@kubun/plugin-p2p 0.12.0 → 0.13.0

package/lib/groups/credential-apply.js

@@ -0,0 +1,410 @@
+import { normalizeDID } from '@kokuin/token';
+import { credentialOpMatchesPut, digestParts, verifyCredentialOp } from '@kubun/credential';
+import { HLC } from '@kubun/hlc';
+import { DEFAULT_MAX_DRIFT_MS } from '@kubun/mutation';
+import { fromB64U } from '@sozai/codec';
+import { credentialEntriesDigest, credentialKeyBranchesDigest, credentialWrappingDigest, verifyCredentialKeyGrant } from './credential-grant-token.js';
+/**
+ * Apply a signed `credential:key-grant`: the key's public record, the one
+ * wrapping addressed to this device, and every entry ciphertext at that version.
+ *
+ * Sender-binding here is DIRECTIONAL, unlike `access-default:set`'s. That rule
+ * ("the stored owner equals the verified issuer") presumes a row, and a grant is
+ * the first thing this device ever hears about the key:
+ *
+ * - key absent → MINT, with `owner_did` from the verified issuer. Accepting a
+ *   key means accepting its signer as the principal who may rotate and revoke it.
+ * - key present → REQUIRE the stored `owner_did` to equal the issuer. That is
+ *   what makes a re-sent frame a retry rather than a takeover: the original
+ *   granter updates, anyone else is refused.
+ *
+ * Returns whether anything was written.
+ */ export async function applyCredentialKeyGrantFrame(params) {
+    const { frame, groupID, logger } = params;
+    const verified = await verifyCredentialKeyGrant(frame.auth);
+    if (verified == null) {
+        logger?.warn('credential:key-grant dropped: token verification failed', {
+            groupID
+        });
+        return false;
+    }
+    const claim = verified.claim;
+    // The plaintext frame is what gets stored, so every stored field has to be the
+    // one that was signed. `ownerDID` is deliberately absent from this list — it is
+    // a mirror the receiver ignores in favour of the issuer.
+    if (claim.keyID !== frame.keyID || claim.keyVersion !== frame.keyVersion || claim.suite !== frame.suite || claim.recipientDID !== frame.wrapping.recipientDID || claim.wrappingDigest !== credentialWrappingDigest(frame.wrapping) || claim.entriesDigest !== credentialEntriesDigest(frame.entries) || claim.keyBranchesDigest !== credentialKeyBranchesDigest(frame.keyBranches)) {
+        logger?.warn('credential:key-grant dropped: frame does not match the signed claim', {
+            groupID,
+            keyID: frame.keyID
+        });
+        return false;
+    }
+    // The frame's `auth` names one authority for the whole bundle, so every op has
+    // to speak for it too — `requireIssuer` carries that binding into the shared
+    // apply, which a reconcile bundle (no `auth`) omits.
+    return await applyCredentialKeyRows({
+        store: params.store,
+        selfDID: params.selfDID,
+        hlc: params.hlc,
+        maxDriftMS: params.maxDriftMS,
+        logger,
+        groupID,
+        bundle: frame,
+        requireIssuer: verified.issuer,
+        label: 'credential:key-grant'
+    });
+}
+/**
+ * Write one key's public record, the one wrapping addressed to this device, and
+ * every entry ciphertext at that version — the row logic a grant and a reconcile
+ * bundle share.
+ *
+ * The key op's verified issuer is the authority: absent key → MINT with
+ * `owner_did` set to it; present key → REQUIRE the stored owner to equal it, so a
+ * re-sent bundle is a retry and anyone else is refused. Every wrapping and entry
+ * op must carry that same issuer, which is what keeps `author_did` identical on
+ * every device and blocks a foreign op riding in beside a real one.
+ */ async function applyCredentialKeyRows(params) {
+    const { store, selfDID, logger, groupID, bundle, label } = params;
+    // Not addressed here — do NOT trust a server's scoping. On a grant fan-out this
+    // is the ordinary outcome for every co-member but one, so it is debug, not a
+    // warning; on a reconcile it is the misdelivery guard, dropping a co-recipient's
+    // wrapping a buggy or hostile server routed into this store.
+    if (normalizeDID(bundle.wrapping.recipientDID) !== normalizeDID(selfDID)) {
+        logger?.debug(`${label} ignored: wrapping is addressed elsewhere`, {
+            groupID,
+            keyID: bundle.keyID
+        });
+        return false;
+    }
+    // The key op self-authenticates its author; that author is the key's owner and
+    // the authority every other op in the bundle must share.
+    const keyVerified = await verifyCredentialOp(bundle.keyOp);
+    if (keyVerified == null) {
+        logger?.warn(`${label} dropped: key op verification failed`, {
+            groupID,
+            keyID: bundle.keyID
+        });
+        return false;
+    }
+    const issuer = keyVerified.issuer;
+    if (params.requireIssuer != null && issuer !== params.requireIssuer) {
+        logger?.warn(`${label} dropped: key op is signed by someone other than the frame issuer`, {
+            groupID,
+            keyID: bundle.keyID
+        });
+        return false;
+    }
+    const keyParams = {
+        keyID: bundle.keyID,
+        ownerDID: issuer,
+        suite: bundle.suite,
+        version: bundle.keyVersion,
+        state: 'active'
+    };
+    if (!credentialOpMatchesPut(keyVerified.claim, {
+        kind: 'key',
+        params: keyParams
+    })) {
+        logger?.warn(`${label} dropped: key op does not speak for the key row`, {
+            groupID,
+            keyID: bundle.keyID
+        });
+        return false;
+    }
+    const existing = await store.getKey(bundle.keyID);
+    if (existing != null && normalizeDID(existing.owner_did) !== issuer) {
+        logger?.warn(`${label} dropped: key is owned by someone else here`, {
+            groupID,
+            keyID: bundle.keyID
+        });
+        return false;
+    }
+    // Bound the granter's stamps BEFORE the first write. The entry rows keep them
+    // verbatim and this device floors its clock to the greatest one it holds, so
+    // an unparseable or far-future stamp that lands is a clock this device can
+    // never catch up to — and every later local credential write would sort under
+    // it. The past direction stays unbounded: an offline write lands late.
+    //
+    // The whole bundle goes, never the offending entry alone: it is stored as a
+    // unit, so a partial apply would store a key whose contents disagree with the
+    // ops that authorized them.
+    const now = Date.now();
+    const bounded = [];
+    for (const entry of bundle.entries){
+        const stamp = HLC.tryParse(entry.hlc);
+        if (stamp == null || stamp.wallTime - now > params.maxDriftMS) {
+            logger?.warn(`${label} dropped: entry stamp is unusable`, {
+                groupID,
+                keyID: bundle.keyID,
+                entryID: entry.entryID,
+                hlc: entry.hlc
+            });
+            return false;
+        }
+        bounded.push({
+            entry,
+            stamp
+        });
+    }
+    const wrappingParams = {
+        wrappingID: bundle.wrapping.wrappingID,
+        keyID: bundle.keyID,
+        keyVersion: bundle.keyVersion,
+        factors: bundle.wrapping.factors,
+        iv: fromB64U(bundle.wrapping.iv),
+        wrappedKey: fromB64U(bundle.wrapping.wrappedKey),
+        // Stored un-normalized, as the granter holds it: it is a key-resolution
+        // input, and a `did:peer:4` short form carries no agreement key.
+        recipientDID: bundle.wrapping.recipientDID
+    };
+    const entryPuts = bounded.map(({ entry, stamp })=>({
+            stamp,
+            token: entry.op,
+            params: {
+                entryID: entry.entryID,
+                keyID: bundle.keyID,
+                keyVersion: bundle.keyVersion,
+                iv: fromB64U(entry.iv),
+                ciphertext: fromB64U(entry.ciphertext),
+                // The GRANTER's stamp, never a local one: the entry op covers this field,
+                // so re-stamping would make the stored row disagree with the op that
+                // authenticated it.
+                hlc: entry.hlc
+            }
+        }));
+    /**
+   * Take the granter's op verbatim, or refuse it.
+   *
+   * The receiver stores an op it did not sign because the merkle leaf hashes the
+   * op: minting a local one would give the same logical row a different leaf on
+   * every device that received it, and the trees would never converge. `opHash`
+   * is recomputed here rather than carried, so a lying digest cannot enter that
+   * lane. `null` refuses the WHOLE bundle — the rows are stored as a set, so a
+   * partial apply would store a key whose contents disagree with what authorized
+   * them.
+   */ const acceptOp = async (token, subject)=>{
+        const op = await verifyCredentialOp(token);
+        if (op == null || op.issuer !== issuer || !credentialOpMatchesPut(op.claim, subject)) {
+            return null;
+        }
+        return {
+            keyID: op.claim.keyID,
+            authorDID: op.issuer,
+            hlc: op.claim.hlc,
+            opJWT: token,
+            opHash: digestParts([
+                token
+            ]),
+            // The branch this wrapping or entry signed. Absent on an op minted outside
+            // a rotation, which carries no branch yet.
+            branchID: op.claim.branchID ?? ''
+        };
+    };
+    const keyOpHash = digestParts([
+        bundle.keyOp
+    ]);
+    const keyOp = {
+        keyID: keyVerified.claim.keyID,
+        authorDID: issuer,
+        hlc: keyVerified.claim.hlc,
+        opJWT: bundle.keyOp,
+        opHash: keyOpHash,
+        // A key-op labels its own branch and never claims it; recomputed here from
+        // the op's own stamp and hash, which is what authenticates it.
+        branchID: `${keyVerified.claim.hlc}:${keyOpHash}`
+    };
+    const keyBranches = [];
+    for (const token of bundle.keyBranches){
+        const verified = await verifyCredentialOp(token);
+        if (verified == null || verified.issuer !== issuer) continue;
+        if (!credentialOpMatchesPut(verified.claim, {
+            kind: 'key',
+            params: keyParams
+        })) {
+            logger?.warn(`${label} dropped: key branch op does not speak for this key version`, {
+                groupID,
+                keyID: bundle.keyID
+            });
+            return false;
+        }
+        const stamp = HLC.tryParse(verified.claim.hlc);
+        if (stamp == null || stamp.wallTime - now > params.maxDriftMS) continue;
+        const opHash = digestParts([
+            token
+        ]);
+        keyBranches.push({
+            keyID: bundle.keyID,
+            authorDID: verified.issuer,
+            hlc: verified.claim.hlc,
+            opJWT: token,
+            opHash,
+            branchID: `${verified.claim.hlc}:${opHash}`
+        });
+    }
+    const wrappingOp = await acceptOp(bundle.wrapping.op, {
+        kind: 'wrapping',
+        params: wrappingParams
+    });
+    const entryOps = await Promise.all(entryPuts.map(async (put)=>await acceptOp(put.token, {
+            kind: 'entry',
+            params: put.params
+        })));
+    if (wrappingOp == null || entryOps.some((op)=>op == null)) {
+        logger?.warn(`${label} dropped: an op does not speak for the row it travels with`, {
+            groupID,
+            keyID: bundle.keyID
+        });
+        return false;
+    }
+    const provenBranchIDs = new Set(keyBranches.map((branch)=>branch.branchID));
+    for (const rowOp of [
+        wrappingOp,
+        ...entryOps
+    ]){
+        if (rowOp != null && rowOp.branchID !== '' && !provenBranchIDs.has(rowOp.branchID)) {
+            logger?.warn(`${label} dropped: row branch has no included key provenance`, {
+                groupID,
+                keyID: bundle.keyID
+            });
+            return false;
+        }
+    }
+    // The key and wrapping ops carry stamps no row keeps, so the entry gate above
+    // never saw them — and `kubun_credential_ops.hlc` is what the sync lane orders
+    // and buckets by. An entry op needs no second check: its claim stamp equals
+    // the entry row's, which `credentialOpMatchesPut` requires.
+    const opStamps = [];
+    for (const op of [
+        keyOp,
+        wrappingOp
+    ]){
+        const stamp = HLC.tryParse(op.hlc);
+        if (stamp == null || stamp.wallTime - now > params.maxDriftMS) {
+            logger?.warn(`${label} dropped: an op stamp is unusable`, {
+                groupID,
+                keyID: bundle.keyID,
+                hlc: op.hlc
+            });
+            return false;
+        }
+        opStamps.push(stamp);
+    }
+    await store.putKey(keyParams, keyOp);
+    for (const branch of keyBranches){
+        await store.recordKeyBranch({
+            keyID: bundle.keyID,
+            keyVersion: bundle.keyVersion,
+            authorDID: branch.authorDID,
+            hlc: branch.hlc,
+            opJWT: branch.opJWT,
+            opHash: branch.opHash,
+            branchID: branch.branchID
+        });
+    }
+    await store.putWrapping(wrappingParams, wrappingOp);
+    for (const [index, put] of entryPuts.entries()){
+        await store.putEntry(put.params, entryOps[index]);
+        // Merged so a later local write sorts after what was received. Safe to
+        // receive unchecked: the gate above rejected the bundle unless every stamp
+        // parsed and sat inside the drift bound.
+        params.hlc?.receive(put.stamp);
+    }
+    for (const stamp of opStamps){
+        params.hlc?.receive(stamp);
+    }
+    return true;
+}
+/**
+ * Apply a credential reconcile response: materialise the catch-up bundles a
+ * recipient missed, then GC the rows a tombstone revokes.
+ *
+ * The server's scoping is NOT trusted. Every row re-verifies its op signature
+ * and every wrapping re-checks it is addressed to this device before a write,
+ * exactly as an unsolicited grant would — a reconcile is a batch of the same
+ * self-authenticating rows, pulled instead of pushed.
+ */ export async function applyCredentialReconcile(params) {
+    const { store, selfDID, logger } = params;
+    const maxDriftMS = params.maxDriftMS ?? DEFAULT_MAX_DRIFT_MS;
+    let applied = 0;
+    for (const bundle of params.bundles){
+        const wrote = await applyCredentialKeyRows({
+            store,
+            selfDID,
+            hlc: params.hlc,
+            maxDriftMS,
+            logger,
+            bundle,
+            label: 'credential:reconcile'
+        });
+        if (wrote) {
+            applied += 1;
+        }
+    }
+    let tombstoned = 0;
+    for (const tombstone of params.tombstones){
+        if (await applyReconcileTombstone(store, tombstone, logger)) {
+            tombstoned += 1;
+        }
+    }
+    return {
+        applied,
+        tombstoned
+    };
+}
+/**
+ * Delete one revoked subject, keying on the tombstone op it carries.
+ *
+ * The op self-authenticates the delete; the subject kind and id come from the
+ * VERIFIED claim, never the wire fields beside it. Only the key's owner may
+ * revoke, so the issuer is checked against the stored key's `owner_did` — a
+ * device holding no such key has nothing to GC and drops it.
+ */ async function applyReconcileTombstone(store, tombstone, logger) {
+    const verified = await verifyCredentialOp(tombstone.opJWT);
+    if (verified == null || !verified.claim.deleted) {
+        logger?.warn('credential:reconcile tombstone dropped: not a verified tombstone', {
+            subjectID: tombstone.subjectID
+        });
+        return false;
+    }
+    const claim = verified.claim;
+    // The wire id is a hint; the signed one decides which row is deleted.
+    if (claim.subjectID !== tombstone.subjectID) {
+        logger?.warn('credential:reconcile tombstone dropped: subject id does not match the op', {
+            subjectID: tombstone.subjectID
+        });
+        return false;
+    }
+    const key = await store.getKey(claim.keyID);
+    if (key == null || normalizeDID(key.owner_did) !== verified.issuer) {
+        logger?.warn('credential:reconcile tombstone dropped: not authored by the key owner', {
+            keyID: claim.keyID,
+            subjectID: claim.subjectID
+        });
+        return false;
+    }
+    const op = {
+        keyID: claim.keyID,
+        authorDID: verified.issuer,
+        hlc: claim.hlc,
+        opJWT: tombstone.opJWT,
+        opHash: digestParts([
+            tombstone.opJWT
+        ]),
+        // A tombstone carries no branch label yet — resolving a tombstone onto the
+        // branch it retires is a later slice.
+        branchID: claim.branchID ?? ''
+    };
+    switch(claim.subjectKind){
+        case 'key':
+            await store.deleteKey(claim.subjectID, op);
+            break;
+        case 'wrapping':
+            await store.deleteWrapping(claim.subjectID, op);
+            break;
+        case 'entry':
+            await store.deleteEntry(claim.subjectID, op);
+            break;
+    }
+    return true;
+}

package/lib/groups/credential-grant-token.d.ts

@@ -0,0 +1,42 @@
+import { type OwnIdentity } from '@kokuin/token';
+import { credentialEntriesDigest, credentialWrappingDigest } from '@kubun/credential';
+/**
+ * Re-exported where the grant lane reads them. They live in `@kubun/credential`
+ * because the credential manager signs the same digests over its own rows, and
+ * an edge back up to this package would be a cycle.
+ */
+export { credentialEntriesDigest, credentialWrappingDigest };
+/** Order-independent authentication for the complete set of branch-op tokens. */
+export declare function credentialKeyBranchesDigest(tokens: ReadonlyArray<string>): string;
+/**
+ * What a granter signs: identifiers and digests, never the ciphertext itself.
+ *
+ * Mirroring the whole frame the way `access-default:set` does would double a
+ * vault-sized grant on the wire. Leaving the entries out of the signature
+ * altogether was the other option and is worse than it looks: substituted
+ * ciphertext IS caught, but by the AEAD tag at read time, and it surfaces as
+ * `CredentialTampered` — a relay swap reported to the operator as an attack on
+ * their own store.
+ */
+export type CredentialKeyGrantClaim = {
+    keyID: string;
+    keyVersion: number;
+    suite: number;
+    /** The wrapping's recipient, in the same un-normalized form the frame carries. */
+    recipientDID: string;
+    wrappingDigest: string;
+    entriesDigest: string;
+    keyBranchesDigest: string;
+};
+/** `issuer` is the normalized verified `iss` — the only owner claim a receiver trusts. */
+export type VerifiedCredentialKeyGrant = {
+    issuer: string;
+    claim: CredentialKeyGrantClaim;
+};
+export declare function signCredentialKeyGrant(identity: OwnIdentity, claim: CredentialKeyGrantClaim): Promise<string>;
+/**
+ * Verify a grant token and extract its claim. Returns `null` (never throws) when
+ * the token is unparseable, unsigned (`alg: 'none'`), or structurally malformed —
+ * an attacker cannot forge an `iss` this way.
+ */
+export declare function verifyCredentialKeyGrant(token: string): Promise<VerifiedCredentialKeyGrant | null>;

package/lib/groups/credential-grant-token.js

@@ -0,0 +1,51 @@
+import { isVerifiedToken, normalizeDID, stringifyToken, verifyToken } from '@kokuin/token';
+import { credentialEntriesDigest, credentialWrappingDigest, digestParts } from '@kubun/credential';
+/**
+ * Re-exported where the grant lane reads them. They live in `@kubun/credential`
+ * because the credential manager signs the same digests over its own rows, and
+ * an edge back up to this package would be a cycle.
+ */ export { credentialEntriesDigest, credentialWrappingDigest };
+/** Order-independent authentication for the complete set of branch-op tokens. */ export function credentialKeyBranchesDigest(tokens) {
+    return digestParts([
+        ...tokens
+    ].sort());
+}
+export async function signCredentialKeyGrant(identity, claim) {
+    const signed = await identity.signToken({
+        ...claim
+    }, {
+        embedLongForm: true
+    });
+    return stringifyToken(signed);
+}
+/**
+ * Verify a grant token and extract its claim. Returns `null` (never throws) when
+ * the token is unparseable, unsigned (`alg: 'none'`), or structurally malformed —
+ * an attacker cannot forge an `iss` this way.
+ */ export async function verifyCredentialKeyGrant(token) {
+    let verified;
+    try {
+        verified = await verifyToken(token);
+    } catch  {
+        return null;
+    }
+    if (!isVerifiedToken(verified)) {
+        return null;
+    }
+    const { iss, keyID, keyVersion, suite, recipientDID, wrappingDigest, entriesDigest, keyBranchesDigest } = verified.payload;
+    if (typeof keyID !== 'string' || typeof keyVersion !== 'number' || typeof suite !== 'number' || typeof recipientDID !== 'string' || typeof wrappingDigest !== 'string' || typeof entriesDigest !== 'string' || typeof keyBranchesDigest !== 'string') {
+        return null;
+    }
+    return {
+        issuer: normalizeDID(iss),
+        claim: {
+            keyID,
+            keyVersion,
+            suite,
+            recipientDID,
+            wrappingDigest,
+            entriesDigest,
+            keyBranchesDigest
+        }
+    };
+}

package/lib/groups/credential-grant.d.ts

@@ -0,0 +1,98 @@
+import { type OwnIdentity } from '@kokuin/token';
+import type { CredentialAuthority, CredentialManager } from '@kubun/credential';
+import type { StoreProvider } from '@kubun/db';
+import type { CredentialStoreAPI } from '@kubun/store-credential';
+import type { CredentialKeyBundle, GroupBroadcastMessage } from './broadcast-message.js';
+import type { GroupHandleRegistry } from './group-handle-registry.js';
+/**
+ * The recipient of a grant holds no leaf in the group, so there is no
+ * authenticated document to wrap to.
+ *
+ * Named rather than left to fail at wrap time: an unresolved recipient reaches
+ * `deriveSharedSecret` as whatever string the caller passed, and comes back as a
+ * DID-shaped complaint about a form — which reads as a bad argument when what
+ * happened is that the group has no such member.
+ */
+export declare class CredentialRecipientNotInGroup extends Error {
+    #private;
+    constructor(groupID: string, recipientDID: string);
+    get groupID(): string;
+    get recipientDID(): string;
+}
+/**
+ * The rows a grant wrote are gone by the time the frame is assembled.
+ *
+ * Reachable: a rotation landing between the grant's version read and this read
+ * back leaves the new wrapping below the current version, so it is not among the
+ * ones read here. Refusing is what stops a frame going out that names a version
+ * with no way in.
+ */
+export declare class CredentialGrantNotReadable extends Error {
+    #private;
+    constructor(keyID: string, detail: string);
+    get keyID(): string;
+}
+export type GrantCredentialKeyParams = {
+    registry: GroupHandleRegistry;
+    /** Bound to the granting device's own credential store. */
+    credentials: CredentialManager;
+    /**
+     * Signs the frame. The same identity the manager is built on: `grant` needs
+     * `administer`, which today means the key's owner, so the signer and the
+     * `owner_did` a receiver mints are the same principal.
+     */
+    identity: OwnIdentity;
+    /**
+     * The very store that manager writes through. The frame is read back from it,
+     * so a different handle on the same data — one outside the caller's
+     * transaction, say — would assemble from rows the grant did not write.
+     */
+    store: CredentialStoreAPI;
+    groupID: string;
+    keyID: string;
+    /** Either form: the roster answers on the normalized one. */
+    recipientDID: string;
+    /** Fire-and-forget fan-out. Called after the grant's write commits. */
+    scheduleBroadcast: (groupID: string, message: GroupBroadcastMessage) => void;
+    /** The request's provider, so the handle restore reads the caller's connection. */
+    stores: StoreProvider;
+    /**
+     * Per-request authority forwarded to `credentials.grant`, overriding the
+     * manager's constructed default. Not yet fed one: the group-grant caller that
+     * will resolve a request authority is a follow-up.
+     */
+    authority?: CredentialAuthority;
+};
+export type GrantCredentialKeyResult = {
+    version: number;
+    /**
+     * False when the recipient already held a wrapping. The frame goes out either
+     * way: a repeat grant is how an undelivered one is retried.
+     */
+    created: boolean;
+};
+/**
+ * Grant a credential key to a co-member, resolving what to wrap to from the MLS
+ * roster, and broadcast the frame that carries it there.
+ *
+ * The leaf credential is the authenticated original — signed, and immutable for
+ * as long as the leaf exists — so it is the only copy of a member's resolvable
+ * DID that cannot have been rewritten. The membership row cannot answer: its
+ * `member_did` is normalized, and for `did:peer:4` that is the short form, which
+ * carries no document and so no agreement key.
+ *
+ * The write happens OUTSIDE the handle lock. Resolving is a pure read of the
+ * ratchet tree, while the grant is a store call, and holding a group's mutex
+ * across one is the deadlock this repo has already paid for once.
+ */
+export declare function grantCredentialKeyToMember(params: GrantCredentialKeyParams): Promise<GrantCredentialKeyResult>;
+/**
+ * Read one key's row bytes back for a recipient, as a grant carries them minus
+ * the `auth` envelope. Shared by the grant path and the credential reconcile
+ * lane, which both have to hand a receiver exactly the granter's stored rows.
+ *
+ * Throws {@link CredentialGrantNotReadable} on a granter-side gap — a missing
+ * key row, or a wrapping a rotation removed between the version read and this
+ * read back — so a caller never ships a bundle that names bytes with no way in.
+ */
+export declare function readCredentialKeyBundle(store: CredentialStoreAPI, keyID: string, recipientWrappableDID: string): Promise<CredentialKeyBundle>;