@enbox/agent 0.1.4 → 0.1.6

package/dist/types/index.d.ts

@@ -7,10 +7,16 @@ export type * from './types/permissions.js';
 export type * from './types/sync.js';
 export type * from './types/vc.js';
 export * from './agent-did-resolver-cache.js';
+export * from './anonymous-dwn-api.js';
 export * from './bearer-identity.js';
 export * from './crypto-api.js';
 export * from './did-api.js';
 export * from './dwn-api.js';
+export * from './dwn-encryption.js';
+export * from './dwn-key-delivery.js';
+export * from './dwn-record-upgrade.js';
+export * from './dwn-type-guards.js';
+export * from './protocol-utils.js';
 export * from './hd-identity-vault.js';
 export * from './identity-api.js';
 export * from './local-key-manager.js';

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,kBAAkB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,mBAAmB,qBAAqB,CAAC;AACzC,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,wBAAwB,CAAC;AAC5C,mBAAmB,wBAAwB,CAAC;AAC5C,mBAAmB,iBAAiB,CAAC;AACrC,mBAAmB,eAAe,CAAC;AAEnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,mBAAmB,kBAAkB,CAAC;AACtC,cAAc,gBAAgB,CAAC;AAC/B,mBAAmB,qBAAqB,CAAC;AACzC,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,wBAAwB,CAAC;AAC5C,mBAAmB,wBAAwB,CAAC;AAC5C,mBAAmB,iBAAiB,CAAC;AACrC,mBAAmB,eAAe,CAAC;AAEnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,sBAAsB,CAAC"}

package/dist/types/protocol-utils.d.ts

@@ -0,0 +1,70 @@
+import type { ProtocolDefinition, ProtocolRuleSet } from '@enbox/dwn-sdk-js';
+/**
+ * Navigates a protocol definition's structure to find the rule set at a given protocol path.
+ * @param protocolDefinition - The protocol definition to search
+ * @param protocolPath - The dot-separated protocol path (e.g. 'thread/message')
+ * @returns The rule set at the given path, or undefined if the path doesn't exist
+ */
+export declare function getRuleSetAtPath(protocolDefinition: ProtocolDefinition, protocolPath: string): ProtocolRuleSet | undefined;
+/**
+ * Extracts the root context ID from a contextId or parentContextId.
+ * e.g. 'abc/def/ghi' -> 'abc', 'abc' -> 'abc'
+ * @param contextId - The context ID to extract the root from
+ * @returns The root context ID
+ */
+export declare function getRootContextId(contextId: string): string;
+/**
+ * Checks if a protocol path represents a multi-party context.
+ * Returns true if the root path's subtree contains $role descendants
+ * or relational who/of $actions rules that grant read access.
+ *
+ * @param protocolDefinition - The full protocol definition
+ * @param rootProtocolPath - The root protocol path to check
+ * @returns true if the protocol path represents a multi-party context
+ */
+export declare function isMultiPartyContext(protocolDefinition: ProtocolDefinition, rootProtocolPath: string): boolean;
+/**
+ * Checks whether any relational who/of rule in the protocol grants
+ * read access for a given actor type and ancestor path.
+ *
+ * Walks the *entire* protocol structure looking for any $actions rule that:
+ *   - Has `who` equal to `actorType` ('recipient' or 'author'), or any actor
+ *     type if `actorType` is `undefined`
+ *   - Has `of` equal to `ofPath`
+ *   - Has `can` including 'read'
+ *
+ * @param actorType  - 'author' | 'recipient', or undefined for any
+ * @param ofPath     - The protocol path to check (e.g. 'thread', 'email')
+ * @param protocolDefinition - The full protocol definition
+ * @returns true if a matching relational read rule exists
+ */
+export declare function hasRelationalReadAccess(actorType: 'author' | 'recipient' | undefined, ofPath: string, protocolDefinition: ProtocolDefinition): boolean;
+/**
+ * Analyses a record write to determine which DIDs need context key delivery.
+ *
+ * Returns a set of participant DIDs that should receive `contextKey` records.
+ * The DWN owner (tenantDid) is always excluded — they have ProtocolPath access.
+ *
+ * Cases handled:
+ *   1. `$role` record with a recipient -> recipient is a participant
+ *   2. Record has a recipient and a relational read rule grants access
+ *      via `{ who: 'recipient', of: '<path>', can: ['read'] }`
+ *   3. Record is authored by an external party -> if `{ who: 'author', of:
+ *      '<path>', can: ['read'] }` rules grant read access, the author needs
+ *      a context key.
+ *
+ * @param params.protocolDefinition - The installed protocol definition
+ * @param params.protocolPath       - The written record's protocol path
+ * @param params.recipient          - Recipient DID from the record, if any
+ * @param params.tenantDid          - The DWN owner's DID (excluded from results)
+ * @param params.authorDid          - Author DID if externally authored, undefined otherwise
+ * @returns Set of DIDs that need context key delivery
+ */
+export declare function detectNewParticipants({ protocolDefinition, protocolPath, recipient, tenantDid, authorDid }: {
+    protocolDefinition: ProtocolDefinition;
+    protocolPath: string;
+    recipient?: string;
+    tenantDid: string;
+    authorDid?: string;
+}): Set<string>;
+//# sourceMappingURL=protocol-utils.d.ts.map

package/dist/types/protocol-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-utils.d.ts","sourceRoot":"","sources":["../../src/protocol-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE7E;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,kBAAkB,EAAE,kBAAkB,EACtC,YAAY,EAAE,MAAM,GACnB,eAAe,GAAG,SAAS,CAS7B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,kBAAkB,EAAE,kBAAkB,EACtC,gBAAgB,EAAE,MAAM,GACvB,OAAO,CA2BT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,EAC7C,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,kBAAkB,GACrC,OAAO,CA+BT;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,kBAAkB,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE;IAC3G,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,GAAG,CAAC,MAAM,CAAC,CAgCd"}

package/dist/types/sync-engine-level.d.ts

@@ -84,59 +84,22 @@ export declare class SyncEngineLevel implements SyncEngine {
     private getLocalLeaves;
     private getRemoteLeaves;
     /**
-     * Fetches missing messages from the remote DWN and processes them on the local DWN
+     * Fetches missing messages from the remote DWN and processes them locally
      * in dependency order (topological sort).
-     *
-     * Messages that fail processing are re-fetched from the remote before each retry
-     * pass rather than buffered in memory. ReadableStream is single-use, so a failed
-     * message's data stream is consumed on the first attempt. Re-fetching provides a
-     * fresh stream without holding all record data in memory simultaneously.
      */
     private pullMessages;
     /**
-     * Fetches messages from a remote DWN by their CIDs using MessagesRead.
-     */
-    private fetchRemoteMessages;
-    /**
-     * Reads missing messages from the local DWN and pushes them to the remote DWN.
-     * Messages are fetched first, then sorted in dependency order (topological sort)
-     * so that initial writes come before updates, and ProtocolsConfigures come before
-     * records that reference those protocols.
+     * Reads missing messages from the local DWN and pushes them to the remote DWN
+     * in dependency order (topological sort).
      */
     private pushMessages;
     /**
-     * Helper to get the CID of a message for logging purposes.
-     */
-    private static getMessageCid;
-    /**
-     * Reads a message from the local DWN by its CID using MessagesRead.
-     */
-    private getLocalMessage;
-    /**
-     * Builds a dependency graph from the fetched messages and returns them in
-     * topological order so that dependencies are processed before dependents.
-     *
-     * Dependencies:
-     * - ProtocolsConfigure must come before any RecordsWrite using that protocol
-     * - Parent record must come before child record (via parentId)
-     * - Initial write must come before update writes (same recordId, not initial)
-     * - Permission grant must come before records using that permissionGrantId
+     * Delegate to the standalone `topologicalSort` function.
+     * Tests call `SyncEngineLevel.topologicalSort(...)` so this static method must remain.
      */
     static topologicalSort<T extends {
         message: GenericMessage;
     }>(messages: T[]): T[];
-    /**
-     * Checks whether a message is an initial RecordsWrite (not an update).
-     * An initial write has recordId === message CID context or has no `dateModified` != `dateCreated`.
-     */
-    private static isInitialWrite;
-    /**
-     * 202: message was successfully written to the remote DWN
-     * 204: an initial write message was written without any data
-     * 409: message was already present on the remote DWN
-     * RecordsDelete + 404: the initial write was not found or already deleted
-     */
-    private static syncMessageReplyIsSuccessful;
     /**
      * Returns the list of sync targets: (did, dwnUrl, delegateDid?, protocol?) tuples.
      */

package/dist/types/sync-engine-level.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync-engine-level.d.ts","sourceRoot":"","sources":["../../src/sync-engine-level.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EACV,cAAc,EAIf,MAAM,mBAAmB,CAAC;AAc3B,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAa,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAMrE,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC;CAClD,CAAC;AASF,qBAAa,eAAgB,YAAW,UAAU;IAChD;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,CAAoB;IAEnC;;OAEG;IACH,OAAO,CAAC,eAAe,CAAiB;IAExC,OAAO,CAAC,GAAG,CAA8C;IACzD,OAAO,CAAC,eAAe,CAAC,CAAiC;IACzD,OAAO,CAAC,SAAS,CAAS;IAE1B;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAC,CAAsB;gBAElC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,qBAAqB;IAM1D;;;;;OAKG;IACH,IAAI,KAAK,IAAI,iBAAiB,CAM7B;IAED,IAAI,KAAK,CAAC,KAAK,EAAE,iBAAiB,EAGjC;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAKtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,mBAAmB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjG,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9C,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAkBzE,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,mBAAmB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyDhD,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE;QACnC,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCjB;;OAEG;IACU,QAAQ,CAAC,OAAO,GAAE,MAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAsB5D;;;OAGG;YACW,iBAAiB;IAiB/B;;;OAGG;YACW,YAAY;IAmB1B;;;OAGG;YACW,aAAa;IA6B3B;;;;;OAKG;YACW,YAAY;YA0EZ,mBAAmB;YAoBnB,oBAAoB;YA0BpB,cAAc;YAoBd,eAAe;IA8B7B;;;;;;;;OAQG;YACW,YAAY;IA0C1B;;OAEG;YACW,mBAAmB;IAmFjC;;;;;OAKG;YACW,YAAY;IAwC1B;;OAEG;mBACkB,aAAa;IAQlC;;OAEG;YACW,eAAe;IAmD7B;;;;;;;;;OASG;IACH,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS;QAAE,OAAO,EAAE,cAAc,CAAA;KAAE,EAC1D,QAAQ,EAAE,CAAC,EAAE,GACZ,CAAC,EAAE;IA4IN;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IAa7B;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,4BAA4B;IAW3C;;OAEG;YACW,cAAc;IAsC5B;;;OAGG;YACW,wBAAwB;CAmBvC"}
+{"version":3,"file":"sync-engine-level.d.ts","sourceRoot":"","sources":["../../src/sync-engine-level.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAqB,MAAM,mBAAmB,CAAC;AAQ3E,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAa,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAQrE,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC;CAClD,CAAC;AASF,qBAAa,eAAgB,YAAW,UAAU;IAChD;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,CAAoB;IAEnC;;OAEG;IACH,OAAO,CAAC,eAAe,CAAiB;IAExC,OAAO,CAAC,GAAG,CAA8C;IACzD,OAAO,CAAC,eAAe,CAAC,CAAiC;IACzD,OAAO,CAAC,SAAS,CAAS;IAE1B;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAC,CAAsB;gBAElC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,qBAAqB;IAM1D;;;;;OAKG;IACH,IAAI,KAAK,IAAI,iBAAiB,CAM7B;IAED,IAAI,KAAK,CAAC,KAAK,EAAE,iBAAiB,EAGjC;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAKtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,mBAAmB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAcjG,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9C,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAkBzE,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,mBAAmB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAUrG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyDhD,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE;QACnC,QAAQ,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCjB;;OAEG;IACU,QAAQ,CAAC,OAAO,GAAE,MAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAsB5D;;;OAGG;YACW,iBAAiB;IAiB/B;;;OAGG;YACW,YAAY;IAmB1B;;;OAGG;YACW,aAAa;IA6B3B;;;;;OAKG;YACW,YAAY;YA0EZ,mBAAmB;YAoBnB,oBAAoB;YA0BpB,cAAc;YAoBd,eAAe;IAkC7B;;;OAGG;YACW,YAAY;IAc1B;;;OAGG;YACW,YAAY;IAkB1B;;;OAGG;IACH,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS;QAAE,OAAO,EAAE,cAAc,CAAA;KAAE,EAC1D,QAAQ,EAAE,CAAC,EAAE,GACZ,CAAC,EAAE;IAIN;;OAEG;YACW,cAAc;IAsC5B;;;OAGG;YACW,wBAAwB;CAmBvC"}

package/dist/types/sync-messages.d.ts

@@ -0,0 +1,76 @@
+import type { PermissionsApi } from './types/permissions.js';
+import type { Web5PlatformAgent } from './types/agent.js';
+import type { GenericMessage, UnionMessageReply } from '@enbox/dwn-sdk-js';
+/** Entry type for fetched messages with optional data stream. */
+export type SyncMessageEntry = {
+    message: GenericMessage;
+    dataStream?: ReadableStream<Uint8Array>;
+};
+/**
+ * 202: message was successfully written to the remote DWN
+ * 204: an initial write message was written without any data
+ * 409: message was already present on the remote DWN
+ * RecordsDelete + 404: the initial write was not found or already deleted
+ */
+export declare function syncMessageReplyIsSuccessful(reply: UnionMessageReply): boolean;
+/**
+ * Helper to get the CID of a message for logging purposes.
+ */
+export declare function getMessageCid(message: GenericMessage): Promise<string>;
+/**
+ * Fetches missing messages from the remote DWN and processes them on the local DWN
+ * in dependency order (topological sort).
+ *
+ * Messages that fail processing are re-fetched from the remote before each retry
+ * pass rather than buffered in memory. ReadableStream is single-use, so a failed
+ * message's data stream is consumed on the first attempt. Re-fetching provides a
+ * fresh stream without holding all record data in memory simultaneously.
+ */
+export declare function pullMessages({ did, dwnUrl, delegateDid, protocol, messageCids, agent, permissionsApi }: {
+    did: string;
+    dwnUrl: string;
+    delegateDid?: string;
+    protocol?: string;
+    messageCids: string[];
+    agent: Web5PlatformAgent;
+    permissionsApi: PermissionsApi;
+}): Promise<void>;
+/**
+ * Fetches messages from a remote DWN by their CIDs using MessagesRead.
+ */
+export declare function fetchRemoteMessages({ did, dwnUrl, delegateDid, protocol, messageCids, agent, permissionsApi }: {
+    did: string;
+    dwnUrl: string;
+    delegateDid?: string;
+    protocol?: string;
+    messageCids: string[];
+    agent: Web5PlatformAgent;
+    permissionsApi: PermissionsApi;
+}): Promise<SyncMessageEntry[]>;
+/**
+ * Reads missing messages from the local DWN and pushes them to the remote DWN.
+ * Messages are fetched first, then sorted in dependency order (topological sort)
+ * so that initial writes come before updates, and ProtocolsConfigures come before
+ * records that reference those protocols.
+ */
+export declare function pushMessages({ did, dwnUrl, delegateDid, protocol, messageCids, agent, permissionsApi }: {
+    did: string;
+    dwnUrl: string;
+    delegateDid?: string;
+    protocol?: string;
+    messageCids: string[];
+    agent: Web5PlatformAgent;
+    permissionsApi: PermissionsApi;
+}): Promise<void>;
+/**
+ * Reads a message from the local DWN by its CID using MessagesRead.
+ */
+export declare function getLocalMessage({ author, delegateDid, protocol, messageCid, agent, permissionsApi }: {
+    author: string;
+    delegateDid?: string;
+    protocol?: string;
+    messageCid: string;
+    agent: Web5PlatformAgent;
+    permissionsApi: PermissionsApi;
+}): Promise<SyncMessageEntry | undefined>;
+//# sourceMappingURL=sync-messages.d.ts.map

package/dist/types/sync-messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-messages.d.ts","sourceRoot":"","sources":["../../src/sync-messages.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAqB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAQ9F,iEAAiE;AACjE,MAAM,MAAM,gBAAgB,GAAG;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,UAAU,CAAC,EAAE,cAAc,CAAC,UAAU,CAAC,CAAA;CAAE,CAAC;AAEpG;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAS9E;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM5E;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC7G,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,iBAAiB,CAAC;IACzB,cAAc,EAAE,cAAc,CAAC;CAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CAkChB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACpH,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,iBAAiB,CAAC;IACzB,cAAc,EAAE,cAAc,CAAC;CAChC,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAuE9B;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC7G,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,iBAAiB,CAAC;IACzB,cAAc,EAAE,cAAc,CAAC;CAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChB;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC1G,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,iBAAiB,CAAC;IACzB,cAAc,EAAE,cAAc,CAAC;CAChC,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAwCxC"}

package/dist/types/sync-topological-sort.d.ts

@@ -0,0 +1,15 @@
+import type { GenericMessage } from '@enbox/dwn-sdk-js';
+/**
+ * Builds a dependency graph from the fetched messages and returns them in
+ * topological order so that dependencies are processed before dependents.
+ *
+ * Dependencies:
+ * - ProtocolsConfigure must come before any RecordsWrite using that protocol
+ * - Parent record must come before child record (via parentId)
+ * - Initial write must come before update writes (same recordId, not initial)
+ * - Permission grant must come before records using that permissionGrantId
+ */
+export declare function topologicalSort<T extends {
+    message: GenericMessage;
+}>(messages: T[]): T[];
+//# sourceMappingURL=sync-topological-sort.d.ts.map

package/dist/types/sync-topological-sort.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-topological-sort.d.ts","sourceRoot":"","sources":["../../src/sync-topological-sort.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAiBxD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,cAAc,CAAA;CAAE,EACnE,QAAQ,EAAE,CAAC,EAAE,GACZ,CAAC,EAAE,CAyIL"}

package/dist/types/test-harness.d.ts

@@ -51,6 +51,16 @@ export declare class PlatformAgentTestHarness {
     };
     constructor(params: PlatformAgentTestHarnessParams);
     clearStorage(): Promise<void>;
+    /**
+     * Clear only DWN-level stores (data, messages, state index, resumable tasks,
+     * sync, permissions) and the DWN-backed store caches — but preserve the
+     * agent DID, vault, and all key/DID/identity material.
+     *
+     * Use this in `beforeEach` when `createAgentDid()` (and optionally
+     * `createIdentity()`) was called once in `beforeAll` to avoid expensive
+     * DID re-creation on every test.
+     */
+    clearDwnStores(): Promise<void>;
     closeStorage(): Promise<void>;
     createAgentDid(): Promise<void>;
     createIdentity({ name, testDwnUrls }: {

package/dist/types/test-harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-harness.d.ts","sourceRoot":"","sources":["../../src/test-harness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,EAAE,cAAc,EAAsB,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAYpI,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EAAE,WAAW,EAAoB,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAoB,MAAM,gBAAgB,CAAC;AAY/D,KAAK,8BAA8B,GAAG;IACpC,KAAK,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAA;IAEzC,WAAW,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC9B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,GAAG,EAAE,GAAG,CAAC;IACT,YAAY,EAAE,cAAc,CAAC;IAC7B,aAAa,EAAE,eAAe,CAAC;IAC/B,eAAe,EAAE,iBAAiB,CAAC;IACnC,qBAAqB,EAAE,uBAAuB,CAAC;IAC/C,SAAS,EAAE,aAAa,CAAC,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC;IACvD,UAAU,EAAE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,SAAS,EAAE;QACT,QAAQ,EAAE,WAAW,CAAC;QACtB,aAAa,EAAE,gBAAgB,CAAC;QAChC,QAAQ,EAAE,WAAW,CAAC;QACtB,KAAK,EAAE,MAAM,IAAI,CAAC;KACnB,CAAA;CACF,CAAC;AAEF,qBAAa,wBAAwB;IAC5B,KAAK,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAE1C,WAAW,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC9B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,GAAG,EAAE,GAAG,CAAC;IACT,YAAY,EAAE,cAAc,CAAC;IAC7B,aAAa,EAAE,eAAe,CAAC;IAC/B,eAAe,EAAE,iBAAiB,CAAC;IACnC,qBAAqB,EAAE,uBAAuB,CAAC;IAC/C,SAAS,EAAE,aAAa,CAAC,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC;IACvD,UAAU,EAAE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjD;;;OAGG;IACI,SAAS,EAAE;QAChB,QAAQ,EAAE,WAAW,CAAC;QACtB,aAAa,EAAE,gBAAgB,CAAC;QAChC,QAAQ,EAAE,WAAW,CAAC;QACtB,gDAAgD;QAChD,KAAK,EAAE,MAAM,IAAI,CAAC;KACnB,CAAC;gBAEU,MAAM,EAAE,8BAA8B;IAcrC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAkC7B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAU7B,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB/B,cAAc,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACjD,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,GAAG,OAAO,CAAC,cAAc,CAAC;WAgCP,KAAK,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,EAAE;QACvE,UAAU,EAAE,KAAK,MAAM,EAAE,GAAG,KAAK,iBAAiB,CAAC,eAAe,CAAC,CAAA;QACnE,WAAW,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;QAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA8FrC,OAAO,CAAC,MAAM,CAAC,aAAa;IAqC5B,OAAO,CAAC,MAAM,CAAC,eAAe;CAsB/B"}
+{"version":3,"file":"test-harness.d.ts","sourceRoot":"","sources":["../../src/test-harness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D,OAAO,EAAE,cAAc,EAAsB,iBAAiB,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAYpI,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EAAE,WAAW,EAAoB,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAoB,MAAM,gBAAgB,CAAC;AAY/D,KAAK,8BAA8B,GAAG;IACpC,KAAK,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAA;IAEzC,WAAW,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC9B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,GAAG,EAAE,GAAG,CAAC;IACT,YAAY,EAAE,cAAc,CAAC;IAC7B,aAAa,EAAE,eAAe,CAAC;IAC/B,eAAe,EAAE,iBAAiB,CAAC;IACnC,qBAAqB,EAAE,uBAAuB,CAAC;IAC/C,SAAS,EAAE,aAAa,CAAC,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC;IACvD,UAAU,EAAE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,SAAS,EAAE;QACT,QAAQ,EAAE,WAAW,CAAC;QACtB,aAAa,EAAE,gBAAgB,CAAC;QAChC,QAAQ,EAAE,WAAW,CAAC;QACtB,KAAK,EAAE,MAAM,IAAI,CAAC;KACnB,CAAA;CACF,CAAC;AAEF,qBAAa,wBAAwB;IAC5B,KAAK,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAC;IAE1C,WAAW,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC9B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,GAAG,EAAE,GAAG,CAAC;IACT,YAAY,EAAE,cAAc,CAAC;IAC7B,aAAa,EAAE,eAAe,CAAC;IAC/B,eAAe,EAAE,iBAAiB,CAAC;IACnC,qBAAqB,EAAE,uBAAuB,CAAC;IAC/C,SAAS,EAAE,aAAa,CAAC,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC;IACvD,UAAU,EAAE,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjD;;;OAGG;IACI,SAAS,EAAE;QAChB,QAAQ,EAAE,WAAW,CAAC;QACtB,aAAa,EAAE,gBAAgB,CAAC;QAChC,QAAQ,EAAE,WAAW,CAAC;QACtB,gDAAgD;QAChD,KAAK,EAAE,MAAM,IAAI,CAAC;KACnB,CAAC;gBAEU,MAAM,EAAE,8BAA8B;IAcrC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAkC1C;;;;;;;;OAQG;IACU,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAU/B,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAU7B,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB/B,cAAc,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACjD,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,GAAG,OAAO,CAAC,cAAc,CAAC;WAgCP,KAAK,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,EAAE;QACvE,UAAU,EAAE,KAAK,MAAM,EAAE,GAAG,KAAK,iBAAiB,CAAC,eAAe,CAAC,CAAA;QACnE,WAAW,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;QAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA8FrC,OAAO,CAAC,MAAM,CAAC,aAAa;IAqC5B,OAAO,CAAC,MAAM,CAAC,eAAe;CAsB/B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enbox/agent",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "type": "module",
   "main": "./dist/esm/index.js",
   "module": "./dist/esm/index.js",
@@ -71,11 +71,11 @@
   },
   "dependencies": {
     "@scure/bip39": "1.2.2",
-    "@enbox/dwn-clients": "0.0.2",
-    "@enbox/dwn-sdk-js": "0.0.5",
+    "@enbox/dwn-clients": "0.0.4",
+    "@enbox/dwn-sdk-js": "0.0.7",
     "@enbox/common": "0.0.3",
-    "@enbox/crypto": "0.0.3",
-    "@enbox/dids": "0.0.3",
+    "@enbox/crypto": "0.0.4",
+    "@enbox/dids": "0.0.5",
     "abstract-level": "1.0.4",
     "ed25519-keygen": "0.4.11",
     "level": "8.0.0",

package/src/anonymous-dwn-api.ts

@@ -0,0 +1,263 @@
+import type { DidUrlDereferencer } from '@enbox/dids';
+
+import type {
+  DateSort,
+  Pagination,
+  ProtocolsQueryFilter,
+  ProtocolsQueryReply,
+  RecordsCountMessage,
+  RecordsCountReply,
+  RecordsFilter,
+  RecordsQueryReply,
+  RecordsReadReply,
+  RecordsSubscribeReply,
+  RecordSubscriptionHandler,
+} from '@enbox/dwn-sdk-js';
+import type { DwnRpcRequest, Web5Rpc } from '@enbox/dwn-clients';
+
+import { ProtocolsQuery, RecordsCount, RecordsQuery, RecordsRead, RecordsSubscribe } from '@enbox/dwn-sdk-js';
+
+import { getDwnServiceEndpointUrls } from './utils.js';
+
+/**
+ * Parameters for constructing an {@link AnonymousDwnApi}.
+ */
+export type AnonymousDwnApiParams = {
+  /** A DID URL dereferencer for resolving target DID service endpoints. */
+  didResolver: DidUrlDereferencer;
+  /** An RPC client for sending messages to remote DWNs. */
+  rpcClient: Web5Rpc;
+};
+
+/**
+ * Parameters for an anonymous records query.
+ * Mirrors the DWN SDK's `RecordsQueryOptions` without `signer` or delegation fields.
+ */
+export type AnonymousRecordsQueryParams = {
+  filter: RecordsFilter;
+  dateSort?: DateSort;
+  pagination?: Pagination;
+  messageTimestamp?: string;
+};
+
+/**
+ * Parameters for an anonymous records read.
+ */
+export type AnonymousRecordsReadParams = {
+  filter: RecordsFilter;
+  messageTimestamp?: string;
+};
+
+/**
+ * Parameters for an anonymous records subscribe.
+ */
+export type AnonymousRecordsSubscribeParams = {
+  filter: RecordsFilter;
+  dateSort?: DateSort;
+  pagination?: Pagination;
+  messageTimestamp?: string;
+};
+
+/**
+ * Parameters for an anonymous records count.
+ */
+export type AnonymousRecordsCountParams = {
+  filter: RecordsFilter;
+  messageTimestamp?: string;
+};
+
+/**
+ * Parameters for an anonymous protocols query.
+ */
+export type AnonymousProtocolsQueryParams = {
+  filter?: ProtocolsQueryFilter;
+  messageTimestamp?: string;
+};
+
+/**
+ * A lightweight DWN API that creates **unsigned** (anonymous) DWN messages and
+ * sends them to remote DWNs via RPC.
+ *
+ * This class does not require a vault, agent DID, signing keys, or any identity
+ * infrastructure. It leverages the DWN SDK's native support for optional
+ * `signer` on read-path operations (RecordsQuery, RecordsRead, RecordsSubscribe,
+ * RecordsCount, ProtocolsQuery).
+ *
+ * Anonymous queries return only published records. Anonymous reads succeed for
+ * published records and for protocol records with `{ who: 'anyone', can: ['read'] }`.
+ *
+ * @example
+ * ```ts
+ * const resolver = new UniversalResolver({ didResolvers: [DidDht, DidJwk] });
+ * const rpcClient = new Web5RpcClient();
+ * const anonymousDwn = new AnonymousDwnApi({ didResolver: resolver, rpcClient });
+ *
+ * const reply = await anonymousDwn.recordsQuery('did:dht:alice...', {
+ *   filter: { protocol: 'https://social.example/posts', protocolPath: 'post' },
+ * });
+ * ```
+ */
+export class AnonymousDwnApi {
+  private _didResolver: DidUrlDereferencer;
+  private _rpcClient: Web5Rpc;
+
+  constructor({ didResolver, rpcClient }: AnonymousDwnApiParams) {
+    this._didResolver = didResolver;
+    this._rpcClient = rpcClient;
+  }
+
+  /**
+   * Send an anonymous (unsigned) `RecordsQuery` to a remote DWN.
+   *
+   * Only published records are returned by the remote DWN.
+   *
+   * @param target - The DID whose DWN will be queried.
+   * @param params - Query parameters (filter, sort, pagination).
+   * @returns The raw `RecordsQueryReply` from the remote DWN.
+   */
+  public async recordsQuery(target: string, params: AnonymousRecordsQueryParams): Promise<RecordsQueryReply> {
+    const recordsQuery = await RecordsQuery.create({
+      filter           : params.filter,
+      dateSort         : params.dateSort,
+      pagination       : params.pagination,
+      messageTimestamp : params.messageTimestamp,
+      // No signer — creates an unsigned message.
+    });
+
+    return await this.sendRequest<RecordsQueryReply>(target, recordsQuery.message);
+  }
+
+  /**
+   * Send an anonymous (unsigned) `RecordsRead` to a remote DWN.
+   *
+   * Succeeds for published records and for protocol records with
+   * `{ who: 'anyone', can: ['read'] }` rules.
+   *
+   * @param target - The DID whose DWN will be read from.
+   * @param params - Read parameters (filter).
+   * @returns The raw `RecordsReadReply` from the remote DWN.
+   */
+  public async recordsRead(target: string, params: AnonymousRecordsReadParams): Promise<RecordsReadReply> {
+    const recordsRead = await RecordsRead.create({
+      filter           : params.filter,
+      messageTimestamp : params.messageTimestamp,
+      // No signer — creates an unsigned message.
+    });
+
+    return await this.sendRequest<RecordsReadReply>(target, recordsRead.message);
+  }
+
+  /**
+   * Send an anonymous (unsigned) `RecordsSubscribe` to a remote DWN.
+   *
+   * Only published record events are received.
+   *
+   * @param target - The DID whose DWN to subscribe to.
+   * @param params - Subscribe parameters (filter).
+   * @param handler - Callback for incoming record events.
+   * @returns The raw `RecordsSubscribeReply` from the remote DWN.
+   */
+  public async recordsSubscribe(
+    target: string,
+    params: AnonymousRecordsSubscribeParams,
+    handler: RecordSubscriptionHandler,
+  ): Promise<RecordsSubscribeReply> {
+    const recordsSubscribe = await RecordsSubscribe.create({
+      filter           : params.filter,
+      dateSort         : params.dateSort,
+      pagination       : params.pagination,
+      messageTimestamp : params.messageTimestamp,
+      // No signer — creates an unsigned message.
+    });
+
+    return await this.sendRequest<RecordsSubscribeReply>(target, recordsSubscribe.message, undefined, handler);
+  }
+
+  /**
+   * Send an anonymous (unsigned) `RecordsCount` to a remote DWN.
+   *
+   * Only published records are counted.
+   *
+   * @param target - The DID whose DWN to count records in.
+   * @param params - Count parameters (filter).
+   * @returns The raw `RecordsCountReply` from the remote DWN.
+   */
+  public async recordsCount(target: string, params: AnonymousRecordsCountParams): Promise<RecordsCountReply> {
+    const recordsCount = await RecordsCount.create({
+      filter           : params.filter,
+      messageTimestamp : params.messageTimestamp,
+      // No signer — creates an unsigned message.
+    });
+
+    return await this.sendRequest<RecordsCountReply>(target, recordsCount.message as RecordsCountMessage);
+  }
+
+  /**
+   * Send an anonymous (unsigned) `ProtocolsQuery` to a remote DWN.
+   *
+   * Only published protocol definitions are returned.
+   *
+   * @param target - The DID whose DWN to query protocols from.
+   * @param params - Optional query parameters (protocol filter).
+   * @returns The raw `ProtocolsQueryReply` from the remote DWN.
+   */
+  public async protocolsQuery(target: string, params?: AnonymousProtocolsQueryParams): Promise<ProtocolsQueryReply> {
+    const protocolsQuery = await ProtocolsQuery.create({
+      filter           : params?.filter,
+      messageTimestamp : params?.messageTimestamp,
+      // No signer — creates an unsigned message.
+    });
+
+    return await this.sendRequest<ProtocolsQueryReply>(target, protocolsQuery.message);
+  }
+
+  /**
+   * Resolve the target DID's DWN service endpoints and send an unsigned
+   * message to the first one that responds.
+   *
+   * Follows the same retry-over-endpoints pattern as `AgentDwnApi.sendDwnRpcRequest()`.
+   */
+  private async sendRequest<TReply>(
+    target: string,
+    message: unknown,
+    data?: Blob,
+    subscriptionHandler?: RecordSubscriptionHandler,
+  ): Promise<TReply> {
+    const dwnEndpointUrls = await getDwnServiceEndpointUrls(target, this._didResolver);
+    const errorMessages: { url: string; message: string }[] = [];
+
+    for (let dwnUrl of dwnEndpointUrls) {
+      try {
+        // For subscriptions, upgrade to WebSocket transport if available.
+        if (subscriptionHandler !== undefined) {
+          const serverInfo = await this._rpcClient.getServerInfo(dwnUrl);
+          if (!serverInfo.webSocketSupport) {
+            errorMessages.push({ url: dwnUrl, message: 'WebSocket support is not enabled on the server.' });
+            continue;
+          }
+
+          const parsedUrl = new URL(dwnUrl);
+          parsedUrl.protocol = parsedUrl.protocol === 'http:' ? 'ws:' : 'wss:';
+          dwnUrl = parsedUrl.toString();
+        }
+
+        const reply = await this._rpcClient.sendDwnRequest({
+          dwnUrl,
+          targetDid           : target,
+          message,
+          data,
+          subscriptionHandler : subscriptionHandler,
+        } as DwnRpcRequest);
+
+        return reply as TReply;
+      } catch (error: unknown) {
+        errorMessages.push({
+          url     : dwnUrl,
+          message : (error instanceof Error) ? error.message : 'Unknown error',
+        });
+      }
+    }
+
+    throw new Error(`AnonymousDwnApi: Failed to send request to '${target}': ${JSON.stringify(errorMessages)}`);
+  }
+}