@enbox/dwn-sdk-js 0.4.5 → 0.4.7

package/src/protocols/encryption.ts

@@ -1,95 +1,33 @@
 import type { CoreProtocol } from '../core/core-protocol.js';
 import type { Filter } from '../types/query-types.js';
-import type { GenericSignaturePayload } from '../types/message-types.js';
 import type { MessagesFilter } from '../types/messages-types.js';
 import type { PermissionGrant } from './permission-grant.js';
 import type { PermissionScope } from '../types/permission-types.js';
-import type { PublicKeyJwk } from '../types/jose-types.js';
+import type { ProtocolDefinition } from '../types/protocols-types.js';
 import type { RecordsWriteMessage } from '../types/records-types.js';
 import type { ValidationStateReader } from '../types/validation-state-reader.js';
-import type { ProtocolActionRule, ProtocolDefinition, ProtocolRuleSet } from '../types/protocols-types.js';
 
-import { checkActor } from '../core/protocol-authorization-action.js';
-import { Encoder } from '../utils/encoder.js';
-import { Encryption } from '../utils/encryption.js';
 import { ENCRYPTION_PROTOCOL_URI } from '../core/constants.js';
 import { FilterUtility } from '../utils/filter.js';
-import { Jws } from '../utils/jws.js';
 import { Message } from '../core/message.js';
 import { Records } from '../utils/records.js';
-import { validateJsonSchema } from '../schema-validator.js';
 import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
-import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
-import { getRuleSetAtPath, isCrossProtocolRef, parseCrossProtocolRef } from '../utils/protocols.js';
-import { ProtocolAction, ProtocolActor } from '../types/protocols-types.js';
-
-type AudienceTags = {
-  protocol: string;
-  contextId: string;
-  role: string;
-  epoch: number;
-  keyId: string;
-};
-
-type AudienceEpochData = AudienceTags & {
-  publicKeyJwk: PublicKeyJwk;
-};
+import { grantKeyScopeCoversDeliveredScope, isGrantKeyEligibleRecordsScope, isGrantKeyRecordsScope } from '../utils/grant-key-coverage.js';
 
 export class EncryptionProtocol implements CoreProtocol {
   public static readonly uri = ENCRYPTION_PROTOCOL_URI;
-  public static readonly audienceEpochPath = 'audienceEpoch';
-  public static readonly audienceKeyPath = 'audienceKey';
   public static readonly grantKeyPath = 'grantKey';
 
   public static readonly definition: ProtocolDefinition = {
     published : true,
     protocol  : EncryptionProtocol.uri,
     types     : {
-      audienceEpoch: {
-        dataFormats : ['application/json'],
-        schema      : 'https://identity.foundation/dwn/json-schemas/encryption/audience-epoch.json',
-      },
-      audienceKey: {
-        dataFormats : ['application/json'],
-        schema      : 'https://identity.foundation/dwn/json-schemas/encryption/audience-key.json',
-      },
       grantKey: {
         dataFormats : ['application/json'],
         schema      : 'https://identity.foundation/dwn/json-schemas/encryption/grant-key.json',
       },
     },
     structure: {
-      audienceEpoch: {
-        $actions: [
-          { can: ['create', 'read'], who: 'anyone' },
-        ],
-        $immutable : true,
-        $tags      : {
-          $allowUndefinedTags : false,
-          $requiredTags       : ['protocol', 'contextId', 'role', 'epoch', 'keyId'],
-          contextId           : { type: 'string' },
-          epoch               : { minimum: 1, type: 'integer' },
-          keyId               : { pattern: '^[A-Za-z0-9_-]{43}$', type: 'string' },
-          protocol            : { type: 'string' },
-          role                : { type: 'string' },
-        },
-      },
-      audienceKey: {
-        $actions: [
-          { can: ['create'], who: 'anyone' },
-          { can: ['read'], of: 'audienceKey', who: 'recipient' },
-        ],
-        $immutable : true,
-        $tags      : {
-          $allowUndefinedTags : false,
-          $requiredTags       : ['protocol', 'contextId', 'role', 'epoch', 'keyId'],
-          contextId           : { type: 'string' },
-          epoch               : { minimum: 1, type: 'integer' },
-          keyId               : { pattern: '^[A-Za-z0-9_-]{43}$', type: 'string' },
-          protocol            : { type: 'string' },
-          role                : { type: 'string' },
-        },
-      },
       grantKey: {
         $actions: [
           { can: ['create'], who: 'anyone' },
@@ -121,119 +59,21 @@ export class EncryptionProtocol implements CoreProtocol {
     message: RecordsWriteMessage,
     validationStateReader: ValidationStateReader,
   ): Promise<void> {
-    switch (message.descriptor.protocolPath) {
-    case EncryptionProtocol.audienceEpochPath:
-      await EncryptionProtocol.preProcessAudienceEpoch(tenant, message, validationStateReader);
-      return;
-    case EncryptionProtocol.audienceKeyPath:
-      await EncryptionProtocol.preProcessAudienceKey(tenant, message, validationStateReader);
-      return;
-    case EncryptionProtocol.grantKeyPath:
+    if (message.descriptor.protocolPath === EncryptionProtocol.grantKeyPath) {
       await EncryptionProtocol.preProcessGrantKey(tenant, message, validationStateReader);
-      return;
-    default:
-      return;
     }
   }
 
-  public async validateRecord(message: RecordsWriteMessage, dataBytes: Uint8Array): Promise<void> {
-    switch (message.descriptor.protocolPath) {
-    case EncryptionProtocol.audienceEpochPath:
-      await EncryptionProtocol.validateAudienceEpoch(message, dataBytes);
-      return;
-    case EncryptionProtocol.audienceKeyPath:
-    case EncryptionProtocol.grantKeyPath:
+  public async validateRecord(message: RecordsWriteMessage, _dataBytes: Uint8Array): Promise<void> {
+    if (message.descriptor.protocolPath === EncryptionProtocol.grantKeyPath) {
       EncryptionProtocol.verifyEncryptedDelivery(message);
       return;
-    default:
-      throw new DwnError(
-        DwnErrorCode.EncryptionProtocolValidateSchemaUnexpectedRecord,
-        `Unexpected encryption record: ${message.descriptor.protocolPath}`
-      );
-    }
-  }
-
-  private static async preProcessAudienceEpoch(
-    tenant: string,
-    message: RecordsWriteMessage,
-    validationStateReader: ValidationStateReader,
-  ): Promise<void> {
-    if (message.encryption !== undefined) {
-      throw new DwnError(
-        DwnErrorCode.EncryptionProtocolValidateAudienceEpochEncrypted,
-        'audienceEpoch records must be plaintext.'
-      );
     }
 
-    const tags = EncryptionProtocol.getAudienceTags(message, 'audienceEpoch');
-    const { ruleSet, protocolDefinition } = await EncryptionProtocol.verifyRoleAudienceDefinition(tenant, tags, message, validationStateReader);
-    await EncryptionProtocol.verifyWriterCanCreateRole({
-      tenant,
-      message,
-      tags,
-      ruleSet,
-      protocolDefinition,
-      validationStateReader,
-    });
-
-  }
-
-  private static async preProcessAudienceKey(
-    tenant: string,
-    message: RecordsWriteMessage,
-    validationStateReader: ValidationStateReader,
-  ): Promise<void> {
-    EncryptionProtocol.verifyEncryptedDelivery(message);
-
-    const recipient = message.descriptor.recipient;
-    if (recipient === undefined) {
-      throw new DwnError(
-        DwnErrorCode.EncryptionProtocolValidateAudienceKeyRecipientMissing,
-        'audienceKey records must have a recipient.'
-      );
-    }
-
-    const tags = EncryptionProtocol.getAudienceTags(message, 'audienceKey');
-    const { ruleSet, protocolDefinition } = await EncryptionProtocol.verifyRoleAudienceDefinition(tenant, tags, message, validationStateReader);
-    await EncryptionProtocol.verifyWriterCanCreateRole({
-      tenant,
-      message,
-      tags,
-      ruleSet,
-      protocolDefinition,
-      validationStateReader,
-    });
-
-    const matchingEpochs = await validationStateReader.queryAudienceEpochs({
-      tenant,
-      protocol  : tags.protocol,
-      contextId : tags.contextId,
-      role      : tags.role,
-      epoch     : tags.epoch,
-      keyId     : tags.keyId,
-    });
-
-    if (matchingEpochs.length === 0) {
-      throw new DwnError(
-        DwnErrorCode.EncryptionProtocolValidateAudienceEpochMissing,
-        'audienceKey references a missing audienceEpoch.'
-      );
-    }
-
-    const hasRoleRecord = await validationStateReader.hasMatchingRoleRecord({
-      tenant,
-      protocol        : tags.protocol,
-      protocolPath    : tags.role,
-      recipient,
-      contextIdPrefix : tags.contextId === '' ? undefined : tags.contextId,
-    });
-
-    if (!hasRoleRecord) {
-      throw new DwnError(
-        DwnErrorCode.EncryptionProtocolValidateAudienceKeyRoleRecordMissing,
-        'audienceKey recipient is not an active holder of the referenced role.'
-      );
-    }
+    throw new DwnError(
+      DwnErrorCode.EncryptionProtocolValidateSchemaUnexpectedRecord,
+      `Unexpected encryption record: ${message.descriptor.protocolPath}`
+    );
   }
 
   private static async preProcessGrantKey(
@@ -252,7 +92,14 @@ export class EncryptionProtocol implements CoreProtocol {
     await EncryptionProtocol.verifyGrantActive(tenant, message, grant, validationStateReader);
     EncryptionProtocol.verifyGrantKeyAuthor(message, grant);
     EncryptionProtocol.verifyGrantKeyRecipient(message, grant);
-    EncryptionProtocol.verifyGrantKeyScope(grant.scope, protocol, protocolPath);
+    await EncryptionProtocol.verifyGrantKeyScope({
+      tenant,
+      message,
+      grantScope: grant.scope,
+      protocol,
+      protocolPath,
+      validationStateReader,
+    });
   }
 
   private static verifyEncryptedDelivery(message: RecordsWriteMessage): void {
@@ -264,79 +111,18 @@ export class EncryptionProtocol implements CoreProtocol {
     }
   }
 
-  private static async validateAudienceEpoch(message: RecordsWriteMessage, dataBytes: Uint8Array): Promise<void> {
-    if (message.encryption !== undefined) {
-      throw new DwnError(
-        DwnErrorCode.EncryptionProtocolValidateAudienceEpochEncrypted,
-        'audienceEpoch records must be plaintext.'
-      );
-    }
-
-    const dataObject = JSON.parse(Encoder.bytesToString(dataBytes)) as AudienceEpochData;
-    validateJsonSchema('AudienceEpoch', dataObject);
-
-    const tags = EncryptionProtocol.getAudienceTags(message, 'audienceEpoch');
-    EncryptionProtocol.verifyAudiencePayloadMatchesTags(dataObject, tags);
-
-    const keyId = await Encryption.getKeyId(dataObject.publicKeyJwk);
-    if (keyId !== dataObject.keyId) {
-      throw new DwnError(
-        DwnErrorCode.EncryptionProtocolValidateAudienceEpochKeyIdMismatch,
-        'audienceEpoch keyId must match publicKeyJwk thumbprint.'
-      );
-    }
-  }
-
-  private static verifyAudiencePayloadMatchesTags(payload: AudienceTags, tags: AudienceTags): void {
-    if (payload.protocol !== tags.protocol ||
-        payload.contextId !== tags.contextId ||
-        payload.role !== tags.role ||
-        payload.epoch !== tags.epoch ||
-        payload.keyId !== tags.keyId) {
-      throw new DwnError(
-        DwnErrorCode.EncryptionProtocolValidateAudienceTagsMismatch,
-        'audienceEpoch tags must match payload fields.'
-      );
-    }
-  }
-
-  private static getRequiredStringTag(message: RecordsWriteMessage, tag: string, recordType = 'grantKey'): string {
+  private static getRequiredStringTag(message: RecordsWriteMessage, tag: string): string {
     const value = message.descriptor.tags?.[tag];
     if (typeof value !== 'string') {
-      const errorCode = recordType === 'grantKey'
-        ? DwnErrorCode.EncryptionProtocolValidateGrantKeyMissingRequiredTag
-        : DwnErrorCode.EncryptionProtocolValidateAudienceMissingRequiredTag;
       throw new DwnError(
-        errorCode,
-        `${recordType} records must include string tag '${tag}'.`
+        DwnErrorCode.EncryptionProtocolValidateGrantKeyMissingRequiredTag,
+        `grantKey records must include string tag '${tag}'.`
       );
     }
 
     return value;
   }
 
-  private static getRequiredIntegerTag(message: RecordsWriteMessage, tag: string, recordType: string): number {
-    const value = message.descriptor.tags?.[tag];
-    if (!Number.isInteger(value)) {
-      throw new DwnError(
-        DwnErrorCode.EncryptionProtocolValidateAudienceMissingRequiredTag,
-        `${recordType} records must include integer tag '${tag}'.`
-      );
-    }
-
-    return value as number;
-  }
-
-  private static getAudienceTags(message: RecordsWriteMessage, recordType: string): AudienceTags {
-    return {
-      protocol  : EncryptionProtocol.getRequiredStringTag(message, 'protocol', recordType),
-      contextId : EncryptionProtocol.getRequiredStringTag(message, 'contextId', recordType),
-      role      : EncryptionProtocol.getRequiredStringTag(message, 'role', recordType),
-      epoch     : EncryptionProtocol.getRequiredIntegerTag(message, 'epoch', recordType),
-      keyId     : EncryptionProtocol.getRequiredStringTag(message, 'keyId', recordType),
-    };
-  }
-
   private static getOptionalStringTag(message: RecordsWriteMessage, tag: string): string | undefined {
     const value = message.descriptor.tags?.[tag];
     if (value === undefined) {
@@ -405,220 +191,64 @@ export class EncryptionProtocol implements CoreProtocol {
     );
   }
 
-  private static verifyGrantKeyScope(grantScope: PermissionScope, protocol: string, protocolPath: string | undefined): void {
-    if (!EncryptionProtocol.isReadScope(grantScope)) {
-      throw new DwnError(
-        DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch,
-        'grantKey must reference a read permission grant.'
-      );
-    }
+  private static async verifyGrantKeyScope(params: {
+    tenant: string;
+    message: RecordsWriteMessage;
+    grantScope: PermissionScope;
+    protocol: string;
+    protocolPath: string | undefined;
+    validationStateReader: ValidationStateReader;
+  }): Promise<void> {
+    const { grantScope, protocol, protocolPath } = params;
 
-    if ('protocol' in grantScope && grantScope.protocol !== undefined && grantScope.protocol !== protocol) {
+    if (!isGrantKeyRecordsScope(grantScope)) {
       throw new DwnError(
         DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch,
-        `grantKey protocol ${protocol} is outside the permission grant scope.`
+        'grantKey must reference a Records.Read or Records.Write permission grant.'
       );
     }
 
-    if (!('protocolPath' in grantScope) || grantScope.protocolPath === undefined) {
-      return;
-    }
-
-    if (protocolPath === undefined || !EncryptionProtocol.isBoundaryAwareSubtree(grantScope.protocolPath, protocolPath)) {
+    if (!isGrantKeyEligibleRecordsScope(grantScope)) {
       throw new DwnError(
         DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch,
-        `grantKey protocolPath ${protocolPath ?? '<protocol>'} is outside the permission grant scope.`
-      );
-    }
-  }
-
-  private static isReadScope(scope: PermissionScope): boolean {
-    return (scope.interface === DwnInterfaceName.Records || scope.interface === DwnInterfaceName.Messages) &&
-      scope.method === DwnMethodName.Read;
-  }
-
-  private static isBoundaryAwareSubtree(scopePath: string, candidatePath: string): boolean {
-    return candidatePath === scopePath || candidatePath.startsWith(scopePath + '/');
-  }
-
-  private static async verifyRoleAudienceDefinition(
-    tenant: string,
-    tags: AudienceTags,
-    message: RecordsWriteMessage,
-    validationStateReader: ValidationStateReader,
-  ): Promise<{ protocolDefinition: ProtocolDefinition; ruleSet: ProtocolRuleSet }> {
-    EncryptionProtocol.verifyRoleAudienceContext(tags.role, tags.contextId);
-
-    const protocolDefinition = await validationStateReader.fetchProtocolDefinition(
-      tenant,
-      tags.protocol,
-      message.descriptor.messageTimestamp,
-    );
-    const ruleSet = getRuleSetAtPath(tags.role, protocolDefinition.structure);
-
-    if (ruleSet?.$role !== true || ruleSet.$keyAgreement === undefined) {
-      throw new DwnError(
-        DwnErrorCode.EncryptionProtocolValidateRoleAudienceInvalid,
-        `role audience path '${tags.role}' must be a role path with $keyAgreement.`
+        'grantKey must not reference a context-scoped permission grant.'
       );
     }
 
-    return { protocolDefinition, ruleSet };
-  }
-
-  private static verifyRoleAudienceContext(rolePath: string, contextId: string): void {
-    const parentDepth = rolePath.split('/').length - 1;
-    if ((parentDepth === 0 && contextId !== '') || (parentDepth > 0 && contextId === '')) {
+    if (grantScope.protocol !== protocol) {
       throw new DwnError(
-        DwnErrorCode.EncryptionProtocolValidateRoleAudienceContextInvalid,
-        'role audience contextId is inconsistent with role path depth.'
+        DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch,
+        `grantKey protocol ${protocol} is outside the permission grant scope.`
       );
     }
-  }
 
-  private static async verifyWriterCanCreateRole(input: {
-    tenant: string;
-    message: RecordsWriteMessage;
-    tags: AudienceTags;
-    ruleSet: ProtocolRuleSet;
-    protocolDefinition: ProtocolDefinition;
-    validationStateReader: ValidationStateReader;
-  }): Promise<void> {
-    const author = Message.getAuthor(input.message);
-    if (author === input.tenant) {
+    const deliveredScope = { protocol, protocolPath };
+    if (grantKeyScopeCoversDeliveredScope({ grantScope, deliveredScope })) {
       return;
     }
 
-    if (author === undefined) {
+    if (protocolPath === undefined) {
       throw new DwnError(
-        DwnErrorCode.EncryptionProtocolValidateAudienceWriterUnauthorized,
-        'audience key records must be authored by a DID authorized to create role records.'
+        DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch,
+        `grantKey protocolPath ${protocolPath ?? '<protocol>'} is outside the permission grant scope.`
       );
     }
 
-    const actionRules = input.ruleSet.$actions ?? [];
-    const recordChain = await EncryptionProtocol.constructRoleParentChain(input.tenant, input.tags, input.validationStateReader);
-    const signaturePayload = Jws.decodePlainObjectPayload(input.message.authorization.signature) as GenericSignaturePayload;
-
-    for (const actionRule of actionRules) {
-      if (!actionRule.can.includes(ProtocolAction.Create)) {
-        continue;
-      }
-
-      if (actionRule.who === ProtocolActor.Anyone) {
-        return;
-      }
-
-      if (await EncryptionProtocol.roleRuleAllowsAuthor(
-        input.tenant,
-        author,
-        actionRule,
-        input.tags,
-        input.protocolDefinition,
-        input.validationStateReader,
-        signaturePayload.protocolRole,
-      )) {
-        return;
-      }
-
-      if (await checkActor(author, actionRule, recordChain, input.protocolDefinition)) {
-        return;
-      }
+    const protocolDefinition = await params.validationStateReader.fetchProtocolDefinition(
+      params.tenant,
+      params.protocol,
+      params.message.descriptor.messageTimestamp,
+    );
+    if (grantKeyScopeCoversDeliveredScope({ grantScope, deliveredScope, protocolDefinition })) {
+      return;
     }
 
     throw new DwnError(
-      DwnErrorCode.EncryptionProtocolValidateAudienceWriterUnauthorized,
-      'audience key records must be authored by a DID authorized to create role records.'
+      DwnErrorCode.EncryptionProtocolValidateGrantKeyGrantScopeMismatch,
+      `grantKey protocolPath ${protocolPath ?? '<protocol>'} is outside the permission grant scope.`
     );
   }
 
-  private static async constructRoleParentChain(
-    tenant: string,
-    tags: AudienceTags,
-    validationStateReader: ValidationStateReader,
-  ): Promise<RecordsWriteMessage[]> {
-    if (tags.contextId === '') {
-      return [];
-    }
-
-    const parentRecordId = tags.contextId.split('/').pop();
-    if (parentRecordId === undefined || parentRecordId === '') {
-      return [];
-    }
-
-    return validationStateReader.constructRecordChain(tenant, parentRecordId);
-  }
-
-  private static async roleRuleAllowsAuthor(
-    tenant: string,
-    author: string,
-    actionRule: ProtocolActionRule,
-    tags: AudienceTags,
-    protocolDefinition: ProtocolDefinition,
-    validationStateReader: ValidationStateReader,
-    invokedRole: string | undefined,
-  ): Promise<boolean> {
-    if (actionRule.role === undefined || invokedRole !== actionRule.role) {
-      return false;
-    }
-
-    const roleRef = actionRule.role;
-    return EncryptionProtocol.hasInvokedRole(tenant, author, roleRef, tags, protocolDefinition, validationStateReader);
-  }
-
-  private static async hasInvokedRole(
-    tenant: string,
-    author: string,
-    roleRef: string,
-    tags: AudienceTags,
-    protocolDefinition: ProtocolDefinition,
-    validationStateReader: ValidationStateReader,
-  ): Promise<boolean> {
-    const resolved = EncryptionProtocol.resolveRoleReference(roleRef, tags.protocol, protocolDefinition);
-    if (resolved === undefined) {
-      return false;
-    }
-
-    const ancestorDepth = resolved.protocolPath.split('/').length - 1;
-    let contextIdPrefix: string | undefined;
-    if (ancestorDepth > 0) {
-      contextIdPrefix = tags.contextId.split('/').slice(0, ancestorDepth).join('/');
-      if (contextIdPrefix === '') {
-        return false;
-      }
-    }
-
-    return validationStateReader.hasMatchingRoleRecord({
-      tenant,
-      protocol     : resolved.protocol,
-      protocolPath : resolved.protocolPath,
-      recipient    : author,
-      contextIdPrefix,
-    });
-  }
-
-  private static resolveRoleReference(
-    roleRef: string,
-    currentProtocol: string,
-    protocolDefinition: ProtocolDefinition,
-  ): { protocol: string; protocolPath: string } | undefined {
-    if (!isCrossProtocolRef(roleRef)) {
-      return { protocol: currentProtocol, protocolPath: roleRef };
-    }
-
-    const parsed = parseCrossProtocolRef(roleRef);
-    if (parsed === undefined) {
-      return undefined;
-    }
-
-    const protocol = protocolDefinition.uses?.[parsed.alias];
-    if (protocol === undefined) {
-      return undefined;
-    }
-
-    return { protocol, protocolPath: parsed.protocolPath };
-  }
-
   public mapErrorToStatusCode(errorCode: string): number | undefined {
     if (errorCode.startsWith('EncryptionProtocolValidate')) {
       return 400;

package/src/store/blockstore-level.ts

@@ -1,7 +1,15 @@
-import { CID } from 'multiformats';
-import type { AbortOptions, AwaitIterable } from 'interface-store';
-import type { Blockstore, Pair } from 'interface-blockstore';
+import type { Blockstore, InputPair, Pair } from 'interface-blockstore';
+import type { BlockstoreAbortOptions, BlockstoreInput, BlockstoreSource } from './blockstore-utils.js';
 
+import { CID } from 'multiformats';
+import { NotFoundError } from 'interface-store';
+import {
+  collectBlockstoreBytes,
+  deleteManyBlockstoreItems,
+  getManyBlockstoreItems,
+  putManyBlockstoreItems,
+  yieldBlockstoreBytes,
+} from './blockstore-utils.js';
 import { createLevelDatabase, LevelWrapper } from './level-wrapper.js';
 
 // `level` works in Node.js 12+ and Electron 5+ on Linux, Mac OS, Windows and
@@ -40,63 +48,51 @@ export class BlockstoreLevel implements Blockstore {
     return new BlockstoreLevel({ ...this.config, location: '' }, db);
   }
 
-  async put(key: CID | string, val: Uint8Array, options?: AbortOptions): Promise<CID> {
-    await this.db.put(String(key), val, options);
+  async put(key: CID | string, val: BlockstoreInput, options?: BlockstoreAbortOptions): Promise<CID> {
+    const bytes = await collectBlockstoreBytes(val);
+    await this.db.put(String(key), bytes, options);
     return CID.parse(key.toString());
   }
 
-  async get(key: CID | string, options?: AbortOptions): Promise<Uint8Array> {
+  async * get(key: CID | string, options?: BlockstoreAbortOptions): AsyncGenerator<Uint8Array> {
     const result = await this.db.get(String(key), options);
-    return result!;
+    if (result === undefined) {
+      throw new NotFoundError();
+    }
+
+    yield result;
   }
 
-  async has(key: CID | string, options?: AbortOptions): Promise<boolean> {
+  async has(key: CID | string, options?: BlockstoreAbortOptions): Promise<boolean> {
     return this.db.has(String(key), options);
   }
 
-  async delete(key: CID | string, options?: AbortOptions): Promise<void> {
+  async delete(key: CID | string, options?: BlockstoreAbortOptions): Promise<void> {
     return this.db.delete(String(key), options);
   }
 
-  async isEmpty(options?: AbortOptions): Promise<boolean> {
+  async isEmpty(options?: BlockstoreAbortOptions): Promise<boolean> {
     return this.db.isEmpty(options);
   }
 
-  async * putMany(source: AwaitIterable<Pair>, options?: AbortOptions): AsyncIterable<CID> {
-    for await (const entry of source) {
-      await this.put(entry.cid, entry.block, options);
-
-      yield entry.cid;
-    }
+  async * putMany(source: BlockstoreSource<InputPair>, options?: BlockstoreAbortOptions): AsyncGenerator<CID> {
+    yield * putManyBlockstoreItems(this, source, options);
   }
 
-  async * getMany(source: AwaitIterable<CID>, options?: AbortOptions): AsyncIterable<Pair> {
-    for await (const key of source) {
-      yield {
-        cid   : key,
-        block : await this.get(key, options)
-      };
-    }
+  async * getMany(source: BlockstoreSource<CID>, options?: BlockstoreAbortOptions): AsyncGenerator<Pair> {
+    yield * getManyBlockstoreItems(this, source, options);
   }
 
-  async * getAll(options?: AbortOptions): AsyncIterable<Pair> {
-    // @ts-expect-error keyEncoding is 'buffer' but types for db.iterator always return the key type as 'string'
-    const li: AsyncGenerator<[Uint8Array, Uint8Array]> = this.db.iterator({
-      keys        : true,
-      keyEncoding : 'buffer'
-    }, options);
+  async * getAll(options?: BlockstoreAbortOptions): AsyncGenerator<Pair> {
+    const li: AsyncGenerator<[string, Uint8Array]> = this.db.iterator({ keys: true }, options);
 
     for await (const [key, value] of li) {
-      yield { cid: CID.decode(key), block: value };
+      yield { cid: CID.parse(key), bytes: yieldBlockstoreBytes(value) };
     }
   }
 
-  async * deleteMany(source: AwaitIterable<CID>, options?: AbortOptions): AsyncIterable<CID> {
-    for await (const key of source) {
-      await this.delete(key, options);
-
-      yield key;
-    }
+  async * deleteMany(source: BlockstoreSource<CID>, options?: BlockstoreAbortOptions): AsyncGenerator<CID> {
+    yield * deleteManyBlockstoreItems(this, source, options);
   }
 
   /**
@@ -110,4 +106,4 @@ export class BlockstoreLevel implements Blockstore {
 export type BlockstoreLevelConfig = {
   location: string,
   createLevelDatabase?: typeof createLevelDatabase,
-};
+};