@interop/did-cli 0.7.1 → 0.9.0

package/dist/edv/recipients.d.ts

@@ -0,0 +1,65 @@
+import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
+/** The X25519 key-agreement verification-method type minimal-cipher expects. */
+export declare const KEY_AGREEMENT_TYPE = "X25519KeyAgreementKey2020";
+/**
+ * An X25519 key-agreement key instance with its `.id` (`kid`) populated. Used
+ * both as a resolved recipient (encrypt reads `id` + `publicKeyMultibase`) and
+ * as the decryption key (decrypt reads `id` + `deriveSecret`).
+ */
+export type KeyAgreementKey = InstanceType<typeof X25519KeyAgreementKey2020> & {
+    id: string;
+};
+/**
+ * Resolve one `--recipient` value to a recipient key. Resolution order: a raw
+ * X25519 `publicKeyMultibase` (starts `z6LS`), then a DID / DID URL, then a
+ * wallet key fingerprint or handle.
+ *
+ * @param options {object}
+ * @param options.ref {string}
+ * @returns {Promise<KeyAgreementKey>}
+ */
+export declare function resolveRecipient({ ref }: {
+    ref: string;
+}): Promise<KeyAgreementKey>;
+/**
+ * Load and validate a key-document JSON file holding an X25519 public key, and
+ * construct its key-agreement key.
+ *
+ * @param options {object}
+ * @param options.path {string}
+ * @returns {Promise<KeyAgreementKey>}
+ */
+export declare function resolveRecipientFile({ path }: {
+    path: string;
+}): Promise<KeyAgreementKey>;
+/**
+ * Resolve a `--key` reference (fingerprint or handle) to a reconstructed
+ * X25519 key-agreement key. The referenced key must be a stored X25519 key
+ * with its secret half.
+ *
+ * @param options {object}
+ * @param options.ref {string}
+ * @returns {Promise<KeyAgreementKey>}
+ */
+export declare function loadKeyAgreementKey({ ref }: {
+    ref: string;
+}): Promise<KeyAgreementKey>;
+/**
+ * Auto-select the decryption key when `--key` is omitted: scan the stored
+ * X25519 secret keys and return the one whose `id` (`kid`) matches a recipient
+ * of the JWE. Throws when none match or more than one does.
+ *
+ * @param options {object}
+ * @param options.jwe {{recipients?: {header?: {kid?: string}}[]}}
+ * @returns {Promise<KeyAgreementKey>}
+ */
+export declare function autoSelectKeyAgreementKey({ jwe }: {
+    jwe: {
+        recipients?: {
+            header?: {
+                kid?: string;
+            };
+        }[];
+    };
+}): Promise<KeyAgreementKey>;
+//# sourceMappingURL=recipients.d.ts.map

package/dist/edv/recipients.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipients.d.ts","sourceRoot":"","sources":["../../src/edv/recipients.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAI7E,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,8BAA8B,CAAA;AAW7D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,yBAAyB,CAAC,GAAG;IAC7E,EAAE,EAAE,MAAM,CAAA;CACX,CAAA;AAqKD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,eAAe,CAAC,CAmB3B;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,eAAe,CAAC,CAa3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,eAAe,CAAC,CAa3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,GAAG,EACJ,EAAE;IACD,GAAG,EAAE;QAAE,UAAU,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE;gBAAE,GAAG,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,EAAE,CAAA;KAAE,CAAA;CACtD,GAAG,OAAO,CAAC,eAAe,CAAC,CAsC3B"}

package/dist/edv/recipients.js

@@ -0,0 +1,253 @@
+/**
+ * Recipient and key-agreement resolution for the `edv encrypt`/`edv decrypt`
+ * commands. Normalizes the several recipient reference forms (a raw X25519
+ * `publicKeyMultibase`, a wallet key fingerprint or handle, a DID or DID URL,
+ * and a key-document JSON file) into `X25519KeyAgreementKey2020` instances --
+ * the shape `@interop/minimal-cipher`'s `keyResolver` returns (the cipher reads
+ * `id` and `publicKeyMultibase` from a recipient on encrypt, and `id` and
+ * `deriveSecret` from the key on decrypt, all of which an instance provides).
+ * Builds the recipients array plus that resolver, and reconstructs stored keys
+ * for decrypt.
+ */
+import { readFile } from 'node:fs/promises';
+import { securityLoader } from '@interop/security-document-loader';
+import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
+import { listCollection, loadFromCollection } from '../storage.js';
+import { resolveKeyRef } from '../meta.js';
+/** The X25519 key-agreement verification-method type minimal-cipher expects. */
+export const KEY_AGREEMENT_TYPE = 'X25519KeyAgreementKey2020';
+/**
+ * Document loader for DID-URL recipient resolution: resolves a bare DID to its
+ * DID document and dereferences a `did#fragment` URL straight to its
+ * verification-method node, for both did:key (offline) and did:web (fetched).
+ * Built once and reused. (Per project convention, DID/JSON-LD resolution goes
+ * through `@interop/security-document-loader`, never a hand-rolled loader.)
+ */
+const documentLoader = securityLoader().build();
+/**
+ * Construct an X25519 key-agreement key from a verification method or stored
+ * key pair. `didKey: true` defaults a source with no `controller`/`id` to its
+ * `did:key` form, so the key class derives `.id` as `did:key:<mb>#<mb>` -- the
+ * `kid` encrypt and decrypt both match on -- while a source that already
+ * carries an `id`/`controller` (e.g. a DID verification method) keeps it. A
+ * `type: 'Multikey'` source is normalized via `fromMultikey`. The constructor
+ * validates the multibase header bytes.
+ *
+ * @param source {Record<string, any>}
+ * @returns {Promise<KeyAgreementKey>}
+ */
+async function keyAgreementKeyFrom(source) {
+    const key = await X25519KeyAgreementKey2020.from({ didKey: true, ...source });
+    return key;
+}
+/**
+ * Split a DID URL into its base DID and `#fragment` (undefined when absent).
+ *
+ * @param options {object}
+ * @param options.ref {string}
+ * @returns {{did: string, fragment?: string}}
+ */
+function splitFragment({ ref }) {
+    const hash = ref.indexOf('#');
+    if (hash === -1) {
+        return { did: ref };
+    }
+    return { did: ref.slice(0, hash), fragment: ref.slice(hash + 1) };
+}
+/**
+ * Resolve a DID URL through the security document loader. A bare DID resolves
+ * to its DID document; a `did#fragment` URL is dereferenced straight to its
+ * verification-method node.
+ *
+ * @param options {object}
+ * @param options.url {string}
+ * @returns {Promise<Record<string, any>>}
+ */
+async function resolveDidUrl({ url }) {
+    const { document } = (await documentLoader(url));
+    return document;
+}
+/**
+ * True when a `publicKeyMultibase` carries the X25519 multicodec header. This
+ * is the type-agnostic discriminator for a usable key-agreement key: it accepts
+ * both an `X25519KeyAgreementKey2020` and a `Multikey` whose key is X25519,
+ * while rejecting an Ed25519/other key, regardless of the `type` string a DID
+ * document happens to use.
+ *
+ * @param publicKeyMultibase {string | undefined}
+ * @returns {boolean}
+ */
+function isX25519PublicKey(publicKeyMultibase) {
+    if (!publicKeyMultibase) {
+        return false;
+    }
+    try {
+        // The constructor validates the X25519 header bytes and throws otherwise.
+        X25519KeyAgreementKey2020.fromFingerprint({
+            fingerprint: publicKeyMultibase
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Validate that a verification method is a usable X25519 key-agreement key
+ * (an `X25519KeyAgreementKey2020` or a `Multikey` whose public key is X25519)
+ * and construct it.
+ *
+ * @param options {object}
+ * @param options.method {Record<string, any>}
+ * @param options.ref {string}
+ * @returns {Promise<KeyAgreementKey>}
+ */
+async function toKeyAgreementKey({ method, ref }) {
+    if (!isX25519PublicKey(method.publicKeyMultibase)) {
+        throw new Error(`Recipient "${ref}" is not an ${KEY_AGREEMENT_TYPE} key.`);
+    }
+    return keyAgreementKeyFrom(method);
+}
+/**
+ * Resolve a DID or DID URL recipient to its X25519 key-agreement key. A bare
+ * DID with a single keyAgreement key uses that key; one with several requires
+ * the `#fragment` form to disambiguate.
+ *
+ * @param options {object}
+ * @param options.ref {string}
+ * @returns {Promise<KeyAgreementKey>}
+ */
+async function resolveDidRecipient({ ref }) {
+    const { did, fragment } = splitFragment({ ref });
+    // A fragment URL dereferences straight to its verification-method node.
+    if (fragment !== undefined) {
+        return toKeyAgreementKey({ method: await resolveDidUrl({ url: ref }), ref });
+    }
+    // A bare DID: pick the single keyAgreement key, dereferencing any entries
+    // that are id references rather than embedded verification methods.
+    const didDocument = await resolveDidUrl({ url: did });
+    const entries = (didDocument.keyAgreement ?? []);
+    const methods = [];
+    for (const entry of entries) {
+        methods.push(typeof entry === 'string' ? await resolveDidUrl({ url: entry }) : entry);
+    }
+    const usable = methods.filter(method => method.type === KEY_AGREEMENT_TYPE && method.publicKeyMultibase);
+    if (usable.length === 0) {
+        throw new Error(`DID ${did} has no ${KEY_AGREEMENT_TYPE} keyAgreement key.`);
+    }
+    if (usable.length > 1) {
+        throw new Error(`DID ${did} has ${usable.length} keyAgreement keys; ` +
+            'use the did#fragment form to choose one.');
+    }
+    return toKeyAgreementKey({ method: usable[0], ref });
+}
+/**
+ * Resolve one `--recipient` value to a recipient key. Resolution order: a raw
+ * X25519 `publicKeyMultibase` (starts `z6LS`), then a DID / DID URL, then a
+ * wallet key fingerprint or handle.
+ *
+ * @param options {object}
+ * @param options.ref {string}
+ * @returns {Promise<KeyAgreementKey>}
+ */
+export async function resolveRecipient({ ref }) {
+    if (ref.startsWith('z6LS')) {
+        return toKeyAgreementKey({
+            method: { type: KEY_AGREEMENT_TYPE, publicKeyMultibase: ref },
+            ref
+        });
+    }
+    if (ref.startsWith('did:')) {
+        return resolveDidRecipient({ ref });
+    }
+    const resolved = await resolveKeyRef({ ref });
+    if (!resolved?.key.publicKeyMultibase) {
+        throw new Error(`Could not resolve recipient "${ref}".`);
+    }
+    const stored = resolved.key;
+    if (stored.type !== KEY_AGREEMENT_TYPE) {
+        throw new Error(`Wallet key "${ref}" is not an ${KEY_AGREEMENT_TYPE} key.`);
+    }
+    return keyAgreementKeyFrom(stored);
+}
+/**
+ * Load and validate a key-document JSON file holding an X25519 public key, and
+ * construct its key-agreement key.
+ *
+ * @param options {object}
+ * @param options.path {string}
+ * @returns {Promise<KeyAgreementKey>}
+ */
+export async function resolveRecipientFile({ path }) {
+    let method;
+    try {
+        method = JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch (err) {
+        throw new Error(`Could not read key document "${path}": ${err.message}`, {
+            cause: err
+        });
+    }
+    return toKeyAgreementKey({ method, ref: path });
+}
+/**
+ * Resolve a `--key` reference (fingerprint or handle) to a reconstructed
+ * X25519 key-agreement key. The referenced key must be a stored X25519 key
+ * with its secret half.
+ *
+ * @param options {object}
+ * @param options.ref {string}
+ * @returns {Promise<KeyAgreementKey>}
+ */
+export async function loadKeyAgreementKey({ ref }) {
+    const resolved = await resolveKeyRef({ ref });
+    if (!resolved) {
+        throw new Error(`No locally stored key found for "${ref}".`);
+    }
+    const stored = resolved.key;
+    if (stored.type !== KEY_AGREEMENT_TYPE) {
+        throw new Error(`Wallet key "${ref}" is not an ${KEY_AGREEMENT_TYPE} key.`);
+    }
+    if (!stored.privateKeyMultibase) {
+        throw new Error(`Wallet key "${ref}" has no secret key to decrypt with.`);
+    }
+    return keyAgreementKeyFrom(stored);
+}
+/**
+ * Auto-select the decryption key when `--key` is omitted: scan the stored
+ * X25519 secret keys and return the one whose `id` (`kid`) matches a recipient
+ * of the JWE. Throws when none match or more than one does.
+ *
+ * @param options {object}
+ * @param options.jwe {{recipients?: {header?: {kid?: string}}[]}}
+ * @returns {Promise<KeyAgreementKey>}
+ */
+export async function autoSelectKeyAgreementKey({ jwe }) {
+    const kids = new Set((jwe.recipients ?? [])
+        .map(recipient => recipient?.header?.kid)
+        .filter((kid) => typeof kid === 'string'));
+    const storageIds = await listCollection('keys');
+    const matches = [];
+    for (const storageId of storageIds) {
+        const stored = await loadFromCollection('keys', storageId);
+        if (stored.type !== KEY_AGREEMENT_TYPE ||
+            !stored.privateKeyMultibase ||
+            !stored.publicKeyMultibase) {
+            continue;
+        }
+        const key = await keyAgreementKeyFrom(stored);
+        if (kids.has(key.id)) {
+            matches.push(key);
+        }
+    }
+    if (matches.length === 0) {
+        throw new Error('No stored X25519 key matches any recipient of this JWE; ' +
+            'pass --key to choose one.');
+    }
+    if (matches.length > 1) {
+        throw new Error(`${matches.length} stored X25519 keys match this JWE; ` +
+            'pass --key to choose one.');
+    }
+    return matches[0];
+}
+//# sourceMappingURL=recipients.js.map

package/dist/edv/recipients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipients.js","sourceRoot":"","sources":["../../src/edv/recipients.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE1C,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAA;AAE7D;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,cAAc,EAAE,CAAC,KAAK,EAAE,CAAA;AAmB/C;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,mBAAmB,CAChC,MAA2B;IAE3B,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IAC7E,OAAO,GAAsB,CAAA;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,EAAE,GAAG,EAAmB;IAI7C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;IACrB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAA;AACnE,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,aAAa,CAAC,EAC3B,GAAG,EAGJ;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,CAE9C,CAAA;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,kBAA2B;IACpD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC;QACH,0EAA0E;QAC1E,yBAAyB,CAAC,eAAe,CAAC;YACxC,WAAW,EAAE,kBAAkB;SAChC,CAAC,CAAA;QACF,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAC/B,MAAM,EACN,GAAG,EAIJ;IACC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,eAAe,kBAAkB,OAAO,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,mBAAmB,CAAC,EACjC,GAAG,EAGJ;IACC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAEhD,wEAAwE;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,YAAY,IAAI,EAAE,CAG5C,CAAA;IACH,MAAM,OAAO,GAA0B,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CACV,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CACxE,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,CAC1E,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,WAAW,kBAAkB,oBAAoB,CAAC,CAAA;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,OAAO,GAAG,QAAQ,MAAM,CAAC,MAAM,sBAAsB;YACnD,0CAA0C,CAC7C,CAAA;IACH,CAAC;IACD,OAAO,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,GAAG,EAGJ;IACC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,iBAAiB,CAAC;YACvB,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,GAAG,EAAE;YAC7D,GAAG;SACJ,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IACrC,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7C,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAA;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAA4B,CAAA;IACpD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,eAAe,kBAAkB,OAAO,CAAC,CAAA;IAC7E,CAAC;IACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,IAAI,EAGL;IACC,IAAI,MAA2B,CAAA;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,EAClE;YACE,KAAK,EAAE,GAAG;SACX,CACF,CAAA;IACH,CAAC;IACD,OAAO,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,GAAG,EAGJ;IACC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;IAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,IAAI,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAA4B,CAAA;IACpD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,eAAe,kBAAkB,OAAO,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,sCAAsC,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,GAAG,EAGJ;IACC,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;SACnB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC;SACxC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAC3D,CAAA;IACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAA;IAC/C,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,MAAM,EACN,SAAS,CACV,CAAA;QACD,IACE,MAAM,CAAC,IAAI,KAAK,kBAAkB;YAClC,CAAC,MAAM,CAAC,mBAAmB;YAC3B,CAAC,MAAM,CAAC,kBAAkB,EAC1B,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,0DAA0D;YACxD,2BAA2B,CAC9B,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,MAAM,sCAAsC;YACrD,2BAA2B,CAC9B,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC"}

package/dist/edv/stream.d.ts

@@ -0,0 +1,69 @@
+import type { Cipher } from '@interop/minimal-cipher';
+import type { IEDVChunk, IEncryptedDocument, IKeyResolver, IRecipientTemplate } from '@interop/data-integrity-core';
+import type { KeyAgreementKey } from './recipients.js';
+/**
+ * Encrypt `data` as a stream of chunks for the given recipients, stamping the
+ * document `sequence` onto each chunk (as `EdvClientCore._updateStream` does).
+ *
+ * @param options {object}
+ * @param options.cipher {Cipher}
+ * @param options.data {Uint8Array}
+ * @param options.recipients {IRecipientTemplate[]}
+ * @param options.keyResolver {IKeyResolver}
+ * @param [options.chunkSize] {number}   Bytes per chunk (cipher default 1 MiB).
+ * @param options.sequence {number}   The owning document's sequence.
+ * @returns {Promise<IEDVChunk[]>}
+ */
+export declare function encryptToChunks({ cipher, data, recipients, keyResolver, chunkSize, sequence }: {
+    cipher: Cipher;
+    data: Uint8Array;
+    recipients: IRecipientTemplate[];
+    keyResolver: IKeyResolver;
+    chunkSize?: number;
+    sequence: number;
+}): Promise<IEDVChunk[]>;
+/**
+ * Decrypt a document's chunks (in `index` order) back into the original bytes.
+ * A wrong key surfaces as a thrown `DataError` from the decrypt transformer.
+ *
+ * @param options {object}
+ * @param options.cipher {Cipher}
+ * @param options.chunks {IEDVChunk[]}
+ * @param options.keyAgreementKey {KeyAgreementKey}
+ * @returns {Promise<Uint8Array>}
+ */
+export declare function decryptChunks({ cipher, chunks, keyAgreementKey }: {
+    cipher: Cipher;
+    chunks: IEDVChunk[];
+    keyAgreementKey: KeyAgreementKey;
+}): Promise<Uint8Array>;
+/**
+ * Write a streamed EDV Document as a bundle directory: `document.json` plus
+ * `chunks/<index>.jwe.json` for each chunk.
+ *
+ * @param options {object}
+ * @param options.dir {string}   The bundle directory path.
+ * @param options.document {IEncryptedDocument}
+ * @param options.chunks {IEDVChunk[]}
+ * @returns {Promise<void>}
+ */
+export declare function writeDocumentBundle({ dir, document, chunks }: {
+    dir: string;
+    document: IEncryptedDocument;
+    chunks: IEDVChunk[];
+}): Promise<void>;
+/**
+ * Read a bundle directory back into its document envelope and chunks (sorted by
+ * `index`).
+ *
+ * @param options {object}
+ * @param options.dir {string}   The bundle directory path.
+ * @returns {Promise<{document: IEncryptedDocument, chunks: IEDVChunk[]}>}
+ */
+export declare function readDocumentBundle({ dir }: {
+    dir: string;
+}): Promise<{
+    document: IEncryptedDocument;
+    chunks: IEDVChunk[];
+}>;
+//# sourceMappingURL=stream.d.ts.map

package/dist/edv/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/edv/stream.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,KAAK,EACV,SAAS,EACT,kBAAkB,EAElB,YAAY,EACZ,kBAAkB,EACnB,MAAM,8BAA8B,CAAA;AAErC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AA6DtD;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,IAAI,EACJ,UAAU,EACV,WAAW,EACX,SAAS,EACT,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,UAAU,CAAA;IAChB,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,WAAW,EAAE,YAAY,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAgBvB;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,EAClC,MAAM,EACN,MAAM,EACN,eAAe,EAChB,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,SAAS,EAAE,CAAA;IACnB,eAAe,EAAE,eAAe,CAAA;CACjC,GAAG,OAAO,CAAC,UAAU,CAAC,CAUtB;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,GAAG,EACH,QAAQ,EACR,MAAM,EACP,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,MAAM,EAAE,SAAS,EAAE,CAAA;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAehB;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC;IAC1E,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,MAAM,EAAE,SAAS,EAAE,CAAA;CACpB,CAAC,CA0BD"}

package/dist/edv/stream.js

@@ -0,0 +1,169 @@
+/**
+ * Chunked-stream support for EDV Documents (Layer 2, Phase 2): encrypt a large
+ * input as a sequence of fixed-size encrypted chunks instead of a single JWE,
+ * and decrypt the chunks back into the original bytes. A streamed document
+ * carries a cleartext `stream: { sequence, chunks }` descriptor; the bytes
+ * themselves live in separate chunk JWEs, each `{ sequence, index, offset, jwe }`
+ * (`IEDVChunk`), mirroring how an EDV / WAS server stores stream resources apart
+ * from the document.
+ *
+ * On disk the document and its chunks are a **bundle directory** (convention
+ * `*.edvdoc/`): `document.json` (the `{ id, sequence, indexed, stream, jwe }`
+ * envelope) and `chunks/<index>.jwe.json` (one file per chunk). This keeps the
+ * chunks as distinct resources, faithful to the server model.
+ *
+ * The cipher driving mirrors `@interop/edv-client`'s `_updateStream` /
+ * `EdvDocument.getStream` without taking that dependency: it pumps the input
+ * through `cipher.createEncryptStream`, stamps the document `sequence` onto each
+ * emitted chunk, and feeds chunks back (in `index` order) through
+ * `cipher.createDecryptStream`.
+ */
+import { mkdir, readFile, readdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { isEncryptedDocument } from './document.js';
+/** The envelope file within a bundle directory. */
+const BUNDLE_DOCUMENT_FILE = 'document.json';
+/** The subdirectory holding the chunk JWE files within a bundle directory. */
+const BUNDLE_CHUNKS_DIR = 'chunks';
+/**
+ * Drain a TransformStream: write each input value, then read every output
+ * value. Reads run concurrently with the single write so a large input cannot
+ * deadlock against the stream's internal backpressure.
+ *
+ * @param options {object}
+ * @param options.stream {TransformStream}
+ * @param options.inputs {unknown[]}   Values to write to the writable side.
+ * @returns {Promise<T[]>}   The values emitted on the readable side.
+ */
+async function pump({ stream, inputs }) {
+    const writer = stream.writable.getWriter();
+    const reader = stream.readable.getReader();
+    const outputs = [];
+    const reading = (async () => {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done) {
+                break;
+            }
+            outputs.push(value);
+        }
+    })();
+    for (const input of inputs) {
+        await writer.write(input);
+    }
+    await writer.close();
+    await reading;
+    return outputs;
+}
+/**
+ * Concatenate Uint8Array parts into a single buffer.
+ *
+ * @param parts {Uint8Array[]}
+ * @returns {Uint8Array}
+ */
+function concatBytes(parts) {
+    const total = parts.reduce((sum, part) => sum + part.byteLength, 0);
+    const result = new Uint8Array(total);
+    let offset = 0;
+    for (const part of parts) {
+        result.set(part, offset);
+        offset += part.byteLength;
+    }
+    return result;
+}
+/**
+ * Encrypt `data` as a stream of chunks for the given recipients, stamping the
+ * document `sequence` onto each chunk (as `EdvClientCore._updateStream` does).
+ *
+ * @param options {object}
+ * @param options.cipher {Cipher}
+ * @param options.data {Uint8Array}
+ * @param options.recipients {IRecipientTemplate[]}
+ * @param options.keyResolver {IKeyResolver}
+ * @param [options.chunkSize] {number}   Bytes per chunk (cipher default 1 MiB).
+ * @param options.sequence {number}   The owning document's sequence.
+ * @returns {Promise<IEDVChunk[]>}
+ */
+export async function encryptToChunks({ cipher, data, recipients, keyResolver, chunkSize, sequence }) {
+    const stream = await cipher.createEncryptStream({
+        recipients,
+        keyResolver,
+        chunkSize
+    });
+    const emitted = await pump({
+        stream,
+        inputs: [data]
+    });
+    return emitted.map(chunk => ({
+        sequence,
+        index: chunk.index,
+        offset: chunk.offset,
+        jwe: chunk.jwe
+    }));
+}
+/**
+ * Decrypt a document's chunks (in `index` order) back into the original bytes.
+ * A wrong key surfaces as a thrown `DataError` from the decrypt transformer.
+ *
+ * @param options {object}
+ * @param options.cipher {Cipher}
+ * @param options.chunks {IEDVChunk[]}
+ * @param options.keyAgreementKey {KeyAgreementKey}
+ * @returns {Promise<Uint8Array>}
+ */
+export async function decryptChunks({ cipher, chunks, keyAgreementKey }) {
+    const ordered = [...chunks].sort((first, second) => first.index - second.index);
+    const stream = await cipher.createDecryptStream({ keyAgreementKey });
+    const parts = await pump({
+        stream,
+        inputs: ordered.map(chunk => ({ jwe: chunk.jwe }))
+    });
+    return concatBytes(parts);
+}
+/**
+ * Write a streamed EDV Document as a bundle directory: `document.json` plus
+ * `chunks/<index>.jwe.json` for each chunk.
+ *
+ * @param options {object}
+ * @param options.dir {string}   The bundle directory path.
+ * @param options.document {IEncryptedDocument}
+ * @param options.chunks {IEDVChunk[]}
+ * @returns {Promise<void>}
+ */
+export async function writeDocumentBundle({ dir, document, chunks }) {
+    const chunksDir = join(dir, BUNDLE_CHUNKS_DIR);
+    await mkdir(chunksDir, { recursive: true });
+    await writeFile(join(dir, BUNDLE_DOCUMENT_FILE), `${JSON.stringify(document, null, 2)}\n`, 'utf8');
+    for (const chunk of chunks) {
+        await writeFile(join(chunksDir, `${chunk.index}.jwe.json`), `${JSON.stringify(chunk, null, 2)}\n`, 'utf8');
+    }
+}
+/**
+ * Read a bundle directory back into its document envelope and chunks (sorted by
+ * `index`).
+ *
+ * @param options {object}
+ * @param options.dir {string}   The bundle directory path.
+ * @returns {Promise<{document: IEncryptedDocument, chunks: IEDVChunk[]}>}
+ */
+export async function readDocumentBundle({ dir }) {
+    let document;
+    try {
+        document = JSON.parse(await readFile(join(dir, BUNDLE_DOCUMENT_FILE), 'utf8'));
+    }
+    catch (err) {
+        throw new Error(`Could not read ${BUNDLE_DOCUMENT_FILE} in bundle "${dir}": ${err.message}`, { cause: err });
+    }
+    if (!isEncryptedDocument(document)) {
+        throw new Error(`Bundle "${dir}" does not contain an EDV Document.`);
+    }
+    const chunksDir = join(dir, BUNDLE_CHUNKS_DIR);
+    const names = (await readdir(chunksDir).catch(() => [])).filter(name => name.endsWith('.jwe.json'));
+    const chunks = [];
+    for (const name of names) {
+        chunks.push(JSON.parse(await readFile(join(chunksDir, name), 'utf8')));
+    }
+    chunks.sort((first, second) => first.index - second.index);
+    return { document, chunks };
+}
+//# sourceMappingURL=stream.js.map

package/dist/edv/stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.js","sourceRoot":"","sources":["../../src/edv/stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAShC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAGnD,mDAAmD;AACnD,MAAM,oBAAoB,GAAG,eAAe,CAAA;AAC5C,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,QAAQ,CAAA;AAElC;;;;;;;;;GASG;AACH,KAAK,UAAU,IAAI,CAAI,EACrB,MAAM,EACN,MAAM,EAIP;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAA;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAA;IAC1C,MAAM,OAAO,GAAQ,EAAE,CAAA;IACvB,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,SAAS,CAAC;YACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAK;YACP,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,KAAU,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC3B,CAAC;IACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IACpB,MAAM,OAAO,CAAA;IACb,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAmB;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;IACnE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACpC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACxB,MAAM,IAAI,IAAI,CAAC,UAAU,CAAA;IAC3B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,IAAI,EACJ,UAAU,EACV,WAAW,EACX,SAAS,EACT,QAAQ,EAQT;IACC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC;QAC9C,UAAU;QACV,WAAW;QACX,SAAS;KACV,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAA+C;QACvE,MAAM;QACN,MAAM,EAAE,CAAC,IAAI,CAAC;KACf,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3B,QAAQ;QACR,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAC,CAAA;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,MAAM,EACN,MAAM,EACN,eAAe,EAKhB;IACC,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAC9B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAC9C,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IACpE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAa;QACnC,MAAM;QACN,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;KACnD,CAAC,CAAA;IACF,OAAO,WAAW,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,GAAG,EACH,QAAQ,EACR,MAAM,EAKP;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;IAC9C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,MAAM,SAAS,CACb,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,EAC/B,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACxC,MAAM,CACP,CAAA;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,CACb,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,KAAK,WAAW,CAAC,EAC1C,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EACrC,MAAM,CACP,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAE,GAAG,EAAmB;IAI/D,IAAI,QAAiB,CAAA;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CACnB,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC,CACxD,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,kBAAkB,oBAAoB,eAAe,GAAG,MAAO,GAAa,CAAC,OAAO,EAAE,EACtF,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,qCAAqC,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAA;IAC9C,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CACrE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC3B,CAAA;IACD,MAAM,MAAM,GAAgB,EAAE,CAAA;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;AAC7B,CAAC"}

package/dist/index.js

@@ -2,6 +2,7 @@
 import { createRequire } from 'node:module';
 import { Command } from 'commander';
 import { makeDidCommand } from './commands/did.js';
+import { makeEdvCommand } from './commands/edv.js';
 import { makeKeyCommand } from './commands/key.js';
 import { makeVcCommand } from './commands/vc.js';
 import { makeWalletCommand } from './commands/wallet.js';
@@ -11,6 +12,7 @@ const { version } = createRequire(import.meta.url)('../package.json');
 const program = new Command();
 program.name('di').description('DID CLI tool').version(version);
 program.addCommand(makeDidCommand());
+program.addCommand(makeEdvCommand());
 program.addCommand(makeKeyCommand());
 program.addCommand(makeVcCommand());
 program.addCommand(makeWalletCommand());

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEpD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAEnE,CAAA;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;AAE7B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAE/D,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAA;AACpC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAA;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAA;AACnC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAA;AACvC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAA;AACpC,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAA;AAErC,OAAO,CAAC,KAAK,EAAE,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEpD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAEnE,CAAA;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;AAE7B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;AAE/D,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAA;AACpC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAA;AACpC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAA;AACpC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAA;AACnC,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAA;AACvC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAA;AACpC,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAA;AAErC,OAAO,CAAC,KAAK,EAAE,CAAA"}

package/dist/meta.d.ts

@@ -156,6 +156,7 @@ export declare function resolveKeyRef({ ref }: {
 }): Promise<{
     storageId: string;
     key: {
+        id?: string;
         publicKeyMultibase?: string;
         secretKeyMultibase?: string;
     };

package/dist/meta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meta.d.ts","sourceRoot":"","sources":["../src/meta.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EASL,KAAK,WAAW,EACjB,MAAM,cAAc,CAAA;AAErB;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,SAAS,EAAE,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IACvE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAQA;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAsB5E;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,kBAAkB,EAClB,GAAG,EACJ,EAAE;IACD,kBAAkB,EAAE,MAAM,CAAA;IAC1B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,kBAAkB,EAClB,GAAG,EACJ,EAAE;IACD,kBAAkB,EAAE,MAAM,CAAA;IAC1B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,EAClC,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAsB9B;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CACnE;IACE,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,CAAC,EAAE,WAAW,CAAA;CACnB,GACD,SAAS,CACZ,CAkCA;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CACzE;IACE,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,IAAI,CAAC,EAAE,WAAW,CAAA;CACnB,GACD,SAAS,CACZ,CAmDA;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAClE;IACE,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE;QAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACjE,IAAI,CAAC,EAAE,WAAW,CAAA;CACnB,GACD,SAAS,CACZ,CAgCA"}
+{"version":3,"file":"meta.d.ts","sourceRoot":"","sources":["../src/meta.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EASL,KAAK,WAAW,EACjB,MAAM,cAAc,CAAA;AAErB;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,SAAS,EAAE,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IACvE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,CAQA;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAsB5E;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,kBAAkB,EAClB,GAAG,EACJ,EAAE;IACD,kBAAkB,EAAE,MAAM,CAAA;IAC1B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,kBAAkB,EAClB,GAAG,EACJ,EAAE;IACD,kBAAkB,EAAE,MAAM,CAAA;IAC1B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,EAClC,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAsB9B;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CACnE;IACE,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,CAAC,EAAE,WAAW,CAAA;CACnB,GACD,SAAS,CACZ,CAkCA;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACjC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CACzE;IACE,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,IAAI,CAAC,EAAE,WAAW,CAAA;CACnB,GACD,SAAS,CACZ,CAmDA;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,EAAE,GAAG,EAAE,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAClE;IACE,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE;QACH,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD,IAAI,CAAC,EAAE,WAAW,CAAA;CACnB,GACD,SAAS,CACZ,CAiCA"}

package/dist/meta.js

@@ -16,7 +16,7 @@ import { findStoredKey, listCollection, listDids, loadDidDocument, loadDidMeta,
  * @returns {{date?: string, type?: string, curve?: string}}
  */
 export function parseKeyStorageId({ storageId }) {
-    const match = storageId.match(/^(\d{4}-\d{2}-\d{2})-(ed25519|ecdsa)(?:-(p\d{3}))?-/);
+    const match = storageId.match(/^(\d{4}-\d{2}-\d{2})-(ed25519|ecdsa|x25519|hmac)(?:-(p\d{3}))?-/);
     if (!match) {
         return {};
     }