@enbox/agent 0.7.6 → 0.7.8

package/dist/esm/sync-permission-grants.js

@@ -0,0 +1,208 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { Jws, Message, PermissionScopeMatcher } from '@enbox/dwn-sdk-js';
+import { lexicographicalCompare, syncScopeFromRecordsProjectionScopes } from './types/sync.js';
+/** Returns a sorted, duplicate-free grant ID set, or `undefined` for owner requests. */
+export function toMessagesPermissionGrantIds(permissionGrantIds) {
+    if (permissionGrantIds === undefined || permissionGrantIds.length === 0) {
+        return undefined;
+    }
+    return [...new Set(permissionGrantIds)].sort(lexicographicalCompare);
+}
+/**
+ * Gets the active permission grant IDs that authorize a Messages operation.
+ *
+ * Owner-authored sync does not invoke grants. Delegate full sync requires at
+ * least one active unscoped Messages.Read grant. Delegate protocol-set sync
+ * requires each requested protocol to be covered by an active Messages.Read
+ * grant, then invokes every active grant that participates in the projection.
+ * This keeps the authorization epoch tied to grant churn without widening the
+ * CID projection being compared.
+ */
+export function getMessagesPermissionGrantsForScope(_a) {
+    return __awaiter(this, arguments, void 0, function* ({ did, delegateDid, protocols, messageType, permissionsApi, }) {
+        const requestedScope = protocols === undefined
+            ? { kind: 'full' }
+            : { kind: 'protocolSet', protocols };
+        const resolutions = yield resolveMessagesSyncScopes({
+            did,
+            delegateDid,
+            requestedScope,
+            messageType,
+            permissionsApi,
+        });
+        return resolutions
+            .flatMap(resolution => resolution.permissionGrants)
+            .sort((a, b) => lexicographicalCompare(a.grant.id, b.grant.id));
+    });
+}
+/**
+ * Resolves active Messages.Read grants into one or more sync targets.
+ *
+ * Broad protocol coverage remains on StateIndex full/protocol roots. Exact
+ * protocolPath and contextId grants are grouped into a Records-primary
+ * projection target so a narrow grant never authorizes a broad protocol root.
+ */
+export function resolveMessagesSyncScopes(_a) {
+    return __awaiter(this, arguments, void 0, function* ({ did, delegateDid, requestedScope, messageType, permissionsApi, }) {
+        if (!delegateDid) {
+            return [{ scope: requestedScope, permissionGrants: [] }];
+        }
+        const now = new Date().toISOString();
+        const permissionGrants = (yield permissionsApi.fetchGrants({
+            author: delegateDid,
+            target: delegateDid,
+            grantor: did,
+            grantee: delegateDid,
+        })).filter(entry => isActiveMessagesGrant(entry, did, delegateDid, now));
+        if (requestedScope.kind === 'full') {
+            return [resolveFullScope(permissionGrants, requestedScope, messageType)];
+        }
+        if (requestedScope.kind === 'protocolSet') {
+            return resolveProtocolSetScope(permissionGrants, requestedScope, messageType);
+        }
+        return [resolveRecordsProjectionScope(permissionGrants, requestedScope, messageType)];
+    });
+}
+function resolveFullScope(permissionGrants, requestedScope, messageType) {
+    const grants = permissionGrants
+        .filter(entry => grantMatchesProtocol(entry, undefined))
+        .sort((a, b) => lexicographicalCompare(a.grant.id, b.grant.id));
+    if (grants.length === 0) {
+        throw new Error(`SyncPermissions: No active Messages.Read permission found for ${messageType}: all protocols`);
+    }
+    return { scope: requestedScope, permissionGrants: grants };
+}
+function resolveProtocolSetScope(permissionGrants, requestedScope, messageType) {
+    const broadProtocols = [];
+    const narrowScopes = [];
+    for (const protocol of requestedScope.protocols) {
+        if (permissionGrants.some(entry => grantMatchesProtocol(entry, protocol))) {
+            broadProtocols.push(protocol);
+            continue;
+        }
+        const protocolNarrowScopes = permissionGrants
+            .map(entry => grantProjectionScopeForProtocol(entry, protocol))
+            .filter((scope) => scope !== undefined);
+        if (protocolNarrowScopes.length === 0) {
+            throw new Error(`SyncPermissions: No active Messages.Read permission found for ${messageType}: ${protocol}`);
+        }
+        narrowScopes.push(...protocolNarrowScopes);
+    }
+    return [
+        ...broadProtocolResolution(permissionGrants, broadProtocols),
+        ...recordsProjectionResolution(permissionGrants, narrowScopes, messageType),
+    ];
+}
+function resolveRecordsProjectionScope(permissionGrants, requestedScope, messageType) {
+    if (!requestedScope.scopes.every(scope => isProjectionScopeCovered(permissionGrants, scope))) {
+        throw new Error(`SyncPermissions: No active Messages.Read permission found for ${messageType}: projected Records scope`);
+    }
+    const grants = permissionGrants
+        .filter(entry => requestedScope.scopes.some(scope => PermissionScopeMatcher.matches(entry.grant.scope, scope)))
+        .sort((a, b) => lexicographicalCompare(a.grant.id, b.grant.id));
+    return { scope: requestedScope, permissionGrants: grants };
+}
+function isProjectionScopeCovered(permissionGrants, scope) {
+    return permissionGrants.some(entry => PermissionScopeMatcher.matches(entry.grant.scope, scope));
+}
+function broadProtocolResolution(permissionGrants, broadProtocols) {
+    if (broadProtocols.length === 0) {
+        return [];
+    }
+    const protocols = [...new Set(broadProtocols)].sort(lexicographicalCompare);
+    const grants = permissionGrants
+        .filter(entry => grantParticipatesInProtocolSet(entry, protocols))
+        .sort((a, b) => lexicographicalCompare(a.grant.id, b.grant.id));
+    return [{
+            scope: {
+                kind: 'protocolSet',
+                protocols,
+            },
+            permissionGrants: grants,
+        }];
+}
+function recordsProjectionResolution(permissionGrants, projectionScopes, messageType) {
+    const [firstScope, ...remainingScopes] = projectionScopes;
+    if (firstScope === undefined) {
+        return [];
+    }
+    const requestedScope = syncScopeFromRecordsProjectionScopes([firstScope, ...remainingScopes]);
+    return [resolveRecordsProjectionScope(permissionGrants, requestedScope, messageType)];
+}
+function grantProjectionScopeForProtocol(entry, protocol) {
+    const scope = entry.grant.scope;
+    if (!isMessagesReadScope(scope) || scope.protocol !== protocol) {
+        return undefined;
+    }
+    if (scope.protocolPath !== undefined) {
+        return { protocol, protocolPath: scope.protocolPath };
+    }
+    if (scope.contextId !== undefined) {
+        return { protocol, contextId: scope.contextId };
+    }
+}
+function isMessagesReadScope(scope) {
+    return scope.interface === 'Messages' &&
+        scope.method === 'Read';
+}
+function grantParticipatesInProtocolSet(entry, protocols) {
+    return protocols.some(protocol => grantMatchesProtocol(entry, protocol));
+}
+/** Converts permission grant entries into authorization epoch inputs. */
+export function toSyncAuthorizationGrants(permissionGrants) {
+    if (permissionGrants.length === 0) {
+        throw new Error('SyncPermissions: delegate authorization requires at least one grant.');
+    }
+    return permissionGrants
+        .map(({ grant }) => ({
+        dateExpires: grant.dateExpires,
+        dateGranted: grant.dateGranted,
+        id: grant.id,
+    }))
+        .sort((a, b) => lexicographicalCompare(a.id, b.id));
+}
+function isActiveMessagesGrant(entry, grantor, grantee, now) {
+    const { grant } = entry;
+    if (grant.grantor !== grantor || grant.grantee !== grantee) {
+        return false;
+    }
+    if (grant.dateGranted > now || grant.dateExpires <= now) {
+        return false;
+    }
+    const scope = grant.scope;
+    return scope.interface === 'Messages' &&
+        scope.method === 'Read';
+}
+function grantMatchesProtocol(entry, protocol) {
+    return PermissionScopeMatcher.matches(entry.grant.scope, { protocol });
+}
+/** Returns sorted grant IDs from permission grant entries. */
+export function permissionGrantIdsFromEntries(permissionGrants) {
+    return toMessagesPermissionGrantIds(permissionGrants.map(entry => entry.grant.id));
+}
+/**
+ * Returns the permission grant IDs invoked by a message.
+ *
+ * Real DWN messages use the author signature payload as the source of truth.
+ */
+export function getInvokedPermissionGrantIds(message) {
+    if (message.authorization === undefined) {
+        return [];
+    }
+    try {
+        const signaturePayload = Jws.decodePlainObjectPayload(message.authorization.signature);
+        return Message.getPermissionGrantIds(signaturePayload);
+    }
+    catch (_a) {
+        return [];
+    }
+}
+//# sourceMappingURL=sync-permission-grants.js.map

package/dist/esm/sync-permission-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-permission-grants.js","sourceRoot":"","sources":["../../src/sync-permission-grants.ts"],"names":[],"mappings":";;;;;;;;;AAKA,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EAAE,sBAAsB,EAAE,oCAAoC,EAAE,MAAM,iBAAiB,CAAC;AAO/F,wFAAwF;AACxF,MAAM,UAAU,4BAA4B,CAAC,kBAAwC;IACnF,IAAI,kBAAkB,KAAK,SAAS,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAwB,CAAC;AAC9F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAgB,mCAAmC;yDAAC,EACxD,GAAG,EACH,WAAW,EACX,SAAS,EACT,WAAW,EACX,cAAc,GAOf;QACC,MAAM,cAAc,GAAc,SAAS,KAAK,SAAS;YACvD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;YAClB,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC;YAClD,GAAG;YACH,WAAW;YACX,cAAc;YACd,WAAW;YACX,cAAc;SACf,CAAC,CAAC;QACH,OAAO,WAAW;aACf,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC;aAClD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAgB,yBAAyB;yDAAC,EAC9C,GAAG,EACH,WAAW,EACX,cAAc,EACd,WAAW,EACX,cAAc,GAOf;QACC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAAC,WAAW,CAAC;YACzD,MAAM,EAAI,WAAW;YACrB,MAAM,EAAI,WAAW;YACrB,OAAO,EAAG,GAAG;YACb,OAAO,EAAG,WAAW;SACtB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QAEzE,IAAI,cAAc,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACnC,OAAO,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,cAAc,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC1C,OAAO,uBAAuB,CAAC,gBAAgB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QAChF,CAAC;QAED,OAAO,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;IACxF,CAAC;CAAA;AAED,SAAS,gBAAgB,CACvB,gBAAwC,EACxC,cAAoD,EACpD,WAAyB;IAEzB,MAAM,MAAM,GAAG,gBAAgB;SAC5B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;SACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iEAAiE,WAAW,iBAAiB,CAAC,CAAC;IACjH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,uBAAuB,CAC9B,gBAAwC,EACxC,cAA2D,EAC3D,WAAyB;IAEzB,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,YAAY,GAA6B,EAAE,CAAC;IAElD,KAAK,MAAM,QAAQ,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;QAChD,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC1E,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,MAAM,oBAAoB,GAAG,gBAAgB;aAC1C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,+BAA+B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;aAC9D,MAAM,CAAC,CAAC,KAAK,EAAmC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QAC3E,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,iEAAiE,WAAW,KAAK,QAAQ,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO;QACL,GAAG,uBAAuB,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAC5D,GAAG,2BAA2B,CAAC,gBAAgB,EAAE,YAAY,EAAE,WAAW,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,gBAAwC,EACxC,cAAiE,EACjE,WAAyB;IAEzB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,wBAAwB,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,iEAAiE,WAAW,2BAA2B,CAAC,CAAC;IAC3H,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB;SAC5B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;SAC9G,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAElE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,wBAAwB,CAC/B,gBAAwC,EACxC,KAA6B;IAE7B,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,uBAAuB,CAC9B,gBAAwC,EACxC,cAAwB;IAExB,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAwB,CAAC;IACnG,MAAM,MAAM,GAAG,gBAAgB;SAC5B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,8BAA8B,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;SACjE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAElE,OAAO,CAAC;YACN,KAAK,EAAE;gBACL,IAAI,EAAE,aAAa;gBACnB,SAAS;aACV;YACD,gBAAgB,EAAE,MAAM;SACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,2BAA2B,CAClC,gBAAwC,EACxC,gBAA0C,EAC1C,WAAyB;IAEzB,MAAM,CAAC,UAAU,EAAE,GAAG,eAAe,CAAC,GAAG,gBAAgB,CAAC;IAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,cAAc,GAAG,oCAAoC,CAAC,CAAC,UAAU,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;IAC9F,OAAO,CAAC,6BAA6B,CAAC,gBAAgB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,+BAA+B,CACtC,KAA2B,EAC3B,QAAgB;IAEhB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;IAChC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAA6C;IACxE,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU;QACnC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;AAC5B,CAAC;AAED,SAAS,8BAA8B,CACrC,KAA2B,EAC3B,SAA8B;IAE9B,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,yBAAyB,CAAC,gBAAwC;IAChF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,gBAAgB;SACpB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACnB,WAAW,EAAG,KAAK,CAAC,WAAW;QAC/B,WAAW,EAAG,KAAK,CAAC,WAAW;QAC/B,EAAE,EAAY,KAAK,CAAC,EAAE;KACvB,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAA0D,CAAC;AACjH,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAA2B,EAC3B,OAAe,EACf,OAAe,EACf,GAAW;IAEX,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACxB,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,GAAG,GAAG,IAAI,KAAK,CAAC,WAAW,IAAI,GAAG,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,OAAO,KAAK,CAAC,SAAS,KAAK,UAAU;QACnC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA2B,EAC3B,QAA4B;IAE5B,OAAO,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,6BAA6B,CAAC,gBAAwC;IACpF,OAAO,4BAA4B,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAuB;IAClE,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,GAAG,CAAC,wBAAwB,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAA4B,CAAC;QAClH,OAAO,OAAO,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/esm/sync-replication-ledger.js

@@ -14,7 +14,7 @@ var __asyncValues = (this && this.__asyncValues) || function (o) {
     function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
     function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
 };
-import { computeScopeId } from './types/sync.js';
+import { canonicalizeSyncScope, computeProjectionId } from './types/sync.js';
 /** Separator used in compound LevelDB keys. */
 const KEY_SEP = '^';
 /**
@@ -22,7 +22,7 @@ const KEY_SEP = '^';
  * sync link in a LevelDB sublevel. Provides CRUD operations and replication
  * checkpoint helpers.
  *
- * Key format: `{tenantDid}^{remoteEndpoint}^{scopeId}`
+ * Key format: `{tenantDid}^{remoteEndpoint}^{projectionId}^{authorizationEpoch}`
  *
  * Each link tracks independent pull and push {@link DirectionCheckpoint}s.
  * The ledger does not own subscriptions or timers — it is a passive state
@@ -37,12 +37,13 @@ export class ReplicationLedger {
     // Key helpers
     // ---------------------------------------------------------------------------
     /** Build the compound key for a link. */
-    static buildKey(tenantDid, remoteEndpoint, scopeId) {
-        return `${tenantDid}${KEY_SEP}${remoteEndpoint}${KEY_SEP}${scopeId}`;
+    static buildKey(tenantDid, remoteEndpoint, projectionId, authorizationEpoch) {
+        return `${tenantDid}${KEY_SEP}${remoteEndpoint}${KEY_SEP}${projectionId}${KEY_SEP}${authorizationEpoch}`;
     }
     // Note: compound keys use raw '^' separator. This is safe because tenantDid
-    // (DID URI), remoteEndpoint (URL), and scopeId (base64url hash) cannot
-    // contain '^'. If future fields can contain '^', keys must be escaped.
+    // (DID URI), remoteEndpoint (URL), projectionId (base64url hash), and
+    // authorizationEpoch (base64url hash) cannot contain '^'. If future fields
+    // can contain '^', keys must be escaped.
     // ---------------------------------------------------------------------------
     // CRUD
     // ---------------------------------------------------------------------------
@@ -52,12 +53,12 @@ export class ReplicationLedger {
      */
     getOrCreateLink(params) {
         return __awaiter(this, void 0, void 0, function* () {
-            const scopeId = yield computeScopeId(params.scope);
-            const key = ReplicationLedger.buildKey(params.tenantDid, params.remoteEndpoint, scopeId);
+            const scope = canonicalizeSyncScope(params.scope);
+            const projectionId = yield computeProjectionId(params.tenantDid, scope);
+            const key = ReplicationLedger.buildKey(params.tenantDid, params.remoteEndpoint, projectionId, params.authorizationEpoch);
             try {
                 const raw = yield this.sublevel.get(key);
                 const link = JSON.parse(raw);
-                delete link.push; // strip legacy push field from old persisted links
                 // connectivity is runtime state — always reset to 'unknown' on load
                 // so stale 'online' from a previous session doesn't give false positives.
                 link.connectivity = 'unknown';
@@ -73,14 +74,15 @@ export class ReplicationLedger {
             const link = {
                 tenantDid: params.tenantDid,
                 remoteEndpoint: params.remoteEndpoint,
-                scopeId,
-                scope: params.scope,
+                projectionId,
+                authorizationEpoch: params.authorizationEpoch,
+                scope,
+                authorization: params.authorization,
                 status: 'initializing',
                 connectivity: 'unknown',
                 pull: {},
                 needsReconcile: false,
                 delegateDid: params.delegateDid,
-                protocol: params.protocol,
             };
             yield this.sublevel.put(key, JSON.stringify(link));
             return link;
@@ -89,15 +91,15 @@ export class ReplicationLedger {
     /** Persist the current state of a link. */
     saveLink(link) {
         return __awaiter(this, void 0, void 0, function* () {
-            const key = ReplicationLedger.buildKey(link.tenantDid, link.remoteEndpoint, link.scopeId);
+            const key = ReplicationLedger.buildKey(link.tenantDid, link.remoteEndpoint, link.projectionId, link.authorizationEpoch);
             link.lastActivityAt = new Date().toISOString();
             yield this.sublevel.put(key, JSON.stringify(link));
         });
     }
     /** Delete a link. */
-    deleteLink(tenantDid, remoteEndpoint, scopeId) {
+    deleteLink(tenantDid, remoteEndpoint, projectionId, authorizationEpoch) {
         return __awaiter(this, void 0, void 0, function* () {
-            const key = ReplicationLedger.buildKey(tenantDid, remoteEndpoint, scopeId);
+            const key = ReplicationLedger.buildKey(tenantDid, remoteEndpoint, projectionId, authorizationEpoch);
             yield this.sublevel.del(key);
         });
     }
@@ -151,31 +153,6 @@ export class ReplicationLedger {
         });
     }
     // ---------------------------------------------------------------------------
-    // Delegate updates
-    // ---------------------------------------------------------------------------
-    /**
-     * Update the `delegateDid` on all persisted links for a tenant and persist.
-     * This ensures that repair and reconcile paths — which read `delegateDid`
-     * from the durable {@link ReplicationLinkState} — use the current delegate
-     * after a hot-swap via `updateIdentityOptions()`.
-     *
-     * @returns the links that were updated.
-     */
-    updateDelegateDid(tenantDid, delegateDid) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const links = yield this.getLinksForTenant(tenantDid);
-            const updated = [];
-            for (const link of links) {
-                if (link.delegateDid !== delegateDid) {
-                    link.delegateDid = delegateDid;
-                    yield this.saveLink(link);
-                    updated.push(link);
-                }
-            }
-            return updated;
-        });
-    }
-    // ---------------------------------------------------------------------------
     // Status transitions
     // ---------------------------------------------------------------------------
     /** Transition a link to a new status and persist. */
@@ -232,6 +209,12 @@ export class ReplicationLedger {
      * are durably committed before calling this.
      */
     static commitContiguousToken(checkpoint, token) {
+        if (checkpoint.contiguousAppliedToken !== undefined &&
+            token.streamId === checkpoint.contiguousAppliedToken.streamId &&
+            token.epoch === checkpoint.contiguousAppliedToken.epoch &&
+            ReplicationLedger.comparePosition(token, checkpoint.contiguousAppliedToken) <= 0) {
+            return;
+        }
         checkpoint.contiguousAppliedToken = token;
     }
     /**

package/dist/esm/sync-replication-ledger.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync-replication-ledger.js","sourceRoot":"","sources":["../../src/sync-replication-ledger.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAKA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,+CAA+C;AAC/C,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IAI5B,YAAY,EAA+C;QACzD,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACvD,CAAC;IAED,8EAA8E;IAC9E,cAAc;IACd,8EAA8E;IAE9E,yCAAyC;IACjC,MAAM,CAAC,QAAQ,CAAC,SAAiB,EAAE,cAAsB,EAAE,OAAe;QAChF,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,cAAc,GAAG,OAAO,GAAG,OAAO,EAAE,CAAC;IACvE,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,uEAAuE;IAEvE,8EAA8E;IAC9E,OAAO;IACP,8EAA8E;IAE9E;;;OAGG;IACU,eAAe,CAAC,MAM5B;;YACC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YAEzF,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;gBACrD,OAAQ,IAAY,CAAC,IAAI,CAAC,CAAC,mDAAmD;gBAC9E,oEAAoE;gBACpE,0EAA0E;gBAC1E,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;gBAC9B,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,KAAyB,CAAC;gBACpC,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACjC,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YAED,4CAA4C;YAC5C,MAAM,IAAI,GAAyB;gBACjC,SAAS,EAAQ,MAAM,CAAC,SAAS;gBACjC,cAAc,EAAG,MAAM,CAAC,cAAc;gBACtC,OAAO;gBACP,KAAK,EAAY,MAAM,CAAC,KAAK;gBAC7B,MAAM,EAAW,cAAc;gBAC/B,YAAY,EAAK,SAAS;gBAC1B,IAAI,EAAa,EAAE;gBACnB,cAAc,EAAG,KAAK;gBACtB,WAAW,EAAM,MAAM,CAAC,WAAW;gBACnC,QAAQ,EAAS,MAAM,CAAC,QAAQ;aACjC,CAAC;YAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;IAED,2CAA2C;IAC9B,QAAQ,CAAC,IAA0B;;YAC9C,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1F,IAAI,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,CAAC;KAAA;IAED,qBAAqB;IACR,UAAU,CAAC,SAAiB,EAAE,cAAsB,EAAE,OAAe;;YAChF,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;YAC3E,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;KAAA;IAED,mCAAmC;IACtB,iBAAiB,CAAC,SAAiB;;;YAC9C,MAAM,MAAM,GAAG,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;YACxC,MAAM,KAAK,GAA2B,EAAE,CAAC;;gBACzC,KAAiC,eAAA,KAAA,cAAA,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA,IAAA,sDAAE,CAAC;oBAA3B,cAAwB;oBAAxB,WAAwB;oBAA9C,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,KAAA,CAAA;oBAC3B,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAyB,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;;;;;;;;;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;IAED,sBAAsB;IACT,WAAW;;;YACtB,MAAM,KAAK,GAA2B,EAAE,CAAC;;gBACzC,KAA8B,eAAA,KAAA,cAAA,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA,IAAA,sDAAE,CAAC;oBAA3B,cAAwB;oBAAxB,WAAwB;oBAA3C,MAAM,CAAC,EAAE,KAAK,CAAC,KAAA,CAAA;oBACxB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAyB,CAAC,CAAC;gBACxD,CAAC;;;;;;;;;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAE9E;;;;;;;OAOG;IACU,iBAAiB,CAAC,SAAiB,EAAE,WAA+B;;YAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;oBACrC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;oBAC/B,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAC1B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KAAA;IAED,8EAA8E;IAC9E,qBAAqB;IACrB,8EAA8E;IAE9E,qDAAqD;IACxC,SAAS,CAAC,IAA0B,EAAE,MAAkB;;YACnE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;KAAA;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAE9E;;;;OAIG;IACI,MAAM,CAAC,eAAe,CAAC,CAAgB,EAAE,CAAgB;QAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC,CAAC;QAAC,CAAC;QACpC,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,mBAAmB,CAAC,UAA+B,EAAE,KAAoB;QACrF,IAAI,UAAU,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACrE,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,sBAAsB,CAAC,QAAQ;YAC7D,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC,sBAAsB,CAAC,KAAK,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,gBAAgB,CAAC,UAA+B,EAAE,KAAoB;QAClF,IACE,UAAU,CAAC,aAAa,KAAK,SAAS;YACtC,iBAAiB,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,EACtE,CAAC;YACD,UAAU,CAAC,aAAa,GAAG,KAAK,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,qBAAqB,CAAC,UAA+B,EAAE,KAAoB;QACvF,UAAU,CAAC,sBAAsB,GAAG,KAAK,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,eAAe,CAAC,UAA+B,EAAE,KAAqB;QAClF,UAAU,CAAC,sBAAsB,GAAG,KAAK,CAAC;QAC1C,UAAU,CAAC,aAAa,GAAG,KAAK,CAAC;IACnC,CAAC;IAED,8EAA8E;IAC9E,yBAAyB;IACzB,8EAA8E;IAE9E;;;OAGG;IACU,kBAAkB,CAAC,IAA0B,EAAE,OAAgB;;YAC1E,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC3B,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KAAA;IAED;;OAEG;IACU,mBAAmB,CAAC,IAA0B;;YACzD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;gBAC5B,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KAAA;CACF"}
+{"version":3,"file":"sync-replication-ledger.js","sourceRoot":"","sources":["../../src/sync-replication-ledger.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAKA,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE7E,+CAA+C;AAC/C,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IAI5B,YAAY,EAA+C;QACzD,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACvD,CAAC;IAED,8EAA8E;IAC9E,cAAc;IACd,8EAA8E;IAE9E,yCAAyC;IACjC,MAAM,CAAC,QAAQ,CACrB,SAAiB,EACjB,cAAsB,EACtB,YAAoB,EACpB,kBAA0B;QAE1B,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,cAAc,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,GAAG,kBAAkB,EAAE,CAAC;IAC3G,CAAC;IAED,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,yCAAyC;IAEzC,8EAA8E;IAC9E,OAAO;IACP,8EAA8E;IAE9E;;;OAGG;IACU,eAAe,CAAC,MAO5B;;YACC,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CACpC,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,cAAc,EACrB,YAAY,EACZ,MAAM,CAAC,kBAAkB,CAC1B,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;gBACrD,oEAAoE;gBACpE,0EAA0E;gBAC1E,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;gBAC9B,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,KAAyB,CAAC;gBACpC,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBACjC,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YAED,4CAA4C;YAC5C,MAAM,IAAI,GAAyB;gBACjC,SAAS,EAAY,MAAM,CAAC,SAAS;gBACrC,cAAc,EAAO,MAAM,CAAC,cAAc;gBAC1C,YAAY;gBACZ,kBAAkB,EAAG,MAAM,CAAC,kBAAkB;gBAC9C,KAAK;gBACL,aAAa,EAAQ,MAAM,CAAC,aAAa;gBACzC,MAAM,EAAe,cAAc;gBACnC,YAAY,EAAS,SAAS;gBAC9B,IAAI,EAAiB,EAAE;gBACvB,cAAc,EAAO,KAAK;gBAC1B,WAAW,EAAU,MAAM,CAAC,WAAW;aACxC,CAAC;YAEF,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;IAED,2CAA2C;IAC9B,QAAQ,CAAC,IAA0B;;YAC9C,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CACpC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,kBAAkB,CACxB,CAAC;YACF,IAAI,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,CAAC;KAAA;IAED,qBAAqB;IACR,UAAU,CACrB,SAAiB,EACjB,cAAsB,EACtB,YAAoB,EACpB,kBAA0B;;YAE1B,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;YACpG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;KAAA;IAED,mCAAmC;IACtB,iBAAiB,CAAC,SAAiB;;;YAC9C,MAAM,MAAM,GAAG,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;YACxC,MAAM,KAAK,GAA2B,EAAE,CAAC;;gBACzC,KAAiC,eAAA,KAAA,cAAA,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA,IAAA,sDAAE,CAAC;oBAA3B,cAAwB;oBAAxB,WAAwB;oBAA9C,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,KAAA,CAAA;oBAC3B,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAyB,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;;;;;;;;;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;IAED,sBAAsB;IACT,WAAW;;;YACtB,MAAM,KAAK,GAA2B,EAAE,CAAC;;gBACzC,KAA8B,eAAA,KAAA,cAAA,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAA,IAAA,sDAAE,CAAC;oBAA3B,cAAwB;oBAAxB,WAAwB;oBAA3C,MAAM,CAAC,EAAE,KAAK,CAAC,KAAA,CAAA;oBACxB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAyB,CAAC,CAAC;gBACxD,CAAC;;;;;;;;;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;IAED,8EAA8E;IAC9E,qBAAqB;IACrB,8EAA8E;IAE9E,qDAAqD;IACxC,SAAS,CAAC,IAA0B,EAAE,MAAkB;;YACnE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;KAAA;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,8EAA8E;IAE9E;;;;OAIG;IACI,MAAM,CAAC,eAAe,CAAC,CAAgB,EAAE,CAAgB;QAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC,CAAC;QAAC,CAAC;QACpC,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,mBAAmB,CAAC,UAA+B,EAAE,KAAoB;QACrF,IAAI,UAAU,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACrE,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,sBAAsB,CAAC,QAAQ;YAC7D,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC,sBAAsB,CAAC,KAAK,CAAC;IACjE,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,gBAAgB,CAAC,UAA+B,EAAE,KAAoB;QAClF,IACE,UAAU,CAAC,aAAa,KAAK,SAAS;YACtC,iBAAiB,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,EACtE,CAAC;YACD,UAAU,CAAC,aAAa,GAAG,KAAK,CAAC;QACnC,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,qBAAqB,CAAC,UAA+B,EAAE,KAAoB;QACvF,IACE,UAAU,CAAC,sBAAsB,KAAK,SAAS;YAC/C,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,sBAAsB,CAAC,QAAQ;YAC7D,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC,sBAAsB,CAAC,KAAK;YACvD,iBAAiB,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAChF,CAAC;YACD,OAAO;QACT,CAAC;QACD,UAAU,CAAC,sBAAsB,GAAG,KAAK,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,eAAe,CAAC,UAA+B,EAAE,KAAqB;QAClF,UAAU,CAAC,sBAAsB,GAAG,KAAK,CAAC;QAC1C,UAAU,CAAC,aAAa,GAAG,KAAK,CAAC;IACnC,CAAC;IAED,8EAA8E;IAC9E,yBAAyB;IACzB,8EAA8E;IAE9E;;;OAGG;IACU,kBAAkB,CAAC,IAA0B,EAAE,OAAgB;;YAC1E,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACzB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC3B,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KAAA;IAED;;OAEG;IACU,mBAAmB,CAAC,IAA0B;;YACzD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;gBAC5B,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KAAA;CACF"}

package/dist/esm/sync-scope-acceptance.js

@@ -0,0 +1,126 @@
+import { DwnInterfaceName, DwnMethodName, PermissionScopeMatcher, PermissionsProtocol } from '@enbox/dwn-sdk-js';
+/**
+ * Classifies whether a live event belongs to the link's current sync scope.
+ *
+ * Full links accept every message. Protocol-set links accept records for a
+ * covered protocol, ProtocolsConfigure messages that install a covered
+ * protocol, and permission records tagged for a covered protocol. RecordsDelete
+ * messages carry no protocol in their descriptor, so they must be classified
+ * from the event's initial write metadata.
+ */
+export function classifySyncEventScope(event, scope) {
+    return classifySyncMessageScope({
+        message: event.message,
+        initialWrite: event.initialWrite,
+        scope,
+    });
+}
+/**
+ * Classifies whether a DWN message belongs to a sync scope before local apply.
+ *
+ * If a RecordsDelete cannot be tied to its initial write, the result is
+ * `unknown` so callers fail closed instead of applying an unclassified delete.
+ */
+export function classifySyncMessageScope({ message, initialWrite, scope, }) {
+    if (scope.kind === 'full') {
+        return 'in-scope';
+    }
+    if (scope.kind === 'recordsProjection') {
+        return classifyRecordsProjectionScope(message, initialWrite, scope);
+    }
+    return classifyProtocolSetScope(message, initialWrite, scope);
+}
+function classifyProtocolSetScope(message, initialWrite, scope) {
+    const descriptor = message.descriptor;
+    const scopedDescriptor = getScopedMessageDescriptor(message, initialWrite);
+    if (scopedDescriptor === undefined) {
+        return 'unknown';
+    }
+    const permissionRecordClassification = classifyTaggedPermissionRecord(scopedDescriptor, scope.protocols);
+    if (permissionRecordClassification !== undefined) {
+        return permissionRecordClassification;
+    }
+    const protocolClassification = classifyProtocolField(scopedDescriptor.protocol, scope.protocols);
+    if (protocolClassification !== undefined) {
+        return protocolClassification;
+    }
+    return classifyProtocolsConfigureDescriptor(descriptor, scope.protocols);
+}
+function classifyTaggedPermissionRecord(descriptor, protocols) {
+    if (descriptor.protocol !== PermissionsProtocol.uri || !isRecordObject(descriptor.tags)) {
+        return undefined;
+    }
+    const taggedProtocol = descriptor.tags.protocol;
+    return typeof taggedProtocol === 'string' && protocols.includes(taggedProtocol)
+        ? 'in-scope'
+        : 'out-of-scope';
+}
+function classifyProtocolField(protocol, protocols) {
+    if (typeof protocol !== 'string') {
+        return undefined;
+    }
+    return protocols.includes(protocol) ? 'in-scope' : 'out-of-scope';
+}
+function classifyProtocolsConfigureDescriptor(descriptor, protocols) {
+    if (descriptor.interface === DwnInterfaceName.Protocols &&
+        descriptor.method === DwnMethodName.Configure &&
+        isRecordObject(descriptor.definition)) {
+        const definitionProtocol = descriptor.definition.protocol;
+        return typeof definitionProtocol === 'string' && protocols.includes(definitionProtocol)
+            ? 'in-scope'
+            : 'out-of-scope';
+    }
+    return 'out-of-scope';
+}
+function getScopedMessageDescriptor(message, initialWrite) {
+    const descriptor = message.descriptor;
+    if (descriptor.interface === DwnInterfaceName.Records &&
+        descriptor.method === DwnMethodName.Delete) {
+        return initialWrite === null || initialWrite === void 0 ? void 0 : initialWrite.descriptor;
+    }
+    return descriptor;
+}
+function classifyRecordsProjectionScope(message, initialWrite, scope) {
+    const target = getRecordsProjectionTarget(message, initialWrite);
+    if (target === undefined) {
+        return isRecordsDelete(message) ? 'unknown' : 'out-of-scope';
+    }
+    return scope.scopes.some(projectionScope => PermissionScopeMatcher.matches(projectionScope, target))
+        ? 'in-scope'
+        : 'out-of-scope';
+}
+function getRecordsProjectionTarget(message, initialWrite) {
+    const descriptor = message.descriptor;
+    if (descriptor.interface !== DwnInterfaceName.Records) {
+        return undefined;
+    }
+    if (descriptor.method === DwnMethodName.Write) {
+        return {
+            protocol: stringField(descriptor.protocol),
+            protocolPath: stringField(descriptor.protocolPath),
+            contextId: message.contextId,
+        };
+    }
+    if (descriptor.method === DwnMethodName.Delete) {
+        if (initialWrite === undefined) {
+            return undefined;
+        }
+        return {
+            protocol: initialWrite.descriptor.protocol,
+            protocolPath: initialWrite.descriptor.protocolPath,
+            contextId: initialWrite.contextId,
+        };
+    }
+}
+function isRecordsDelete(message) {
+    const descriptor = message.descriptor;
+    return descriptor.interface === DwnInterfaceName.Records &&
+        descriptor.method === DwnMethodName.Delete;
+}
+function isRecordObject(value) {
+    return typeof value === 'object' && value !== null;
+}
+function stringField(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+//# sourceMappingURL=sync-scope-acceptance.js.map

package/dist/esm/sync-scope-acceptance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-scope-acceptance.js","sourceRoot":"","sources":["../../src/sync-scope-acceptance.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAgBjH;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAmB,EAAE,KAAgB;IAC1E,OAAO,wBAAwB,CAAC;QAC9B,OAAO,EAAQ,KAAK,CAAC,OAAO;QAC5B,YAAY,EAAG,KAAK,CAAC,YAAY;QACjC,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,EACvC,OAAO,EACP,YAAY,EACZ,KAAK,GACgC;IACrC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAAC,OAAO,UAAU,CAAC;IAAC,CAAC;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACvC,OAAO,8BAA8B,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,wBAAwB,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAuB,EACvB,YAA6C,EAC7C,KAA2B;IAE3B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAqC,CAAC;IACjE,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC3E,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,8BAA8B,GAAG,8BAA8B,CAAC,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACzG,IAAI,8BAA8B,KAAK,SAAS,EAAE,CAAC;QAAC,OAAO,8BAA8B,CAAC;IAAC,CAAC;IAE5F,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACjG,IAAI,sBAAsB,KAAK,SAAS,EAAE,CAAC;QAAC,OAAO,sBAAsB,CAAC;IAAC,CAAC;IAE5E,OAAO,oCAAoC,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,8BAA8B,CACrC,UAAmC,EACnC,SAA4B;IAE5B,IAAI,UAAU,CAAC,QAAQ,KAAK,mBAAmB,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;IAChD,OAAO,OAAO,cAAc,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC7E,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,cAAc,CAAC;AACrB,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAiB,EAAE,SAA4B;IAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;AACpE,CAAC;AAED,SAAS,oCAAoC,CAC3C,UAAmC,EACnC,SAA4B;IAE5B,IACE,UAAU,CAAC,SAAS,KAAK,gBAAgB,CAAC,SAAS;QACnD,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,SAAS;QAC7C,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,EACrC,CAAC;QACD,MAAM,kBAAkB,GAAG,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC1D,OAAO,OAAO,kBAAkB,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACrF,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,cAAc,CAAC;IACrB,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAuB,EACvB,YAA6C;IAE7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAqC,CAAC;IACjE,IACE,UAAU,CAAC,SAAS,KAAK,gBAAgB,CAAC,OAAO;QACjD,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAC1C,CAAC;QACD,OAAO,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,UAAiD,CAAC;IACzE,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,8BAA8B,CACrC,OAAuB,EACvB,YAA6C,EAC7C,KAAiC;IAEjC,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC;IAC/D,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAClG,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,cAAc,CAAC;AACrB,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAuB,EACvB,YAA6C;IAE7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAqC,CAAC;IACjE,IAAI,UAAU,CAAC,SAAS,KAAK,gBAAgB,CAAC,OAAO,EAAE,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,KAAK,EAAE,CAAC;QAC9C,OAAO;YACL,QAAQ,EAAO,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC/C,YAAY,EAAG,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC;YACnD,SAAS,EAAO,OAA+B,CAAC,SAAS;SAC1D,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QAC/C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,QAAQ,EAAO,YAAY,CAAC,UAAU,CAAC,QAAQ;YAC/C,YAAY,EAAG,YAAY,CAAC,UAAU,CAAC,YAAY;YACnD,SAAS,EAAM,YAAY,CAAC,SAAS;SACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAuB;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAqC,CAAC;IACjE,OAAO,UAAU,CAAC,SAAS,KAAK,gBAAgB,CAAC,OAAO;QACtD,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}

package/dist/esm/sync-topological-sort.js

@@ -1,11 +1,44 @@
+import { getInvokedPermissionGrantIds } from './sync-permission-grants.js';
 import { DwnInterfaceName, DwnMethodName, PermissionsProtocol } from '@enbox/dwn-sdk-js';
+function isRecordsDescriptor(descriptor) {
+    return descriptor.interface === DwnInterfaceName.Records;
+}
+function isRecordsWriteDescriptor(descriptor) {
+    return descriptor.interface === DwnInterfaceName.Records && descriptor.method === DwnMethodName.Write;
+}
+function isRecordsDeleteDescriptor(descriptor) {
+    return descriptor.interface === DwnInterfaceName.Records && descriptor.method === DwnMethodName.Delete;
+}
+function isProtocolsConfigureDescriptor(descriptor) {
+    return descriptor.interface === DwnInterfaceName.Protocols && descriptor.method === DwnMethodName.Configure;
+}
+function getRecordId(message) {
+    return message.recordId;
+}
+function getProtocolDefinition(message) {
+    const { descriptor } = message;
+    return isProtocolsConfigureDescriptor(descriptor) ? descriptor.definition : undefined;
+}
+function getConfiguredProtocol(message) {
+    var _a;
+    const protocol = (_a = getProtocolDefinition(message)) === null || _a === void 0 ? void 0 : _a.protocol;
+    return typeof protocol === 'string' ? protocol : undefined;
+}
+function getComposedProtocolDependencies(message) {
+    var _a;
+    const uses = (_a = getProtocolDefinition(message)) === null || _a === void 0 ? void 0 : _a.uses;
+    if (!uses) {
+        return [];
+    }
+    return Object.values(uses).filter((protocol) => typeof protocol === 'string');
+}
 /**
  * Checks whether a message is an initial RecordsWrite (not an update).
  * An initial write has dateCreated === messageTimestamp (first write for this recordId).
  */
 function isInitialWrite(message) {
     const desc = message.descriptor;
-    if (desc.interface !== DwnInterfaceName.Records || desc.method !== DwnMethodName.Write) {
+    if (!isRecordsWriteDescriptor(desc)) {
         return false;
     }
     // A RecordsWrite is initial if dateCreated === messageTimestamp (first write for this recordId).
@@ -17,12 +50,12 @@ function isInitialWrite(message) {
  *
  * Dependencies:
  * - ProtocolsConfigure must come before any RecordsWrite using that protocol
+ * - Composed ProtocolsConfigure must come after ProtocolsConfigure messages for protocols in `uses`
  * - Parent record must come before child record (via parentId)
  * - Initial write must come before update writes (same recordId, not initial)
- * - Permission grant must come before records using that permissionGrantId
+ * - Permission grants must come before messages that invoke them
  */
 export function topologicalSort(messages) {
-    var _a;
     if (messages.length <= 1) {
         return messages;
     }
@@ -36,13 +69,13 @@ export function topologicalSort(messages) {
         byIndex.set(i, entry);
         const desc = entry.message.descriptor;
         if (desc.interface === DwnInterfaceName.Protocols && desc.method === DwnMethodName.Configure) {
-            const protocolUrl = (_a = desc.definition) === null || _a === void 0 ? void 0 : _a.protocol;
+            const protocolUrl = getConfiguredProtocol(entry.message);
             if (protocolUrl) {
                 protocolConfigureIndex.set(protocolUrl, i);
             }
         }
-        if (desc.interface === DwnInterfaceName.Records && desc.method === DwnMethodName.Write) {
-            const recordId = entry.message.recordId;
+        if (isRecordsWriteDescriptor(desc)) {
+            const recordId = getRecordId(entry.message);
             const initial = isInitialWrite(entry.message);
             if (initial && recordId) {
                 initialWriteIndex.set(recordId, i);
@@ -73,38 +106,47 @@ export function topologicalSort(messages) {
     };
     for (let i = 0; i < messages.length; i++) {
         const desc = messages[i].message.descriptor;
+        // Composition dependency: a composed protocol depends on its referenced protocol definitions.
+        if (isProtocolsConfigureDescriptor(desc)) {
+            for (const protocol of getComposedProtocolDependencies(messages[i].message)) {
+                if (protocolConfigureIndex.has(protocol)) {
+                    addEdge(protocolConfigureIndex.get(protocol), i);
+                }
+            }
+        }
         // Protocol dependency: RecordsWrite depends on ProtocolsConfigure for its protocol.
-        if (desc.interface === DwnInterfaceName.Records) {
+        if (isRecordsDescriptor(desc)) {
             const protocol = desc.protocol;
             if (protocol && protocolConfigureIndex.has(protocol)) {
                 addEdge(protocolConfigureIndex.get(protocol), i);
             }
         }
         // Parent dependency: child record depends on parent record.
-        if (desc.interface === DwnInterfaceName.Records && desc.parentId) {
+        if (isRecordsDescriptor(desc) && desc.parentId) {
             const parentId = desc.parentId;
             if (initialWriteIndex.has(parentId)) {
                 addEdge(initialWriteIndex.get(parentId), i);
             }
         }
         // Initial write dependency: update depends on initial write.
-        if (desc.interface === DwnInterfaceName.Records && desc.method === DwnMethodName.Write) {
-            const recordId = messages[i].message.recordId;
+        if (isRecordsWriteDescriptor(desc)) {
+            const recordId = getRecordId(messages[i].message);
             if (recordId && !isInitialWrite(messages[i].message) && initialWriteIndex.has(recordId)) {
                 addEdge(initialWriteIndex.get(recordId), i);
             }
         }
         // Delete depends on initial write.
-        if (desc.interface === DwnInterfaceName.Records && desc.method === DwnMethodName.Delete) {
+        if (isRecordsDeleteDescriptor(desc)) {
             const recordId = desc.recordId;
             if (recordId && initialWriteIndex.has(recordId)) {
                 addEdge(initialWriteIndex.get(recordId), i);
             }
         }
-        // Permission grant dependency: message depends on the grant it references.
-        const permissionGrantId = desc.permissionGrantId;
-        if (permissionGrantId && grantIndex.has(permissionGrantId)) {
-            addEdge(grantIndex.get(permissionGrantId), i);
+        // Permission grant dependency: message depends on each grant it references.
+        for (const permissionGrantId of getInvokedPermissionGrantIds(messages[i].message)) {
+            if (grantIndex.has(permissionGrantId)) {
+                addEdge(grantIndex.get(permissionGrantId), i);
+            }
         }
     }
     // Kahn's algorithm for topological sort.