@enbox/dwn-sdk-js 0.4.8 → 0.4.10

package/src/interfaces/messages-subscribe.ts

@@ -1,7 +1,6 @@
-import type { MessagesFilter } from '../types/messages-types.js';
 import type { MessageSigner } from '../types/signer.js';
 import type { ProgressToken } from '../types/subscriptions.js';
-import type { MessagesSubscribeDescriptor, MessagesSubscribeMessage } from '../types/messages-types.js';
+import type { MessagesFilter, MessagesSubscribeDescriptor, MessagesSubscribeMessage } from '../types/messages-types.js';
 
 import { AbstractMessage } from '../core/abstract-message.js';
 import { Message } from '../core/message.js';

package/src/interfaces/records-write.ts

@@ -518,19 +518,6 @@ export class RecordsWrite implements MessageInterface<RecordsWriteMessage> {
     return this.message;
   }
 
-  /**
-   * Encrypts the symmetric encryption key using the public keys given and attaches the resulting `encryption` property.
-   */
-  public async encryptSymmetricEncryptionKey(
-    encryptionInput: EncryptionInput,
-  ): Promise<void> {
-    this._message.encryption = await createEncryptionProperty(encryptionInput);
-
-    delete this._message.authorization;
-    this._signaturePayload = undefined;
-    this._author = undefined;
-  }
-
   /**
    * Signs the RecordsWrite, the signer is commonly the author, but can also be a delegate.
    */

package/src/store/index-level-compound.ts

@@ -1,9 +1,6 @@
+import type { CompoundIndexDefinition, IndexedItem, IndexLevelOptions } from './index-level.js';
 import type { Filter, KeyValues, QueryOptions } from '../types/query-types.js';
-import type { IndexedItem, IndexLevelOptions } from './index-level.js';
-import type { LevelWrapperBatchOperation, LevelWrapperIteratorOptions } from './level-wrapper.js';
-
-import type { CompoundIndexDefinition } from './index-level.js';
-import type { LevelWrapper } from './level-wrapper.js';
+import type { LevelWrapper, LevelWrapperBatchOperation, LevelWrapperIteratorOptions } from './level-wrapper.js';
 
 import { FilterUtility } from '../utils/filter.js';
 import { SortDirection } from '../types/query-types.js';

package/src/store/level-wrapper.ts

@@ -251,8 +251,12 @@ export class LevelWrapper<V> {
     }
 
     // derive an exclusive `maxKey` by changing the last prefix character to the immediate succeeding character in unicode
-    // (which matches how `abstract-level` creates a `boundary`)
-    const maxKey = prefix.slice(0, -1) + String.fromCharCode(prefix.charCodeAt(prefix.length - 1) + 1);
+    // (which matches how `abstract-level` creates a `boundary`).
+    //
+    // This MUST stay UTF-16 code-unit based (`charCodeAt`/`fromCharCode`) to match `abstract-level`'s
+    // boundary semantics: `fromCharCode` wraps at 0xFFFF whereas `fromCodePoint` would emit an astral
+    // surrogate pair, producing a different — and incorrect — key range. NOSONAR (typescript:S7758).
+    const maxKey = prefix.slice(0, -1) + String.fromCharCode(prefix.charCodeAt(prefix.length - 1) + 1); // NOSONAR
     const minKey = prefix;
 
     return [minKey, maxKey];

package/src/types/protocols-types.ts

@@ -237,7 +237,8 @@ type ProtocolRuleSetValue =
   | ProtocolTagsDefinition
   | ProtocolSizeDefinition
   | ProtocolRecordLimitDefinition
-  | ProtocolDeliveryStrategy
+  // `ProtocolDeliveryStrategy` ('direct' | 'subscribe') is intentionally omitted here: its
+  // values are already covered by the `string` member below (see the `$delivery` field typing).
   | boolean
   | string
   | undefined;

package/src/utils/encryption.ts

@@ -107,13 +107,11 @@ export type KeyUnwrapPayload = {
 export type X25519KeyWrapInput = {
   cek: Uint8Array;
   keyInput: X25519KeyEncryptionInput;
-  ephemeralPrivateKey?: Jwk;
 };
 
 export type SealWrapInput = {
   privateKeyBytes: Uint8Array;
   keyInput: SealKeyWrapInput;
-  ephemeralPrivateKey?: Jwk;
 };
 
 export type SealUnwrapInput = {
@@ -180,17 +178,6 @@ export class Encryption {
     return Encryption.toStream(ciphertext);
   }
 
-  public static async decryptStream(
-    algorithm: ContentEncryptionAlgorithm,
-    keyBytes: Uint8Array,
-    initializationVector: Uint8Array,
-    ciphertextStream: ReadableStream<Uint8Array>,
-  ): Promise<ReadableStream<Uint8Array>> {
-    const ciphertext = await Encryption.readStream(ciphertextStream);
-    const plaintext = await Encryption.decrypt(algorithm, keyBytes, initializationVector, ciphertext);
-    return Encryption.toStream(plaintext);
-  }
-
   public static async wrapKey(input: X25519KeyWrapInput): Promise<{ encryptedKey: Uint8Array; ephemeralPublicKey: PublicKeyJwk }> {
     if (Encryption.isX25519KeyAgreementAlgorithm(input.keyInput.algorithm)) {
       return Encryption.wrapX25519Key(input);
@@ -206,7 +193,7 @@ export class Encryption {
 
     Encryption.validateContentEncryptionKey(input.privateKeyBytes);
 
-    const privateKey = input.ephemeralPrivateKey ?? await X25519.generateKey();
+    const privateKey = await X25519.generateKey();
     const publicKey = await X25519.getPublicKey({ key: privateKey }) as PublicKeyJwk;
     const sharedSecret = await X25519.sharedSecret({
       privateKeyA : privateKey,
@@ -231,7 +218,7 @@ export class Encryption {
   private static async wrapX25519Key(input: X25519KeyWrapInput): Promise<{ encryptedKey: Uint8Array; ephemeralPublicKey: PublicKeyJwk }> {
     Encryption.validateContentEncryptionKey(input.cek);
 
-    const privateKey = input.ephemeralPrivateKey ?? await X25519.generateKey();
+    const privateKey = await X25519.generateKey();
     const publicKey = await X25519.getPublicKey({ key: privateKey }) as PublicKeyJwk;
     const sharedSecret = await X25519.sharedSecret({
       privateKeyA : privateKey,

package/src/utils/hd-key.ts

@@ -1,7 +1,6 @@
-import type { PrivateKeyJwk, PublicKeyJwk } from '../types/jose-types.js';
+import type { PrivateKeyJwk } from '../types/jose-types.js';
 
 import { Encoder } from './encoder.js';
-import { X25519 } from '@enbox/crypto';
 import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
 
 export enum KeyDerivationScheme {
@@ -20,36 +19,6 @@ export type DerivedPrivateJwk = {
  * Class containing hierarchical deterministic key related utility methods used by the DWN.
  */
 export class HdKey {
-  /**
-   * Derives a descendant private key.
-   * Uses X25519 keys for encryption key derivation.
-   */
-  public static async derivePrivateKey(ancestorKey: DerivedPrivateJwk, subDerivationPath: string[]): Promise<DerivedPrivateJwk> {
-    const ancestorPrivateKey = await X25519.privateKeyToBytes({ privateKey: ancestorKey.derivedPrivateKey });
-    const ancestorPrivateKeyDerivationPath = ancestorKey.derivationPath ?? [];
-    const derivedPrivateKeyBytes = await HdKey.derivePrivateKeyBytes(ancestorPrivateKey, subDerivationPath);
-    const derivedPrivateKeyJwk = await X25519.bytesToPrivateKey({ privateKeyBytes: derivedPrivateKeyBytes });
-    const derivedDescendantPrivateKey: DerivedPrivateJwk = {
-      rootKeyId         : ancestorKey.rootKeyId,
-      derivationScheme  : ancestorKey.derivationScheme,
-      derivationPath    : [...ancestorPrivateKeyDerivationPath, ...subDerivationPath],
-      derivedPrivateKey : derivedPrivateKeyJwk as PrivateKeyJwk
-    };
-
-    return derivedDescendantPrivateKey;
-  }
-
-  /**
-   * Derives a descendant public key from an ancestor private key.
-   * Uses X25519 keys for encryption key derivation.
-   */
-  public static async derivePublicKey(ancestorKey: DerivedPrivateJwk, subDerivationPath: string[]): Promise<PublicKeyJwk> {
-    const derivedDescendantPrivateKey = await HdKey.derivePrivateKey(ancestorKey, subDerivationPath);
-    const derivedDescendantPublicKey = await X25519.getPublicKey({ key: derivedDescendantPrivateKey.derivedPrivateKey });
-
-    return derivedDescendantPublicKey as PublicKeyJwk;
-  }
-
   /**
    * Derives a hardened hierarchical deterministic private key.
    */

package/src/utils/jws.ts

@@ -1,6 +1,5 @@
-import type { GeneralJws } from '../types/jws-types.js';
 import type { MessageSigner } from '../types/signer.js';
-import type { SignatureEntry } from '../types/jws-types.js';
+import type { GeneralJws, SignatureEntry } from '../types/jws-types.js';
 import type { KeyMaterial, PublicKeyJwk } from '../types/jose-types.js';
 
 import { Encoder } from './encoder.js';

package/src/utils/protocols.ts

@@ -1,10 +1,7 @@
-import type { DerivedPrivateJwk } from '../utils/hd-key.js';
 import type { EncryptionKeyDeriver } from '../types/encryption-types.js';
-import type { PrivateKeyJwk, PublicKeyJwk } from '../types/jose-types.js';
 import type { ProtocolDefinition, ProtocolRuleSet } from '../types/protocols-types.js';
 
-import { X25519 } from '@enbox/crypto';
-import { HdKey, KeyDerivationScheme } from '../utils/hd-key.js';
+import { KeyDerivationScheme } from '../utils/hd-key.js';
 
 /**
  * Result of parsing a cross-protocol reference in `alias:path` format.
@@ -116,104 +113,44 @@ export class Protocols {
    * because their records belong to the referenced protocol, whose own encryption keys govern them.
    * Children of `$ref` nodes are still processed because they belong to the composing protocol.
    *
-   * Overload 1 (callback-based): Accepts an EncryptionKeyDeriver that performs
-   * key derivation internally. The private key never leaves the caller's boundary.
+   * Accepts an EncryptionKeyDeriver that performs key derivation internally.
+   * The private key never leaves the caller's boundary.
    */
   public static async deriveAndInjectPublicEncryptionKeys(
     protocolDefinition: ProtocolDefinition,
     keyDeriver: EncryptionKeyDeriver,
-  ): Promise<ProtocolDefinition>;
-
-  /**
-   * Overload 2 (raw-key): Takes rootKeyId and raw PrivateKeyJwk directly.
-   */
-  public static async deriveAndInjectPublicEncryptionKeys(
-    protocolDefinition: ProtocolDefinition,
-    rootKeyId: string,
-    privateJwk: PrivateKeyJwk,
-  ): Promise<ProtocolDefinition>;
-
-  // Implementation dispatches based on argument type.
-  public static async deriveAndInjectPublicEncryptionKeys(
-    protocolDefinition: ProtocolDefinition,
-    rootKeyIdOrKeyDeriver: string | EncryptionKeyDeriver,
-    privateJwk?: PrivateKeyJwk,
   ): Promise<ProtocolDefinition> {
     // clone before modify
     const clone = JSON.parse(JSON.stringify(protocolDefinition)) as ProtocolDefinition;
 
-    if (typeof rootKeyIdOrKeyDeriver !== 'string') {
-      // Callback-based path
-      const keyDeriver = rootKeyIdOrKeyDeriver;
-      const basePath = [KeyDerivationScheme.ProtocolPath, protocolDefinition.protocol];
-      clone.$keyAgreement = {
-        publicKeyJwk: await keyDeriver.derivePublicKey(basePath),
-      };
-
-      async function injectKeysViaCallback(
-        ruleSet: ProtocolRuleSet, parentPath: string[],
-      ): Promise<void> {
-        for (const key in ruleSet) {
-          if (!key.startsWith('$')) {
-            const currentPath = [...parentPath, key];
-            const childRuleSet = ruleSet[key] as ProtocolRuleSet;
-
-            // Skip $ref nodes — they are governed by the referenced protocol's encryption keys.
-            // Still recurse into children, which belong to the composing protocol.
-            if (childRuleSet.$ref !== undefined) {
-              await injectKeysViaCallback(childRuleSet, currentPath);
-              continue;
-            }
-
-            const publicKeyJwk = await keyDeriver.derivePublicKey(currentPath);
-            childRuleSet.$keyAgreement = { publicKeyJwk };
-            await injectKeysViaCallback(childRuleSet, currentPath);
-          }
-        }
-      }
-
-      await injectKeysViaCallback(clone.structure as ProtocolRuleSet, basePath);
-      return clone;
-    }
-
-    // Raw-key path
-    const rootKeyId = rootKeyIdOrKeyDeriver;
+    const basePath = [KeyDerivationScheme.ProtocolPath, protocolDefinition.protocol];
+    clone.$keyAgreement = {
+      publicKeyJwk: await keyDeriver.derivePublicKey(basePath),
+    };
 
-    // a function that recursively creates and adds `$keyAgreement` property to every rule set
-    async function addEncryptionProperty(ruleSet: ProtocolRuleSet, parentKey: DerivedPrivateJwk): Promise<void> {
+    async function injectKeys(
+      ruleSet: ProtocolRuleSet, parentPath: string[],
+    ): Promise<void> {
       for (const key in ruleSet) {
-        // if we encounter a nested rule set (a property name that doesn't begin with '$'), recursively inject the `$keyAgreement` property
         if (!key.startsWith('$')) {
-          const derivedPrivateKey = await HdKey.derivePrivateKey(parentKey, [key]);
+          const currentPath = [...parentPath, key];
           const childRuleSet = ruleSet[key] as ProtocolRuleSet;
 
           // Skip $ref nodes — they are governed by the referenced protocol's encryption keys.
           // Still recurse into children, which belong to the composing protocol.
           if (childRuleSet.$ref !== undefined) {
-            await addEncryptionProperty(childRuleSet, derivedPrivateKey);
+            await injectKeys(childRuleSet, currentPath);
             continue;
           }
 
-          const publicKeyJwk = await X25519.getPublicKey({ key: derivedPrivateKey.derivedPrivateKey }) as PublicKeyJwk;
-
+          const publicKeyJwk = await keyDeriver.derivePublicKey(currentPath);
           childRuleSet.$keyAgreement = { publicKeyJwk };
-          await addEncryptionProperty(childRuleSet, derivedPrivateKey);
+          await injectKeys(childRuleSet, currentPath);
         }
       }
     }
 
-    // inject encryption property starting from each root level record type
-    const rootKey: DerivedPrivateJwk = {
-      derivationScheme  : KeyDerivationScheme.ProtocolPath,
-      derivedPrivateKey : privateJwk!,
-      rootKeyId
-    };
-    const protocolLevelDerivedKey = await HdKey.derivePrivateKey(rootKey, [KeyDerivationScheme.ProtocolPath, protocolDefinition.protocol]);
-    clone.$keyAgreement = {
-      publicKeyJwk: await X25519.getPublicKey({ key: protocolLevelDerivedKey.derivedPrivateKey }) as PublicKeyJwk,
-    };
-    await addEncryptionProperty(clone.structure as ProtocolRuleSet, protocolLevelDerivedKey);
-
+    await injectKeys(clone.structure as ProtocolRuleSet, basePath);
     return clone;
   }
 }

package/src/utils/records.ts

@@ -1,7 +1,5 @@
 import type { DerivedPrivateJwk } from './hd-key.js';
-import type { Jwk } from '@enbox/crypto';
 import type { KeyDecrypter } from '../types/encryption-types.js';
-import type { PublicKeyJwk } from '../types/jose-types.js';
 import type { X25519KeyEncryption } from './encryption.js';
 import type { Filter, KeyValues, StartsWithFilter } from '../types/query-types.js';
 import type { GenericMessage, GenericSignaturePayload, MessageSort } from '../types/message-types.js';
@@ -63,31 +61,12 @@ export class Records {
 
   /**
    * Decrypts the encrypted data in a message reply.
-   *
-   * Overload 1 (callback-based): Accepts a KeyDecrypter that performs
-   * X25519-HKDF key agreement + AES Key Unwrap internally.
+   * Accepts a KeyDecrypter that performs X25519-HKDF key agreement + AES Key Unwrap internally.
    */
   public static async decrypt(
     recordsWrite: RecordsWriteMessage,
     keyDecrypter: KeyDecrypter,
     cipherStream: ReadableStream<Uint8Array>,
-  ): Promise<ReadableStream<Uint8Array>>;
-
-  /**
-   * Overload 2 (raw-key): Takes DerivedPrivateJwk directly.
-   * @param ancestorPrivateKey Any ancestor private key in the key derivation path.
-   */
-  public static async decrypt(
-    recordsWrite: RecordsWriteMessage,
-    ancestorPrivateKey: DerivedPrivateJwk,
-    cipherStream: ReadableStream<Uint8Array>,
-  ): Promise<ReadableStream<Uint8Array>>;
-
-  // Implementation dispatches based on argument type.
-  public static async decrypt(
-    recordsWrite: RecordsWriteMessage,
-    keyOrDecrypter: DerivedPrivateJwk | KeyDecrypter,
-    cipherStream: ReadableStream<Uint8Array>,
   ): Promise<ReadableStream<Uint8Array>> {
     const { encryption } = recordsWrite;
     if (encryption === undefined) {
@@ -101,27 +80,21 @@ export class Records {
     const actualDataCid = await Cid.computeDagPbCidFromBytes(ciphertext);
     Records.validateEncryptedDataIntegrity(recordsWrite, actualDataCid, ciphertext.byteLength);
 
-    const { fullDerivationPath, leafPrivateKey, matchingKeyEncryption } =
-      await Records.findMatchingKeyEncryption(recordsWrite, keyOrDecrypter);
+    const { fullDerivationPath, matchingKeyEncryption } =
+      await Records.findMatchingKeyEncryption(recordsWrite, keyDecrypter);
 
     if (matchingKeyEncryption === undefined) {
       throw new DwnError(
         DwnErrorCode.RecordsDecryptNoMatchingKeyEncryptedFound,
-        `Unable to find a matching key encryption entry for '${keyOrDecrypter.rootKeyId}' and '${keyOrDecrypter.derivationScheme}'.`
+        `Unable to find a matching key encryption entry for '${keyDecrypter.rootKeyId}' and '${keyDecrypter.derivationScheme}'.`
       );
     }
 
-    let cek: Uint8Array;
-
-    if ('decrypt' in keyOrDecrypter) {
-      cek = await keyOrDecrypter.decrypt(fullDerivationPath, {
-        encryptedKey       : Encoder.base64UrlToBytes(matchingKeyEncryption.encryptedKey),
-        ephemeralPublicKey : matchingKeyEncryption.ephemeralPublicKey,
-        keyEncryption      : matchingKeyEncryption,
-      });
-    } else {
-      cek = await Encryption.unwrapKey(leafPrivateKey!, matchingKeyEncryption);
-    }
+    const cek = await keyDecrypter.decrypt(fullDerivationPath, {
+      encryptedKey       : Encoder.base64UrlToBytes(matchingKeyEncryption.encryptedKey),
+      ephemeralPublicKey : matchingKeyEncryption.ephemeralPublicKey,
+      keyEncryption      : matchingKeyEncryption,
+    });
 
     const iv = Encoder.base64UrlToBytes(encryption.initializationVector);
     const plaintext = await Encryption.decrypt(encryption.algorithm, cek, iv, ciphertext);
@@ -132,33 +105,18 @@ export class Records {
 
   private static async findMatchingKeyEncryption(
     recordsWrite: RecordsWriteMessage,
-    keyOrDecrypter: DerivedPrivateJwk | KeyDecrypter,
-  ): Promise<{ fullDerivationPath: string[]; leafPrivateKey?: Jwk; matchingKeyEncryption?: X25519KeyEncryption }> {
+    keyDecrypter: KeyDecrypter,
+  ): Promise<{ fullDerivationPath: string[]; matchingKeyEncryption?: X25519KeyEncryption }> {
     const { encryption } = recordsWrite;
-    const fullDerivationPath = Records.constructKeyDerivationPath(keyOrDecrypter.derivationScheme, recordsWrite);
-
-    if ('decrypt' in keyOrDecrypter) {
-      const publicKey = await keyOrDecrypter.derivePublicKey(fullDerivationPath);
-      const keyId = await Encryption.getKeyId(publicKey);
-      return {
-        fullDerivationPath,
-        matchingKeyEncryption: encryption!.keyEncryption.find((entry): boolean =>
-          entry.derivationScheme === keyOrDecrypter.derivationScheme && entry.keyId === keyId
-        ),
-      };
-    }
-
-    const leafPrivateKeyBytes = await Records.derivePrivateKey(keyOrDecrypter, fullDerivationPath);
-    const leafPrivateKey = await X25519.bytesToPrivateKey({ privateKeyBytes: leafPrivateKeyBytes });
+    const fullDerivationPath = Records.constructKeyDerivationPath(keyDecrypter.derivationScheme, recordsWrite);
 
-    const publicKey = await X25519.getPublicKey({ key: leafPrivateKey });
-    const keyId = keyOrDecrypter.keyId ?? await Encryption.getKeyId(publicKey as PublicKeyJwk);
+    const publicKey = await keyDecrypter.derivePublicKey(fullDerivationPath);
+    const keyId = await Encryption.getKeyId(publicKey);
 
     return {
       fullDerivationPath,
-      leafPrivateKey,
       matchingKeyEncryption: encryption!.keyEncryption.find((entry): boolean =>
-        entry.derivationScheme === keyOrDecrypter.derivationScheme && entry.keyId === keyId
+        entry.derivationScheme === keyDecrypter.derivationScheme && entry.keyId === keyId
       ),
     };
   }

package/dist/esm/tests/validation/json-schemas/encryption/delivery.spec.js

@@ -1,47 +0,0 @@
-import { validateJsonSchema } from '../../../../src/schema-validator.js';
-import { describe, expect, it } from 'bun:test';
-const delivery = {
-    contextId: 'thread-1',
-    keyId: 'abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG',
-    keyMaterial: {
-        algorithm: 'X25519-HKDF-SHA256+A256KW',
-        derivationScheme: 'roleAudience',
-        keyId: 'abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG',
-        privateKeyJwk: {
-            crv: 'X25519',
-            d: 'private-key',
-            kty: 'OKP',
-            x: 'public-key',
-        },
-        publicKeyJwk: {
-            crv: 'X25519',
-            kty: 'OKP',
-            x: 'public-key',
-        },
-    },
-    protocol: 'https://example.com/protocol',
-    rolePath: 'thread/participant',
-};
-describe('Delivery Schema', () => {
-    it('should accept a roleAudience key delivery payload', () => {
-        expect(() => validateJsonSchema('Delivery', delivery)).not.toThrow();
-    });
-    it('should reject legacy epoch fields', () => {
-        const invalidDelivery = {
-            ...structuredClone(delivery),
-            epoch: 1,
-        };
-        expect(() => validateJsonSchema('Delivery', invalidDelivery)).toThrow();
-    });
-    it('should reject non-roleAudience key material', () => {
-        const invalidDelivery = structuredClone(delivery);
-        invalidDelivery.keyMaterial.derivationScheme = 'protocolPath';
-        expect(() => validateJsonSchema('Delivery', invalidDelivery)).toThrow();
-    });
-    it('should reject key IDs that are not base64url thumbprints', () => {
-        const invalidDelivery = structuredClone(delivery);
-        invalidDelivery.keyMaterial.keyId = 'abcdefghijklmnopqrstuvwxyz0123456789ABCDEF!';
-        expect(() => validateJsonSchema('Delivery', invalidDelivery)).toThrow();
-    });
-});
-//# sourceMappingURL=delivery.spec.js.map

package/dist/esm/tests/validation/json-schemas/encryption/delivery.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"delivery.spec.js","sourceRoot":"","sources":["../../../../../../tests/validation/json-schemas/encryption/delivery.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAEhD,MAAM,QAAQ,GAAG;IACf,SAAS,EAAK,UAAU;IACxB,KAAK,EAAS,6CAA6C;IAC3D,WAAW,EAAG;QACZ,SAAS,EAAU,2BAA2B;QAC9C,gBAAgB,EAAG,cAAc;QACjC,KAAK,EAAc,6CAA6C;QAChE,aAAa,EAAM;YACjB,GAAG,EAAG,QAAQ;YACd,CAAC,EAAK,aAAa;YACnB,GAAG,EAAG,KAAK;YACX,CAAC,EAAK,YAAY;SACnB;QACD,YAAY,EAAE;YACZ,GAAG,EAAG,QAAQ;YACd,GAAG,EAAG,KAAK;YACX,CAAC,EAAK,YAAY;SACnB;KACF;IACD,QAAQ,EAAG,8BAA8B;IACzC,QAAQ,EAAG,oBAAoB;CAChC,CAAC;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CACJ,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAC/C,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,eAAe,GAAG;YACtB,GAAG,eAAe,CAAC,QAAQ,CAAC;YAC5B,KAAK,EAAE,CAAC;SACT,CAAC;QAEF,MAAM,CACJ,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,eAAe,CAAC,CACtD,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClD,eAAe,CAAC,WAAW,CAAC,gBAAgB,GAAG,cAAc,CAAC;QAE9D,MAAM,CACJ,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,eAAe,CAAC,CACtD,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClD,eAAe,CAAC,WAAW,CAAC,KAAK,GAAG,6CAA6C,CAAC;QAElF,MAAM,CACJ,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,eAAe,CAAC,CACtD,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/esm/tests/validation/json-schemas/encryption/grant-key.spec.js

@@ -1,72 +0,0 @@
-import { validateJsonSchema } from '../../../../src/schema-validator.js';
-import { describe, expect, it } from 'bun:test';
-const grantKey = {
-    grantId: 'grant-id',
-    keyMaterial: {
-        algorithm: 'X25519-HKDF-SHA256+A256KW',
-        derivationPath: ['protocolPath', 'https://example.com/protocol', 'message'],
-        derivationScheme: 'protocolPath',
-        keyId: 'abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG',
-        privateKeyJwk: {
-            crv: 'X25519',
-            d: 'private-key',
-            kty: 'OKP',
-            x: 'public-key',
-        },
-        publicKeyJwk: {
-            crv: 'X25519',
-            kty: 'OKP',
-            x: 'public-key',
-        },
-    },
-    scope: {
-        protocol: 'https://example.com/protocol',
-        protocolPath: 'message',
-        scheme: 'protocolPath',
-    },
-};
-describe('GrantKey Schema', () => {
-    it('should accept protocolPath derivation paths', () => {
-        expect(() => validateJsonSchema('GrantKey', grantKey)).not.toThrow();
-    });
-    it('should reject derivation paths that do not start with protocolPath', () => {
-        const invalidGrantKey = structuredClone(grantKey);
-        invalidGrantKey.keyMaterial.derivationPath[0] = 'unsupported';
-        expect(() => validateJsonSchema('GrantKey', invalidGrantKey)).toThrow();
-    });
-    it('should reject empty derivation path segments', () => {
-        const invalidGrantKey = structuredClone(grantKey);
-        invalidGrantKey.keyMaterial.derivationPath[2] = '';
-        expect(() => validateJsonSchema('GrantKey', invalidGrantKey)).toThrow();
-    });
-    it('should reject derivation paths with too many segments', () => {
-        const invalidGrantKey = structuredClone(grantKey);
-        invalidGrantKey.keyMaterial.derivationPath = [
-            'protocolPath',
-            'https://example.com/protocol',
-            'a',
-            'b',
-            'c',
-            'd',
-            'e',
-            'f',
-            'g',
-            'h',
-            'i',
-            'j',
-            'k',
-        ];
-        expect(() => validateJsonSchema('GrantKey', invalidGrantKey)).toThrow();
-    });
-    it('should reject key IDs that are not base64url thumbprints', () => {
-        const invalidGrantKey = structuredClone(grantKey);
-        invalidGrantKey.keyMaterial.keyId = 'abcdefghijklmnopqrstuvwxyz0123456789ABCDEF!';
-        expect(() => validateJsonSchema('GrantKey', invalidGrantKey)).toThrow();
-    });
-    it('should reject unsupported key material algorithms', () => {
-        const invalidGrantKey = structuredClone(grantKey);
-        invalidGrantKey.keyMaterial.algorithm = 'unsupported';
-        expect(() => validateJsonSchema('GrantKey', invalidGrantKey)).toThrow();
-    });
-});
-//# sourceMappingURL=grant-key.spec.js.map

package/dist/esm/tests/validation/json-schemas/encryption/grant-key.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"grant-key.spec.js","sourceRoot":"","sources":["../../../../../../tests/validation/json-schemas/encryption/grant-key.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAEhD,MAAM,QAAQ,GAAG;IACf,OAAO,EAAO,UAAU;IACxB,WAAW,EAAG;QACZ,SAAS,EAAU,2BAA2B;QAC9C,cAAc,EAAK,CAAC,cAAc,EAAE,8BAA8B,EAAE,SAAS,CAAC;QAC9E,gBAAgB,EAAG,cAAc;QACjC,KAAK,EAAc,6CAA6C;QAChE,aAAa,EAAM;YACjB,GAAG,EAAG,QAAQ;YACd,CAAC,EAAK,aAAa;YACnB,GAAG,EAAG,KAAK;YACX,CAAC,EAAK,YAAY;SACnB;QACD,YAAY,EAAE;YACZ,GAAG,EAAG,QAAQ;YACd,GAAG,EAAG,KAAK;YACX,CAAC,EAAK,YAAY;SACnB;KACF;IACD,KAAK,EAAE;QACL,QAAQ,EAAO,8BAA8B;QAC7C,YAAY,EAAG,SAAS;QACxB,MAAM,EAAS,cAAc;KAC9B;CACF,CAAC;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CACJ,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAC/C,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClD,eAAe,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC;QAE9D,MAAM,CACJ,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,eAAe,CAAC,CACtD,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClD,eAAe,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAEnD,MAAM,CACJ,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,eAAe,CAAC,CACtD,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClD,eAAe,CAAC,WAAW,CAAC,cAAc,GAAG;YAC3C,cAAc;YACd,8BAA8B;YAC9B,GAAG;YACH,GAAG;YACH,GAAG;YACH,GAAG;YACH,GAAG;YACH,GAAG;YACH,GAAG;YACH,GAAG;YACH,GAAG;YACH,GAAG;YACH,GAAG;SACJ,CAAC;QAEF,MAAM,CACJ,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,eAAe,CAAC,CACtD,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClD,eAAe,CAAC,WAAW,CAAC,KAAK,GAAG,6CAA6C,CAAC;QAElF,MAAM,CACJ,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,eAAe,CAAC,CACtD,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClD,eAAe,CAAC,WAAW,CAAC,SAAS,GAAG,aAAa,CAAC;QAEtD,MAAM,CACJ,GAAG,EAAE,CAAC,kBAAkB,CAAC,UAAU,EAAE,eAAe,CAAC,CACtD,CAAC,OAAO,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/types/tests/validation/json-schemas/encryption/delivery.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=delivery.spec.d.ts.map

package/dist/types/tests/validation/json-schemas/encryption/delivery.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"delivery.spec.d.ts","sourceRoot":"","sources":["../../../../../../tests/validation/json-schemas/encryption/delivery.spec.ts"],"names":[],"mappings":""}

package/dist/types/tests/validation/json-schemas/encryption/grant-key.spec.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=grant-key.spec.d.ts.map

package/dist/types/tests/validation/json-schemas/encryption/grant-key.spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"grant-key.spec.d.ts","sourceRoot":"","sources":["../../../../../../tests/validation/json-schemas/encryption/grant-key.spec.ts"],"names":[],"mappings":""}