@enbox/dwn-sdk-js 0.4.4 → 0.4.5

package/src/core/recording-validation-state-reader.ts

@@ -87,6 +87,19 @@ export class RecordingValidationStateReader implements ValidationStateReader {
     return this.inner.queryLatestRoleRecords(input);
   }
 
+  /** @inheritdoc */
+  public async queryAudienceEpochs(input: {
+    tenant: string;
+    protocol: string;
+    contextId: string;
+    role: string;
+    epoch: number;
+    keyId?: string;
+  }): Promise<RecordsWriteMessage[]> {
+    this.recordedReads.push({ method: 'queryAudienceEpochs' });
+    return this.inner.queryAudienceEpochs(input);
+  }
+
   /** @inheritdoc */
   public async fetchGrant(tenant: string, permissionGrantId: string): Promise<PermissionGrant> {
     this.recordedReads.push({ method: 'fetchGrant' });

package/src/core/replication-apply.ts

@@ -5,7 +5,9 @@ import type { ValidationStateReader } from '../types/validation-state-reader.js'
 
 import { DwnErrorCode } from './dwn-error.js';
 import { Encoder } from '../utils/encoder.js';
+import { EncryptionProtocol } from '../protocols/encryption.js';
 import { Message } from './message.js';
+import { ROLE_AUDIENCE_DERIVATION_SCHEME } from '../utils/encryption.js';
 import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
 import { isCrossProtocolRef, parseCrossProtocolRef } from '../utils/protocols.js';
 
@@ -40,6 +42,14 @@ export type ReplicationApplyResultContext = {
   missingAncestorRecordIds?: string[];
 };
 
+type AudienceDependencyTags = {
+  protocol: string;
+  contextId: string;
+  role: string;
+  epoch: number;
+  keyId: string;
+};
+
 export type DependencyRef =
   | { type: 'Protocol'; protocol: string; messageCid?: string; terminal?: boolean }
   | { type: 'InitialWrite'; recordId: string; protocol?: string; messageCid?: string; terminal?: boolean }
@@ -47,7 +57,14 @@ export type DependencyRef =
   | { type: 'Ancestor'; recordId: string; protocol?: string; messageCid?: string; terminal?: boolean }
   | { type: 'Role'; protocol: string; protocolPath: string; recipient: string; contextPrefix?: string; messageCid?: string; terminal?: boolean }
   | { type: 'Grant'; permissionGrantId: string; messageCid?: string; terminal?: boolean }
-  | { type: 'KeyDelivery'; protocol: string; contextId: string; messageCid?: string; terminal?: boolean }
+  | {
+      type: 'EncryptionProtocol';
+      protocolPath: 'audienceEpoch' | 'audienceKey' | 'grantKey';
+      tags?: Record<string, string | number>;
+      recipient?: string;
+      messageCid?: string;
+      terminal?: boolean;
+    }
   | { type: 'CrossProtocolRef'; protocol: string; recordId: string; messageCid?: string; terminal?: boolean }
   | { type: 'RecordData'; recordId: string; dataCid: string; protocol?: string; messageCid?: string; terminal?: boolean };
 
@@ -180,7 +197,14 @@ function dependencyRefsFromStatus(
   case DwnErrorCode.GrantAuthorizationGrantMissing:
     return toRefList(grantDependencyFromMessage(message));
   case DwnErrorCode.ProtocolAuthorizationMatchingRoleRecordNotFound:
+  case DwnErrorCode.EncryptionProtocolValidateAudienceWriterUnauthorized:
     return toRefList(roleDependencyFromMessage(message, context));
+  case DwnErrorCode.EncryptionProtocolValidateAudienceEpochMissing:
+    return toRefList(encryptionProtocolDependencyFromMessage(message, EncryptionProtocol.audienceEpochPath));
+  case DwnErrorCode.ProtocolAuthorizationEncryptionRoleAudienceEpochMissing:
+    return toRefList(encryptionProtocolDependencyFromRoleAudienceEntry(message, detail));
+  case DwnErrorCode.EncryptionProtocolValidateAudienceKeyRoleRecordMissing:
+    return toRefList(roleDependencyFromEncryptionAudienceRecipient(message));
   case DwnErrorCode.RecordsWriteMissingDataInPrevious:
   case DwnErrorCode.RecordsWriteMissingEncodedDataInPrevious:
     return toRefList(recordDataDependencyFromMessage(message));
@@ -214,7 +238,7 @@ function protocolDependencyFromMessage(message: GenericMessage, detail: string):
     return { type: 'Protocol', protocol: composedProtocol };
   }
 
-  const protocol = (message.descriptor as Record<string, unknown>).protocol;
+  const protocol = dependencyProtocolFromMessage(message);
   return typeof protocol === 'string' ? { type: 'Protocol', protocol } : undefined;
 }
 
@@ -235,7 +259,7 @@ function parentDependenciesFromMessage(
     return [];
   }
 
-  const protocol = (message.descriptor as Record<string, unknown>).protocol;
+  const protocol = dependencyProtocolFromMessage(message);
   const protocolProperty = typeof protocol === 'string' ? { protocol } : {};
   const ancestorRefs = (context.missingAncestorRecordIds ?? [])
     .filter((recordId): boolean => recordId !== parentRef.recordId)
@@ -248,9 +272,8 @@ function parentDependencyFromMessage(
   message: GenericMessage,
   detail: string,
 ): Extract<DependencyRef, { type: 'Parent' }> | undefined {
-  const descriptor = message.descriptor as Record<string, unknown>;
   const parentId = parentRecordIdFromMessage(message, detail);
-  const protocol = /in protocol '([^']+)'/.exec(detail)?.[1] ?? descriptor.protocol;
+  const protocol = /in protocol '([^']+)'/.exec(detail)?.[1] ?? dependencyProtocolFromMessage(message);
 
   if (parentId === undefined || typeof protocol !== 'string') {
     return undefined;
@@ -278,7 +301,7 @@ function ancestorDependenciesFromMessage(
   detail: string,
   context: ReplicationApplyResultContext,
 ): DependencyRef[] {
-  const protocol = (message.descriptor as Record<string, unknown>).protocol;
+  const protocol = dependencyProtocolFromMessage(message);
   const protocolProperty = typeof protocol === 'string' ? { protocol } : {};
 
   const batchedRecordIds = context.missingAncestorRecordIds;
@@ -303,7 +326,7 @@ function initialWriteDependencyFromMessage(message: GenericMessage): DependencyR
     return undefined;
   }
 
-  const protocol = (message.descriptor as Record<string, unknown>).protocol;
+  const protocol = dependencyProtocolFromMessage(message);
   return {
     type     : 'InitialWrite',
     recordId : message.recordId,
@@ -312,6 +335,14 @@ function initialWriteDependencyFromMessage(message: GenericMessage): DependencyR
 }
 
 function grantDependencyFromMessage(message: GenericMessage): DependencyRef | undefined {
+  if (isEncryptionProtocolMessage(message)) {
+    const tags = (message.descriptor as Record<string, unknown>).tags;
+    const grantId = isRecordObject(tags) ? tags.grantId : undefined;
+    if (typeof grantId === 'string') {
+      return { type: 'Grant', permissionGrantId: grantId };
+    }
+  }
+
   const descriptorGrantId = (message.descriptor as Record<string, unknown>).permissionGrantId;
   if (typeof descriptorGrantId === 'string') {
     return { type: 'Grant', permissionGrantId: descriptorGrantId };
@@ -330,7 +361,7 @@ function recordDataDependencyFromMessage(message: GenericMessage): DependencyRef
 
   const descriptor = message.descriptor as Record<string, unknown>;
   const dataCid = descriptor.dataCid;
-  const protocol = descriptor.protocol;
+  const protocol = dependencyProtocolFromMessage(message);
   return typeof dataCid === 'string'
     ? {
       type     : 'RecordData',
@@ -342,6 +373,11 @@ function recordDataDependencyFromMessage(message: GenericMessage): DependencyRef
 }
 
 function roleDependencyFromMessage(message: GenericMessage, context: ReplicationApplyResultContext): DependencyRef | undefined {
+  const encryptionRoleDependency = roleDependencyFromEncryptionAudienceWriter(message, context);
+  if (encryptionRoleDependency !== undefined) {
+    return encryptionRoleDependency;
+  }
+
   const descriptor = message.descriptor as Record<string, unknown>;
   const filter = descriptor.filter as Record<string, unknown> | undefined;
   const protocol = descriptor.protocol ?? filter?.protocol;
@@ -383,6 +419,184 @@ function roleDependencyFromMessage(message: GenericMessage, context: Replication
   };
 }
 
+function encryptionProtocolDependencyFromMessage(
+  message: GenericMessage,
+  protocolPath: Extract<DependencyRef, { type: 'EncryptionProtocol' }>['protocolPath'],
+): DependencyRef | undefined {
+  const tags = encryptionAudienceTagsFromMessage(message);
+  return tags === undefined
+    ? undefined
+    : { type: 'EncryptionProtocol', protocolPath, tags };
+}
+
+function encryptionProtocolDependencyFromRoleAudienceEntry(
+  message: GenericMessage,
+  detail: string,
+): DependencyRef | undefined {
+  const descriptor = message.descriptor as Record<string, unknown>;
+  const messageContextId = (message as { contextId?: unknown }).contextId;
+  const contextId = typeof messageContextId === 'string' ? messageContextId : descriptor.contextId;
+  const keyEncryption = (message as {
+    encryption?: {
+      keyEncryption?: Record<string, unknown>[];
+    };
+  }).encryption?.keyEncryption;
+  if (typeof contextId !== 'string' || !Array.isArray(keyEncryption)) {
+    return undefined;
+  }
+
+  const missingRole = /role '([^']+)'/.exec(detail)?.[1];
+  const entry = keyEncryption.find((candidate): boolean =>
+    candidate.derivationScheme === ROLE_AUDIENCE_DERIVATION_SCHEME &&
+    typeof candidate.protocol === 'string' &&
+    typeof candidate.role === 'string' &&
+    (missingRole === undefined || candidate.role === missingRole) &&
+    typeof candidate.epoch === 'number' &&
+    typeof candidate.keyId === 'string'
+  );
+  if (entry === undefined) {
+    return undefined;
+  }
+
+  const role = entry.role as string;
+  const audienceContextId = roleAudienceContextId(role, contextId);
+  if (audienceContextId === undefined) {
+    return undefined;
+  }
+
+  return {
+    type         : 'EncryptionProtocol',
+    protocolPath : EncryptionProtocol.audienceEpochPath,
+    tags         : {
+      protocol  : entry.protocol as string,
+      contextId : audienceContextId,
+      role,
+      epoch     : entry.epoch as number,
+      keyId     : entry.keyId as string,
+    },
+  };
+}
+
+function roleDependencyFromEncryptionAudienceRecipient(message: GenericMessage): DependencyRef | undefined {
+  const tags = encryptionAudienceTagsFromMessage(message);
+  const recipient = (message.descriptor as Record<string, unknown>).recipient;
+  if (tags === undefined || typeof recipient !== 'string') {
+    return undefined;
+  }
+
+  return {
+    type         : 'Role',
+    protocol     : tags.protocol,
+    protocolPath : tags.role,
+    recipient,
+    ...(tags.contextId === '' ? {} : { contextPrefix: tags.contextId }),
+  };
+}
+
+function roleDependencyFromEncryptionAudienceWriter(
+  message: GenericMessage,
+  context: ReplicationApplyResultContext,
+): DependencyRef | undefined {
+  const tags = encryptionAudienceTagsFromMessage(message);
+  const protocolRole = getSignaturePayload(message)?.protocolRole;
+  const recipient = Message.getAuthor(message);
+  if (tags === undefined || typeof protocolRole !== 'string' || recipient === undefined) {
+    return undefined;
+  }
+
+  let roleProtocol = tags.protocol;
+  let roleProtocolPath = protocolRole;
+  if (isCrossProtocolRef(protocolRole)) {
+    const parsed = parseCrossProtocolRef(protocolRole);
+    const referencedProtocol = parsed === undefined ? undefined : context.protocolDefinition?.uses?.[parsed.alias];
+    if (parsed === undefined || referencedProtocol === undefined) {
+      return undefined;
+    }
+
+    roleProtocol = referencedProtocol;
+    roleProtocolPath = parsed.protocolPath;
+  }
+
+  const contextPrefix = roleContextPrefix(roleProtocolPath, tags.contextId);
+  return {
+    type         : 'Role',
+    protocol     : roleProtocol,
+    protocolPath : roleProtocolPath,
+    recipient,
+    ...(contextPrefix === undefined ? {} : { contextPrefix }),
+  };
+}
+
+function encryptionAudienceTagsFromMessage(message: GenericMessage): AudienceDependencyTags | undefined {
+  if (!isEncryptionProtocolMessage(message)) {
+    return undefined;
+  }
+
+  const tags = (message.descriptor as Record<string, unknown>).tags;
+  if (!isRecordObject(tags)) {
+    return undefined;
+  }
+
+  const { protocol, contextId, role, epoch, keyId } = tags;
+  if (
+    typeof protocol !== 'string' ||
+    typeof contextId !== 'string' ||
+    typeof role !== 'string' ||
+    typeof epoch !== 'number' ||
+    typeof keyId !== 'string'
+  ) {
+    return undefined;
+  }
+
+  return { protocol, contextId, role, epoch, keyId };
+}
+
+function dependencyProtocolFromMessage(message: GenericMessage): string | undefined {
+  if (isEncryptionProtocolMessage(message)) {
+    const tags = (message.descriptor as Record<string, unknown>).tags;
+    const protocol = isRecordObject(tags) ? tags.protocol : undefined;
+    return typeof protocol === 'string' ? protocol : undefined;
+  }
+
+  const descriptor = message.descriptor as Record<string, unknown>;
+  const filter = descriptor.filter as Record<string, unknown> | undefined;
+  const protocol = descriptor.protocol ?? filter?.protocol;
+  return typeof protocol === 'string' ? protocol : undefined;
+}
+
+function isEncryptionProtocolMessage(message: GenericMessage): boolean {
+  const descriptor = message.descriptor as Record<string, unknown>;
+  return descriptor.interface === DwnInterfaceName.Records &&
+    descriptor.protocol === EncryptionProtocol.uri;
+}
+
+function roleContextPrefix(rolePath: string, contextId: string): string | undefined {
+  const roleSegments = rolePath.split('/').length - 1;
+  if (roleSegments === 0 || contextId === '') {
+    return undefined;
+  }
+
+  return contextId.split('/').slice(0, roleSegments).join('/');
+}
+
+function roleAudienceContextId(rolePath: string, contextId: string): string | undefined {
+  const roleSegments = rolePath.split('/').length - 1;
+  if (roleSegments === 0) {
+    return '';
+  }
+
+  const contextSegments = contextId.split('/');
+  if (contextSegments.length < roleSegments) {
+    return undefined;
+  }
+
+  return contextSegments.slice(0, roleSegments).join('/');
+}
+
+function isRecordObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null;
+}
+
 function isRecordsWrite(message: GenericMessage): message is GenericMessage & { recordId: string } {
   return message.descriptor.interface === DwnInterfaceName.Records &&
     message.descriptor.method === DwnMethodName.Write &&

package/src/core/validation-state-reader.ts

@@ -7,6 +7,7 @@ import type { ValidationStateReader } from '../types/validation-state-reader.js'
 import type { DataEncodedRecordsWriteMessage, RecordsWriteMessage } from '../types/records-types.js';
 import type { ProtocolDefinition, ProtocolsConfigureMessage } from '../types/protocols-types.js';
 
+import { ENCRYPTION_PROTOCOL_URI } from './constants.js';
 import { FilterUtility } from '../utils/filter.js';
 import { PermissionGrant } from '../protocols/permission-grant.js';
 import { PermissionsProtocol } from '../protocols/permissions.js';
@@ -165,6 +166,35 @@ export class StoreValidationStateReader implements ValidationStateReader {
     return matchingMessages as RecordsWriteMessage[];
   }
 
+  /** @inheritdoc */
+  public async queryAudienceEpochs(input: {
+    tenant: string;
+    protocol: string;
+    contextId: string;
+    role: string;
+    epoch: number;
+    keyId?: string;
+  }): Promise<RecordsWriteMessage[]> {
+    const filter: Filter = {
+      interface         : DwnInterfaceName.Records,
+      method            : DwnMethodName.Write,
+      isLatestBaseState : true,
+      protocol          : ENCRYPTION_PROTOCOL_URI,
+      protocolPath      : 'audienceEpoch',
+      'tag.protocol'    : input.protocol,
+      'tag.contextId'   : input.contextId,
+      'tag.role'        : input.role,
+      'tag.epoch'       : input.epoch,
+    };
+
+    if (input.keyId !== undefined) {
+      filter['tag.keyId'] = input.keyId;
+    }
+
+    const { messages } = await this.messageStore.query(input.tenant, [filter]);
+    return messages as RecordsWriteMessage[];
+  }
+
   /** @inheritdoc */
   public async fetchGrant(tenant: string, permissionGrantId: string): Promise<PermissionGrant> {
     const grantQuery = {

package/src/dwn.ts

@@ -41,6 +41,7 @@ import { Cid } from './utils/cid.js';
 import { CoreProtocolRegistry } from './core/core-protocol.js';
 import { DataStream } from './utils/data-stream.js';
 import { DwnConstant } from './core/dwn-constant.js';
+import { EncryptionProtocol } from './protocols/encryption.js';
 import { Message } from './core/message.js';
 import { messageReplyFromError } from './core/message-reply.js';
 import { MessagesQueryHandler } from './handlers/messages-query.js';
@@ -115,6 +116,7 @@ export class Dwn {
 
     // Initialize the core protocol registry with built-in system protocols.
     this._coreProtocols = new CoreProtocolRegistry();
+    this._coreProtocols.register(new EncryptionProtocol());
     this._coreProtocols.register(new PermissionsProtocol());
 
     // The single narrow surface through which validation logic reads state (replay-basis closure).
@@ -426,7 +428,7 @@ export class Dwn {
       RecordsWrite.validateDataIntegrity(message.descriptor.dataCid, message.descriptor.dataSize, dataCid, dataBytes.length);
 
       if (coreProtocol?.validateRecord !== undefined) {
-        coreProtocol.validateRecord(message, dataBytes);
+        await coreProtocol.validateRecord(message, dataBytes);
       }
 
       return;
@@ -492,7 +494,10 @@ export class Dwn {
     reply: { status: { detail?: string } },
   ): Promise<ProtocolDefinition | undefined> {
     const detail = reply.status.detail ?? '';
-    if (!detail.startsWith(`${DwnErrorCode.ProtocolAuthorizationMatchingRoleRecordNotFound}:`)) {
+    if (
+      !detail.startsWith(`${DwnErrorCode.ProtocolAuthorizationMatchingRoleRecordNotFound}:`) &&
+      !detail.startsWith(`${DwnErrorCode.EncryptionProtocolValidateAudienceWriterUnauthorized}:`)
+    ) {
       return undefined;
     }
 
@@ -516,6 +521,14 @@ export class Dwn {
     message: GenericMessage,
   ): ReplicationApplyProtocolDefinitionLookup | undefined {
     if (Dwn.isRecordsWriteMessage(message)) {
+      const taggedProtocol = Dwn.getEncryptionRecordTaggedProtocol(message);
+      if (taggedProtocol !== undefined) {
+        return {
+          protocol         : taggedProtocol,
+          messageTimestamp : message.descriptor.messageTimestamp,
+        };
+      }
+
       return {
         protocol         : message.descriptor.protocol,
         messageTimestamp : message.descriptor.messageTimestamp,
@@ -526,6 +539,15 @@ export class Dwn {
     return protocol === undefined ? undefined : { protocol };
   }
 
+  private static getEncryptionRecordTaggedProtocol(message: RecordsWriteMessage): string | undefined {
+    if (message.descriptor.protocol !== EncryptionProtocol.uri) {
+      return undefined;
+    }
+
+    const protocol = message.descriptor.tags?.protocol;
+    return typeof protocol === 'string' ? protocol : undefined;
+  }
+
   private static getMessageProtocolForReplicationApply(message: GenericMessage): string | undefined {
     const descriptor = message.descriptor as { protocol?: unknown; filter?: { protocol?: unknown } };
     if (typeof descriptor.protocol === 'string') {

package/src/handlers/messages-query.ts

@@ -9,7 +9,6 @@ import { messageReplyFromError } from '../core/message-reply.js';
 import { Messages } from '../utils/messages.js';
 import { MessagesGrantAuthorization } from '../core/messages-grant-authorization.js';
 import { MessagesQuery } from '../interfaces/messages-query.js';
-import { PermissionsProtocol } from '../protocols/permissions.js';
 import { Replication } from '../utils/replication.js';
 import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 
@@ -187,10 +186,12 @@ export class MessagesQueryHandler implements MethodHandler {
       protocols.add(filter.protocol);
     }
 
-    const protocolList = [...protocols];
-    const scopes = protocolList.map(protocol => Replication.protocolDomain(protocol));
-    if (!protocols.has(PermissionsProtocol.uri)) {
-      scopes.push(...protocolList.map(protocol => Replication.permissionDomain(protocol)));
+    const scopes: string[] = [];
+    for (const protocol of protocols) {
+      scopes.push(
+        Replication.protocolDomain(protocol),
+        ...Replication.taggedCoreProtocolDomains(protocol, protocols),
+      );
     }
 
     return scopes;

package/src/handlers/protocols-configure.ts

@@ -15,7 +15,7 @@ import { RecordsWrite } from '../interfaces/records-write.js';
 import { StorageController } from '../store/storage-controller.js';
 import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
-import { getRuleSetAtPath, parseCrossProtocolRef } from '../utils/protocols.js';
+import { getRuleSetAtPath, getTypeName, parseCrossProtocolRef } from '../utils/protocols.js';
 
 type StoredInitialWriteConfigValidity = 'valid' | 'invalid' | 'unknown';
 
@@ -291,7 +291,12 @@ export class ProtocolsConfigureHandler implements MethodHandler {
     }
 
     // Walk the structure and validate all $ref paths and cross-protocol role references
-    ProtocolsConfigureHandler.validateRefsAndRolesRecursively(definition.structure as ProtocolRuleSet, '', referencedDefinitions);
+    ProtocolsConfigureHandler.validateRefsAndRolesRecursively(
+      definition,
+      definition.structure as ProtocolRuleSet,
+      '',
+      referencedDefinitions,
+    );
   }
 
   /**
@@ -300,6 +305,7 @@ export class ProtocolsConfigureHandler implements MethodHandler {
    * - Cross-protocol `role` references point to valid `$role: true` paths in the referenced protocol
    */
   private static validateRefsAndRolesRecursively(
+    definition: ProtocolDefinition,
     ruleSet: ProtocolRuleSet,
     protocolPath: string,
     referencedDefinitions: Map<string, ProtocolDefinition>
@@ -362,6 +368,8 @@ export class ProtocolsConfigureHandler implements MethodHandler {
 
       // Validate cross-protocol references in $actions (roles and `of` paths)
       const actionRules = childRuleSet.$actions ?? [];
+      const typeName = getTypeName(childProtocolPath);
+      const isEncryptedPath = definition.types[typeName]?.encryptionRequired === true;
       for (const actionRule of actionRules) {
         // Validate cross-protocol role references
         if (actionRule.role !== undefined) {
@@ -385,6 +393,14 @@ export class ProtocolsConfigureHandler implements MethodHandler {
                 `does not point to a valid role ($role: true) in protocol '${refDefinition.protocol}'.`
               );
             }
+
+            if (isEncryptedPath && actionRule.can.includes('read') && roleRuleSet.$keyAgreement === undefined) {
+              throw new DwnError(
+                DwnErrorCode.ProtocolsConfigureInvalidEncryptedRoleMissingKeyAgreement,
+                `encrypted protocol path '${childProtocolPath}' references cross-protocol role '${actionRule.role}' ` +
+                `with no $keyAgreement.`
+              );
+            }
           }
         }
 
@@ -414,7 +430,7 @@ export class ProtocolsConfigureHandler implements MethodHandler {
       }
 
       // Recurse into children
-      ProtocolsConfigureHandler.validateRefsAndRolesRecursively(childRuleSet, childProtocolPath, referencedDefinitions);
+      ProtocolsConfigureHandler.validateRefsAndRolesRecursively(definition, childRuleSet, childProtocolPath, referencedDefinitions);
     }
   }
 }

package/src/handlers/records-write.ts

@@ -244,7 +244,7 @@ export class RecordsWriteHandler implements MethodHandler {
         ? undefined
         : this.deps.coreProtocols?.get(message.descriptor.protocol);
       if (coreProtocol?.validateRecord !== undefined) {
-        coreProtocol.validateRecord(message, dataBytes);
+        await coreProtocol.validateRecord(message, dataBytes);
       }
 
       messageWithOptionalEncodedData = await this.cloneAndAddEncodedData(message, dataBytes);

package/src/index.ts

@@ -10,7 +10,7 @@ export type { RecordedValidationRead } from './core/recording-validation-state-r
 export { RecordingValidationStateReader } from './core/recording-validation-state-reader.js';
 export type { MessagesFilter, MessagesQueryDescriptor, MessagesQueryMessage, MessagesQueryReply, MessagesQueryReplyEntry, MessagesReadMessage, MessagesReadReply, MessagesReadReplyEntry, MessagesReadDescriptor, MessagesSubscribeDescriptor, MessagesSubscribeMessage, MessagesSubscribeReply, MessagesSubscribeMessageOptions } from './types/messages-types.js';
 export type { GT, LT, Filter, FilterValue, KeyValues, EqualFilter, OneOfFilter, RangeFilter, RangeCriterion, PaginationCursor, QueryOptions, RangeValue, StartsWithFilter } from './types/query-types.js';
-export type { ProtocolsConfigureDescriptor, ProtocolDefinition, ProtocolTypes, ProtocolRuleSet, ProtocolsQueryFilter, ProtocolsConfigureMessage, ProtocolsQueryMessage, ProtocolsQueryReply, ProtocolActionRule, ProtocolDeliveryStrategy, ProtocolPathEncryption, ProtocolsQueryDescriptor, ProtocolRecordLimitDefinition, ProtocolSizeDefinition, ProtocolTagsDefinition, ProtocolTagSchema, ProtocolType, ProtocolUses } from './types/protocols-types.js';
+export type { ProtocolsConfigureDescriptor, ProtocolDefinition, ProtocolTypes, ProtocolRuleSet, ProtocolsQueryFilter, ProtocolsConfigureMessage, ProtocolsQueryMessage, ProtocolsQueryReply, ProtocolActionRule, ProtocolDeliveryStrategy, ProtocolKeyAgreement, ProtocolsQueryDescriptor, ProtocolRecordLimitDefinition, ProtocolSizeDefinition, ProtocolTagsDefinition, ProtocolTagSchema, ProtocolType, ProtocolUses } from './types/protocols-types.js';
 export { ProtocolRecordLimitStrategy } from './types/protocols-types.js';
 export type { DataEncodedRecordsWriteMessage, RecordsCountDescriptor, RecordsCountMessage, RecordsCountReply, RecordsDeleteMessage, RecordsFilter, RecordsQueryMessage, RecordsQueryReply, RecordsQueryReplyEntry, RecordsReadMessage, RecordsReadReply, RecordsSubscribeDescriptor, RecordsSubscribeMessage, RecordsSubscribeReply, RecordsWriteDescriptor, RecordsWriteTags, RecordsWriteTagValue, RecordsWriteMessage, RecordsWriteSignaturePayload, RecordsDeleteDescriptor, RecordsQueryDescriptor, RecordsReadDescriptor, RecordsSubscribeMessageOptions, RecordsWriteMessageOptions, InternalRecordsWriteMessage, RecordEvent, RecordsWriteTagsFilter } from './types/records-types.js';
 export type { GeneralJws, SignatureEntry } from './types/jws-types.js';
@@ -38,10 +38,19 @@ export { DwnInterfaceName, DwnMethodName } from './enums/dwn-interface-method.js
 export { Encoder } from './utils/encoder.js';
 export { MessagesSubscribe } from './interfaces/messages-subscribe.js';
 export type { MessagesSubscribeOptions } from './interfaces/messages-subscribe.js';
-export { Encryption, ContentEncryptionAlgorithm, KeyAgreementAlgorithm } from './utils/encryption.js';
-export type { JweEncryption, JweRecipient, JweRecipientHeader, JweProtectedHeader, JweKeyUnwrapPayload } from './utils/encryption.js';
+export { Encryption, ContentEncryptionAlgorithm, KeyAgreementAlgorithm, ROLE_AUDIENCE_DERIVATION_SCHEME } from './utils/encryption.js';
+export type {
+  DwnEncryption,
+  KeyEncryption,
+  KeyEncryptionInput,
+  KeyUnwrapPayload,
+  ProtocolPathKeyEncryption,
+  ProtocolPathKeyEncryptionInput,
+  RoleAudienceKeyEncryption,
+  RoleAudienceKeyEncryptionInput,
+} from './utils/encryption.js';
 export { RecordsWrite } from './interfaces/records-write.js';
-export type { EncryptionInput, KeyEncryptionInput, RecordsWriteOptions, CreateFromOptions } from './interfaces/records-write.js';
+export type { EncryptionInput, RecordsWriteOptions, CreateFromOptions } from './interfaces/records-write.js';
 export { executeUnlessAborted } from './utils/abort.js';
 export { Jws } from './utils/jws.js';
 export type { KeyMaterial, PrivateKeyJwk, PublicKeyJwk, Jwk } from './types/jose-types.js';
@@ -57,6 +66,7 @@ export type { MessageInterface } from './types/message-interface.js';
 export { PermissionGrant } from './protocols/permission-grant.js';
 export { PermissionRequest } from './protocols/permission-request.js';
 export { PermissionsProtocol } from './protocols/permissions.js';
+export { EncryptionProtocol } from './protocols/encryption.js';
 export type { PermissionGrantCreateOptions, PermissionRequestCreateOptions, PermissionRevocationCreateOptions } from './protocols/permissions.js';
 export { PermissionScopeMatcher } from './utils/permission-scope.js';
 export type { ProtocolScope } from './utils/permission-scope.js';
@@ -80,7 +90,7 @@ export { Secp256r1 } from './utils/secp256r1.js';
 export type { SupportedCurve } from './jose/algorithms/signing/signature-algorithms.js';
 export type { MessageSigner } from './types/signer.js';
 export { SortDirection } from './types/query-types.js';
-export type { EncryptionKeyDeriver, KeyDecrypter } from './types/encryption-types.js';
+export type { EncryptionKeyDeriver, KeyDecrypter, KeyDecrypterDerivationScheme } from './types/encryption-types.js';
 export { Time } from './utils/time.js';
 export * from './types/permission-types.js';
 export * from './types/records-types.js';