@enbox/dwn-sdk-js 0.4.4 → 0.4.6

package/dist/esm/src/utils/encryption.js

@@ -1,225 +1,185 @@
 import { concatBytes } from '@noble/ciphers/utils';
+import { AesCtr, AesKw, computeJwkThumbprint, Hkdf, X25519 } from '@enbox/crypto';
 import { Encoder } from './encoder.js';
 import { KeyDerivationScheme } from './hd-key.js';
-import { AesGcm, AesKw, ConcatKdf, X25519, XChaCha20Poly1305 } from '@enbox/crypto';
-/**
- * Content encryption algorithms supported by the DWN.
- * Both are AEAD (Authenticated Encryption with Associated Data) ciphers.
- */
+import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 export var ContentEncryptionAlgorithm;
 (function (ContentEncryptionAlgorithm) {
-    /** AES-256 in Galois/Counter Mode. NIST-approved, hardware-accelerated. 96-bit nonce. */
-    ContentEncryptionAlgorithm["A256GCM"] = "A256GCM";
-    /** XChaCha20-Poly1305. 192-bit nonce (safe to randomize). Constant-time. */
-    ContentEncryptionAlgorithm["XC20P"] = "XC20P";
+    ContentEncryptionAlgorithm["A256CTR"] = "A256CTR";
 })(ContentEncryptionAlgorithm || (ContentEncryptionAlgorithm = {}));
-/**
- * Key agreement algorithm used by the DWN.
- * ECDH-ES with X25519 key agreement and AES-256 Key Wrap.
- */
 export var KeyAgreementAlgorithm;
 (function (KeyAgreementAlgorithm) {
-    KeyAgreementAlgorithm["EcdhEsA256kw"] = "ECDH-ES+A256KW";
+    KeyAgreementAlgorithm["X25519HkdfSha256A256Kw"] = "X25519-HKDF-SHA256+A256KW";
 })(KeyAgreementAlgorithm || (KeyAgreementAlgorithm = {}));
-/** Size of the AES-GCM authentication tag in bytes. */
-const AES_GCM_TAG_LENGTH_BYTES = 16;
-/** Size of the Poly1305 authentication tag in bytes. */
-const POLY1305_TAG_LENGTH_BYTES = 16;
-/**
- * Utility class for DWN encryption operations using JWE (RFC 7516).
- * Uses ECDH-ES+A256KW key agreement with X25519 and either AES-256-GCM or XChaCha20-Poly1305
- * for authenticated content encryption.
- */
+export const ROLE_AUDIENCE_DERIVATION_SCHEME = 'roleAudience';
+const AES_256_KEY_LENGTH_BYTES = 32;
+const AES_CTR_COUNTER_LENGTH_BYTES = 16;
+const AES_CTR_COUNTER_LENGTH_BITS = 128;
+const KEK_INFO_PREFIX = KeyAgreementAlgorithm.X25519HkdfSha256A256Kw;
 export class Encryption {
-    /**
-     * Encrypts data using an AEAD cipher (A256GCM or XC20P).
-     * Returns ciphertext with the authentication tag appended.
-     */
-    static async aeadEncrypt(algorithm, keyBytes, iv, plaintext) {
-        if (algorithm === ContentEncryptionAlgorithm.A256GCM) {
-            const keyJwk = { kty: 'oct', k: Encoder.bytesToBase64Url(keyBytes), alg: 'A256GCM' };
-            // Web Crypto AES-GCM returns ciphertext || tag
-            const combined = await AesGcm.encrypt({ data: plaintext, iv, key: keyJwk });
-            const ciphertext = combined.slice(0, combined.length - AES_GCM_TAG_LENGTH_BYTES);
-            const tag = combined.slice(combined.length - AES_GCM_TAG_LENGTH_BYTES);
-            return { ciphertext, tag };
-        }
-        else if (algorithm === ContentEncryptionAlgorithm.XC20P) {
-            // @noble/ciphers XChaCha20-Poly1305 returns ciphertext || tag
-            const combined = await XChaCha20Poly1305.encryptRaw({ data: plaintext, keyBytes, nonce: iv });
-            const ciphertext = combined.slice(0, combined.length - POLY1305_TAG_LENGTH_BYTES);
-            const tag = combined.slice(combined.length - POLY1305_TAG_LENGTH_BYTES);
-            return { ciphertext, tag };
-        }
-        else {
-            throw new Error(`Unsupported content encryption algorithm: ${algorithm}`);
-        }
+    static async encrypt(algorithm, keyBytes, initializationVector, plaintext) {
+        Encryption.validateContentEncryptionParameters(algorithm, keyBytes, initializationVector);
+        return AesCtr.encrypt({
+            counter: initializationVector,
+            data: plaintext,
+            key: Encryption.toA256CtrJwk(keyBytes),
+            length: AES_CTR_COUNTER_LENGTH_BITS,
+        });
     }
-    /**
-     * Decrypts data using an AEAD cipher (A256GCM or XC20P).
-     * Expects ciphertext and tag as separate inputs.
-     */
-    static async aeadDecrypt(algorithm, keyBytes, iv, ciphertext, tag) {
-        // Both Web Crypto (AES-GCM) and @noble/ciphers (XChaCha20-Poly1305) expect ciphertext || tag
-        const combined = concatBytes(ciphertext, tag);
-        if (algorithm === ContentEncryptionAlgorithm.A256GCM) {
-            const keyJwk = { kty: 'oct', k: Encoder.bytesToBase64Url(keyBytes), alg: 'A256GCM' };
-            return AesGcm.decrypt({ data: combined, iv, key: keyJwk });
-        }
-        else if (algorithm === ContentEncryptionAlgorithm.XC20P) {
-            return XChaCha20Poly1305.decryptRaw({ data: combined, keyBytes, nonce: iv });
-        }
-        else {
-            throw new Error(`Unsupported content encryption algorithm: ${algorithm}`);
-        }
+    static async decrypt(algorithm, keyBytes, initializationVector, ciphertext) {
+        Encryption.validateContentEncryptionParameters(algorithm, keyBytes, initializationVector);
+        return AesCtr.decrypt({
+            counter: initializationVector,
+            data: ciphertext,
+            key: Encryption.toA256CtrJwk(keyBytes),
+            length: AES_CTR_COUNTER_LENGTH_BITS,
+        });
     }
-    /**
-     * Encrypts data as a ReadableStream using an AEAD cipher.
-     * Collects all chunks, encrypts, and returns a new stream of ciphertext || tag.
-     * The iv and tag are NOT embedded in the stream — they are stored in the JWE structure.
-     */
-    static async aeadEncryptStream(algorithm, keyBytes, iv, plaintextStream) {
+    static async encryptStream(algorithm, keyBytes, initializationVector, plaintextStream) {
         const plaintext = await Encryption.readStream(plaintextStream);
-        const { ciphertext, tag } = await Encryption.aeadEncrypt(algorithm, keyBytes, iv, plaintext);
-        const ciphertextStream = new ReadableStream({
-            start(controller) {
-                controller.enqueue(ciphertext);
-                controller.close();
-            }
-        });
-        return { ciphertextStream, tag };
+        const ciphertext = await Encryption.encrypt(algorithm, keyBytes, initializationVector, plaintext);
+        return Encryption.toStream(ciphertext);
     }
-    /**
-     * Decrypts a ciphertext stream using an AEAD cipher.
-     * Returns a ReadableStream of plaintext.
-     */
-    static async aeadDecryptStream(algorithm, keyBytes, iv, ciphertextStream, tag) {
+    static async decryptStream(algorithm, keyBytes, initializationVector, ciphertextStream) {
         const ciphertext = await Encryption.readStream(ciphertextStream);
-        const plaintext = await Encryption.aeadDecrypt(algorithm, keyBytes, iv, ciphertext, tag);
-        return new ReadableStream({
-            start(controller) {
-                controller.enqueue(plaintext);
-                controller.close();
-            }
-        });
+        const plaintext = await Encryption.decrypt(algorithm, keyBytes, initializationVector, ciphertext);
+        return Encryption.toStream(plaintext);
     }
-    /**
-     * Performs ECDH-ES key agreement with X25519 and wraps the CEK using AES-256 Key Wrap.
-     *
-     * @param ephemeralPrivateKey - Ephemeral X25519 private key (JWK).
-     * @param recipientPublicKey - Recipient's X25519 public key (JWK).
-     * @param cek - The Content Encryption Key to wrap.
-     * @returns The wrapped CEK bytes.
-     */
-    static async ecdhEsWrapKey(ephemeralPrivateKey, recipientPublicKey, cek) {
-        // 1. ECDH shared secret
+    static async wrapKey(recipientPublicKey, cek, keyInput, ephemeralPrivateKey) {
+        return Encryption.wrapX25519Key(recipientPublicKey, cek, keyInput, ephemeralPrivateKey);
+    }
+    static async wrapX25519Key(recipientPublicKey, cek, keyInput, ephemeralPrivateKey) {
+        Encryption.validateContentEncryptionKey(cek);
+        const privateKey = ephemeralPrivateKey ?? await X25519.generateKey();
+        const publicKey = await X25519.getPublicKey({ key: privateKey });
         const sharedSecret = await X25519.sharedSecret({
-            privateKeyA: ephemeralPrivateKey,
+            privateKeyA: privateKey,
             publicKeyB: recipientPublicKey,
         });
-        // 2. Derive KEK via Concat KDF (RFC 7518 Section 4.6.2)
-        const kek = await ConcatKdf.deriveKey({
-            sharedSecret,
-            keyDataLen: 256,
-            fixedInfo: {
-                algorithmId: 'A256KW',
-                partyUInfo: '',
-                partyVInfo: '',
-                suppPubInfo: 256,
-            },
-        });
-        // 3. AES-256 Key Wrap
-        const cekJwk = { kty: 'oct', k: Encoder.bytesToBase64Url(cek), alg: 'A256GCM' };
-        const kekJwk = { kty: 'oct', k: Encoder.bytesToBase64Url(kek), alg: 'A256KW' };
-        const wrappedKey = await AesKw.wrapKey({ unwrappedKey: cekJwk, encryptionKey: kekJwk });
-        return wrappedKey;
-    }
-    /**
-     * Performs ECDH-ES key agreement with X25519 and unwraps the CEK using AES-256 Key Unwrap.
-     *
-     * @param recipientPrivateKey - Recipient's X25519 private key (JWK).
-     * @param ephemeralPublicKey - Ephemeral X25519 public key from the JWE recipient header (JWK).
-     * @param wrappedKey - The wrapped CEK bytes.
-     * @returns The unwrapped CEK bytes.
-     */
-    static async ecdhEsUnwrapKey(recipientPrivateKey, ephemeralPublicKey, wrappedKey) {
-        // 1. ECDH shared secret
+        const kek = await Encryption.deriveKek(sharedSecret, keyInput);
+        const cekJwk = Encryption.toA256CtrJwk(cek);
+        const kekJwk = { alg: 'A256KW', k: Encoder.bytesToBase64Url(kek), kty: 'oct' };
+        const encryptedKey = await AesKw.wrapKey({ encryptionKey: kekJwk, unwrappedKey: cekJwk });
+        return { encryptedKey, ephemeralPublicKey: publicKey };
+    }
+    static async unwrapKey(recipientPrivateKey, keyEncryption) {
+        if (keyEncryption.algorithm === KeyAgreementAlgorithm.X25519HkdfSha256A256Kw) {
+            return Encryption.unwrapX25519Key(recipientPrivateKey, keyEncryption);
+        }
+        throw new Error(`Unsupported key agreement algorithm: ${keyEncryption.algorithm}`);
+    }
+    static async unwrapX25519Key(recipientPrivateKey, keyEncryption) {
         const sharedSecret = await X25519.sharedSecret({
             privateKeyA: recipientPrivateKey,
-            publicKeyB: ephemeralPublicKey,
+            publicKeyB: keyEncryption.ephemeralPublicKey,
         });
-        // 2. Derive KEK via Concat KDF
-        const kek = await ConcatKdf.deriveKey({
-            sharedSecret,
-            keyDataLen: 256,
-            fixedInfo: {
-                algorithmId: 'A256KW',
-                partyUInfo: '',
-                partyVInfo: '',
-                suppPubInfo: 256,
-            },
-        });
-        // 3. AES-256 Key Unwrap
-        const kekJwk = { kty: 'oct', k: Encoder.bytesToBase64Url(kek), alg: 'A256KW' };
+        const kek = await Encryption.deriveKek(sharedSecret, keyEncryption);
+        const kekJwk = { alg: 'A256KW', k: Encoder.bytesToBase64Url(kek), kty: 'oct' };
         const unwrappedJwk = await AesKw.unwrapKey({
-            wrappedKeyBytes: wrappedKey,
-            wrappedKeyAlgorithm: 'A256GCM',
             decryptionKey: kekJwk,
+            wrappedKeyAlgorithm: ContentEncryptionAlgorithm.A256CTR,
+            wrappedKeyBytes: Encoder.base64UrlToBytes(keyEncryption.encryptedKey),
         });
         return Encoder.base64UrlToBytes(unwrappedJwk.k);
     }
-    /**
-     * Builds a JWE encryption property structure from encryption input.
-     * The ciphertext (encrypted record data) is stored separately in the DataStore,
-     * so only the key wrapping metadata, IV, and authentication tag are included here.
-     *
-     * @param encryptionInput - Describes the CEK, IV, and recipient key encryption inputs.
-     * @param tag - The authentication tag produced by the AEAD cipher during data encryption.
-     */
-    static async buildJwe(encryptionInput, tag) {
-        const enc = encryptionInput.algorithm ?? ContentEncryptionAlgorithm.A256GCM;
-        const protectedHeader = {
-            alg: KeyAgreementAlgorithm.EcdhEsA256kw,
-            enc,
-        };
-        const protectedHeaderBase64url = Encoder.stringToBase64Url(JSON.stringify(protectedHeader));
-        const recipients = [];
+    static async buildEncryptionProperty(encryptionInput) {
+        const algorithm = encryptionInput.algorithm ?? ContentEncryptionAlgorithm.A256CTR;
+        Encryption.validateContentEncryptionParameters(algorithm, encryptionInput.key, encryptionInput.initializationVector);
+        const keyEncryption = [];
         for (const keyInput of encryptionInput.keyEncryptionInputs) {
-            // Generate ephemeral X25519 key pair for each recipient
-            const ephemeralPrivateKey = await X25519.generateKey();
-            const ephemeralPublicKey = await X25519.getPublicKey({ key: ephemeralPrivateKey });
-            // Wrap the CEK
-            const wrappedKey = await Encryption.ecdhEsWrapKey(ephemeralPrivateKey, keyInput.publicKey, encryptionInput.key);
-            const recipientHeader = {
-                kid: keyInput.publicKeyId,
-                epk: ephemeralPublicKey,
-                derivationScheme: keyInput.derivationScheme,
+            keyEncryption.push(await Encryption.buildKeyEncryptionEntry(encryptionInput.key, keyInput));
+        }
+        return {
+            algorithm,
+            initializationVector: Encoder.bytesToBase64Url(encryptionInput.initializationVector),
+            keyEncryption,
+        };
+    }
+    static async getKeyId(publicKeyJwk) {
+        return computeJwkThumbprint({ jwk: publicKeyJwk });
+    }
+    static validateEncryptionProperty(encryption) {
+        const initializationVector = Encoder.base64UrlToBytes(encryption.initializationVector);
+        if (initializationVector.byteLength !== AES_CTR_COUNTER_LENGTH_BYTES) {
+            throw new DwnError(DwnErrorCode.RecordsWriteValidateIntegrityEncryptionInitializationVectorInvalid, `A256CTR initializationVector must decode to ${AES_CTR_COUNTER_LENGTH_BYTES} bytes.`);
+        }
+        for (const entry of encryption.keyEncryption) {
+            Encryption.validateKeyEncryptionEntry(entry);
+        }
+    }
+    static async buildKeyEncryptionEntry(cek, keyInput) {
+        const { encryptedKey, ephemeralPublicKey } = await Encryption.wrapKey(keyInput.publicKey, cek, keyInput);
+        const common = {
+            algorithm: KeyAgreementAlgorithm.X25519HkdfSha256A256Kw,
+            encryptedKey: Encoder.bytesToBase64Url(encryptedKey),
+            ephemeralPublicKey,
+            keyId: keyInput.keyId,
+        };
+        if (keyInput.derivationScheme === KeyDerivationScheme.ProtocolPath) {
+            return {
+                ...common,
+                derivationScheme: KeyDerivationScheme.ProtocolPath,
             };
-            // Attach derived public key for protocolContext scheme
-            if (keyInput.derivationScheme === KeyDerivationScheme.ProtocolContext) {
-                recipientHeader.derivedPublicKey = keyInput.publicKey;
-            }
-            recipients.push({
-                header: recipientHeader,
-                encrypted_key: Encoder.bytesToBase64Url(wrappedKey),
-            });
         }
         return {
-            protected: protectedHeaderBase64url,
-            iv: Encoder.bytesToBase64Url(encryptionInput.initializationVector),
-            tag: Encoder.bytesToBase64Url(tag),
-            recipients,
+            ...common,
+            derivationScheme: ROLE_AUDIENCE_DERIVATION_SCHEME,
+            epoch: keyInput.epoch,
+            protocol: keyInput.protocol,
+            role: keyInput.role,
         };
     }
-    /**
-     * Parses the JWE protected header from its base64url encoding.
-     */
-    static parseProtectedHeader(protectedBase64url) {
-        return Encoder.base64UrlToObject(protectedBase64url);
+    static validateKeyEncryptionEntry(entry) {
+        if (entry.algorithm === KeyAgreementAlgorithm.X25519HkdfSha256A256Kw) {
+            Encryption.validateX25519KeyEncryptionEntry(entry);
+            return;
+        }
+        throw new DwnError(DwnErrorCode.RecordsWriteValidateIntegrityEncryptionEphemeralPublicKeyInvalid, `Unsupported key agreement algorithm: ${entry.algorithm}`);
+    }
+    static validateX25519KeyEncryptionEntry(entry) {
+        if (entry.ephemeralPublicKey.kty !== 'OKP' || entry.ephemeralPublicKey.crv !== 'X25519') {
+            throw new DwnError(DwnErrorCode.RecordsWriteValidateIntegrityEncryptionEphemeralPublicKeyInvalid, 'ephemeralPublicKey must be an OKP X25519 public key.');
+        }
+    }
+    static async deriveKek(sharedSecret, keyEncryption) {
+        Encryption.validateSharedSecret(sharedSecret);
+        const info = Encryption.getKekInfo(keyEncryption);
+        return Hkdf.deriveKeyBytes({
+            baseKeyBytes: sharedSecret,
+            hash: 'SHA-256',
+            info,
+            length: 256,
+            salt: new Uint8Array(),
+        });
+    }
+    static getKekInfo(keyEncryption) {
+        if (keyEncryption.derivationScheme === ROLE_AUDIENCE_DERIVATION_SCHEME) {
+            return `${KEK_INFO_PREFIX}|roleAudience|${keyEncryption.protocol}|${keyEncryption.role}|${keyEncryption.epoch}|${keyEncryption.keyId}`;
+        }
+        return `${KEK_INFO_PREFIX}|protocolPath|${keyEncryption.keyId}`;
+    }
+    static validateContentEncryptionParameters(algorithm, keyBytes, initializationVector) {
+        if (algorithm !== ContentEncryptionAlgorithm.A256CTR) {
+            throw new Error(`Unsupported content encryption algorithm: ${algorithm}`);
+        }
+        Encryption.validateContentEncryptionKey(keyBytes);
+        if (initializationVector.byteLength !== AES_CTR_COUNTER_LENGTH_BYTES) {
+            throw new Error(`A256CTR initializationVector must be ${AES_CTR_COUNTER_LENGTH_BYTES} bytes.`);
+        }
+    }
+    static validateContentEncryptionKey(keyBytes) {
+        if (keyBytes.byteLength !== AES_256_KEY_LENGTH_BYTES) {
+            throw new Error(`A256CTR content encryption key must be ${AES_256_KEY_LENGTH_BYTES} bytes.`);
+        }
+    }
+    static validateSharedSecret(sharedSecret) {
+        if (sharedSecret.every((byte) => byte === 0)) {
+            throw new Error('X25519 shared secret MUST NOT be all zeros.');
+        }
+    }
+    static toA256CtrJwk(keyBytes) {
+        return { alg: ContentEncryptionAlgorithm.A256CTR, k: Encoder.bytesToBase64Url(keyBytes), kty: 'oct' };
     }
-    /**
-     * Reads a ReadableStream to completion and returns all bytes concatenated.
-     */
     static async readStream(stream) {
         const reader = stream.getReader();
         const chunks = [];
@@ -232,5 +192,13 @@ export class Encryption {
         }
         return concatBytes(...chunks);
     }
+    static toStream(data) {
+        return new ReadableStream({
+            start(controller) {
+                controller.enqueue(data);
+                controller.close();
+            }
+        });
+    }
 }
 //# sourceMappingURL=encryption.js.map

package/dist/esm/src/utils/encryption.js.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../../../src/utils/encryption.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEpF;;;GAGG;AACH,MAAM,CAAN,IAAY,0BAKX;AALD,WAAY,0BAA0B;IACpC,yFAAyF;IACzF,iDAAmB,CAAA;IACnB,4EAA4E;IAC5E,6CAAe,CAAA;AACjB,CAAC,EALW,0BAA0B,KAA1B,0BAA0B,QAKrC;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,qBAEX;AAFD,WAAY,qBAAqB;IAC/B,wDAA+B,CAAA;AACjC,CAAC,EAFW,qBAAqB,KAArB,qBAAqB,QAEhC;AAED,uDAAuD;AACvD,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC,wDAAwD;AACxD,MAAM,yBAAyB,GAAG,EAAE,CAAC;AA2FrC;;;;GAIG;AACH,MAAM,OAAO,UAAU;IAErB;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,WAAW,CAC7B,SAAqC,EACrC,QAAoB,EACpB,EAAc,EACd,SAAqB;QAErB,IAAI,SAAS,KAAK,0BAA0B,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,MAAM,GAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;YAC1F,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5E,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,wBAAwB,CAAC,CAAC;YACjF,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,wBAAwB,CAAC,CAAC;YACvE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAE7B,CAAC;aAAM,IAAI,SAAS,KAAK,0BAA0B,CAAC,KAAK,EAAE,CAAC;YAC1D,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9F,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,yBAAyB,CAAC,CAAC;YAClF,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,yBAAyB,CAAC,CAAC;YACxE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAE7B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAmB,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,WAAW,CAC7B,SAAqC,EACrC,QAAoB,EACpB,EAAc,EACd,UAAsB,EACtB,GAAe;QAEf,6FAA6F;QAC7F,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAE9C,IAAI,SAAS,KAAK,0BAA0B,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,MAAM,GAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;YAC1F,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7D,CAAC;aAAM,IAAI,SAAS,KAAK,0BAA0B,CAAC,KAAK,EAAE,CAAC;YAC1D,OAAO,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAE/E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAmB,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,KAAK,CAAC,iBAAiB,CACnC,SAAqC,EACrC,QAAoB,EACpB,EAAc,EACd,eAA2C;QAE3C,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAC/D,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAC7F,MAAM,gBAAgB,GAAG,IAAI,cAAc,CAAa;YACtD,KAAK,CAAC,UAAU;gBACd,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAC/B,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;SACF,CAAC,CAAC;QACH,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC;IACnC,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,iBAAiB,CACnC,SAAqC,EACrC,QAAoB,EACpB,EAAc,EACd,gBAA4C,EAC5C,GAAe;QAEf,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;QACzF,OAAO,IAAI,cAAc,CAAa;YACpC,KAAK,CAAC,UAAU;gBACd,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC9B,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,aAAa,CAC/B,mBAAwB,EACxB,kBAAuB,EACvB,GAAe;QAEf,wBAAwB;QACxB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;YAC7C,WAAW,EAAG,mBAAmB;YACjC,UAAU,EAAI,kBAAkB;SACjC,CAAC,CAAC;QAEH,wDAAwD;QACxD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC;YACpC,YAAY;YACZ,UAAU,EAAG,GAAG;YAChB,SAAS,EAAI;gBACX,WAAW,EAAG,QAAQ;gBACtB,UAAU,EAAI,EAAE;gBAChB,UAAU,EAAI,EAAE;gBAChB,WAAW,EAAG,GAAG;aAClB;SACF,CAAC,CAAC;QAEH,sBAAsB;QACtB,MAAM,MAAM,GAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACrF,MAAM,MAAM,GAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACpF,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;QAExF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,eAAe,CACjC,mBAAwB,EACxB,kBAAuB,EACvB,UAAsB;QAEtB,wBAAwB;QACxB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;YAC7C,WAAW,EAAG,mBAAmB;YACjC,UAAU,EAAI,kBAAkB;SACjC,CAAC,CAAC;QAEH,+BAA+B;QAC/B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC;YACpC,YAAY;YACZ,UAAU,EAAG,GAAG;YAChB,SAAS,EAAI;gBACX,WAAW,EAAG,QAAQ;gBACtB,UAAU,EAAI,EAAE;gBAChB,UAAU,EAAI,EAAE;gBAChB,WAAW,EAAG,GAAG;aAClB;SACF,CAAC,CAAC;QAEH,wBAAwB;QACxB,MAAM,MAAM,GAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACpF,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;YACzC,eAAe,EAAO,UAAU;YAChC,mBAAmB,EAAG,SAAS;YAC/B,aAAa,EAAS,MAAM;SAC7B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAE,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAC1B,eAAgC,EAChC,GAAe;QAEf,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,IAAI,0BAA0B,CAAC,OAAO,CAAC;QAC5E,MAAM,eAAe,GAAuB;YAC1C,GAAG,EAAE,qBAAqB,CAAC,YAAY;YACvC,GAAG;SACJ,CAAC;QAEF,MAAM,wBAAwB,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;QAE5F,MAAM,UAAU,GAAmB,EAAE,CAAC;QACtC,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC;YAC3D,wDAAwD;YACxD,MAAM,mBAAmB,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YACvD,MAAM,kBAAkB,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAEnF,eAAe;YACf,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,aAAa,CAC/C,mBAAmB,EACnB,QAAQ,CAAC,SAAgB,EACzB,eAAe,CAAC,GAAG,CACpB,CAAC;YAEF,MAAM,eAAe,GAAuB;gBAC1C,GAAG,EAAgB,QAAQ,CAAC,WAAW;gBACvC,GAAG,EAAgB,kBAAkC;gBACrD,gBAAgB,EAAG,QAAQ,CAAC,gBAAgB;aAC7C,CAAC;YAEF,uDAAuD;YACvD,IAAI,QAAQ,CAAC,gBAAgB,KAAM,mBAAmB,CAAC,eAAuC,EAAE,CAAC;gBAC/F,eAAe,CAAC,gBAAgB,GAAG,QAAQ,CAAC,SAAS,CAAC;YACxD,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,MAAM,EAAU,eAAe;gBAC/B,aAAa,EAAG,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,SAAS,EAAG,wBAAwB;YACpC,EAAE,EAAU,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,oBAAoB,CAAC;YAC1E,GAAG,EAAS,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC;YACzC,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,oBAAoB,CAAC,kBAA0B;QAC3D,OAAO,OAAO,CAAC,iBAAiB,CAAC,kBAAkB,CAAuB,CAAC;IAC7E,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAkC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI,EAAE,CAAC;gBAAC,MAAM;YAAC,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,WAAW,CAAC,GAAG,MAAM,CAAC,CAAC;IAChC,CAAC;CACF"}
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../../../src/utils/encryption.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAElF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,CAAN,IAAY,0BAEX;AAFD,WAAY,0BAA0B;IACpC,iDAAmB,CAAA;AACrB,CAAC,EAFW,0BAA0B,KAA1B,0BAA0B,QAErC;AAED,MAAM,CAAN,IAAY,qBAEX;AAFD,WAAY,qBAAqB;IAC/B,6EAAoD,CAAA;AACtD,CAAC,EAFW,qBAAqB,KAArB,qBAAqB,QAEhC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,cAAc,CAAC;AAE9D,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AACxC,MAAM,eAAe,GAAG,qBAAqB,CAAC,sBAAsB,CAAC;AA+DrE,MAAM,OAAO,UAAU;IACd,MAAM,CAAC,KAAK,CAAC,OAAO,CACzB,SAAqC,EACrC,QAAoB,EACpB,oBAAgC,EAChC,SAAqB;QAErB,UAAU,CAAC,mCAAmC,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QAC1F,OAAO,MAAM,CAAC,OAAO,CAAC;YACpB,OAAO,EAAG,oBAAoB;YAC9B,IAAI,EAAM,SAAS;YACnB,GAAG,EAAO,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC;YAC3C,MAAM,EAAI,2BAA2B;SACtC,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,OAAO,CACzB,SAAqC,EACrC,QAAoB,EACpB,oBAAgC,EAChC,UAAsB;QAEtB,UAAU,CAAC,mCAAmC,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QAC1F,OAAO,MAAM,CAAC,OAAO,CAAC;YACpB,OAAO,EAAG,oBAAoB;YAC9B,IAAI,EAAM,UAAU;YACpB,GAAG,EAAO,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC;YAC3C,MAAM,EAAI,2BAA2B;SACtC,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,aAAa,CAC/B,SAAqC,EACrC,QAAoB,EACpB,oBAAgC,EAChC,eAA2C;QAE3C,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC;QAClG,OAAO,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,aAAa,CAC/B,SAAqC,EACrC,QAAoB,EACpB,oBAAgC,EAChC,gBAA4C;QAE5C,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC;QAClG,OAAO,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,OAAO,CACzB,kBAAgC,EAChC,GAAe,EACf,QAA4B,EAC5B,mBAAyB;QAEzB,OAAO,UAAU,CAAC,aAAa,CAAC,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC1F,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,aAAa,CAChC,kBAAgC,EAChC,GAAe,EACf,QAAkC,EAClC,mBAAyB;QAEzB,UAAU,CAAC,4BAA4B,CAAC,GAAG,CAAC,CAAC;QAE7C,MAAM,UAAU,GAAG,mBAAmB,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QACrE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAiB,CAAC;QACjF,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;YAC7C,WAAW,EAAG,UAAU;YACxB,UAAU,EAAI,kBAAyB;SACxC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACpF,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QAE1F,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC;IACzD,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,SAAS,CAC3B,mBAAwB,EACxB,aAA4B;QAE5B,IAAI,aAAa,CAAC,SAAS,KAAK,qBAAqB,CAAC,sBAAsB,EAAE,CAAC;YAC7E,OAAO,UAAU,CAAC,eAAe,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,wCAAyC,aAA+B,CAAC,SAAS,EAAE,CAAC,CAAC;IACxG,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,eAAe,CAClC,mBAAwB,EACxB,aAAkC;QAElC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;YAC7C,WAAW,EAAG,mBAAmB;YACjC,UAAU,EAAI,aAAa,CAAC,kBAAyB;SACtD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QACpE,MAAM,MAAM,GAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACpF,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC;YACzC,aAAa,EAAS,MAAM;YAC5B,mBAAmB,EAAG,0BAA0B,CAAC,OAAO;YACxD,eAAe,EAAO,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,YAAY,CAAC;SAC3E,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAE,CAAC,CAAC;IACnD,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,uBAAuB,CACzC,eAAgC;QAEhC,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,IAAI,0BAA0B,CAAC,OAAO,CAAC;QAClF,UAAU,CAAC,mCAAmC,CAAC,SAAS,EAAE,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,oBAAoB,CAAC,CAAC;QAErH,MAAM,aAAa,GAAoB,EAAE,CAAC;QAC1C,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC;YAC3D,aAAa,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,uBAAuB,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9F,CAAC;QAED,OAAO;YACL,SAAS;YACT,oBAAoB,EAAE,OAAO,CAAC,gBAAgB,CAAC,eAAe,CAAC,oBAAoB,CAAC;YACpF,aAAa;SACd,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,YAA0B;QACrD,OAAO,oBAAoB,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IACrD,CAAC;IAEM,MAAM,CAAC,0BAA0B,CAAC,UAAyB;QAChE,MAAM,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;QACvF,IAAI,oBAAoB,CAAC,UAAU,KAAK,4BAA4B,EAAE,CAAC;YACrE,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,kEAAkE,EAC/E,+CAA+C,4BAA4B,SAAS,CACrF,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC7C,UAAU,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAC1C,GAAe,EACf,QAA4B;QAE5B,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,CACnE,QAAQ,CAAC,SAAS,EAClB,GAAG,EACH,QAAQ,CACT,CAAC;QACF,MAAM,MAAM,GAAG;YACb,SAAS,EAAM,qBAAqB,CAAC,sBAAsB;YAC3D,YAAY,EAAG,OAAO,CAAC,gBAAgB,CAAC,YAAY,CAAC;YACrD,kBAAkB;YAClB,KAAK,EAAU,QAAQ,CAAC,KAAK;SAC9B,CAAC;QAEF,IAAI,QAAQ,CAAC,gBAAgB,KAAK,mBAAmB,CAAC,YAAY,EAAE,CAAC;YACnE,OAAO;gBACL,GAAG,MAAM;gBACT,gBAAgB,EAAE,mBAAmB,CAAC,YAAY;aACnD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG,MAAM;YACT,gBAAgB,EAAG,+BAA+B;YAClD,KAAK,EAAc,QAAQ,CAAC,KAAK;YACjC,QAAQ,EAAW,QAAQ,CAAC,QAAQ;YACpC,IAAI,EAAe,QAAQ,CAAC,IAAI;SACjC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,0BAA0B,CAAC,KAAoB;QAC5D,IAAI,KAAK,CAAC,SAAS,KAAK,qBAAqB,CAAC,sBAAsB,EAAE,CAAC;YACrE,UAAU,CAAC,gCAAgC,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,gEAAgE,EAC7E,wCAAyC,KAAuB,CAAC,SAAS,EAAE,CAC7E,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,gCAAgC,CAAC,KAA0B;QACxE,IAAI,KAAK,CAAC,kBAAkB,CAAC,GAAG,KAAK,KAAK,IAAI,KAAK,CAAC,kBAAkB,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACxF,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,gEAAgE,EAC7E,sDAAsD,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,SAAS,CAC5B,YAAwB,EACxB,aAA6D;QAE7D,UAAU,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,cAAc,CAAC;YACzB,YAAY,EAAG,YAAY;YAC3B,IAAI,EAAW,SAAS;YACxB,IAAI;YACJ,MAAM,EAAS,GAAG;YAClB,IAAI,EAAW,IAAI,UAAU,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,UAAU,CAAC,aAA6D;QACrF,IAAI,aAAa,CAAC,gBAAgB,KAAK,+BAA+B,EAAE,CAAC;YACvE,OAAO,GAAG,eAAe,iBAAiB,aAAa,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,IAAI,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;QACzI,CAAC;QAED,OAAO,GAAG,eAAe,iBAAiB,aAAa,CAAC,KAAK,EAAE,CAAC;IAClE,CAAC;IAEO,MAAM,CAAC,mCAAmC,CAChD,SAAqC,EACrC,QAAoB,EACpB,oBAAgC;QAEhC,IAAI,SAAS,KAAK,0BAA0B,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAmB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,UAAU,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,oBAAoB,CAAC,UAAU,KAAK,4BAA4B,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,wCAAwC,4BAA4B,SAAS,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,4BAA4B,CAAC,QAAoB;QAC9D,IAAI,QAAQ,CAAC,UAAU,KAAK,wBAAwB,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,0CAA0C,wBAAwB,SAAS,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,oBAAoB,CAAC,YAAwB;QAC1D,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAW,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,QAAoB;QAC9C,OAAO,EAAE,GAAG,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACxG,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAkC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,WAAW,CAAC,GAAG,MAAM,CAAC,CAAC;IAChC,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,IAAgB;QACtC,OAAO,IAAI,cAAc,CAAa;YACpC,KAAK,CAAC,UAAU;gBACd,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACzB,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/esm/src/utils/hd-key.js

@@ -4,7 +4,6 @@ import { X25519 } from '@enbox/crypto';
 import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 export var KeyDerivationScheme;
 (function (KeyDerivationScheme) {
-    KeyDerivationScheme["ProtocolContext"] = "protocolContext";
     KeyDerivationScheme["ProtocolPath"] = "protocolPath";
 })(KeyDerivationScheme || (KeyDerivationScheme = {}));
 /**

package/dist/esm/src/utils/hd-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"hd-key.js","sourceRoot":"","sources":["../../../../src/utils/hd-key.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,CAAN,IAAY,mBAGX;AAHD,WAAY,mBAAmB;IAC7B,0DAAmC,CAAA;IACnC,oDAA6B,CAAA;AAC/B,CAAC,EAHW,mBAAmB,KAAnB,mBAAmB,QAG9B;AASD;;GAEG;AACH,MAAM,OAAO,KAAK;IAChB;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAA8B,EAAE,iBAA2B;QAC9F,MAAM,kBAAkB,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACzG,MAAM,gCAAgC,GAAG,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC;QAC1E,MAAM,sBAAsB,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;QACxG,MAAM,oBAAoB,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACzG,MAAM,2BAA2B,GAAsB;YACrD,SAAS,EAAW,WAAW,CAAC,SAAS;YACzC,gBAAgB,EAAI,WAAW,CAAC,gBAAgB;YAChD,cAAc,EAAM,CAAC,GAAG,gCAAgC,EAAE,GAAG,iBAAiB,CAAC;YAC/E,iBAAiB,EAAG,oBAAqC;SAC1D,CAAC;QAEF,OAAO,2BAA2B,CAAC;IACrC,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,WAA8B,EAAE,iBAA2B;QAC7F,MAAM,2BAA2B,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACjG,MAAM,0BAA0B,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,2BAA2B,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAErH,OAAO,0BAA0C,CAAC;IACpD,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAsB,EAAE,YAAsB;QACtF,KAAK,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAE9C,IAAI,iBAAiB,GAAG,UAAU,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACpD,iBAAiB,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC;gBACjD,aAAa,EAAQ,SAAS;gBAC9B,kBAAkB,EAAG,iBAAiB;gBACtC,IAAI,EAAiB,YAAY,EAAE,sEAAsE;gBACzG,gBAAgB,EAAK,EAAE,CAAC,sBAAsB;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAKtC;QACC,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QAE7E,MAAM,SAAS,GAAG,kBAAkB,EAAkB,CAAC;QAEvD,mGAAmG;QACnG,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,kBAAkC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAEnI,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACrD;YACE,IAAI,EAAG,MAAM;YACb,IAAI,EAAG,aAAa;YACpB,IAAI,EAAG,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,8CAA8C;YACxE,IAAI,EAAG,IAAoB;SAC5B,EACD,YAAY,EACZ,gBAAgB,GAAG,CAAC,CAAC,6BAA6B;SACnD,CAAC;QAEF,0CAA0C;QAC1C,MAAM,eAAe,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACzD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,yBAAyB,CAAC,YAAsB;QAC7D,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,0BAA0B,EAAE,gCAAgC,YAAY,EAAE,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"hd-key.js","sourceRoot":"","sources":["../../../../src/utils/hd-key.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,CAAN,IAAY,mBAEX;AAFD,WAAY,mBAAmB;IAC7B,oDAA6B,CAAA;AAC/B,CAAC,EAFW,mBAAmB,KAAnB,mBAAmB,QAE9B;AAUD;;GAEG;AACH,MAAM,OAAO,KAAK;IAChB;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAA8B,EAAE,iBAA2B;QAC9F,MAAM,kBAAkB,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACzG,MAAM,gCAAgC,GAAG,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC;QAC1E,MAAM,sBAAsB,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;QACxG,MAAM,oBAAoB,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,eAAe,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACzG,MAAM,2BAA2B,GAAsB;YACrD,SAAS,EAAW,WAAW,CAAC,SAAS;YACzC,gBAAgB,EAAI,WAAW,CAAC,gBAAgB;YAChD,cAAc,EAAM,CAAC,GAAG,gCAAgC,EAAE,GAAG,iBAAiB,CAAC;YAC/E,iBAAiB,EAAG,oBAAqC;SAC1D,CAAC;QAEF,OAAO,2BAA2B,CAAC;IACrC,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,WAA8B,EAAE,iBAA2B;QAC7F,MAAM,2BAA2B,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACjG,MAAM,0BAA0B,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,2BAA2B,CAAC,iBAAiB,EAAE,CAAC,CAAC;QAErH,OAAO,0BAA0C,CAAC;IACpD,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAsB,EAAE,YAAsB;QACtF,KAAK,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAE9C,IAAI,iBAAiB,GAAG,UAAU,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACpD,iBAAiB,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC;gBACjD,aAAa,EAAQ,SAAS;gBAC9B,kBAAkB,EAAG,iBAAiB;gBACtC,IAAI,EAAiB,YAAY,EAAE,sEAAsE;gBACzG,gBAAgB,EAAK,EAAE,CAAC,sBAAsB;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAKtC;QACC,MAAM,EAAE,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QAE7E,MAAM,SAAS,GAAG,kBAAkB,EAAkB,CAAC;QAEvD,mGAAmG;QACnG,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,kBAAkC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAEnI,6CAA6C;QAC7C,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACrD;YACE,IAAI,EAAG,MAAM;YACb,IAAI,EAAG,aAAa;YACpB,IAAI,EAAG,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,8CAA8C;YACxE,IAAI,EAAG,IAAoB;SAC5B,EACD,YAAY,EACZ,gBAAgB,GAAG,CAAC,CAAC,6BAA6B;SACnD,CAAC;QAEF,0CAA0C;QAC1C,MAAM,eAAe,GAAG,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACzD,OAAO,eAAe,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,yBAAyB,CAAC,YAAsB;QAC7D,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,0BAA0B,EAAE,gCAAgC,YAAY,EAAE,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;CACF"}

package/dist/esm/src/utils/permission-scope.js

@@ -3,9 +3,9 @@
  *
  * Matching fails closed for invalid combinations: `protocolPath` and
  * `contextId` are mutually exclusive, and either field requires `protocol`.
- * `protocol` and `protocolPath` match by exact equality. `contextId` scopes
- * match a context subtree: the target context must equal the scoped context or
- * begin with the scoped context followed by `/`.
+ * `protocol` matches by exact equality. `protocolPath` and `contextId` scopes
+ * match subtrees: the target value must equal the scoped value or begin with the
+ * scoped value followed by `/`.
  */
 export class PermissionScopeMatcher {
     /**
@@ -22,7 +22,7 @@ export class PermissionScopeMatcher {
             return false;
         }
         if (scope.protocolPath !== undefined) {
-            return scope.protocolPath === target.protocolPath;
+            return PermissionScopeMatcher.matchesSubtree(scope.protocolPath, target.protocolPath);
         }
         if (scope.contextId !== undefined) {
             return PermissionScopeMatcher.matchesContextId(scope.contextId, target.contextId);
@@ -30,8 +30,11 @@ export class PermissionScopeMatcher {
         return true;
     }
     static matchesContextId(scopeContextId, candidateContextId) {
-        return typeof candidateContextId === 'string' &&
-            (candidateContextId === scopeContextId || candidateContextId.startsWith(scopeContextId + '/'));
+        return PermissionScopeMatcher.matchesSubtree(scopeContextId, candidateContextId);
+    }
+    static matchesSubtree(scopeValue, candidateValue) {
+        return typeof candidateValue === 'string' &&
+            (candidateValue === scopeValue || candidateValue.startsWith(scopeValue + '/'));
     }
 }
 //# sourceMappingURL=permission-scope.js.map

package/dist/esm/src/utils/permission-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-scope.js","sourceRoot":"","sources":["../../../../src/utils/permission-scope.ts"],"names":[],"mappings":"AAaA;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAsB;IACjC;;OAEG;IACI,MAAM,CAAC,OAAO,CAAC,KAAoB,EAAE,MAAqB;QAC/D,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACxG,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC;QACpD,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,cAAsB,EAAE,kBAA2B;QACjF,OAAO,OAAO,kBAAkB,KAAK,QAAQ;YAC3C,CAAC,kBAAkB,KAAK,cAAc,IAAI,kBAAkB,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC;IACnG,CAAC;CACF"}
+{"version":3,"file":"permission-scope.js","sourceRoot":"","sources":["../../../../src/utils/permission-scope.ts"],"names":[],"mappings":"AAaA;;;;;;;;GAQG;AACH,MAAM,OAAO,sBAAsB;IACjC;;OAEG;IACI,MAAM,CAAC,OAAO,CAAC,KAAoB,EAAE,MAAqB;QAC/D,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACxG,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,sBAAsB,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QACxF,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,gBAAgB,CAAC,cAAsB,EAAE,kBAA2B;QACjF,OAAO,sBAAsB,CAAC,cAAc,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACnF,CAAC;IAEO,MAAM,CAAC,cAAc,CAAC,UAAkB,EAAE,cAAuB;QACvE,OAAO,OAAO,cAAc,KAAK,QAAQ;YACvC,CAAC,cAAc,KAAK,UAAU,IAAI,cAAc,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC;IACnF,CAAC;CACF"}

package/dist/esm/src/utils/protocols.js

@@ -52,7 +52,7 @@ export function getRuleSetAtPath(protocolPath, structure) {
  * Class containing Protocol related utility methods.
  */
 export class Protocols {
-    // Implementation dispatches based on argument type
+    // Implementation dispatches based on argument type.
     static async deriveAndInjectPublicEncryptionKeys(protocolDefinition, rootKeyIdOrKeyDeriver, privateJwk) {
         // clone before modify
         const clone = JSON.parse(JSON.stringify(protocolDefinition));
@@ -60,6 +60,9 @@ export class Protocols {
             // Callback-based path
             const keyDeriver = rootKeyIdOrKeyDeriver;
             const basePath = [KeyDerivationScheme.ProtocolPath, protocolDefinition.protocol];
+            clone.$keyAgreement = {
+                publicKeyJwk: await keyDeriver.derivePublicKey(basePath),
+            };
             async function injectKeysViaCallback(ruleSet, parentPath) {
                 for (const key in ruleSet) {
                     if (!key.startsWith('$')) {
@@ -72,10 +75,7 @@ export class Protocols {
                             continue;
                         }
                         const publicKeyJwk = await keyDeriver.derivePublicKey(currentPath);
-                        childRuleSet.$encryption = {
-                            rootKeyId: keyDeriver.rootKeyId,
-                            publicKeyJwk,
-                        };
+                        childRuleSet.$keyAgreement = { publicKeyJwk };
                         await injectKeysViaCallback(childRuleSet, currentPath);
                     }
                 }
@@ -83,12 +83,12 @@ export class Protocols {
             await injectKeysViaCallback(clone.structure, basePath);
             return clone;
         }
-        // Raw-key path (existing logic, unchanged)
+        // Raw-key path
         const rootKeyId = rootKeyIdOrKeyDeriver;
-        // a function that recursively creates and adds `$encryption` property to every rule set
+        // a function that recursively creates and adds `$keyAgreement` property to every rule set
         async function addEncryptionProperty(ruleSet, parentKey) {
             for (const key in ruleSet) {
-                // if we encounter a nested rule set (a property name that doesn't begin with '$'), recursively inject the `$encryption` property
+                // if we encounter a nested rule set (a property name that doesn't begin with '$'), recursively inject the `$keyAgreement` property
                 if (!key.startsWith('$')) {
                     const derivedPrivateKey = await HdKey.derivePrivateKey(parentKey, [key]);
                     const childRuleSet = ruleSet[key];
@@ -99,7 +99,7 @@ export class Protocols {
                         continue;
                     }
                     const publicKeyJwk = await X25519.getPublicKey({ key: derivedPrivateKey.derivedPrivateKey });
-                    childRuleSet.$encryption = { rootKeyId, publicKeyJwk };
+                    childRuleSet.$keyAgreement = { publicKeyJwk };
                     await addEncryptionProperty(childRuleSet, derivedPrivateKey);
                 }
             }
@@ -111,6 +111,9 @@ export class Protocols {
             rootKeyId
         };
         const protocolLevelDerivedKey = await HdKey.derivePrivateKey(rootKey, [KeyDerivationScheme.ProtocolPath, protocolDefinition.protocol]);
+        clone.$keyAgreement = {
+            publicKeyJwk: await X25519.getPublicKey({ key: protocolLevelDerivedKey.derivedPrivateKey }),
+        };
         await addEncryptionProperty(clone.structure, protocolLevelDerivedKey);
         return clone;
     }

package/dist/esm/src/utils/protocols.js.map

@@ -1 +1 @@
-{"version":3,"file":"protocols.js","sourceRoot":"","sources":["../../../../src/utils/protocols.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAYhE;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAEnD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,YAAoB;IAC9C,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB,EAAE,SAA6C;IAClG,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,OAAoC,CAAC;IACzC,IAAI,YAAY,GAAuC,SAAS,CAAC;IAEjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAChC,YAAY,GAAG,OAA6C,CAAC;IAC/D,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,SAAS;IA4BpB,mDAAmD;IAC5C,MAAM,CAAC,KAAK,CAAC,mCAAmC,CACrD,kBAAsC,EACtC,qBAAoD,EACpD,UAA0B;QAE1B,sBAAsB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAuB,CAAC;QAEnF,IAAI,OAAO,qBAAqB,KAAK,QAAQ,EAAE,CAAC;YAC9C,sBAAsB;YACtB,MAAM,UAAU,GAAG,qBAAqB,CAAC;YACzC,MAAM,QAAQ,GAAG,CAAC,mBAAmB,CAAC,YAAY,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAEjF,KAAK,UAAU,qBAAqB,CAClC,OAAwB,EAAE,UAAoB;gBAE9C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;oBAC1B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;wBACzB,MAAM,WAAW,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,CAAC;wBACzC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAoB,CAAC;wBAErD,oFAAoF;wBACpF,uEAAuE;wBACvE,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;4BACpC,MAAM,qBAAqB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;4BACvD,SAAS;wBACX,CAAC;wBAED,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;wBACnE,YAAY,CAAC,WAAW,GAAG;4BACzB,SAAS,EAAE,UAAU,CAAC,SAAS;4BAC/B,YAAY;yBACb,CAAC;wBACF,MAAM,qBAAqB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;oBACzD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,qBAAqB,CAAC,KAAK,CAAC,SAA4B,EAAE,QAAQ,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,2CAA2C;QAC3C,MAAM,SAAS,GAAG,qBAAqB,CAAC;QAExC,wFAAwF;QACxF,KAAK,UAAU,qBAAqB,CAAC,OAAwB,EAAE,SAA4B;YACzF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,iIAAiI;gBACjI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBACzE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAoB,CAAC;oBAErD,oFAAoF;oBACpF,uEAAuE;oBACvE,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBACpC,MAAM,qBAAqB,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;wBAC7D,SAAS;oBACX,CAAC;oBAED,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,EAAE,CAAiB,CAAC;oBAE7G,YAAY,CAAC,WAAW,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;oBACvD,MAAM,qBAAqB,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,MAAM,OAAO,GAAsB;YACjC,gBAAgB,EAAI,mBAAmB,CAAC,YAAY;YACpD,iBAAiB,EAAG,UAAW;YAC/B,SAAS;SACV,CAAC;QACF,MAAM,uBAAuB,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,YAAY,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvI,MAAM,qBAAqB,CAAC,KAAK,CAAC,SAA4B,EAAE,uBAAuB,CAAC,CAAC;QAEzF,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"protocols.js","sourceRoot":"","sources":["../../../../src/utils/protocols.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAYhE;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IAEnD,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,YAAoB;IAC9C,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB,EAAE,SAA6C;IAClG,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,OAAoC,CAAC;IACzC,IAAI,YAAY,GAAuC,SAAS,CAAC;IAEjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAChC,YAAY,GAAG,OAA6C,CAAC;IAC/D,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,SAAS;IA0BpB,oDAAoD;IAC7C,MAAM,CAAC,KAAK,CAAC,mCAAmC,CACrD,kBAAsC,EACtC,qBAAoD,EACpD,UAA0B;QAE1B,sBAAsB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAuB,CAAC;QAEnF,IAAI,OAAO,qBAAqB,KAAK,QAAQ,EAAE,CAAC;YAC9C,sBAAsB;YACtB,MAAM,UAAU,GAAG,qBAAqB,CAAC;YACzC,MAAM,QAAQ,GAAG,CAAC,mBAAmB,CAAC,YAAY,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACjF,KAAK,CAAC,aAAa,GAAG;gBACpB,YAAY,EAAE,MAAM,UAAU,CAAC,eAAe,CAAC,QAAQ,CAAC;aACzD,CAAC;YAEF,KAAK,UAAU,qBAAqB,CAClC,OAAwB,EAAE,UAAoB;gBAE9C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;oBAC1B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;wBACzB,MAAM,WAAW,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,CAAC;wBACzC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAoB,CAAC;wBAErD,oFAAoF;wBACpF,uEAAuE;wBACvE,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;4BACpC,MAAM,qBAAqB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;4BACvD,SAAS;wBACX,CAAC;wBAED,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;wBACnE,YAAY,CAAC,aAAa,GAAG,EAAE,YAAY,EAAE,CAAC;wBAC9C,MAAM,qBAAqB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;oBACzD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,qBAAqB,CAAC,KAAK,CAAC,SAA4B,EAAE,QAAQ,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,eAAe;QACf,MAAM,SAAS,GAAG,qBAAqB,CAAC;QAExC,0FAA0F;QAC1F,KAAK,UAAU,qBAAqB,CAAC,OAAwB,EAAE,SAA4B;YACzF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC1B,mIAAmI;gBACnI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,iBAAiB,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBACzE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAoB,CAAC;oBAErD,oFAAoF;oBACpF,uEAAuE;oBACvE,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBACpC,MAAM,qBAAqB,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;wBAC7D,SAAS;oBACX,CAAC;oBAED,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,EAAE,CAAiB,CAAC;oBAE7G,YAAY,CAAC,aAAa,GAAG,EAAE,YAAY,EAAE,CAAC;oBAC9C,MAAM,qBAAqB,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,MAAM,OAAO,GAAsB;YACjC,gBAAgB,EAAI,mBAAmB,CAAC,YAAY;YACpD,iBAAiB,EAAG,UAAW;YAC/B,SAAS;SACV,CAAC;QACF,MAAM,uBAAuB,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,YAAY,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvI,KAAK,CAAC,aAAa,GAAG;YACpB,YAAY,EAAE,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC,iBAAiB,EAAE,CAAiB;SAC5G,CAAC;QACF,MAAM,qBAAqB,CAAC,KAAK,CAAC,SAA4B,EAAE,uBAAuB,CAAC,CAAC;QAEzF,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}