@storacha/encrypt-upload-client 1.1.76-rc.0 → 1.1.76-rc.2

package/dist/core/metadata/encrypted-metadata.d.ts

@@ -1,13 +1,12 @@
-export function extract(archive: Uint8Array): any
-export function create(
-  strategy: 'lit' | 'kms',
-  data: any
-):
-  | import('../../types.js').LitMetadataView
-  | import('../../types.js').KMSMetadataView
-export function getSupportedVersions(): string[]
-export function isVersionSupported(version: string): boolean
-import * as LitMetadata from './lit-metadata.js'
-import * as KMSMetadata from './kms-metadata.js'
-export { LitMetadata, KMSMetadata }
-//# sourceMappingURL=encrypted-metadata.d.ts.map
+export function extract(archive: Uint8Array): Types.Result<any>;
+export function view({ root }: {
+    root: Types.IPLDBlock;
+}): Types.Result<any>;
+export function create(strategy: "lit" | "kms", data: any): Types.LitMetadataView | Types.KMSMetadataView;
+export function getSupportedVersions(): string[];
+export function isVersionSupported(version: string): boolean;
+import type * as Types from '../../types.js';
+import * as LitMetadata from './lit-metadata.js';
+import * as KMSMetadata from './kms-metadata.js';
+export { LitMetadata, KMSMetadata };
+//# sourceMappingURL=encrypted-metadata.d.ts.map

package/dist/core/metadata/encrypted-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encrypted-metadata.d.ts","sourceRoot":"","sources":["../../../src/core/metadata/encrypted-metadata.js"],"names":[],"mappings":"AAuBO,iCAHI,UAAU,GACR,GAAG,CA8Bf;AAQM,iCAHI,KAAK,GAAG,KAAK,QACb,GAAG,uFAWb;AAKM,iDAAuD;AAOvD,4CAFI,MAAM,WAEgD;6BA1EpC,mBAAmB;6BACnB,mBAAmB"}
+{"version":3,"file":"encrypted-metadata.d.ts","sourceRoot":"","sources":["../../../src/core/metadata/encrypted-metadata.js"],"names":[],"mappings":"AA2BO,iCAHI,UAAU,GACR,aAAa,GAAG,CAAC,CAkB7B;AASM,+BAHJ;IAAgC,IAAI,EAA5B,eAAe;CACvB,GAAU,aAAa,GAAG,CAAC,CAgB7B;AAQM,iCAHI,KAAK,GAAG,KAAK,QACb,GAAG,iDAWb;AAKM,iDAAuD;AAOvD,4CAFI,MAAM,WAEgD;4BAlFtC,gBAAgB;6BAPd,mBAAmB;6BACnB,mBAAmB"}

package/dist/core/metadata/encrypted-metadata.js

@@ -8,6 +8,9 @@ import * as KMSMetadata from './kms-metadata.js';
 import { CAR, error } from '@ucanto/core';
 import * as dagCBOR from '@ipld/dag-cbor';
 import { UnknownFormat } from '../errors.js';
+/**
+ * @import * as Types from '../../types.js'
+ */
 const FORMATS = {
     [LitMetadata.version]: LitMetadata, // 'encrypted-metadata@0.1'
     [KMSMetadata.version]: KMSMetadata, // 'encrypted-metadata@0.2'
@@ -16,7 +19,7 @@ const FORMATS = {
  * Universal extract function - tries each registered format
  *
  * @param {Uint8Array} archive
- * @returns {any}
+ * @returns {Types.Result<any>}
  */
 export const extract = (archive) => {
     // Decode CAR to check version
@@ -28,12 +31,22 @@ export const extract = (archive) => {
     if (code !== dagCBOR.code) {
         return error(new UnknownFormat(`unexpected root CID codec: 0x${code.toString(16)}`));
     }
+    return view({ root: roots[0] });
+};
+/**
+ * Universal view function - tries each registered format
+ *
+ * @param {object} source
+ * @param {Types.IPLDBlock} source.root
+ * @returns {Types.Result<any>}
+ */
+export const view = ({ root }) => {
     // Check which version this metadata uses
-    const value = dagCBOR.decode(roots[0].bytes);
+    const value = dagCBOR.decode(root.bytes);
     for (const [version, formatModule] of Object.entries(FORMATS)) {
         if (value && typeof value === 'object' && version in value) {
             // Found matching version, delegate to specific format module
-            return formatModule.extract(archive);
+            return formatModule.view({ root });
         }
     }
     return error(new UnknownFormat('Unknown metadata format - no matching version found'));

package/dist/crypto/adapters/kms-crypto-adapter.d.ts

@@ -7,176 +7,160 @@
  * @implements {Type.CryptoAdapter}
  */
 export class KMSCryptoAdapter implements Type.CryptoAdapter {
-  /**
-   * Create a new KMS crypto adapter
-   *
-   * @param {Type.SymmetricCrypto} symmetricCrypto - The symmetric crypto implementation (browser or node)
-   * @param {URL|string} keyManagerServiceURL - The key manager service URL
-   * @param {`did:${string}:${string}`} keyManagerServiceDID - The key manager service DID
-   * @param {object} [options] - Optional configuration
-   * @param {boolean} [options.allowInsecureHttp] - Allow HTTP for testing (NOT for production)
-   */
-  constructor(
-    symmetricCrypto: Type.SymmetricCrypto,
-    keyManagerServiceURL: URL | string,
-    keyManagerServiceDID: `did:${string}:${string}`,
-    options?: {
-      allowInsecureHttp?: boolean | undefined
-    }
-  )
-  symmetricCrypto: Type.SymmetricCrypto
-  keyManagerServiceURL: URL
-  keyManagerServiceDID: import('@ucanto/client').PrincipalView<`did:${string}:${string}`>
-  /**
-   * Encrypt a stream of data using the symmetric crypto
-   *
-   * @param {Type.BlobLike} data
-   */
-  encryptStream(data: Type.BlobLike): Promise<Type.EncryptOutput>
-  /**
-   * Decrypt a stream of data using the symmetric crypto
-   *
-   * @param {ReadableStream} encryptedData
-   * @param {Uint8Array} key
-   * @param {Uint8Array} iv
-   */
-  decryptStream(
-    encryptedData: ReadableStream,
-    key: Uint8Array,
-    iv: Uint8Array
-  ): Promise<ReadableStream<any>>
-  /**
-   * Encrypt a symmetric key using the KMS
-   *
-   * @param {Uint8Array} key
-   * @param {Uint8Array} iv
-   * @param {Type.EncryptionConfig} encryptionConfig
-   * @returns {Promise<Type.EncryptedKeyResult>}
-   */
-  encryptSymmetricKey(
-    key: Uint8Array,
-    iv: Uint8Array,
-    encryptionConfig: Type.EncryptionConfig
-  ): Promise<Type.EncryptedKeyResult>
-  /**
-   * @param {string} encryptedKey
-   * @param {object} configs
-   * @param {Type.DecryptionConfig} configs.decryptionConfig
-   * @param {Type.ExtractedMetadata} configs.metadata
-   * @param {Type.AnyLink} configs.resourceCID
-   * @param {import('@storacha/client/types').Signer<import('@storacha/client/types').DID, import('@storacha/client/types').SigAlg>} configs.issuer
-   * @param {import('@storacha/client/types').DID} configs.audience
-   */
-  decryptSymmetricKey(
-    encryptedKey: string,
-    configs: {
-      decryptionConfig: Type.DecryptionConfig
-      metadata: Type.ExtractedMetadata
-      resourceCID: Type.AnyLink
-      issuer: import('@storacha/client/types').Signer<
-        import('@storacha/client/types').DID,
-        import('@storacha/client/types').SigAlg
-      >
-      audience: import('@storacha/client/types').DID
-    }
-  ): Promise<{
-    key: Uint8Array
-    iv: Uint8Array
-  }>
-  /**
-   * Get decrypted symmetric key in base64 string from KMS via private gateway
-   *
-   * @param {string} encryptedSymmetricKey - The encrypted symmetric key (base64-encoded)
-   * @param {Type.SpaceDID} spaceDID - The space DID
-   * @param {import('@ucanto/interface').Proof} decryptionProof - The decryption delegation proof
-   * @param {import('@ucanto/interface').Proof[]} proofs - The proofs to access the space
-   * @param {import('@storacha/client/types').Signer<import('@storacha/client/types').DID, import('@storacha/client/types').SigAlg>} issuer - The issuer
-   * @returns {Promise<{decryptedSymmetricKey: string}>} - The decrypted symmetric key (base64-encoded)
-   */
-  getDecryptedSymmetricKey(
-    encryptedSymmetricKey: string,
-    spaceDID: Type.SpaceDID,
-    decryptionProof: import('@ucanto/interface').Proof,
-    proofs: import('@ucanto/interface').Proof[],
-    issuer: import('@storacha/client/types').Signer<
-      import('@storacha/client/types').DID,
-      import('@storacha/client/types').SigAlg
-    >
-  ): Promise<{
-    decryptedSymmetricKey: string
-  }>
-  /**
-   * Extract the encrypted metadata from the CAR file
-   * KMS adapter only handles KMS format (encrypted-metadata@0.2)
-   *
-   * @param {Uint8Array} car
-   * @returns {Type.ExtractedMetadata}
-   */
-  extractEncryptedMetadata(car: Uint8Array): Type.ExtractedMetadata
-  /**
-   * @param {Type.ExtractedMetadata} metadata
-   * @returns {string}
-   */
-  getEncryptedKey(metadata: Type.ExtractedMetadata): string
-  /**
-   * Encode metadata for upload
-   *
-   * @param {string} encryptedDataCID - The CID of the encrypted data
-   * @param {string} encryptedKey - The encrypted key
-   * @param {Type.KMSKeyMetadata} metadata - The metadata to encode
-   * @returns {Promise<{ cid: import('@storacha/upload-client/types').AnyLink, bytes: Uint8Array }>} - The encoded metadata
-   */
-  encodeMetadata(
-    encryptedDataCID: string,
-    encryptedKey: string,
-    metadata: Type.KMSKeyMetadata
-  ): Promise<{
-    cid: import('@storacha/upload-client/types').AnyLink
-    bytes: Uint8Array
-  }>
-  /**
-   * Get the RSA public key from the space/encryption/setup
-   *
-   * @param {Type.EncryptionConfig} encryptionConfig
-   * @returns {Promise<{ publicKey: string, provider: string, algorithm: string }>}
-   */
-  getSpacePublicKey(encryptionConfig: Type.EncryptionConfig): Promise<{
-    publicKey: string
-    provider: string
-    algorithm: string
-  }>
-  /**
-   * Get the Web Crypto API SubtleCrypto interface (universal compatibility)
-   *
-   * @returns {SubtleCrypto} - The SubtleCrypto interface
-   */
-  getSubtleCrypto(): SubtleCrypto
-  /**
-   * Encrypt data with RSA-OAEP using the public key
-   *
-   * @param {Uint8Array} dataToEncrypt
-   * @param {string} publicKeyPem
-   * @returns {Promise<Uint8Array>}
-   */
-  encryptWithRSA(
-    dataToEncrypt: Uint8Array,
-    publicKeyPem: string
-  ): Promise<Uint8Array>
-  /**
-   * Convert PEM-encoded public key to ArrayBuffer for Web Crypto API
-   *
-   * @param {string} pem - PEM-encoded public key string
-   * @returns {ArrayBuffer} - DER-encoded key data for crypto.subtle.importKey()
-   */
-  pemToArrayBuffer(pem: string): ArrayBuffer
-  newKeyManagerServiceConnection(): import('@ucanto/interface').ConnectionView<any>
-  /**
-   * Sanitize the space DID for the KMS key ID
-   *
-   * @param {Type.SpaceDID} spaceDID
-   * @returns {string}
-   */
-  sanitizeSpaceDIDForKMSKeyId(spaceDID: Type.SpaceDID): string
+    /**
+     * Create a new KMS crypto adapter
+     *
+     * @param {Type.SymmetricCrypto} symmetricCrypto - The symmetric crypto implementation (browser or node)
+     * @param {URL|string} keyManagerServiceURL - The key manager service URL
+     * @param {`did:${string}:${string}`} keyManagerServiceDID - The key manager service DID
+     * @param {object} [options] - Optional configuration
+     * @param {boolean} [options.allowInsecureHttp] - Allow HTTP for testing (NOT for production)
+     */
+    constructor(symmetricCrypto: Type.SymmetricCrypto, keyManagerServiceURL: URL | string, keyManagerServiceDID: `did:${string}:${string}`, options?: {
+        allowInsecureHttp?: boolean | undefined;
+    });
+    /** @type {Map<Type.SpaceDID, { publicKey: string, provider: string, algorithm: string }>} */
+    _cachedPublicKeys: Map<Type.SpaceDID, {
+        publicKey: string;
+        provider: string;
+        algorithm: string;
+    }>;
+    symmetricCrypto: Type.SymmetricCrypto;
+    keyManagerServiceURL: URL;
+    keyManagerServiceDID: import("@ucanto/client").PrincipalView<`did:${string}:${string}`>;
+    /**
+     * Encrypt a stream of data using the symmetric crypto
+     *
+     * @param {Type.BlobLike} data
+     */
+    encryptStream(data: Type.BlobLike): Promise<Type.EncryptOutput>;
+    /**
+     * Decrypt a stream of data using the symmetric crypto
+     *
+     * @param {ReadableStream} encryptedData
+     * @param {Uint8Array} key
+     * @param {Uint8Array} iv
+     */
+    decryptStream(encryptedData: ReadableStream, key: Uint8Array, iv: Uint8Array): Promise<ReadableStream<any>>;
+    /**
+     * Encrypt a symmetric key using the KMS
+     *
+     * @param {Uint8Array} key
+     * @param {Uint8Array} iv
+     * @param {Type.EncryptionConfig} encryptionConfig
+     * @returns {Promise<Type.EncryptedKeyResult>}
+     */
+    encryptSymmetricKey(key: Uint8Array, iv: Uint8Array, encryptionConfig: Type.EncryptionConfig): Promise<Type.EncryptedKeyResult>;
+    /**
+     * @param {string} encryptedKey
+     * @param {object} configs
+     * @param {Type.DecryptionConfig} configs.decryptionConfig
+     * @param {Type.ExtractedMetadata} configs.metadata
+     * @param {Type.AnyLink} configs.resourceCID
+     * @param {import('@storacha/client/types').Signer<import('@storacha/client/types').DID, import('@storacha/client/types').SigAlg>} configs.issuer
+     * @param {import('@storacha/client/types').DID} configs.audience
+     */
+    decryptSymmetricKey(encryptedKey: string, configs: {
+        decryptionConfig: Type.DecryptionConfig;
+        metadata: Type.ExtractedMetadata;
+        resourceCID: Type.AnyLink;
+        issuer: import("@storacha/client/types").Signer<import("@storacha/client/types").DID, import("@storacha/client/types").SigAlg>;
+        audience: import("@storacha/client/types").DID;
+    }): Promise<{
+        key: Uint8Array;
+        iv: Uint8Array;
+    }>;
+    /**
+     * Get decrypted symmetric key in base64 string from KMS via private gateway
+     *
+     * @param {string} encryptedSymmetricKey - The encrypted symmetric key (base64-encoded)
+     * @param {Type.SpaceDID} spaceDID - The space DID
+     * @param {import('@ucanto/interface').Proof} decryptionProof - The decryption delegation proof
+     * @param {import('@ucanto/interface').Proof[]} proofs - The proofs to access the space
+     * @param {import('@storacha/client/types').Signer<import('@storacha/client/types').DID, import('@storacha/client/types').SigAlg>} issuer - The issuer
+     * @returns {Promise<{decryptedSymmetricKey: string}>} - The decrypted symmetric key (base64-encoded)
+     */
+    getDecryptedSymmetricKey(encryptedSymmetricKey: string, spaceDID: Type.SpaceDID, decryptionProof: import("@ucanto/interface").Proof, proofs: import("@ucanto/interface").Proof[], issuer: import("@storacha/client/types").Signer<import("@storacha/client/types").DID, import("@storacha/client/types").SigAlg>): Promise<{
+        decryptedSymmetricKey: string;
+    }>;
+    /**
+     * Extract the encrypted metadata from the CAR file
+     * KMS adapter only handles KMS format (encrypted-metadata@0.2)
+     *
+     * @param {Uint8Array} car
+     * @returns {Type.ExtractedMetadata}
+     */
+    extractEncryptedMetadata(car: Uint8Array): Type.ExtractedMetadata;
+    /**
+     * @param {object} source
+     * @param {Type.IPLDBlock} source.root
+     */
+    viewEncryptedMetadata({ root }: {
+        root: Type.IPLDBlock;
+    }): Type.ExtractedMetadata;
+    /**
+     *
+     * @param {Type.Result<any>} kmsContentResult
+     * @returns {Type.ExtractedMetadata}
+     */
+    _validateKMSMetadata(kmsContentResult: Type.Result<any>): Type.ExtractedMetadata;
+    /**
+     * @param {Type.ExtractedMetadata} metadata
+     * @returns {string}
+     */
+    getEncryptedKey(metadata: Type.ExtractedMetadata): string;
+    /**
+     * Encode metadata for upload
+     *
+     * @param {string} encryptedDataCID - The CID of the encrypted data
+     * @param {string} encryptedKey - The encrypted key
+     * @param {Type.KMSKeyMetadata} metadata - The metadata to encode
+     * @returns {Promise<{ cid: import('@storacha/upload-client/types').AnyLink, bytes: Uint8Array }>} - The encoded metadata
+     */
+    encodeMetadata(encryptedDataCID: string, encryptedKey: string, metadata: Type.KMSKeyMetadata): Promise<{
+        cid: import("@storacha/upload-client/types").AnyLink;
+        bytes: Uint8Array;
+    }>;
+    /**
+     * Get the RSA public key from the space/encryption/setup
+     *
+     * @param {Type.EncryptionConfig} encryptionConfig
+     * @returns {Promise<{ publicKey: string, provider: string, algorithm: string }>}
+     */
+    getSpacePublicKey(encryptionConfig: Type.EncryptionConfig): Promise<{
+        publicKey: string;
+        provider: string;
+        algorithm: string;
+    }>;
+    /**
+     * Get the Web Crypto API SubtleCrypto interface (universal compatibility)
+     *
+     * @returns {SubtleCrypto} - The SubtleCrypto interface
+     */
+    getSubtleCrypto(): SubtleCrypto;
+    /**
+     * Encrypt data with RSA-OAEP using the public key
+     *
+     * @param {Uint8Array} dataToEncrypt
+     * @param {string} publicKeyPem
+     * @returns {Promise<Uint8Array>}
+     */
+    encryptWithRSA(dataToEncrypt: Uint8Array, publicKeyPem: string): Promise<Uint8Array>;
+    /**
+     * Convert PEM-encoded public key to ArrayBuffer for Web Crypto API
+     *
+     * @param {string} pem - PEM-encoded public key string
+     * @returns {ArrayBuffer} - DER-encoded key data for crypto.subtle.importKey()
+     */
+    pemToArrayBuffer(pem: string): ArrayBuffer;
+    newKeyManagerServiceConnection(): import("@ucanto/interface").ConnectionView<any>;
+    /**
+     * Sanitize the space DID for the KMS key ID
+     *
+     * @param {Type.SpaceDID} spaceDID
+     * @returns {string}
+     */
+    sanitizeSpaceDIDForKMSKeyId(spaceDID: Type.SpaceDID): string;
 }
-import * as Type from '../../types.js'
-//# sourceMappingURL=kms-crypto-adapter.d.ts.map
+import * as Type from '../../types.js';
+//# sourceMappingURL=kms-crypto-adapter.d.ts.map

package/dist/crypto/adapters/kms-crypto-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kms-crypto-adapter.d.ts","sourceRoot":"","sources":["../../../src/crypto/adapters/kms-crypto-adapter.js"],"names":[],"mappings":"AAWA;;;;;;;GAOG;AACH,yCAFgB,IAAI,CAAC,aAAa;IAGhC;;;;;;;;OAQG;IACH,6BANW,IAAI,CAAC,eAAe,wBACpB,GAAG,GAAC,MAAM,wBACV,OAAO,MAAM,IAAI,MAAM,EAAE,YAEjC;QAA0B,iBAAiB;KAC7C,EA0BA;IAnBC,sCAAsC;IAiBtC,0BAA+B;IAC/B,wFAA2D;IAG7D;;;;OAIG;IACH,oBAFW,IAAI,CAAC,QAAQ,+BAIvB;IAED;;;;;;OAMG;IACH,6BAJW,cAAc,OACd,UAAU,MACV,UAAU,gCAIpB;IAED;;;;;;;OAOG;IACH,yBALW,UAAU,MACV,UAAU,oBACV,IAAI,CAAC,gBAAgB,GACnB,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CA4B5C;IAED;;;;;;;;OAQG;IACH,kCARW,MAAM,WAEd;QAAuC,gBAAgB,EAA/C,IAAI,CAAC,gBAAgB;QACW,QAAQ,EAAxC,IAAI,CAAC,iBAAiB;QACA,WAAW,EAAjC,IAAI,CAAC,OAAO;QACoH,MAAM,EAAtI,OAAO,wBAAwB,EAAE,MAAM,CAAC,OAAO,wBAAwB,EAAE,GAAG,EAAE,OAAO,wBAAwB,EAAE,MAAM,CAAC;QACxE,QAAQ,EAAtD,OAAO,wBAAwB,EAAE,GAAG;KAC9C;;;OA6BA;IAED;;;;;;;;;OASG;IACH,gDAPW,MAAM,YACN,IAAI,CAAC,QAAQ,mBACb,OAAO,mBAAmB,EAAE,KAAK,UACjC,OAAO,mBAAmB,EAAE,KAAK,EAAE,UACnC,OAAO,wBAAwB,EAAE,MAAM,CAAC,OAAO,wBAAwB,EAAE,GAAG,EAAE,OAAO,wBAAwB,EAAE,MAAM,CAAC,GACpH,OAAO,CAAC;QAAC,qBAAqB,EAAE,MAAM,CAAA;KAAC,CAAC,CAgCpD;IAED;;;;;;OAMG;IACH,8BAHW,UAAU,GACR,IAAI,CAAC,iBAAiB,CAiClC;IAED;;;OAGG;IACH,0BAHW,IAAI,CAAC,iBAAiB,GACpB,MAAM,CASlB;IAED;;;;;;;OAOG;IACH,iCALW,MAAM,gBACN,MAAM,YACN,IAAI,CAAC,cAAc,GACjB,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,+BAA+B,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC,CAoBhG;IAED;;;;;OAKG;IACH,oCAHW,IAAI,CAAC,gBAAgB,GACnB,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CA6B/E;IAED;;;;OAIG;IACH,mBAFa,YAAY,CAWxB;IAED;;;;;;OAMG;IACH,8BAJW,UAAU,gBACV,MAAM,GACJ,OAAO,CAAC,UAAU,CAAC,CAyB/B;IAED;;;;;OAKG;IACH,sBAHW,MAAM,GACJ,WAAW,CA6BvB;IAED,kFASC;IAED;;;;;OAKG;IACH,sCAHW,IAAI,CAAC,QAAQ,GACX,MAAM,CAIlB;CACF;sBAzZqB,gBAAgB"}
+{"version":3,"file":"kms-crypto-adapter.d.ts","sourceRoot":"","sources":["../../../src/crypto/adapters/kms-crypto-adapter.js"],"names":[],"mappings":"AAWA;;;;;;;GAOG;AACH,yCAFgB,IAAI,CAAC,aAAa;IAMhC;;;;;;;;OAQG;IACH,6BANW,IAAI,CAAC,eAAe,wBACpB,GAAG,GAAC,MAAM,wBACV,OAAO,MAAM,IAAI,MAAM,EAAE,YAEjC;QAA0B,iBAAiB;KAC7C,EA0BA;IArCD,6FAA6F;IAC7F,mBADW,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAC5D;IAiB3B,sCAAsC;IAiBtC,0BAA+B;IAC/B,wFAA2D;IAG7D;;;;OAIG;IACH,oBAFW,IAAI,CAAC,QAAQ,+BAIvB;IAED;;;;;;OAMG;IACH,6BAJW,cAAc,OACd,UAAU,MACV,UAAU,gCAIpB;IAED;;;;;;;OAOG;IACH,yBALW,UAAU,MACV,UAAU,oBACV,IAAI,CAAC,gBAAgB,GACnB,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CA4B5C;IAED;;;;;;;;OAQG;IACH,kCARW,MAAM,WAEd;QAAuC,gBAAgB,EAA/C,IAAI,CAAC,gBAAgB;QACW,QAAQ,EAAxC,IAAI,CAAC,iBAAiB;QACA,WAAW,EAAjC,IAAI,CAAC,OAAO;QACoH,MAAM,EAAtI,OAAO,wBAAwB,EAAE,MAAM,CAAC,OAAO,wBAAwB,EAAE,GAAG,EAAE,OAAO,wBAAwB,EAAE,MAAM,CAAC;QACxE,QAAQ,EAAtD,OAAO,wBAAwB,EAAE,GAAG;KAC9C;;;OA6BA;IAED;;;;;;;;;OASG;IACH,gDAPW,MAAM,YACN,IAAI,CAAC,QAAQ,mBACb,OAAO,mBAAmB,EAAE,KAAK,UACjC,OAAO,mBAAmB,EAAE,KAAK,EAAE,UACnC,OAAO,wBAAwB,EAAE,MAAM,CAAC,OAAO,wBAAwB,EAAE,GAAG,EAAE,OAAO,wBAAwB,EAAE,MAAM,CAAC,GACpH,OAAO,CAAC;QAAC,qBAAqB,EAAE,MAAM,CAAA;KAAC,CAAC,CAgCpD;IAED;;;;;;OAMG;IACH,8BAHW,UAAU,GACR,IAAI,CAAC,iBAAiB,CAKlC;IAED;;;OAGG;IACH,gCAFG;QAA+B,IAAI,EAA3B,IAAI,CAAC,SAAS;KACxB,0BAGA;IAED;;;;OAIG;IACH,uCAHW,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GACd,IAAI,CAAC,iBAAiB,CAgClC;IAED;;;OAGG;IACH,0BAHW,IAAI,CAAC,iBAAiB,GACpB,MAAM,CASlB;IAED;;;;;;;OAOG;IACH,iCALW,MAAM,gBACN,MAAM,YACN,IAAI,CAAC,cAAc,GACjB,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,+BAA+B,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC,CAoBhG;IAED;;;;;OAKG;IACH,oCAHW,IAAI,CAAC,gBAAgB,GACnB,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAsC/E;IAED;;;;OAIG;IACH,mBAFa,YAAY,CAWxB;IAED;;;;;;OAMG;IACH,8BAJW,UAAU,gBACV,MAAM,GACJ,OAAO,CAAC,UAAU,CAAC,CAyB/B;IAED;;;;;OAKG;IACH,sBAHW,MAAM,GACJ,WAAW,CA6BvB;IAED,kFASC;IAED;;;;;OAKG;IACH,sCAHW,IAAI,CAAC,QAAQ,GACX,MAAM,CAIlB;CACF;sBAtbqB,gBAAgB"}

package/dist/crypto/adapters/kms-crypto-adapter.js

@@ -3,7 +3,7 @@ import { CAR, HTTP } from '@ucanto/transport';
 import { base64 } from 'multiformats/bases/base64';
 import * as Type from '../../types.js';
 import { EncryptionSetup, EncryptionKeyDecrypt, } from '@storacha/capabilities/space';
-import { KMSMetadata } from '../../core/metadata/encrypted-metadata.js';
+import * as EncryptedMetadata from '../../core/metadata/encrypted-metadata.js';
 import * as DID from '@ipld/dag-ucan/did';
 /**
  * KMSCryptoAdapter implements the complete CryptoAdapter interface using KMS.
@@ -14,6 +14,8 @@ import * as DID from '@ipld/dag-ucan/did';
  * @implements {Type.CryptoAdapter}
  */
 export class KMSCryptoAdapter {
+    /** @type {Map<Type.SpaceDID, { publicKey: string, provider: string, algorithm: string }>} */
+    _cachedPublicKeys = new Map();
     /**
      * Create a new KMS crypto adapter
      *
@@ -153,7 +155,22 @@ export class KMSCryptoAdapter {
      * @returns {Type.ExtractedMetadata}
      */
     extractEncryptedMetadata(car) {
-        const kmsContentResult = KMSMetadata.extract(car);
+        const kmsContentResult = EncryptedMetadata.extract(car);
+        return this._validateKMSMetadata(kmsContentResult);
+    }
+    /**
+     * @param {object} source
+     * @param {Type.IPLDBlock} source.root
+     */
+    viewEncryptedMetadata({ root }) {
+        return this._validateKMSMetadata(EncryptedMetadata.view({ root }));
+    }
+    /**
+     *
+     * @param {Type.Result<any>} kmsContentResult
+     * @returns {Type.ExtractedMetadata}
+     */
+    _validateKMSMetadata(kmsContentResult) {
         if (kmsContentResult.error) {
             throw kmsContentResult.error;
         }
@@ -211,7 +228,7 @@ export class KMSCryptoAdapter {
                 algorithm: kmsKeyMetadata.kms.algorithm,
             },
         };
-        const kmsMetadata = KMSMetadata.create(uploadData);
+        const kmsMetadata = EncryptedMetadata.create('kms', uploadData);
         return await kmsMetadata.archiveBlock();
     }
     /**
@@ -221,6 +238,10 @@ export class KMSCryptoAdapter {
      * @returns {Promise<{ publicKey: string, provider: string, algorithm: string }>}
      */
     async getSpacePublicKey(encryptionConfig) {
+        const cached = this._cachedPublicKeys.get(encryptionConfig.spaceDID);
+        if (cached) {
+            return cached;
+        }
         // Step 1: Invoke the EncryptionSetup capability
         const setupResult = await EncryptionSetup.invoke({
             issuer: encryptionConfig.issuer,
@@ -240,8 +261,12 @@ export class KMSCryptoAdapter {
                 'Encryption setup failed';
             throw new Error(errorMessage);
         }
-        // Step 3: Return the public key and key reference
-        return /** @type {{ publicKey: string, provider: string, algorithm: string }} */ (setupResult.out.ok);
+        // Step 3: Cache the public key and key reference
+        const publicKeyData = 
+        /** @type {{ publicKey: string, provider: string, algorithm: string }} */ (setupResult.out.ok);
+        this._cachedPublicKeys.set(encryptionConfig.spaceDID, publicKeyData);
+        // Step 4: Return the public key and key reference
+        return publicKeyData;
     }
     /**
      * Get the Web Crypto API SubtleCrypto interface (universal compatibility)

package/dist/crypto/adapters/lit-crypto-adapter.d.ts

@@ -103,6 +103,19 @@ export class LitCryptoAdapter implements Type.CryptoAdapter {
      * @returns {Type.ExtractedMetadata} - The extracted metadata
      */
     extractEncryptedMetadata(car: Uint8Array): Type.ExtractedMetadata;
+    /**
+     * @param {object} source
+     * @param {Type.IPLDBlock} source.root
+     */
+    viewEncryptedMetadata({ root }: {
+        root: Type.IPLDBlock;
+    }): Type.ExtractedMetadata;
+    /**
+     *
+     * @param {Type.Result<any>} encryptedContentResult
+     * @returns {Type.ExtractedMetadata}
+     */
+    _validateLitMetadata(encryptedContentResult: Type.Result<any>): Type.ExtractedMetadata;
     /**
      * Get the encrypted key from the metadata
      *

package/dist/crypto/adapters/lit-crypto-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lit-crypto-adapter.d.ts","sourceRoot":"","sources":["../../../src/crypto/adapters/lit-crypto-adapter.js"],"names":[],"mappings":"AAMA;;;;;;;GAOG;AACH,yCAFgB,IAAI,CAAC,aAAa;IAGhC;;;;;;OAMG;IACH,6BAJW,IAAI,CAAC,eAAe,aACpB,OAAO,0BAA0B,EAAE,aAAa,eAChD,IAAI,CAAC,WAAW,EAM1B;IAHC,sCAAsC;IACtC;;;;;;;;;;;;;;;;;;;;;;;;;;;MAA0B;IAC1B;;MAA8B;IAGhC;;;;;OAKG;IACH,oBAHW,IAAI,CAAC,QAAQ,GACX,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAIvC;IAED;;;;;;;OAOG;IACH,6BALW,cAAc,OACd,UAAU,MACV,UAAU,GACR,OAAO,CAAC,cAAc,CAAC,CAInC;IAED;;;;;;;OAOG;IACH,yBALW,UAAU,MACV,UAAU,oBACV,IAAI,CAAC,gBAAgB,GACnB,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CA6B5C;IAED;;;;;;;;;;;;OAYG;IACH,kCAVW,MAAM,WAEd;QAAuC,gBAAgB,EAA/C,IAAI,CAAC,gBAAgB;QACW,QAAQ,EAAxC,IAAI,CAAC,iBAAiB;QACqB,iBAAiB,EAA5D,OAAO,mBAAmB,EAAE,KAAK;QACX,WAAW,EAAjC,IAAI,CAAC,OAAO;QACoH,MAAM,EAAtI,OAAO,wBAAwB,EAAE,MAAM,CAAC,OAAO,wBAAwB,EAAE,GAAG,EAAE,OAAO,wBAAwB,EAAE,MAAM,CAAC;QACxE,QAAQ,EAAtD,OAAO,wBAAwB,EAAE,GAAG;KAC5C,GAAU,OAAO,CAAC;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,EAAE,EAAE,UAAU,CAAA;KAAE,CAAC,CAgFxD;IAED;;;;;OAKG;IACH,8BAHW,UAAU,GACR,IAAI,CAAC,iBAAiB,CA4BlC;IAED;;;;;OAKG;IACH,0BAHW,IAAI,CAAC,iBAAiB,GACpB,MAAM,CAOlB;IAED;;;;;;;OAOG;IACH,iCALW,MAAM,gBACN,MAAM,YACN,IAAI,CAAC,cAAc,GACjB,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,+BAA+B,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC,CAehG;CACF;sBAxPqB,gBAAgB"}
+{"version":3,"file":"lit-crypto-adapter.d.ts","sourceRoot":"","sources":["../../../src/crypto/adapters/lit-crypto-adapter.js"],"names":[],"mappings":"AAMA;;;;;;;GAOG;AACH,yCAFgB,IAAI,CAAC,aAAa;IAGhC;;;;;;OAMG;IACH,6BAJW,IAAI,CAAC,eAAe,aACpB,OAAO,0BAA0B,EAAE,aAAa,eAChD,IAAI,CAAC,WAAW,EAM1B;IAHC,sCAAsC;IACtC;;;;;;;;;;;;;;;;;;;;;;;;;;;MAA0B;IAC1B;;MAA8B;IAGhC;;;;;OAKG;IACH,oBAHW,IAAI,CAAC,QAAQ,GACX,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAIvC;IAED;;;;;;;OAOG;IACH,6BALW,cAAc,OACd,UAAU,MACV,UAAU,GACR,OAAO,CAAC,cAAc,CAAC,CAInC;IAED;;;;;;;OAOG;IACH,yBALW,UAAU,MACV,UAAU,oBACV,IAAI,CAAC,gBAAgB,GACnB,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CA6B5C;IAED;;;;;;;;;;;;OAYG;IACH,kCAVW,MAAM,WAEd;QAAuC,gBAAgB,EAA/C,IAAI,CAAC,gBAAgB;QACW,QAAQ,EAAxC,IAAI,CAAC,iBAAiB;QACqB,iBAAiB,EAA5D,OAAO,mBAAmB,EAAE,KAAK;QACX,WAAW,EAAjC,IAAI,CAAC,OAAO;QACoH,MAAM,EAAtI,OAAO,wBAAwB,EAAE,MAAM,CAAC,OAAO,wBAAwB,EAAE,GAAG,EAAE,OAAO,wBAAwB,EAAE,MAAM,CAAC;QACxE,QAAQ,EAAtD,OAAO,wBAAwB,EAAE,GAAG;KAC5C,GAAU,OAAO,CAAC;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,EAAE,EAAE,UAAU,CAAA;KAAE,CAAC,CAgFxD;IAED;;;;;OAKG;IACH,8BAHW,UAAU,GACR,IAAI,CAAC,iBAAiB,CAIlC;IACD;;;OAGG;IACH,gCAFG;QAA+B,IAAI,EAA3B,IAAI,CAAC,SAAS;KACxB,0BAGA;IAED;;;;OAIG;IACH,6CAHW,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GACd,IAAI,CAAC,iBAAiB,CA0BlC;IAED;;;;;OAKG;IACH,0BAHW,IAAI,CAAC,iBAAiB,GACpB,MAAM,CAOlB;IAED;;;;;;;OAOG;IACH,iCALW,MAAM,gBACN,MAAM,YACN,IAAI,CAAC,cAAc,GACjB,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,+BAA+B,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC,CAehG;CACF;sBAtQqB,gBAAgB"}

package/dist/crypto/adapters/lit-crypto-adapter.js

@@ -152,7 +152,21 @@ export class LitCryptoAdapter {
      * @returns {Type.ExtractedMetadata} - The extracted metadata
      */
     extractEncryptedMetadata(car) {
-        const encryptedContentResult = EncryptedMetadata.extract(car);
+        return this._validateLitMetadata(EncryptedMetadata.extract(car));
+    }
+    /**
+     * @param {object} source
+     * @param {Type.IPLDBlock} source.root
+     */
+    viewEncryptedMetadata({ root }) {
+        return this._validateLitMetadata(EncryptedMetadata.view({ root }));
+    }
+    /**
+     *
+     * @param {Type.Result<any>} encryptedContentResult
+     * @returns {Type.ExtractedMetadata}
+     */
+    _validateLitMetadata(encryptedContentResult) {
         if (encryptedContentResult.error) {
             throw encryptedContentResult.error;
         }

package/dist/handlers/decrypt-handler.d.ts

@@ -1,29 +1,4 @@
-/**
- * Decrypt file content using the decrypted symmetric key and IV.
- *
- * @param {Type.CryptoAdapter} cryptoAdapter - The crypto adapter responsible for performing
- * encryption and decryption operations.
- * @param {Uint8Array} key - The symmetric key
- * @param {Uint8Array} iv - The initialization vector
- * @param {AsyncIterable<Uint8Array>|Uint8Array} content - The encrypted file content
- * @returns {Promise<ReadableStream>} The decrypted file stream
- */
-export function decryptFileWithKey(
-  cryptoAdapter: Type.CryptoAdapter,
-  key: Uint8Array,
-  iv: Uint8Array,
-  content: AsyncIterable<Uint8Array> | Uint8Array
-): Promise<ReadableStream>
-export function retrieveAndDecrypt(
-  storachaClient: import('@storacha/client').Client,
-  cryptoAdapter: Type.CryptoAdapter,
-  gatewayURL: URL,
-  cid: Type.AnyLink,
-  decryptionConfig: Type.DecryptionConfig
-): Promise<Type.DecryptionResult>
-export function getCarFileFromPublicGateway(
-  gatewayURL: URL,
-  cid: string
-): Promise<Uint8Array>
-import * as Type from '../types.js'
-//# sourceMappingURL=decrypt-handler.d.ts.map
+export function retrieveAndDecrypt(storachaClient: import("@storacha/client").Client, cryptoAdapter: Type.CryptoAdapter, gatewayURL: URL, cid: Type.AnyLink, decryptionConfig: Type.DecryptionConfig): Promise<Type.DecryptionResult>;
+export function getCarFileFromPublicGateway(gatewayURL: URL, cid: string): Promise<Uint8Array>;
+import * as Type from '../types.js';
+//# sourceMappingURL=decrypt-handler.d.ts.map

package/dist/handlers/decrypt-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt-handler.d.ts","sourceRoot":"","sources":["../../src/handlers/decrypt-handler.js"],"names":[],"mappings":"AAyEA;;;;;;;;;GASG;AACH,kDAPW,IAAI,CAAC,aAAa,OAElB,UAAU,MACV,UAAU,WACV,aAAa,CAAC,UAAU,CAAC,GAAC,UAAU,GAClC,OAAO,CAAC,cAAc,CAAC,CAiDnC;AA/GM,mDARI,OAAO,kBAAkB,EAAE,MAAM,iBACjC,IAAI,CAAC,aAAa,cAElB,GAAG,OACH,IAAI,CAAC,OAAO,oBACZ,IAAI,CAAC,gBAAgB,GACnB,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAsD1C;AAwEM,wDAJI,GAAG,OACH,MAAM,GACJ,OAAO,CAAC,UAAU,CAAC,CA+B/B;sBAvKqB,aAAa"}
+{"version":3,"file":"decrypt-handler.d.ts","sourceRoot":"","sources":["../../src/handlers/decrypt-handler.js"],"names":[],"mappings":"AAkBO,mDARI,OAAO,kBAAkB,EAAE,MAAM,iBACjC,IAAI,CAAC,aAAa,cAElB,GAAG,OACH,IAAI,CAAC,OAAO,oBACZ,IAAI,CAAC,gBAAgB,GACnB,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CA2B1C;AAaM,wDAJI,GAAG,OACH,MAAM,GACJ,OAAO,CAAC,UAAU,CAAC,CA+B/B;sBAjFqB,aAAa"}