@enbox/dwn-sdk-js 0.4.4 → 0.4.6

package/dist/types/src/utils/permission-scope.d.ts

@@ -15,9 +15,9 @@ export type ProtocolScope = {
  *
  * Matching fails closed for invalid combinations: `protocolPath` and
  * `contextId` are mutually exclusive, and either field requires `protocol`.
- * `protocol` and `protocolPath` match by exact equality. `contextId` scopes
- * match a context subtree: the target context must equal the scoped context or
- * begin with the scoped context followed by `/`.
+ * `protocol` matches by exact equality. `protocolPath` and `contextId` scopes
+ * match subtrees: the target value must equal the scoped value or begin with the
+ * scoped value followed by `/`.
  */
 export declare class PermissionScopeMatcher {
     /**
@@ -25,5 +25,6 @@ export declare class PermissionScopeMatcher {
      */
     static matches(scope: ProtocolScope, target: ProtocolScope): boolean;
     private static matchesContextId;
+    private static matchesSubtree;
 }
 //# sourceMappingURL=permission-scope.d.ts.map

package/dist/types/src/utils/permission-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-scope.d.ts","sourceRoot":"","sources":["../../../../src/utils/permission-scope.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC;;OAEG;WACW,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO;IAwB3E,OAAO,CAAC,MAAM,CAAC,gBAAgB;CAIhC"}
+{"version":3,"file":"permission-scope.d.ts","sourceRoot":"","sources":["../../../../src/utils/permission-scope.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC;;OAEG;WACW,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO;IAwB3E,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAI/B,OAAO,CAAC,MAAM,CAAC,cAAc;CAI9B"}

package/dist/types/src/utils/protocols.d.ts

@@ -41,11 +41,10 @@ export declare function getRuleSetAtPath(protocolPath: string, structure: {
  */
 export declare class Protocols {
     /**
-     * Derives public encryptions keys and inject it in the `$encryption` property for each protocol path segment of the given Protocol definition,
-     * then returns the final encryption-enabled protocol definition.
+     * Derives public encryption keys and injects them in `$keyAgreement`.
      * NOTE: The original definition passed in is unmodified.
      *
-     * `$ref` nodes (cross-protocol attachment points) are skipped during `$encryption` injection
+     * `$ref` nodes (cross-protocol attachment points) are skipped during `$keyAgreement` injection
      * because their records belong to the referenced protocol, whose own encryption keys govern them.
      * Children of `$ref` nodes are still processed because they belong to the composing protocol.
      *
@@ -54,8 +53,7 @@ export declare class Protocols {
      */
     static deriveAndInjectPublicEncryptionKeys(protocolDefinition: ProtocolDefinition, keyDeriver: EncryptionKeyDeriver): Promise<ProtocolDefinition>;
     /**
-     * Overload 2 (raw-key, existing): Takes rootKeyId and raw PrivateKeyJwk directly.
-     * Preserved for backward compatibility with tests and non-KMS callers.
+     * Overload 2 (raw-key): Takes rootKeyId and raw PrivateKeyJwk directly.
      */
     static deriveAndInjectPublicEncryptionKeys(protocolDefinition: ProtocolDefinition, rootKeyId: string, privateJwk: PrivateKeyJwk): Promise<ProtocolDefinition>;
 }

package/dist/types/src/utils/protocols.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocols.d.ts","sourceRoot":"","sources":["../../../../src/utils/protocols.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,wBAAwB,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAKvF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAU/E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAA;CAAE,GAAG,eAAe,GAAG,SAAS,CAcjI;AAED;;GAEG;AACH,qBAAa,SAAS;IACpB;;;;;;;;;;;OAWG;WACiB,mCAAmC,CACrD,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IAE9B;;;OAGG;WACiB,mCAAmC,CACrD,kBAAkB,EAAE,kBAAkB,EACtC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,aAAa,GACxB,OAAO,CAAC,kBAAkB,CAAC;CAkF/B"}
+{"version":3,"file":"protocols.d.ts","sourceRoot":"","sources":["../../../../src/utils/protocols.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,wBAAwB,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAKvF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAU/E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAA;CAAE,GAAG,eAAe,GAAG,SAAS,CAcjI;AAED;;GAEG;AACH,qBAAa,SAAS;IACpB;;;;;;;;;;OAUG;WACiB,mCAAmC,CACrD,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IAE9B;;OAEG;WACiB,mCAAmC,CACrD,kBAAkB,EAAE,kBAAkB,EACtC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,aAAa,GACxB,OAAO,CAAC,kBAAkB,CAAC;CAqF/B"}

package/dist/types/src/utils/records.d.ts

@@ -5,6 +5,7 @@ import type { GenericMessage, GenericSignaturePayload, MessageSort } from '../ty
 import type { RecordsCountMessage, RecordsDeleteMessage, RecordsFilter, RecordsQueryMessage, RecordsReadMessage, RecordsSubscribeMessage, RecordsWriteDescriptor, RecordsWriteMessage, RecordsWriteTags, RecordsWriteTagsFilter } from '../types/records-types.js';
 import { DateSort } from '../types/records-types.js';
 import { DwnErrorCode } from '../core/dwn-error.js';
+import { ROLE_AUDIENCE_DERIVATION_SCHEME } from './encryption.js';
 import { KeyDerivationScheme } from './hd-key.js';
 /**
  * Class containing useful utilities related to the Records interface.
@@ -26,7 +27,7 @@ export declare class Records {
      * Decrypts the encrypted data in a message reply.
      *
      * Overload 1 (callback-based): Accepts a KeyDecrypter that performs
-     * HKDF derivation + ECDH-ES key agreement + AES Key Unwrap internally.
+     * X25519-HKDF key agreement + AES Key Unwrap internally.
      */
     static decrypt(recordsWrite: RecordsWriteMessage, keyDecrypter: KeyDecrypter, cipherStream: ReadableStream<Uint8Array>): Promise<ReadableStream<Uint8Array>>;
     /**
@@ -34,10 +35,12 @@ export declare class Records {
      * @param ancestorPrivateKey Any ancestor private key in the key derivation path.
      */
     static decrypt(recordsWrite: RecordsWriteMessage, ancestorPrivateKey: DerivedPrivateJwk, cipherStream: ReadableStream<Uint8Array>): Promise<ReadableStream<Uint8Array>>;
+    private static findMatchingKeyEncryption;
+    private static validateEncryptedDataIntegrity;
     /**
      * Constructs full key derivation path using the specified scheme.
      */
-    static constructKeyDerivationPath(keyDerivationScheme: KeyDerivationScheme, recordsWriteMessage: RecordsWriteMessage): string[];
+    static constructKeyDerivationPath(keyDerivationScheme: KeyDerivationScheme | typeof ROLE_AUDIENCE_DERIVATION_SCHEME, recordsWriteMessage: RecordsWriteMessage): string[];
     /**
      * Constructs the full key derivation path using `protocolPath` scheme.
      *
@@ -47,17 +50,6 @@ export declare class Records {
      * its children (composing protocol) use different protocol URIs and thus different key trees.
      */
     static constructKeyDerivationPathUsingProtocolPathScheme(descriptor: RecordsWriteDescriptor): string[];
-    /**
-     * Constructs the full key derivation path using `protocolContext` scheme.
-     *
-     * NOTE on protocol composition: When a context tree spans two protocols via `$ref` composition,
-     * the root `contextId` segment (the `$ref` parent record's ID) is shared across both protocols.
-     * This means ProtocolContext-encrypted records from the composing protocol and the referenced
-     * protocol derive the same context key. This is by design — it enables multi-party access within
-     * a shared context (e.g., thread participants can decrypt messages from both the threads protocol
-     * and composing protocols that attach to those threads).
-     */
-    static constructKeyDerivationPathUsingProtocolContextScheme(contextId: string): string[];
     /**
      * Derives a descendant private key given an ancestor private key and the full absolute derivation path.
      * Uses X25519 keys for encryption key derivation.

package/dist/types/src/utils/records.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../../../src/utils/records.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAEnQ,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAUrD,OAAO,EAAY,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAS,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGzD;;GAEG;AACH,qBAAa,OAAO;IAElB;;OAEG;WACW,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,IAAI,mBAAmB;IAQrF;;OAEG;WACiB,qBAAqB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAM/G;;OAEG;WACiB,sBAAsB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAQjH;;;;;OAKG;WACiB,OAAO,CACzB,YAAY,EAAE,mBAAmB,EACjC,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,cAAc,CAAC,UAAU,CAAC,GACvC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAEtC;;;OAGG;WACiB,OAAO,CACzB,YAAY,EAAE,mBAAmB,EACjC,kBAAkB,EAAE,iBAAiB,EACrC,YAAY,EAAE,cAAc,CAAC,UAAU,CAAC,GACvC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAuEtC;;OAEG;WACW,0BAA0B,CACtC,mBAAmB,EAAE,mBAAmB,EACxC,mBAAmB,EAAE,mBAAmB,GACvC,MAAM,EAAE;IAgBX;;;;;;;OAOG;WACW,iDAAiD,CAAC,UAAU,EAAE,sBAAsB,GAAG,MAAM,EAAE;IAW7G;;;;;;;;;OASG;WACW,oDAAoD,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAY/F;;;OAGG;WACiB,gBAAgB,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAoBxI;;;OAGG;WACW,oDAAoD,CAChE,yBAAyB,EAAE,MAAM,EAAE,EACnC,2BAA2B,EAAE,MAAM,EAAE,GACpC,IAAI;IAYP;;OAEG;WACW,+BAA+B,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS;IAkBhG;;;;;OAKG;WACW,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa;IAyBnE;;;OAGG;WACW,oCAAoC,CAChD,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,YAAY,EACvB,aAAa,EAAE,MAAM,GACpB,IAAI;WAsBO,kBAAkB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,IAAI,gBAAgB;IAI5F;;OAEG;WACW,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS;IAShE;;OAEG;WACW,iBAAiB,CAAE,IAAI,EAAE;QAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAAA;KAAC,GAAG,MAAM;IAS7F;;;;;OAKG;WACW,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM;IA0D/E;;;;;;OAMG;WACiB,0CAA0C,CAC5D,OAAO,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,uBAAuB,EAC9I,sBAAsB,EAAE,uBAAuB,GAAG,SAAS,EAC3D,qBAAqB,CAAC,EAAE,uBAAuB,GAAG,SAAS,GAC1D,OAAO,CAAC,IAAI,CAAC;IAwFhB;;;;;;OAMG;WACW,eAAe,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,WAAW;IAmB/D;;OAEG;WACW,uBAAuB,CAAC,gBAAgB,EAAE,uBAAuB,GAAG,OAAO;IAIzF;;OAEG;WACW,8BAA8B,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO;IAK5E;;OAEG;WACW,gCAAgC,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO;IAQ9E;;;;;;;;;;OAUG;WACiB,iCAAiC,CACnD,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,cAAc,GACpC,OAAO,CAAC,OAAO,CAAC;IAenB;;;;;;OAMG;IACH,MAAM,CAAC,qCAAqC,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;IAQ/F;;;;;;OAMG;IACH,MAAM,CAAC,kCAAkC,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;CAO1F"}
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../../../src/utils/records.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAGjE,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACtG,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAInQ,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AASrD,OAAO,EAAY,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAc,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAAS,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGzD;;GAEG;AACH,qBAAa,OAAO;IAElB;;OAEG;WACW,cAAc,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,IAAI,mBAAmB;IAQrF;;OAEG;WACiB,qBAAqB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAM/G;;OAEG;WACiB,sBAAsB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAQjH;;;;;OAKG;WACiB,OAAO,CACzB,YAAY,EAAE,mBAAmB,EACjC,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,cAAc,CAAC,UAAU,CAAC,GACvC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAEtC;;;OAGG;WACiB,OAAO,CACzB,YAAY,EAAE,mBAAmB,EACjC,kBAAkB,EAAE,iBAAiB,EACrC,YAAY,EAAE,cAAc,CAAC,UAAU,CAAC,GACvC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;mBAiDjB,yBAAyB;IAiC9C,OAAO,CAAC,MAAM,CAAC,8BAA8B;IAqB7C;;OAEG;WACW,0BAA0B,CACtC,mBAAmB,EAAE,mBAAmB,GAAG,OAAO,+BAA+B,EACjF,mBAAmB,EAAE,mBAAmB,GACvC,MAAM,EAAE;IAiBX;;;;;;;OAOG;WACW,iDAAiD,CAAC,UAAU,EAAE,sBAAsB,GAAG,MAAM,EAAE;IAW7G;;;OAGG;WACiB,gBAAgB,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAoBxI;;;OAGG;WACW,oDAAoD,CAChE,yBAAyB,EAAE,MAAM,EAAE,EACnC,2BAA2B,EAAE,MAAM,EAAE,GACpC,IAAI;IAYP;;OAEG;WACW,+BAA+B,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS;IAkBhG;;;;;OAKG;WACW,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa;IAyBnE;;;OAGG;WACW,oCAAoC,CAChD,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,YAAY,EACvB,aAAa,EAAE,MAAM,GACpB,IAAI;WAsBO,kBAAkB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,IAAI,gBAAgB;IAI5F;;OAEG;WACW,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS;IAShE;;OAEG;WACW,iBAAiB,CAAE,IAAI,EAAE;QAAE,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAAA;KAAC,GAAG,MAAM;IAS7F;;;;;OAKG;WACW,aAAa,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM;IA0D/E;;;;;;OAMG;WACiB,0CAA0C,CAC5D,OAAO,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,oBAAoB,GAAG,uBAAuB,EAC9I,sBAAsB,EAAE,uBAAuB,GAAG,SAAS,EAC3D,qBAAqB,CAAC,EAAE,uBAAuB,GAAG,SAAS,GAC1D,OAAO,CAAC,IAAI,CAAC;IAwFhB;;;;;;OAMG;WACW,eAAe,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,WAAW;IAmB/D;;OAEG;WACW,uBAAuB,CAAC,gBAAgB,EAAE,uBAAuB,GAAG,OAAO;IAIzF;;OAEG;WACW,8BAA8B,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO;IAK5E;;OAEG;WACW,gCAAgC,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO;IAQ9E;;;;;;;;;;OAUG;WACiB,iCAAiC,CACnD,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,cAAc,GACpC,OAAO,CAAC,OAAO,CAAC;IAenB;;;;;;OAMG;IACH,MAAM,CAAC,qCAAqC,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;IAQ/F;;;;;;OAMG;IACH,MAAM,CAAC,kCAAkC,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;CAO1F"}

package/dist/types/src/utils/replication.d.ts

@@ -7,11 +7,14 @@ export declare class Replication {
     static readonly globalDomain = "";
     static protocolDomain(protocolUri: string): string;
     static permissionDomain(protocolUri: string): string;
+    static encryptionDomain(protocolUri: string): string;
+    static taggedCoreProtocolDomains(protocolUri: string, protocolsInScope?: ReadonlySet<string>): string[];
     static deriveStreamId(tenant: string): Promise<string>;
     static computeFingerprintScopes(message: GenericMessage, indexes: KeyValues): string[];
     static assertFingerprintScopesUntouched(persistedScopes: string[], message: GenericMessage, messageCid: string, newIndexes: KeyValues): void;
     private static scopeSetsMatch;
     private static throwFingerprintScopeMutation;
+    private static isCoreProtocolUri;
     static hashMessageCid(messageCid: string): Promise<Uint8Array>;
     static emptyFingerprint(): Uint8Array;
     static xorFingerprint(fingerprint: Uint8Array, contribution: Uint8Array): Uint8Array;

package/dist/types/src/utils/replication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replication.d.ts","sourceRoot":"","sources":["../../../../src/utils/replication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAWzD;;GAEG;AACH,qBAAa,WAAW;IACtB,gBAAuB,YAAY,MAAM;WAE3B,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAI3C,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAIvC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;WAOrD,wBAAwB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,EAAE;WAoB/E,gCAAgC,CAC5C,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,SAAS,GACpB,IAAI;IAOP,OAAO,CAAC,MAAM,CAAC,cAAc;IAQ7B,OAAO,CAAC,MAAM,CAAC,6BAA6B;WAOxB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;WAM7D,gBAAgB,IAAI,UAAU;WAI9B,cAAc,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,GAAG,UAAU;WAQ7E,gBAAgB,CAAC,WAAW,EAAE,UAAU,GAAG,MAAM;WAIjD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU;WAQzC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;CAW1D"}
+{"version":3,"file":"replication.d.ts","sourceRoot":"","sources":["../../../../src/utils/replication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAYzD;;GAEG;AACH,qBAAa,WAAW;IACtB,gBAAuB,YAAY,MAAM;WAE3B,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAI3C,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAI7C,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM;WAI7C,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,GAAE,WAAW,CAAC,MAAM,CAAa,GAAG,MAAM,EAAE;WAerG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;WAOrD,wBAAwB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,GAAG,MAAM,EAAE;WAsB/E,gCAAgC,CAC5C,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,SAAS,GACpB,IAAI;IAOP,OAAO,CAAC,MAAM,CAAC,cAAc;IAQ7B,OAAO,CAAC,MAAM,CAAC,6BAA6B;IAO5C,OAAO,CAAC,MAAM,CAAC,iBAAiB;WAIZ,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;WAM7D,gBAAgB,IAAI,UAAU;WAI9B,cAAc,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,GAAG,UAAU;WAQ7E,gBAAgB,CAAC,WAAW,EAAE,UAAU,GAAG,MAAM;WAIjD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU;WAQzC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;CAW1D"}

package/dist/types/tests/features/protocol-composition.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol-composition.spec.d.ts","sourceRoot":"","sources":["../../../../tests/features/protocol-composition.spec.ts"],"names":[],"mappings":"AAyBA;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CA6hF9C"}
+{"version":3,"file":"protocol-composition.spec.d.ts","sourceRoot":"","sources":["../../../../tests/features/protocol-composition.spec.ts"],"names":[],"mappings":"AAyBA;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CA4hF9C"}

package/dist/types/tests/handlers/messages-query.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messages-query.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/messages-query.spec.ts"],"names":[],"mappings":"AAyBA,wBAAgB,wBAAwB,IAAI,IAAI,CA6Q/C"}
+{"version":3,"file":"messages-query.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/messages-query.spec.ts"],"names":[],"mappings":"AAyBA,wBAAgB,wBAAwB,IAAI,IAAI,CAuV/C"}

package/dist/types/tests/handlers/records-read.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"records-read.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/records-read.spec.ts"],"names":[],"mappings":"AAkCA,wBAAgB,sBAAsB,IAAI,IAAI,CA2nE7C"}
+{"version":3,"file":"records-read.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/records-read.spec.ts"],"names":[],"mappings":"AAiCA,wBAAgB,sBAAsB,IAAI,IAAI,CA09D7C"}

package/dist/types/tests/handlers/records-write.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"records-write.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/records-write.spec.ts"],"names":[],"mappings":"AAqDA,wBAAgB,uBAAuB,IAAI,IAAI,CA0mJ9C"}
+{"version":3,"file":"records-write.spec.d.ts","sourceRoot":"","sources":["../../../../tests/handlers/records-write.spec.ts"],"names":[],"mappings":"AAmDA,wBAAgB,uBAAuB,IAAI,IAAI,CA26J9C"}

package/dist/types/tests/protocols/encryption.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=encryption.spec.d.ts.map

package/dist/types/tests/protocols/encryption.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.spec.d.ts","sourceRoot":"","sources":["../../../../tests/protocols/encryption.spec.ts"],"names":[],"mappings":""}

package/dist/types/tests/scenarios/end-to-end-tests.spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"end-to-end-tests.spec.d.ts","sourceRoot":"","sources":["../../../../tests/scenarios/end-to-end-tests.spec.ts"],"names":[],"mappings":"AAqBA,wBAAgB,qBAAqB,IAAI,IAAI,CAsP5C"}
+{"version":3,"file":"end-to-end-tests.spec.d.ts","sourceRoot":"","sources":["../../../../tests/scenarios/end-to-end-tests.spec.ts"],"names":[],"mappings":"AA8BA,wBAAgB,qBAAqB,IAAI,IAAI,CAsO5C"}

package/dist/types/tests/utils/test-data-generator.d.ts

@@ -285,8 +285,6 @@ export declare class TestDataGenerator {
      * @param input.encryptSymmetricKeyWithProtocolPathDerivedKey
      *        Set to `true` to attach the symmetric key encrypted by the protocol path derived public key
      *
-     * @param input.encryptSymmetricKeyWithProtocolContextDerivedKey
-     *        Set to `true` to attach the symmetric key encrypted by the protocol context derived public key
      */
     static generateProtocolEncryptedRecordsWrite(input: {
         plaintextBytes: Uint8Array;
@@ -295,10 +293,7 @@ export declare class TestDataGenerator {
         protocolDefinition: ProtocolDefinition;
         protocolPath: string;
         protocolParentContextId?: string;
-        protocolContextDerivingRootKeyId?: string;
-        protocolContextDerivedPublicKeyJwk?: PublicKeyJwk;
         encryptSymmetricKeyWithProtocolPathDerivedKey: boolean;
-        encryptSymmetricKeyWithProtocolContextDerivedKey: boolean;
     }): Promise<{
         message: RecordsWriteMessage;
         dataStream: ReadableStream<Uint8Array>;

package/dist/types/tests/utils/test-data-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-data-generator.d.ts","sourceRoot":"","sources":["../../../../tests/utils/test-data-generator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAK/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAOtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,KAAK,EAAqB,eAAe,EAA2C,MAAM,uCAAuC,CAAC;AACzI,OAAO,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAClM,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7I,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAmB,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChJ,OAAO,KAAK,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AASrG,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAG/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAGzE,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAGvE,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAUrE;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,aAAa,CAAA;KAAE,CAAC;IAChE,0FAA0F;IAC1F,iBAAiB,EAAE;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,aAAa,CAAA;KAAE,CAAC;IAC1E,MAAM,EAAE,aAAa,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;OAEG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,8BAA8B,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,yBAAyB,CAAC;IACnC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAA;CACF,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACvC,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,EAAE,8BAA8B,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IAEtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,IAAI,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;IAC5B,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACvC,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,UAAU,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACxC,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IACxC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,MAAM,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,oBAAoB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,oDAAoD;IACpD,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,OAAO,EAAE,wBAAwB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,oBAAoB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,EAAE,kBAS3C,CAAC;AAEF;;GAEG;AACH,qBAAa,iBAAiB;IAC5B;;OAEG;WACiB,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAyC/E;;;;OAIG;WACiB,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzF;;;;OAIG;WACiB,0BAA0B,CAC5C,KAAK,CAAC,EAAE,+BAA+B,GACtC,OAAO,CAAC,gCAAgC,CAAC;IAwC5C;;OAEG;WACiB,sBAAsB,CAAC,KAAK,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,4BAA4B,CAAC;WAuBlG,mBAAmB,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAmC7G;;;;;;;;;OASG;WACiB,oBAAoB,CAAC,KAAK,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAqDhH;;;;;;;;;;;;OAYG;WACiB,qCAAqC,CAAC,KAAK,EAAE;QAC/D,cAAc,EAAE,UAAU,CAAC;QAC3B,MAAM,EAAE,OAAO,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,kBAAkB,EAAE,kBAAkB,CAAC;QACvC,YAAY,EAAE,MAAM,CAAC;QACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,gCAAgC,CAAC,EAAE,MAAM,CAAC;QAC1C,kCAAkC,CAAC,EAAE,YAAY,CAAC;QAClD,6CAA6C,EAAE,OAAO,CAAC;QACvD,gDAAgD,EAAE,OAAO,CAAC;KAC3D,GAAG,OAAO,CAAC;QACV,OAAO,EAAE,mBAAmB,CAAC;QAC7B,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;QACvC,YAAY,EAAE,YAAY,CAAC;QAC3B,eAAe,EAAE,eAAe,CAAC;QACjC,kBAAkB,EAAE,UAAU,CAAC;KAChC,CAAC;IAuGF;;;;OAIG;WACiB,wBAAwB,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA8BxH;;OAEG;WACiB,oBAAoB,CAAC,KAAK,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAsChH;;OAEG;WACiB,wBAAwB,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,OAAO,CAAC,8BAA8B,CAAC;IAuC5H;;OAEG;WACiB,oBAAoB,CAAC,KAAK,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAoChH;;OAEG;WACiB,qBAAqB,CAAC,KAAK,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAgBnH;;OAEG;WACiB,yBAAyB,CAAC,KAAK,CAAC,EAAE,8BAA8B,GAAG,OAAO,CAAC,+BAA+B,CAAC;IAuB/H;;OAEG;WACiB,qBAAqB,CAAC,KAAK,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC;WAyB/F,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAmB/G;;OAEG;WACW,qBAAqB,IAAI,kBAAkB;IAMzD;;OAEG;WACW,8BAA8B,IAAI,UAAU;IAU1D;;OAEG;WACiB,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;IAQ5D;;OAEG;WACW,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAYlD;;OAEG;WACW,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASrD;;OAEG;WACiB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAO1D;;;;OAIG;WACW,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM;IAIzD;;;;OAIG;WACW,eAAe,CAAC,OAAO,CAAC,EAAE;QACtC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KACzI,GAAG,MAAM;IAcV;;OAEG;WACW,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB;IAiB9E;;OAEG;WACiB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC;CAgC9D"}
+{"version":3,"file":"test-data-generator.d.ts","sourceRoot":"","sources":["../../../../tests/utils/test-data-generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAK/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAOtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AACvF,OAAO,KAAK,EAAqB,eAAe,EAAuD,MAAM,uCAAuC,CAAC;AACrJ,OAAO,KAAK,EAAE,8BAA8B,EAAE,QAAQ,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAClM,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7I,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAmB,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAChJ,OAAO,KAAK,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAUrG,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAG/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAGvE,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AASrE;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,aAAa,CAAA;KAAE,CAAC;IAChE,0FAA0F;IAC1F,iBAAiB,EAAE;QAAE,SAAS,EAAE,YAAY,CAAC;QAAC,UAAU,EAAE,aAAa,CAAA;KAAE,CAAC;IAC1E,MAAM,EAAE,aAAa,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;OAEG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,8BAA8B,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,yBAAyB,CAAC;IACnC,kBAAkB,EAAE,kBAAkB,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE;QACP,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAA;CACF,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,qBAAqB,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACvC,YAAY,EAAE,YAAY,CAAC;IAC3B,kBAAkB,EAAE,8BAA8B,CAAC;CACpD,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IAEtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,IAAI,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,YAAY,CAAC;IAC5B,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACvC,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,UAAU,CAAC;IACvB,UAAU,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACxC,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IACxC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,MAAM,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,uBAAuB,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,OAAO,EAAE,mBAAmB,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,oBAAoB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG;IAC3C,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,oDAAoD;IACpD,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,OAAO,EAAE,wBAAwB,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,oBAAoB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,YAAY,EAAE,YAAY,CAAC;CAC5B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,EAAE,kBAS3C,CAAC;AAEF;;GAEG;AACH,qBAAa,iBAAiB;IAC5B;;OAEG;WACiB,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAyC/E;;;;OAIG;WACiB,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzF;;;;OAIG;WACiB,0BAA0B,CAC5C,KAAK,CAAC,EAAE,+BAA+B,GACtC,OAAO,CAAC,gCAAgC,CAAC;IAwC5C;;OAEG;WACiB,sBAAsB,CAAC,KAAK,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,4BAA4B,CAAC;WAuBlG,mBAAmB,CAAC,KAAK,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAmC7G;;;;;;;;;OASG;WACiB,oBAAoB,CAAC,KAAK,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAqDhH;;;;;;;;;;OAUG;WACiB,qCAAqC,CAAC,KAAK,EAAE;QAC/D,cAAc,EAAE,UAAU,CAAC;QAC3B,MAAM,EAAE,OAAO,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,kBAAkB,EAAE,kBAAkB,CAAC;QACvC,YAAY,EAAE,MAAM,CAAC;QACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,6CAA6C,EAAE,OAAO,CAAC;KACxD,GAAG,OAAO,CAAC;QACV,OAAO,EAAE,mBAAmB,CAAC;QAC7B,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;QACvC,YAAY,EAAE,YAAY,CAAC;QAC3B,eAAe,EAAE,eAAe,CAAC;QACjC,kBAAkB,EAAE,UAAU,CAAC;KAChC,CAAC;IA+DF;;;;OAIG;WACiB,wBAAwB,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IA8BxH;;OAEG;WACiB,oBAAoB,CAAC,KAAK,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAsChH;;OAEG;WACiB,wBAAwB,CAAC,KAAK,CAAC,EAAE,6BAA6B,GAAG,OAAO,CAAC,8BAA8B,CAAC;IAuC5H;;OAEG;WACiB,oBAAoB,CAAC,KAAK,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAoChH;;OAEG;WACiB,qBAAqB,CAAC,KAAK,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAgBnH;;OAEG;WACiB,yBAAyB,CAAC,KAAK,CAAC,EAAE,8BAA8B,GAAG,OAAO,CAAC,+BAA+B,CAAC;IAuB/H;;OAEG;WACiB,qBAAqB,CAAC,KAAK,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,2BAA2B,CAAC;WAyB/F,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAmB/G;;OAEG;WACW,qBAAqB,IAAI,kBAAkB;IAMzD;;OAEG;WACW,8BAA8B,IAAI,UAAU;IAU1D;;OAEG;WACiB,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;IAQ5D;;OAEG;WACW,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAYlD;;OAEG;WACW,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASrD;;OAEG;WACiB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAO1D;;;;OAIG;WACW,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM;IAIzD;;;;OAIG;WACW,eAAe,CAAC,OAAO,CAAC,EAAE;QACtC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KACzI,GAAG,MAAM;IAcV;;OAEG;WACW,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB;IAiB9E;;OAEG;WACiB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC;CAgC9D"}

package/dist/types/tests/validation/json-schemas/encryption/audience-key.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audience-key.spec.d.ts.map

package/dist/types/tests/validation/json-schemas/encryption/audience-key.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience-key.spec.d.ts","sourceRoot":"","sources":["../../../../../../tests/validation/json-schemas/encryption/audience-key.spec.ts"],"names":[],"mappings":""}

package/dist/types/tests/validation/json-schemas/encryption/grant-key.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=grant-key.spec.d.ts.map

package/dist/types/tests/validation/json-schemas/encryption/grant-key.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-key.spec.d.ts","sourceRoot":"","sources":["../../../../../../tests/validation/json-schemas/encryption/grant-key.spec.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enbox/dwn-sdk-js",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "A reference implementation of https://identity.foundation/decentralized-web-node/spec/",
   "repository": {
     "type": "git",
@@ -65,8 +65,8 @@
   "react-native": "./dist/esm/src/index.js",
   "dependencies": {
     "@enbox/common": "0.1.1",
-    "@enbox/crypto": "0.1.1",
-    "@enbox/dids": "0.1.1",
+    "@enbox/crypto": "0.1.2",
+    "@enbox/dids": "0.1.2",
     "@ipld/dag-cbor": "9.0.5",
     "@js-temporal/polyfill": "0.4.4",
     "@noble/ciphers": "0.5.3",

package/src/core/constants.ts

@@ -16,12 +16,12 @@ export const PERMISSIONS_REVOCATION_PATH = 'grant/revocation';
 export const PERMISSIONS_PROTOCOL_URI = 'https://identity.foundation/dwn/permissions';
 
 /**
- * Well-known key-delivery protocol URI used for encrypted context-key records.
+ * The DWN Encryption protocol URI.
  */
-export const KEY_DELIVERY_PROTOCOL_URI = 'https://identity.foundation/protocols/key-delivery';
+export const ENCRYPTION_PROTOCOL_URI = 'https://identity.foundation/dwn/protocols/encryption';
 
 const RECORDS_PRIMARY_PROJECTION_EXCLUDED_PROTOCOLS = new Set<string>([
-  KEY_DELIVERY_PROTOCOL_URI,
+  ENCRYPTION_PROTOCOL_URI,
   PERMISSIONS_PROTOCOL_URI,
 ]);
 

package/src/core/core-protocol.ts

@@ -35,7 +35,7 @@ export interface CoreProtocol {
    * Called after protocol authorization but before storage.
    * @throws DwnError to reject the write with the appropriate status code.
    */
-  validateRecord?(message: RecordsWriteMessage, dataBytes: Uint8Array): void;
+  validateRecord?(message: RecordsWriteMessage, dataBytes: Uint8Array): Promise<void> | void;
 
   /**
    * Pre-processing hook: runs before storing a record under this protocol.

package/src/core/dwn-error.ts

@@ -20,6 +20,22 @@ export enum DwnErrorCode {
   ComputeCidCodecNotSupported = 'ComputeCidCodecNotSupported',
   ComputeCidMultihashNotSupported = 'ComputeCidMultihashNotSupported',
   Ed25519InvalidJwk = 'Ed25519InvalidJwk',
+  EncryptionProtocolValidateAudienceEpochEncrypted = 'EncryptionProtocolValidateAudienceEpochEncrypted',
+  EncryptionProtocolValidateAudienceEpochKeyIdMismatch = 'EncryptionProtocolValidateAudienceEpochKeyIdMismatch',
+  EncryptionProtocolValidateAudienceEpochMissing = 'EncryptionProtocolValidateAudienceEpochMissing',
+  EncryptionProtocolValidateAudienceKeyRecipientMissing = 'EncryptionProtocolValidateAudienceKeyRecipientMissing',
+  EncryptionProtocolValidateAudienceKeyRoleRecordMissing = 'EncryptionProtocolValidateAudienceKeyRoleRecordMissing',
+  EncryptionProtocolValidateAudienceMissingRequiredTag = 'EncryptionProtocolValidateAudienceMissingRequiredTag',
+  EncryptionProtocolValidateAudienceTagsMismatch = 'EncryptionProtocolValidateAudienceTagsMismatch',
+  EncryptionProtocolValidateAudienceWriterUnauthorized = 'EncryptionProtocolValidateAudienceWriterUnauthorized',
+  EncryptionProtocolValidateEncryptedDeliveryMissingEncryption = 'EncryptionProtocolValidateEncryptedDeliveryMissingEncryption',
+  EncryptionProtocolValidateGrantKeyAuthorMismatch = 'EncryptionProtocolValidateGrantKeyAuthorMismatch',
+  EncryptionProtocolValidateGrantKeyGrantScopeMismatch = 'EncryptionProtocolValidateGrantKeyGrantScopeMismatch',
+  EncryptionProtocolValidateGrantKeyMissingRequiredTag = 'EncryptionProtocolValidateGrantKeyMissingRequiredTag',
+  EncryptionProtocolValidateGrantKeyRecipientMismatch = 'EncryptionProtocolValidateGrantKeyRecipientMismatch',
+  EncryptionProtocolValidateRoleAudienceContextInvalid = 'EncryptionProtocolValidateRoleAudienceContextInvalid',
+  EncryptionProtocolValidateRoleAudienceInvalid = 'EncryptionProtocolValidateRoleAudienceInvalid',
+  EncryptionProtocolValidateSchemaUnexpectedRecord = 'EncryptionProtocolValidateSchemaUnexpectedRecord',
   EventLogNotOpenError = 'EventLogNotOpenError',
   EventLogProgressGap = 'EventLogProgressGap',
   MessagesGrantAuthorizationMismatchedProtocol = 'MessagesGrantAuthorizationMismatchedProtocol',
@@ -101,6 +117,10 @@ export enum DwnErrorCode {
   ProtocolAuthorizationInitialWriteRevalidationNotInitial = 'ProtocolAuthorizationInitialWriteRevalidationNotInitial',
   ProtocolAuthorizationDuplicateRoleRecipient = 'ProtocolAuthorizationDuplicateRoleRecipient',
   ProtocolAuthorizationEncryptionRequired = 'ProtocolAuthorizationEncryptionRequired',
+  ProtocolAuthorizationEncryptionKeyAgreementMissing = 'ProtocolAuthorizationEncryptionKeyAgreementMissing',
+  ProtocolAuthorizationEncryptionProtocolPathEntryMissing = 'ProtocolAuthorizationEncryptionProtocolPathEntryMissing',
+  ProtocolAuthorizationEncryptionRoleAudienceEntryMissing = 'ProtocolAuthorizationEncryptionRoleAudienceEntryMissing',
+  ProtocolAuthorizationEncryptionRoleAudienceEpochMissing = 'ProtocolAuthorizationEncryptionRoleAudienceEpochMissing',
   ProtocolAuthorizationImmutableRecord = 'ProtocolAuthorizationImmutableRecord',
   ProtocolAuthorizationInvalidSchema = 'ProtocolAuthorizationInvalidSchema',
   ProtocolAuthorizationInvalidType = 'ProtocolAuthorizationInvalidType',
@@ -142,6 +162,10 @@ export enum DwnErrorCode {
   ProtocolsConfigureInvalidActionUpdateWithoutCreate = 'ProtocolsConfigureInvalidActionUpdateWithoutCreate',
   ProtocolsConfigureInvalidCrossProtocolOf = 'ProtocolsConfigureInvalidCrossProtocolOf',
   ProtocolsConfigureInvalidCrossProtocolRole = 'ProtocolsConfigureInvalidCrossProtocolRole',
+  ProtocolsConfigureInvalidEncryptedAnyoneRead = 'ProtocolsConfigureInvalidEncryptedAnyoneRead',
+  ProtocolsConfigureInvalidEncryptedRoleMissingKeyAgreement = 'ProtocolsConfigureInvalidEncryptedRoleMissingKeyAgreement',
+  ProtocolsConfigureMissingEncryptedPathKeyAgreement = 'ProtocolsConfigureMissingEncryptedPathKeyAgreement',
+  ProtocolsConfigureMissingTopLevelKeyAgreement = 'ProtocolsConfigureMissingTopLevelKeyAgreement',
   ProtocolsConfigureInvalidRecipientOfAction = 'ProtocolsConfigureInvalidRecipientOfAction',
   ProtocolsConfigureInvalidRuleSetRecordType = 'ProtocolsConfigureInvalidRuleSetRecordType',
   ProtocolsConfigureInvalidTagSchema = 'ProtocolsConfigureInvalidTagSchema',
@@ -158,6 +182,7 @@ export enum DwnErrorCode {
   RecordsAuthorDelegatedGrantGrantedToAndOwnerSignatureMismatch = 'RecordsAuthorDelegatedGrantGrantedToAndOwnerSignatureMismatch',
   RecordsAuthorDelegatedGrantNotADelegatedGrant = 'RecordsAuthorDelegatedGrantNotADelegatedGrant',
   RecordsDecryptNoMatchingKeyEncryptedFound = 'RecordsDecryptNoMatchingKeyEncryptedFound',
+  RecordsDecryptUnsupportedKeyDerivationScheme = 'RecordsDecryptUnsupportedKeyDerivationScheme',
   RecordsCountFilterMissingRequiredProperties = 'RecordsCountFilterMissingRequiredProperties',
   RecordsCountNestedProtocolPathContextIdInvalid = 'RecordsCountNestedProtocolPathContextIdInvalid',
 
@@ -194,6 +219,7 @@ export enum DwnErrorCode {
   RecordsWriteCreateMissingSigner = 'RecordsWriteCreateMissingSigner',
   RecordsWriteCreateDataAndDataCidMutuallyExclusive = 'RecordsWriteCreateDataAndDataCidMutuallyExclusive',
   RecordsWriteCreateDataCidAndDataSizeMutuallyInclusive = 'RecordsWriteCreateDataCidAndDataSizeMutuallyInclusive',
+  RecordsWriteCreateEncryptionAndEncryptionInputMutuallyExclusive = 'RecordsWriteCreateEncryptionAndEncryptionInputMutuallyExclusive',
   RecordsWriteCreateMissingProtocol = 'RecordsWriteCreateMissingProtocol',
   RecordsWriteDataCidMismatch = 'RecordsWriteDataCidMismatch',
   RecordsWriteDataSizeMismatch = 'RecordsWriteDataSizeMismatch',
@@ -204,7 +230,6 @@ export enum DwnErrorCode {
   RecordsWriteMissingSigner = 'RecordsWriteMissingSigner',
   RecordsWriteMissingDataInPrevious = 'RecordsWriteMissingDataInPrevious',
   RecordsWriteMissingEncodedDataInPrevious = 'RecordsWriteMissingEncodedDataInPrevious',
-  RecordsWriteMissingEncryption = 'RecordsWriteMissingEncryption',
 
   RecordsWriteNotAllowedAfterDelete = 'RecordsWriteNotAllowedAfterDelete',
   RecordsWriteOwnerAndTenantMismatch = 'RecordsWriteOwnerAndTenantMismatch',
@@ -214,7 +239,10 @@ export enum DwnErrorCode {
   RecordsWriteValidateIntegrityContextIdMismatch = 'RecordsWriteValidateIntegrityContextIdMismatch',
   RecordsWriteValidateIntegrityContextIdNotInSignerSignaturePayload = 'RecordsWriteValidateIntegrityContextIdNotInSignerSignaturePayload',
   RecordsWriteValidateIntegrityDateCreatedMismatch = 'RecordsWriteValidateIntegrityDateCreatedMismatch',
+  RecordsWriteValidateIntegrityEncryptionCidMissing = 'RecordsWriteValidateIntegrityEncryptionCidMissing',
   RecordsWriteValidateIntegrityEncryptionCidMismatch = 'RecordsWriteValidateIntegrityEncryptionCidMismatch',
+  RecordsWriteValidateIntegrityEncryptionEphemeralPublicKeyInvalid = 'RecordsWriteValidateIntegrityEncryptionEphemeralPublicKeyInvalid',
+  RecordsWriteValidateIntegrityEncryptionInitializationVectorInvalid = 'RecordsWriteValidateIntegrityEncryptionInitializationVectorInvalid',
   RecordsWriteValidateIntegrityRecordIdUnauthorized = 'RecordsWriteValidateIntegrityRecordIdUnauthorized',
   SchemaValidatorAdditionalPropertyNotAllowed = 'SchemaValidatorAdditionalPropertyNotAllowed',
   SchemaValidatorFailure = 'SchemaValidatorFailure',

package/src/core/messages-grant-authorization.ts

@@ -8,6 +8,7 @@ import type { DataEncodedRecordsWriteMessage, RecordsDeleteMessage, RecordsWrite
 import type { MessagesQueryMessage, MessagesReadMessage, MessagesSubscribeMessage } from '../types/messages-types.js';
 
 import { DwnInterfaceName } from '../enums/dwn-interface-method.js';
+import { EncryptionProtocol } from '../protocols/encryption.js';
 import { GrantAuthorization } from './grant-authorization.js';
 import { PermissionScopeMatcher } from '../utils/permission-scope.js';
 import { PermissionsProtocol } from '../protocols/permissions.js';
@@ -240,6 +241,10 @@ export class MessagesGrantAuthorization {
       );
     }
 
+    if (recordsWriteMessage.descriptor.protocol === EncryptionProtocol.uri) {
+      return MessagesGrantAuthorization.isEncryptionRecordScopeAuthorized(recordsWriteMessage, incomingScope);
+    }
+
     return PermissionScopeMatcher.matches(incomingScope, MessagesGrantAuthorization.getRecordsScopeTarget(recordsWriteMessage));
   }
 
@@ -263,6 +268,23 @@ export class MessagesGrantAuthorization {
       && PermissionScopeMatcher.matches(incomingScope, permissionScope);
   }
 
+  private static isEncryptionRecordScopeAuthorized(
+    recordsWriteMessage: RecordsWriteMessage,
+    incomingScope: MessagesPermissionScope,
+  ): boolean {
+    const tags = recordsWriteMessage.descriptor.tags;
+    const protocol = tags?.protocol;
+    if (typeof protocol !== 'string') {
+      return false;
+    }
+
+    return PermissionScopeMatcher.matches(incomingScope, {
+      protocol,
+      protocolPath : MessagesGrantAuthorization.getStringTag(recordsWriteMessage, 'protocolPath'),
+      contextId    : MessagesGrantAuthorization.getStringTag(recordsWriteMessage, 'contextId'),
+    });
+  }
+
   private static isProtocolsConfigureScopeAuthorized(
     protocolsConfigureMessage: ProtocolsConfigureMessage,
     incomingScope: MessagesPermissionScope
@@ -291,6 +313,11 @@ export class MessagesGrantAuthorization {
     return { protocol, protocolPath, contextId };
   }
 
+  private static getStringTag(recordsWriteMessage: RecordsWriteMessage, tag: string): string | undefined {
+    const value = recordsWriteMessage.descriptor.tags?.[tag];
+    return typeof value === 'string' ? value : undefined;
+  }
+
   private static isSubtreeScope(scope: MessagesPermissionScope): boolean {
     return scope.protocolPath !== undefined || scope.contextId !== undefined;
   }

package/src/core/protocol-authorization-validation.ts

@@ -1,14 +1,16 @@
 import type { RecordsWrite } from '../interfaces/records-write.js';
 import type { RecordsWriteMessage } from '../types/records-types.js';
+import type { RoleAudienceKeyEncryption } from '../utils/encryption.js';
 import type { ValidationStateReader } from '../types/validation-state-reader.js';
-import type { ProtocolDefinition, ProtocolRuleSet, ProtocolType, ProtocolTypes } from '../types/protocols-types.js';
-
-import { ProtocolRecordLimitStrategy } from '../types/protocols-types.js';
+import type { ProtocolActionRule, ProtocolDefinition, ProtocolRuleSet, ProtocolType, ProtocolTypes } from '../types/protocols-types.js';
 
+import { KeyDerivationScheme } from '../utils/hd-key.js';
 import { Records } from '../utils/records.js';
 import { validateProtocolTags } from '../utils/protocol-tags.js';
 import { DwnError, DwnErrorCode } from './dwn-error.js';
-import { getTypeName, parseCrossProtocolRef } from '../utils/protocols.js';
+import { Encryption, ROLE_AUDIENCE_DERIVATION_SCHEME } from '../utils/encryption.js';
+import { getRuleSetAtPath, getTypeName, parseCrossProtocolRef } from '../utils/protocols.js';
+import { ProtocolAction, ProtocolRecordLimitStrategy } from '../types/protocols-types.js';
 
 /**
  * Verifies the `protocolPath` declared in the given message matches the path of actual record chain.
@@ -170,7 +172,14 @@ export async function verifyTypeWithComposition(
     tenant, declaredProtocolPath, protocolDefinition, validationStateReader, protocolDefinitionTimestamp
   );
 
-  verifyType(inboundMessage, protocolTypes, declaredTypeName);
+  const protocolType = verifyType(inboundMessage, protocolTypes, declaredTypeName);
+  await verifyProtocolPathEncryptionIfNeeded(
+    tenant,
+    inboundMessage,
+    protocolDefinition,
+    protocolType,
+    validationStateReader,
+  );
 }
 
 /**
@@ -216,7 +225,7 @@ export function verifyType(
   inboundMessage: RecordsWriteMessage,
   protocolTypes: ProtocolTypes,
   typeName?: string,
-): void {
+): ProtocolType {
   const declaredTypeName = typeName ?? getTypeName(inboundMessage.descriptor.protocolPath);
   const typeNames = Object.keys(protocolTypes);
 
@@ -254,6 +263,136 @@ export function verifyType(
       `type '${declaredTypeName}' requires encryption but message has no encryption metadata`
     );
   }
+
+  return protocolType;
+}
+
+async function verifyProtocolPathEncryptionIfNeeded(
+  tenant: string,
+  inboundMessage: RecordsWriteMessage,
+  protocolDefinition: ProtocolDefinition,
+  protocolType: ProtocolType,
+  validationStateReader: ValidationStateReader,
+): Promise<void> {
+  if (protocolType.encryptionRequired !== true) {
+    return;
+  }
+
+  const ruleSet = getRuleSetAtPath(inboundMessage.descriptor.protocolPath, protocolDefinition.structure);
+  if (ruleSet?.$keyAgreement?.publicKeyJwk === undefined) {
+    throw new DwnError(
+      DwnErrorCode.ProtocolAuthorizationEncryptionKeyAgreementMissing,
+      `encrypted protocol path '${inboundMessage.descriptor.protocolPath}' has no $keyAgreement`
+    );
+  }
+
+  const publicKeyJwk = ruleSet.$keyAgreement.publicKeyJwk;
+  const keyId = await Encryption.getKeyId(publicKeyJwk);
+  const hasProtocolPathEntry = inboundMessage.encryption!.keyEncryption.some((entry): boolean =>
+    entry.derivationScheme === KeyDerivationScheme.ProtocolPath && entry.keyId === keyId
+  );
+
+  if (!hasProtocolPathEntry) {
+    throw new DwnError(
+      DwnErrorCode.ProtocolAuthorizationEncryptionProtocolPathEntryMissing,
+      `encrypted record is missing a protocolPath keyEncryption entry for '${inboundMessage.descriptor.protocolPath}'`
+    );
+  }
+
+  await verifyRoleAudienceEncryptionIfNeeded(tenant, inboundMessage, protocolDefinition, ruleSet, validationStateReader);
+}
+
+async function verifyRoleAudienceEncryptionIfNeeded(
+  tenant: string,
+  inboundMessage: RecordsWriteMessage,
+  protocolDefinition: ProtocolDefinition,
+  ruleSet: ProtocolRuleSet,
+  validationStateReader: ValidationStateReader,
+): Promise<void> {
+  const readRoleRules = (ruleSet.$actions ?? []).filter((actionRule): boolean =>
+    actionRule.role !== undefined && actionRule.can.includes(ProtocolAction.Read)
+  );
+
+  for (const actionRule of readRoleRules) {
+    const roleAudience = resolveRoleAudience(actionRule, inboundMessage, protocolDefinition);
+    if (roleAudience === undefined) {
+      continue;
+    }
+
+    const matchingEntry = inboundMessage.encryption!.keyEncryption.find((entry): entry is RoleAudienceKeyEncryption =>
+      entry.derivationScheme === ROLE_AUDIENCE_DERIVATION_SCHEME &&
+      entry.protocol === roleAudience.protocol &&
+      entry.role === roleAudience.role
+    );
+
+    if (matchingEntry === undefined) {
+      throw new DwnError(
+        DwnErrorCode.ProtocolAuthorizationEncryptionRoleAudienceEntryMissing,
+        `encrypted record is missing a roleAudience keyEncryption entry for role '${roleAudience.role}'`
+      );
+    }
+
+    const matchingEpochs = await validationStateReader.queryAudienceEpochs({
+      tenant,
+      protocol  : roleAudience.protocol,
+      contextId : roleAudience.contextId,
+      role      : roleAudience.role,
+      epoch     : matchingEntry.epoch,
+      keyId     : matchingEntry.keyId,
+    });
+
+    if (matchingEpochs.length === 0) {
+      throw new DwnError(
+        DwnErrorCode.ProtocolAuthorizationEncryptionRoleAudienceEpochMissing,
+        `encrypted record references a missing audienceEpoch for role '${roleAudience.role}'`
+      );
+    }
+  }
+}
+
+function resolveRoleAudience(
+  actionRule: ProtocolActionRule,
+  inboundMessage: RecordsWriteMessage,
+  protocolDefinition: ProtocolDefinition,
+): { protocol: string; role: string; contextId: string } | undefined {
+  const roleRef = actionRule.role;
+  if (roleRef === undefined) {
+    return undefined;
+  }
+
+  const parsed = parseCrossProtocolRef(roleRef);
+  const protocol = parsed === undefined
+    ? inboundMessage.descriptor.protocol
+    : protocolDefinition.uses?.[parsed.alias];
+  const role = parsed === undefined ? roleRef : parsed.protocolPath;
+  if (protocol === undefined) {
+    return undefined;
+  }
+
+  const contextId = getRoleAudienceContextId(inboundMessage, role);
+  return contextId === undefined ? undefined : { protocol, role, contextId };
+}
+
+function getRoleAudienceContextId(
+  inboundMessage: RecordsWriteMessage,
+  rolePath: string,
+): string | undefined {
+  const parentDepth = rolePath.split('/').length - 1;
+  if (parentDepth === 0) {
+    return '';
+  }
+
+  const contextId = inboundMessage.contextId;
+  if (typeof contextId !== 'string') {
+    return undefined;
+  }
+
+  const contextSegments = contextId.split('/');
+  if (contextSegments.length < parentDepth) {
+    return undefined;
+  }
+
+  return contextSegments.slice(0, parentDepth).join('/');
 }
 
 /**