@enbox/dwn-sdk-js 0.4.3 → 0.4.5

package/src/core/dwn-error.ts

@@ -20,6 +20,22 @@ export enum DwnErrorCode {
   ComputeCidCodecNotSupported = 'ComputeCidCodecNotSupported',
   ComputeCidMultihashNotSupported = 'ComputeCidMultihashNotSupported',
   Ed25519InvalidJwk = 'Ed25519InvalidJwk',
+  EncryptionProtocolValidateAudienceEpochEncrypted = 'EncryptionProtocolValidateAudienceEpochEncrypted',
+  EncryptionProtocolValidateAudienceEpochKeyIdMismatch = 'EncryptionProtocolValidateAudienceEpochKeyIdMismatch',
+  EncryptionProtocolValidateAudienceEpochMissing = 'EncryptionProtocolValidateAudienceEpochMissing',
+  EncryptionProtocolValidateAudienceKeyRecipientMissing = 'EncryptionProtocolValidateAudienceKeyRecipientMissing',
+  EncryptionProtocolValidateAudienceKeyRoleRecordMissing = 'EncryptionProtocolValidateAudienceKeyRoleRecordMissing',
+  EncryptionProtocolValidateAudienceMissingRequiredTag = 'EncryptionProtocolValidateAudienceMissingRequiredTag',
+  EncryptionProtocolValidateAudienceTagsMismatch = 'EncryptionProtocolValidateAudienceTagsMismatch',
+  EncryptionProtocolValidateAudienceWriterUnauthorized = 'EncryptionProtocolValidateAudienceWriterUnauthorized',
+  EncryptionProtocolValidateEncryptedDeliveryMissingEncryption = 'EncryptionProtocolValidateEncryptedDeliveryMissingEncryption',
+  EncryptionProtocolValidateGrantKeyAuthorMismatch = 'EncryptionProtocolValidateGrantKeyAuthorMismatch',
+  EncryptionProtocolValidateGrantKeyGrantScopeMismatch = 'EncryptionProtocolValidateGrantKeyGrantScopeMismatch',
+  EncryptionProtocolValidateGrantKeyMissingRequiredTag = 'EncryptionProtocolValidateGrantKeyMissingRequiredTag',
+  EncryptionProtocolValidateGrantKeyRecipientMismatch = 'EncryptionProtocolValidateGrantKeyRecipientMismatch',
+  EncryptionProtocolValidateRoleAudienceContextInvalid = 'EncryptionProtocolValidateRoleAudienceContextInvalid',
+  EncryptionProtocolValidateRoleAudienceInvalid = 'EncryptionProtocolValidateRoleAudienceInvalid',
+  EncryptionProtocolValidateSchemaUnexpectedRecord = 'EncryptionProtocolValidateSchemaUnexpectedRecord',
   EventLogNotOpenError = 'EventLogNotOpenError',
   EventLogProgressGap = 'EventLogProgressGap',
   MessagesGrantAuthorizationMismatchedProtocol = 'MessagesGrantAuthorizationMismatchedProtocol',
@@ -101,6 +117,10 @@ export enum DwnErrorCode {
   ProtocolAuthorizationInitialWriteRevalidationNotInitial = 'ProtocolAuthorizationInitialWriteRevalidationNotInitial',
   ProtocolAuthorizationDuplicateRoleRecipient = 'ProtocolAuthorizationDuplicateRoleRecipient',
   ProtocolAuthorizationEncryptionRequired = 'ProtocolAuthorizationEncryptionRequired',
+  ProtocolAuthorizationEncryptionKeyAgreementMissing = 'ProtocolAuthorizationEncryptionKeyAgreementMissing',
+  ProtocolAuthorizationEncryptionProtocolPathEntryMissing = 'ProtocolAuthorizationEncryptionProtocolPathEntryMissing',
+  ProtocolAuthorizationEncryptionRoleAudienceEntryMissing = 'ProtocolAuthorizationEncryptionRoleAudienceEntryMissing',
+  ProtocolAuthorizationEncryptionRoleAudienceEpochMissing = 'ProtocolAuthorizationEncryptionRoleAudienceEpochMissing',
   ProtocolAuthorizationImmutableRecord = 'ProtocolAuthorizationImmutableRecord',
   ProtocolAuthorizationInvalidSchema = 'ProtocolAuthorizationInvalidSchema',
   ProtocolAuthorizationInvalidType = 'ProtocolAuthorizationInvalidType',
@@ -142,6 +162,10 @@ export enum DwnErrorCode {
   ProtocolsConfigureInvalidActionUpdateWithoutCreate = 'ProtocolsConfigureInvalidActionUpdateWithoutCreate',
   ProtocolsConfigureInvalidCrossProtocolOf = 'ProtocolsConfigureInvalidCrossProtocolOf',
   ProtocolsConfigureInvalidCrossProtocolRole = 'ProtocolsConfigureInvalidCrossProtocolRole',
+  ProtocolsConfigureInvalidEncryptedAnyoneRead = 'ProtocolsConfigureInvalidEncryptedAnyoneRead',
+  ProtocolsConfigureInvalidEncryptedRoleMissingKeyAgreement = 'ProtocolsConfigureInvalidEncryptedRoleMissingKeyAgreement',
+  ProtocolsConfigureMissingEncryptedPathKeyAgreement = 'ProtocolsConfigureMissingEncryptedPathKeyAgreement',
+  ProtocolsConfigureMissingTopLevelKeyAgreement = 'ProtocolsConfigureMissingTopLevelKeyAgreement',
   ProtocolsConfigureInvalidRecipientOfAction = 'ProtocolsConfigureInvalidRecipientOfAction',
   ProtocolsConfigureInvalidRuleSetRecordType = 'ProtocolsConfigureInvalidRuleSetRecordType',
   ProtocolsConfigureInvalidTagSchema = 'ProtocolsConfigureInvalidTagSchema',
@@ -158,6 +182,7 @@ export enum DwnErrorCode {
   RecordsAuthorDelegatedGrantGrantedToAndOwnerSignatureMismatch = 'RecordsAuthorDelegatedGrantGrantedToAndOwnerSignatureMismatch',
   RecordsAuthorDelegatedGrantNotADelegatedGrant = 'RecordsAuthorDelegatedGrantNotADelegatedGrant',
   RecordsDecryptNoMatchingKeyEncryptedFound = 'RecordsDecryptNoMatchingKeyEncryptedFound',
+  RecordsDecryptUnsupportedKeyDerivationScheme = 'RecordsDecryptUnsupportedKeyDerivationScheme',
   RecordsCountFilterMissingRequiredProperties = 'RecordsCountFilterMissingRequiredProperties',
   RecordsCountNestedProtocolPathContextIdInvalid = 'RecordsCountNestedProtocolPathContextIdInvalid',
 
@@ -194,6 +219,7 @@ export enum DwnErrorCode {
   RecordsWriteCreateMissingSigner = 'RecordsWriteCreateMissingSigner',
   RecordsWriteCreateDataAndDataCidMutuallyExclusive = 'RecordsWriteCreateDataAndDataCidMutuallyExclusive',
   RecordsWriteCreateDataCidAndDataSizeMutuallyInclusive = 'RecordsWriteCreateDataCidAndDataSizeMutuallyInclusive',
+  RecordsWriteCreateEncryptionAndEncryptionInputMutuallyExclusive = 'RecordsWriteCreateEncryptionAndEncryptionInputMutuallyExclusive',
   RecordsWriteCreateMissingProtocol = 'RecordsWriteCreateMissingProtocol',
   RecordsWriteDataCidMismatch = 'RecordsWriteDataCidMismatch',
   RecordsWriteDataSizeMismatch = 'RecordsWriteDataSizeMismatch',
@@ -204,7 +230,6 @@ export enum DwnErrorCode {
   RecordsWriteMissingSigner = 'RecordsWriteMissingSigner',
   RecordsWriteMissingDataInPrevious = 'RecordsWriteMissingDataInPrevious',
   RecordsWriteMissingEncodedDataInPrevious = 'RecordsWriteMissingEncodedDataInPrevious',
-  RecordsWriteMissingEncryption = 'RecordsWriteMissingEncryption',
 
   RecordsWriteNotAllowedAfterDelete = 'RecordsWriteNotAllowedAfterDelete',
   RecordsWriteOwnerAndTenantMismatch = 'RecordsWriteOwnerAndTenantMismatch',
@@ -214,7 +239,10 @@ export enum DwnErrorCode {
   RecordsWriteValidateIntegrityContextIdMismatch = 'RecordsWriteValidateIntegrityContextIdMismatch',
   RecordsWriteValidateIntegrityContextIdNotInSignerSignaturePayload = 'RecordsWriteValidateIntegrityContextIdNotInSignerSignaturePayload',
   RecordsWriteValidateIntegrityDateCreatedMismatch = 'RecordsWriteValidateIntegrityDateCreatedMismatch',
+  RecordsWriteValidateIntegrityEncryptionCidMissing = 'RecordsWriteValidateIntegrityEncryptionCidMissing',
   RecordsWriteValidateIntegrityEncryptionCidMismatch = 'RecordsWriteValidateIntegrityEncryptionCidMismatch',
+  RecordsWriteValidateIntegrityEncryptionEphemeralPublicKeyInvalid = 'RecordsWriteValidateIntegrityEncryptionEphemeralPublicKeyInvalid',
+  RecordsWriteValidateIntegrityEncryptionInitializationVectorInvalid = 'RecordsWriteValidateIntegrityEncryptionInitializationVectorInvalid',
   RecordsWriteValidateIntegrityRecordIdUnauthorized = 'RecordsWriteValidateIntegrityRecordIdUnauthorized',
   SchemaValidatorAdditionalPropertyNotAllowed = 'SchemaValidatorAdditionalPropertyNotAllowed',
   SchemaValidatorFailure = 'SchemaValidatorFailure',

package/src/core/messages-grant-authorization.ts

@@ -8,6 +8,7 @@ import type { DataEncodedRecordsWriteMessage, RecordsDeleteMessage, RecordsWrite
 import type { MessagesQueryMessage, MessagesReadMessage, MessagesSubscribeMessage } from '../types/messages-types.js';
 
 import { DwnInterfaceName } from '../enums/dwn-interface-method.js';
+import { EncryptionProtocol } from '../protocols/encryption.js';
 import { GrantAuthorization } from './grant-authorization.js';
 import { PermissionScopeMatcher } from '../utils/permission-scope.js';
 import { PermissionsProtocol } from '../protocols/permissions.js';
@@ -240,6 +241,10 @@ export class MessagesGrantAuthorization {
       );
     }
 
+    if (recordsWriteMessage.descriptor.protocol === EncryptionProtocol.uri) {
+      return MessagesGrantAuthorization.isEncryptionRecordScopeAuthorized(recordsWriteMessage, incomingScope);
+    }
+
     return PermissionScopeMatcher.matches(incomingScope, MessagesGrantAuthorization.getRecordsScopeTarget(recordsWriteMessage));
   }
 
@@ -263,6 +268,23 @@ export class MessagesGrantAuthorization {
       && PermissionScopeMatcher.matches(incomingScope, permissionScope);
   }
 
+  private static isEncryptionRecordScopeAuthorized(
+    recordsWriteMessage: RecordsWriteMessage,
+    incomingScope: MessagesPermissionScope,
+  ): boolean {
+    const tags = recordsWriteMessage.descriptor.tags;
+    const protocol = tags?.protocol;
+    if (typeof protocol !== 'string') {
+      return false;
+    }
+
+    return PermissionScopeMatcher.matches(incomingScope, {
+      protocol,
+      protocolPath : MessagesGrantAuthorization.getStringTag(recordsWriteMessage, 'protocolPath'),
+      contextId    : MessagesGrantAuthorization.getStringTag(recordsWriteMessage, 'contextId'),
+    });
+  }
+
   private static isProtocolsConfigureScopeAuthorized(
     protocolsConfigureMessage: ProtocolsConfigureMessage,
     incomingScope: MessagesPermissionScope
@@ -291,6 +313,11 @@ export class MessagesGrantAuthorization {
     return { protocol, protocolPath, contextId };
   }
 
+  private static getStringTag(recordsWriteMessage: RecordsWriteMessage, tag: string): string | undefined {
+    const value = recordsWriteMessage.descriptor.tags?.[tag];
+    return typeof value === 'string' ? value : undefined;
+  }
+
   private static isSubtreeScope(scope: MessagesPermissionScope): boolean {
     return scope.protocolPath !== undefined || scope.contextId !== undefined;
   }

package/src/core/protocol-authorization-validation.ts

@@ -1,14 +1,16 @@
 import type { RecordsWrite } from '../interfaces/records-write.js';
 import type { RecordsWriteMessage } from '../types/records-types.js';
+import type { RoleAudienceKeyEncryption } from '../utils/encryption.js';
 import type { ValidationStateReader } from '../types/validation-state-reader.js';
-import type { ProtocolDefinition, ProtocolRuleSet, ProtocolType, ProtocolTypes } from '../types/protocols-types.js';
-
-import { ProtocolRecordLimitStrategy } from '../types/protocols-types.js';
+import type { ProtocolActionRule, ProtocolDefinition, ProtocolRuleSet, ProtocolType, ProtocolTypes } from '../types/protocols-types.js';
 
+import { KeyDerivationScheme } from '../utils/hd-key.js';
 import { Records } from '../utils/records.js';
 import { validateProtocolTags } from '../utils/protocol-tags.js';
 import { DwnError, DwnErrorCode } from './dwn-error.js';
-import { getTypeName, parseCrossProtocolRef } from '../utils/protocols.js';
+import { Encryption, ROLE_AUDIENCE_DERIVATION_SCHEME } from '../utils/encryption.js';
+import { getRuleSetAtPath, getTypeName, parseCrossProtocolRef } from '../utils/protocols.js';
+import { ProtocolAction, ProtocolRecordLimitStrategy } from '../types/protocols-types.js';
 
 /**
  * Verifies the `protocolPath` declared in the given message matches the path of actual record chain.
@@ -170,7 +172,14 @@ export async function verifyTypeWithComposition(
     tenant, declaredProtocolPath, protocolDefinition, validationStateReader, protocolDefinitionTimestamp
   );
 
-  verifyType(inboundMessage, protocolTypes, declaredTypeName);
+  const protocolType = verifyType(inboundMessage, protocolTypes, declaredTypeName);
+  await verifyProtocolPathEncryptionIfNeeded(
+    tenant,
+    inboundMessage,
+    protocolDefinition,
+    protocolType,
+    validationStateReader,
+  );
 }
 
 /**
@@ -216,7 +225,7 @@ export function verifyType(
   inboundMessage: RecordsWriteMessage,
   protocolTypes: ProtocolTypes,
   typeName?: string,
-): void {
+): ProtocolType {
   const declaredTypeName = typeName ?? getTypeName(inboundMessage.descriptor.protocolPath);
   const typeNames = Object.keys(protocolTypes);
 
@@ -254,6 +263,136 @@ export function verifyType(
       `type '${declaredTypeName}' requires encryption but message has no encryption metadata`
     );
   }
+
+  return protocolType;
+}
+
+async function verifyProtocolPathEncryptionIfNeeded(
+  tenant: string,
+  inboundMessage: RecordsWriteMessage,
+  protocolDefinition: ProtocolDefinition,
+  protocolType: ProtocolType,
+  validationStateReader: ValidationStateReader,
+): Promise<void> {
+  if (protocolType.encryptionRequired !== true) {
+    return;
+  }
+
+  const ruleSet = getRuleSetAtPath(inboundMessage.descriptor.protocolPath, protocolDefinition.structure);
+  if (ruleSet?.$keyAgreement?.publicKeyJwk === undefined) {
+    throw new DwnError(
+      DwnErrorCode.ProtocolAuthorizationEncryptionKeyAgreementMissing,
+      `encrypted protocol path '${inboundMessage.descriptor.protocolPath}' has no $keyAgreement`
+    );
+  }
+
+  const publicKeyJwk = ruleSet.$keyAgreement.publicKeyJwk;
+  const keyId = await Encryption.getKeyId(publicKeyJwk);
+  const hasProtocolPathEntry = inboundMessage.encryption!.keyEncryption.some((entry): boolean =>
+    entry.derivationScheme === KeyDerivationScheme.ProtocolPath && entry.keyId === keyId
+  );
+
+  if (!hasProtocolPathEntry) {
+    throw new DwnError(
+      DwnErrorCode.ProtocolAuthorizationEncryptionProtocolPathEntryMissing,
+      `encrypted record is missing a protocolPath keyEncryption entry for '${inboundMessage.descriptor.protocolPath}'`
+    );
+  }
+
+  await verifyRoleAudienceEncryptionIfNeeded(tenant, inboundMessage, protocolDefinition, ruleSet, validationStateReader);
+}
+
+async function verifyRoleAudienceEncryptionIfNeeded(
+  tenant: string,
+  inboundMessage: RecordsWriteMessage,
+  protocolDefinition: ProtocolDefinition,
+  ruleSet: ProtocolRuleSet,
+  validationStateReader: ValidationStateReader,
+): Promise<void> {
+  const readRoleRules = (ruleSet.$actions ?? []).filter((actionRule): boolean =>
+    actionRule.role !== undefined && actionRule.can.includes(ProtocolAction.Read)
+  );
+
+  for (const actionRule of readRoleRules) {
+    const roleAudience = resolveRoleAudience(actionRule, inboundMessage, protocolDefinition);
+    if (roleAudience === undefined) {
+      continue;
+    }
+
+    const matchingEntry = inboundMessage.encryption!.keyEncryption.find((entry): entry is RoleAudienceKeyEncryption =>
+      entry.derivationScheme === ROLE_AUDIENCE_DERIVATION_SCHEME &&
+      entry.protocol === roleAudience.protocol &&
+      entry.role === roleAudience.role
+    );
+
+    if (matchingEntry === undefined) {
+      throw new DwnError(
+        DwnErrorCode.ProtocolAuthorizationEncryptionRoleAudienceEntryMissing,
+        `encrypted record is missing a roleAudience keyEncryption entry for role '${roleAudience.role}'`
+      );
+    }
+
+    const matchingEpochs = await validationStateReader.queryAudienceEpochs({
+      tenant,
+      protocol  : roleAudience.protocol,
+      contextId : roleAudience.contextId,
+      role      : roleAudience.role,
+      epoch     : matchingEntry.epoch,
+      keyId     : matchingEntry.keyId,
+    });
+
+    if (matchingEpochs.length === 0) {
+      throw new DwnError(
+        DwnErrorCode.ProtocolAuthorizationEncryptionRoleAudienceEpochMissing,
+        `encrypted record references a missing audienceEpoch for role '${roleAudience.role}'`
+      );
+    }
+  }
+}
+
+function resolveRoleAudience(
+  actionRule: ProtocolActionRule,
+  inboundMessage: RecordsWriteMessage,
+  protocolDefinition: ProtocolDefinition,
+): { protocol: string; role: string; contextId: string } | undefined {
+  const roleRef = actionRule.role;
+  if (roleRef === undefined) {
+    return undefined;
+  }
+
+  const parsed = parseCrossProtocolRef(roleRef);
+  const protocol = parsed === undefined
+    ? inboundMessage.descriptor.protocol
+    : protocolDefinition.uses?.[parsed.alias];
+  const role = parsed === undefined ? roleRef : parsed.protocolPath;
+  if (protocol === undefined) {
+    return undefined;
+  }
+
+  const contextId = getRoleAudienceContextId(inboundMessage, role);
+  return contextId === undefined ? undefined : { protocol, role, contextId };
+}
+
+function getRoleAudienceContextId(
+  inboundMessage: RecordsWriteMessage,
+  rolePath: string,
+): string | undefined {
+  const parentDepth = rolePath.split('/').length - 1;
+  if (parentDepth === 0) {
+    return '';
+  }
+
+  const contextId = inboundMessage.contextId;
+  if (typeof contextId !== 'string') {
+    return undefined;
+  }
+
+  const contextSegments = contextId.split('/');
+  if (contextSegments.length < parentDepth) {
+    return undefined;
+  }
+
+  return contextSegments.slice(0, parentDepth).join('/');
 }
 
 /**

package/src/core/recording-validation-state-reader.ts

@@ -87,6 +87,19 @@ export class RecordingValidationStateReader implements ValidationStateReader {
     return this.inner.queryLatestRoleRecords(input);
   }
 
+  /** @inheritdoc */
+  public async queryAudienceEpochs(input: {
+    tenant: string;
+    protocol: string;
+    contextId: string;
+    role: string;
+    epoch: number;
+    keyId?: string;
+  }): Promise<RecordsWriteMessage[]> {
+    this.recordedReads.push({ method: 'queryAudienceEpochs' });
+    return this.inner.queryAudienceEpochs(input);
+  }
+
   /** @inheritdoc */
   public async fetchGrant(tenant: string, permissionGrantId: string): Promise<PermissionGrant> {
     this.recordedReads.push({ method: 'fetchGrant' });

package/src/core/replication-apply.ts

@@ -5,7 +5,9 @@ import type { ValidationStateReader } from '../types/validation-state-reader.js'
 
 import { DwnErrorCode } from './dwn-error.js';
 import { Encoder } from '../utils/encoder.js';
+import { EncryptionProtocol } from '../protocols/encryption.js';
 import { Message } from './message.js';
+import { ROLE_AUDIENCE_DERIVATION_SCHEME } from '../utils/encryption.js';
 import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
 import { isCrossProtocolRef, parseCrossProtocolRef } from '../utils/protocols.js';
 
@@ -40,6 +42,14 @@ export type ReplicationApplyResultContext = {
   missingAncestorRecordIds?: string[];
 };
 
+type AudienceDependencyTags = {
+  protocol: string;
+  contextId: string;
+  role: string;
+  epoch: number;
+  keyId: string;
+};
+
 export type DependencyRef =
   | { type: 'Protocol'; protocol: string; messageCid?: string; terminal?: boolean }
   | { type: 'InitialWrite'; recordId: string; protocol?: string; messageCid?: string; terminal?: boolean }
@@ -47,7 +57,14 @@ export type DependencyRef =
   | { type: 'Ancestor'; recordId: string; protocol?: string; messageCid?: string; terminal?: boolean }
   | { type: 'Role'; protocol: string; protocolPath: string; recipient: string; contextPrefix?: string; messageCid?: string; terminal?: boolean }
   | { type: 'Grant'; permissionGrantId: string; messageCid?: string; terminal?: boolean }
-  | { type: 'KeyDelivery'; protocol: string; contextId: string; messageCid?: string; terminal?: boolean }
+  | {
+      type: 'EncryptionProtocol';
+      protocolPath: 'audienceEpoch' | 'audienceKey' | 'grantKey';
+      tags?: Record<string, string | number>;
+      recipient?: string;
+      messageCid?: string;
+      terminal?: boolean;
+    }
   | { type: 'CrossProtocolRef'; protocol: string; recordId: string; messageCid?: string; terminal?: boolean }
   | { type: 'RecordData'; recordId: string; dataCid: string; protocol?: string; messageCid?: string; terminal?: boolean };
 
@@ -180,7 +197,14 @@ function dependencyRefsFromStatus(
   case DwnErrorCode.GrantAuthorizationGrantMissing:
     return toRefList(grantDependencyFromMessage(message));
   case DwnErrorCode.ProtocolAuthorizationMatchingRoleRecordNotFound:
+  case DwnErrorCode.EncryptionProtocolValidateAudienceWriterUnauthorized:
     return toRefList(roleDependencyFromMessage(message, context));
+  case DwnErrorCode.EncryptionProtocolValidateAudienceEpochMissing:
+    return toRefList(encryptionProtocolDependencyFromMessage(message, EncryptionProtocol.audienceEpochPath));
+  case DwnErrorCode.ProtocolAuthorizationEncryptionRoleAudienceEpochMissing:
+    return toRefList(encryptionProtocolDependencyFromRoleAudienceEntry(message, detail));
+  case DwnErrorCode.EncryptionProtocolValidateAudienceKeyRoleRecordMissing:
+    return toRefList(roleDependencyFromEncryptionAudienceRecipient(message));
   case DwnErrorCode.RecordsWriteMissingDataInPrevious:
   case DwnErrorCode.RecordsWriteMissingEncodedDataInPrevious:
     return toRefList(recordDataDependencyFromMessage(message));
@@ -214,7 +238,7 @@ function protocolDependencyFromMessage(message: GenericMessage, detail: string):
     return { type: 'Protocol', protocol: composedProtocol };
   }
 
-  const protocol = (message.descriptor as Record<string, unknown>).protocol;
+  const protocol = dependencyProtocolFromMessage(message);
   return typeof protocol === 'string' ? { type: 'Protocol', protocol } : undefined;
 }
 
@@ -235,7 +259,7 @@ function parentDependenciesFromMessage(
     return [];
   }
 
-  const protocol = (message.descriptor as Record<string, unknown>).protocol;
+  const protocol = dependencyProtocolFromMessage(message);
   const protocolProperty = typeof protocol === 'string' ? { protocol } : {};
   const ancestorRefs = (context.missingAncestorRecordIds ?? [])
     .filter((recordId): boolean => recordId !== parentRef.recordId)
@@ -248,9 +272,8 @@ function parentDependencyFromMessage(
   message: GenericMessage,
   detail: string,
 ): Extract<DependencyRef, { type: 'Parent' }> | undefined {
-  const descriptor = message.descriptor as Record<string, unknown>;
   const parentId = parentRecordIdFromMessage(message, detail);
-  const protocol = /in protocol '([^']+)'/.exec(detail)?.[1] ?? descriptor.protocol;
+  const protocol = /in protocol '([^']+)'/.exec(detail)?.[1] ?? dependencyProtocolFromMessage(message);
 
   if (parentId === undefined || typeof protocol !== 'string') {
     return undefined;
@@ -278,7 +301,7 @@ function ancestorDependenciesFromMessage(
   detail: string,
   context: ReplicationApplyResultContext,
 ): DependencyRef[] {
-  const protocol = (message.descriptor as Record<string, unknown>).protocol;
+  const protocol = dependencyProtocolFromMessage(message);
   const protocolProperty = typeof protocol === 'string' ? { protocol } : {};
 
   const batchedRecordIds = context.missingAncestorRecordIds;
@@ -303,7 +326,7 @@ function initialWriteDependencyFromMessage(message: GenericMessage): DependencyR
     return undefined;
   }
 
-  const protocol = (message.descriptor as Record<string, unknown>).protocol;
+  const protocol = dependencyProtocolFromMessage(message);
   return {
     type     : 'InitialWrite',
     recordId : message.recordId,
@@ -312,6 +335,14 @@ function initialWriteDependencyFromMessage(message: GenericMessage): DependencyR
 }
 
 function grantDependencyFromMessage(message: GenericMessage): DependencyRef | undefined {
+  if (isEncryptionProtocolMessage(message)) {
+    const tags = (message.descriptor as Record<string, unknown>).tags;
+    const grantId = isRecordObject(tags) ? tags.grantId : undefined;
+    if (typeof grantId === 'string') {
+      return { type: 'Grant', permissionGrantId: grantId };
+    }
+  }
+
   const descriptorGrantId = (message.descriptor as Record<string, unknown>).permissionGrantId;
   if (typeof descriptorGrantId === 'string') {
     return { type: 'Grant', permissionGrantId: descriptorGrantId };
@@ -330,7 +361,7 @@ function recordDataDependencyFromMessage(message: GenericMessage): DependencyRef
 
   const descriptor = message.descriptor as Record<string, unknown>;
   const dataCid = descriptor.dataCid;
-  const protocol = descriptor.protocol;
+  const protocol = dependencyProtocolFromMessage(message);
   return typeof dataCid === 'string'
     ? {
       type     : 'RecordData',
@@ -342,6 +373,11 @@ function recordDataDependencyFromMessage(message: GenericMessage): DependencyRef
 }
 
 function roleDependencyFromMessage(message: GenericMessage, context: ReplicationApplyResultContext): DependencyRef | undefined {
+  const encryptionRoleDependency = roleDependencyFromEncryptionAudienceWriter(message, context);
+  if (encryptionRoleDependency !== undefined) {
+    return encryptionRoleDependency;
+  }
+
   const descriptor = message.descriptor as Record<string, unknown>;
   const filter = descriptor.filter as Record<string, unknown> | undefined;
   const protocol = descriptor.protocol ?? filter?.protocol;
@@ -383,6 +419,184 @@ function roleDependencyFromMessage(message: GenericMessage, context: Replication
   };
 }
 
+function encryptionProtocolDependencyFromMessage(
+  message: GenericMessage,
+  protocolPath: Extract<DependencyRef, { type: 'EncryptionProtocol' }>['protocolPath'],
+): DependencyRef | undefined {
+  const tags = encryptionAudienceTagsFromMessage(message);
+  return tags === undefined
+    ? undefined
+    : { type: 'EncryptionProtocol', protocolPath, tags };
+}
+
+function encryptionProtocolDependencyFromRoleAudienceEntry(
+  message: GenericMessage,
+  detail: string,
+): DependencyRef | undefined {
+  const descriptor = message.descriptor as Record<string, unknown>;
+  const messageContextId = (message as { contextId?: unknown }).contextId;
+  const contextId = typeof messageContextId === 'string' ? messageContextId : descriptor.contextId;
+  const keyEncryption = (message as {
+    encryption?: {
+      keyEncryption?: Record<string, unknown>[];
+    };
+  }).encryption?.keyEncryption;
+  if (typeof contextId !== 'string' || !Array.isArray(keyEncryption)) {
+    return undefined;
+  }
+
+  const missingRole = /role '([^']+)'/.exec(detail)?.[1];
+  const entry = keyEncryption.find((candidate): boolean =>
+    candidate.derivationScheme === ROLE_AUDIENCE_DERIVATION_SCHEME &&
+    typeof candidate.protocol === 'string' &&
+    typeof candidate.role === 'string' &&
+    (missingRole === undefined || candidate.role === missingRole) &&
+    typeof candidate.epoch === 'number' &&
+    typeof candidate.keyId === 'string'
+  );
+  if (entry === undefined) {
+    return undefined;
+  }
+
+  const role = entry.role as string;
+  const audienceContextId = roleAudienceContextId(role, contextId);
+  if (audienceContextId === undefined) {
+    return undefined;
+  }
+
+  return {
+    type         : 'EncryptionProtocol',
+    protocolPath : EncryptionProtocol.audienceEpochPath,
+    tags         : {
+      protocol  : entry.protocol as string,
+      contextId : audienceContextId,
+      role,
+      epoch     : entry.epoch as number,
+      keyId     : entry.keyId as string,
+    },
+  };
+}
+
+function roleDependencyFromEncryptionAudienceRecipient(message: GenericMessage): DependencyRef | undefined {
+  const tags = encryptionAudienceTagsFromMessage(message);
+  const recipient = (message.descriptor as Record<string, unknown>).recipient;
+  if (tags === undefined || typeof recipient !== 'string') {
+    return undefined;
+  }
+
+  return {
+    type         : 'Role',
+    protocol     : tags.protocol,
+    protocolPath : tags.role,
+    recipient,
+    ...(tags.contextId === '' ? {} : { contextPrefix: tags.contextId }),
+  };
+}
+
+function roleDependencyFromEncryptionAudienceWriter(
+  message: GenericMessage,
+  context: ReplicationApplyResultContext,
+): DependencyRef | undefined {
+  const tags = encryptionAudienceTagsFromMessage(message);
+  const protocolRole = getSignaturePayload(message)?.protocolRole;
+  const recipient = Message.getAuthor(message);
+  if (tags === undefined || typeof protocolRole !== 'string' || recipient === undefined) {
+    return undefined;
+  }
+
+  let roleProtocol = tags.protocol;
+  let roleProtocolPath = protocolRole;
+  if (isCrossProtocolRef(protocolRole)) {
+    const parsed = parseCrossProtocolRef(protocolRole);
+    const referencedProtocol = parsed === undefined ? undefined : context.protocolDefinition?.uses?.[parsed.alias];
+    if (parsed === undefined || referencedProtocol === undefined) {
+      return undefined;
+    }
+
+    roleProtocol = referencedProtocol;
+    roleProtocolPath = parsed.protocolPath;
+  }
+
+  const contextPrefix = roleContextPrefix(roleProtocolPath, tags.contextId);
+  return {
+    type         : 'Role',
+    protocol     : roleProtocol,
+    protocolPath : roleProtocolPath,
+    recipient,
+    ...(contextPrefix === undefined ? {} : { contextPrefix }),
+  };
+}
+
+function encryptionAudienceTagsFromMessage(message: GenericMessage): AudienceDependencyTags | undefined {
+  if (!isEncryptionProtocolMessage(message)) {
+    return undefined;
+  }
+
+  const tags = (message.descriptor as Record<string, unknown>).tags;
+  if (!isRecordObject(tags)) {
+    return undefined;
+  }
+
+  const { protocol, contextId, role, epoch, keyId } = tags;
+  if (
+    typeof protocol !== 'string' ||
+    typeof contextId !== 'string' ||
+    typeof role !== 'string' ||
+    typeof epoch !== 'number' ||
+    typeof keyId !== 'string'
+  ) {
+    return undefined;
+  }
+
+  return { protocol, contextId, role, epoch, keyId };
+}
+
+function dependencyProtocolFromMessage(message: GenericMessage): string | undefined {
+  if (isEncryptionProtocolMessage(message)) {
+    const tags = (message.descriptor as Record<string, unknown>).tags;
+    const protocol = isRecordObject(tags) ? tags.protocol : undefined;
+    return typeof protocol === 'string' ? protocol : undefined;
+  }
+
+  const descriptor = message.descriptor as Record<string, unknown>;
+  const filter = descriptor.filter as Record<string, unknown> | undefined;
+  const protocol = descriptor.protocol ?? filter?.protocol;
+  return typeof protocol === 'string' ? protocol : undefined;
+}
+
+function isEncryptionProtocolMessage(message: GenericMessage): boolean {
+  const descriptor = message.descriptor as Record<string, unknown>;
+  return descriptor.interface === DwnInterfaceName.Records &&
+    descriptor.protocol === EncryptionProtocol.uri;
+}
+
+function roleContextPrefix(rolePath: string, contextId: string): string | undefined {
+  const roleSegments = rolePath.split('/').length - 1;
+  if (roleSegments === 0 || contextId === '') {
+    return undefined;
+  }
+
+  return contextId.split('/').slice(0, roleSegments).join('/');
+}
+
+function roleAudienceContextId(rolePath: string, contextId: string): string | undefined {
+  const roleSegments = rolePath.split('/').length - 1;
+  if (roleSegments === 0) {
+    return '';
+  }
+
+  const contextSegments = contextId.split('/');
+  if (contextSegments.length < roleSegments) {
+    return undefined;
+  }
+
+  return contextSegments.slice(0, roleSegments).join('/');
+}
+
+function isRecordObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null;
+}
+
 function isRecordsWrite(message: GenericMessage): message is GenericMessage & { recordId: string } {
   return message.descriptor.interface === DwnInterfaceName.Records &&
     message.descriptor.method === DwnMethodName.Write &&