAwB,IAAI,IAAI,
|
|
1
|
+
{"version":3,"file":"messages-query.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/messages-query.spec.ts"],"names":[],"mappings":"AAyBA,wBAAgB,wBAAwB,IAAI,IAAI,CAuV/C"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"records-read.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/records-read.spec.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"records-read.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/records-read.spec.ts"],"names":[],"mappings":"AAiCA,wBAAgB,sBAAsB,IAAI,IAAI,CA09D7C"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"records-write.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/records-write.spec.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"records-write.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/records-write.spec.ts"],"names":[],"mappings":"AAmDA,wBAAgB,uBAAuB,IAAI,IAAI,CA26J9C"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"encryption.spec.d.ts","sourceRoot":"","sources":["../../../../tests/protocols/encryption.spec.ts"],"names":[],"mappings":""}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"end-to-end-tests.spec.d.ts","sourceRoot":"","sources":["../../../../tests/scenarios/end-to-end-tests.spec.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"end-to-end-tests.spec.d.ts","sourceRoot":"","sources":["../../../../tests/scenarios/end-to-end-tests.spec.ts"],"names":[],"mappings":"AA8BA,wBAAgB,qBAAqB,IAAI,IAAI,CAsO5C"}
|
|
@@ -285,8 +285,6 @@ export declare class TestDataGenerator {
|
|
|
285
285
|
* @param input.encryptSymmetricKeyWithProtocolPathDerivedKey
|
|
286
286
|
* Set to `true` to attach the symmetric key encrypted by the protocol path derived public key
|
|
287
287
|
*
|
|
288
|
-
* @param input.encryptSymmetricKeyWithProtocolContextDerivedKey
|
|
289
|
-
* Set to `true` to attach the symmetric key encrypted by the protocol context derived public key
|
|
290
288
|
*/
|
|
291
289
|
static generateProtocolEncryptedRecordsWrite(input: {
|
|
292
290
|
plaintextBytes: Uint8Array;
|
|
@@ -295,10 +293,7 @@ export declare class TestDataGenerator {
|
|
|
295
293
|
protocolDefinition: ProtocolDefinition;
|
|
296
294
|
protocolPath: string;
|
|
297
295
|
protocolParentContextId?: string;
|
|
298
|
-
protocolContextDerivingRootKeyId?: string;
|
|
299
|
-
protocolContextDerivedPublicKeyJwk?: PublicKeyJwk;
|
|
300
296
|
encryptSymmetricKeyWithProtocolPathDerivedKey: boolean;
|
|
301
|
-
encryptSymmetricKeyWithProtocolContextDerivedKey: boolean;
|
|
302
297
|
}): Promise<{
|
|
303
298
|
message: RecordsWriteMessage;
|
|
304
299
|
dataStream: ReadableStream<Uint8Array>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"test-data-generator.d.ts","sourceRoot":"","sources":["../../../../tests/utils/test-data-generator.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"test-data-generator.d.ts","sourceRoot":"","sources":["../../../../tests/utils/test-data-generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAK/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAOtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,KAAK,EAAqB,eAAe,EAAuD,MAAM,uCAAuC,CAAC;AACrJ,OAAO,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAClM,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7I,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAmB,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChJ,OAAO,KAAK,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAUrG,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAG/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAGvE,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AASrE;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,aAAa,CAAA;KAAE,CAAC;IAChE,0FAA0F;IAC1F,iBAAiB,EAAE;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,aAAa,CAAA;KAAE,CAAC;IAC1E,MAAM,EAAE,aAAa,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;OAEG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,8BAA8B,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,yBAAyB,CAAC;IACnC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAA;CACF,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACvC,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,EAAE,8BAA8B,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IAEtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,IAAI,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;IAC5B,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACvC,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,UAAU,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACxC,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IACxC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,MAAM,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,oBAAoB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,oDAAoD;IACpD,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,OAAO,EAAE,wBAAwB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,oBAAoB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,EAAE,kBAS3C,CAAC;AAEF;;GAEG;AACH,qBAAa,iBAAiB;IAC5B;;OAEG;WACiB,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAyC/E;;;;OAIG;WACiB,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzF;;;;OAIG;WACiB,0BAA0B,CAC5C,KAAK,CAAC,EAAE,+BAA+B,GACtC,OAAO,CAAC,gCAAgC,CAAC;IAwC5C;;OAEG;WACiB,sBAAsB,CAAC,KAAK,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,4BAA4B,CAAC;WAuBlG,mBAAmB,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAmC7G;;;;;;;;;OASG;WACiB,oBAAoB,CAAC,KAAK,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAqDhH;;;;;;;;;;OAUG;WACiB,qCAAqC,CAAC,KAAK,EAAE;QAC/D,cAAc,EAAE,UAAU,CAAC;QAC3B,MAAM,EAAE,OAAO,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,kBAAkB,EAAE,kBAAkB,CAAC;QACvC,YAAY,EAAE,MAAM,CAAC;QACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,6CAA6C,EAAE,OAAO,CAAC;KACxD,GAAG,OAAO,CAAC;QACV,OAAO,EAAE,mBAAmB,CAAC;QAC7B,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;QACvC,YAAY,EAAE,YAAY,CAAC;QAC3B,eAAe,EAAE,eAAe,CAAC;QACjC,kBAAkB,EAAE,UAAU,CAAC;KAChC,CAAC;IA+DF;;;;OAIG;WACiB,wBAAwB,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA8BxH;;OAEG;WACiB,oBAAoB,CAAC,KAAK,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAsChH;;OAEG;WACiB,wBAAwB,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,OAAO,CAAC,8BAA8B,CAAC;IAuC5H;;OAEG;WACiB,oBAAoB,CAAC,KAAK,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAoChH;;OAEG;WACiB,qBAAqB,CAAC,KAAK,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAgBnH;;OAEG;WACiB,yBAAyB,CAAC,KAAK,CAAC,EAAE,8BAA8B,GAAG,OAAO,CAAC,+BAA+B,CAAC;IAuB/H;;OAEG;WACiB,qBAAqB,CAAC,KAAK,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC;WAyB/F,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAmB/G;;OAEG;WACW,qBAAqB,IAAI,kBAAkB;IAMzD;;OAEG;WACW,8BAA8B,IAAI,UAAU;IAU1D;;OAEG;WACiB,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;IAQ5D;;OAEG;WACW,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAYlD;;OAEG;WACW,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASrD;;OAEG;WACiB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAO1D;;;;OAIG;WACW,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM;IAIzD;;;;OAIG;WACW,eAAe,CAAC,OAAO,CAAC,EAAE;QACtC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KACzI,GAAG,MAAM;IAcV;;OAEG;WACW,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB;IAiB9E;;OAEG;WACiB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC;CAgC9D"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"grant-key.spec.d.ts","sourceRoot":"","sources":["../../../../../../tests/validation/json-schemas/encryption/grant-key.spec.ts"],"names":[],"mappings":""}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@enbox/dwn-sdk-js",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.5",
|
|
4
4
|
"description": "A reference implementation of https://identity.foundation/decentralized-web-node/spec/",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -65,8 +65,8 @@
|
|
|
65
65
|
"react-native": "./dist/esm/src/index.js",
|
|
66
66
|
"dependencies": {
|
|
67
67
|
"@enbox/common": "0.1.1",
|
|
68
|
-
"@enbox/crypto": "0.1.
|
|
69
|
-
"@enbox/dids": "0.1.
|
|
68
|
+
"@enbox/crypto": "0.1.2",
|
|
69
|
+
"@enbox/dids": "0.1.2",
|
|
70
70
|
"@ipld/dag-cbor": "9.0.5",
|
|
71
71
|
"@js-temporal/polyfill": "0.4.4",
|
|
72
72
|
"@noble/ciphers": "0.5.3",
|
package/src/core/constants.ts
CHANGED
|
@@ -16,12 +16,12 @@ export const PERMISSIONS_REVOCATION_PATH = 'grant/revocation';
|
|
|
16
16
|
export const PERMISSIONS_PROTOCOL_URI = 'https://identity.foundation/dwn/permissions';
|
|
17
17
|
|
|
18
18
|
/**
|
|
19
|
-
*
|
|
19
|
+
* The DWN Encryption protocol URI.
|
|
20
20
|
*/
|
|
21
|
-
export const
|
|
21
|
+
export const ENCRYPTION_PROTOCOL_URI = 'https://identity.foundation/dwn/protocols/encryption';
|
|
22
22
|
|
|
23
23
|
const RECORDS_PRIMARY_PROJECTION_EXCLUDED_PROTOCOLS = new Set<string>([
|
|
24
|
-
|
|
24
|
+
ENCRYPTION_PROTOCOL_URI,
|
|
25
25
|
PERMISSIONS_PROTOCOL_URI,
|
|
26
26
|
]);
|
|
27
27
|
|
|
@@ -35,7 +35,7 @@ export interface CoreProtocol {
|
|
|
35
35
|
* Called after protocol authorization but before storage.
|
|
36
36
|
* @throws DwnError to reject the write with the appropriate status code.
|
|
37
37
|
*/
|
|
38
|
-
validateRecord?(message: RecordsWriteMessage, dataBytes: Uint8Array): void;
|
|
38
|
+
validateRecord?(message: RecordsWriteMessage, dataBytes: Uint8Array): Promise<void> | void;
|
|
39
39
|
|
|
40
40
|
/**
|
|
41
41
|
* Pre-processing hook: runs before storing a record under this protocol.
|