@enbox/agent 0.7.7 → 0.7.9

package/dist/esm/sync-engine-level.js

@@ -17,20 +17,22 @@ var __asyncValues = (this && this.__asyncValues) || function (o) {
 import ms from 'ms';
 import { Level } from 'level';
 import { sleep } from '@enbox/common';
-import { Encoder, hashToHex, initDefaultHashes, Message } from '@enbox/dwn-sdk-js';
-import { evaluateClosure } from './sync-closure-resolver.js';
-import { MAX_PENDING_TOKENS } from './types/sync.js';
-import { ReplicationLedger } from './sync-replication-ledger.js';
-import { createClosureContext, invalidateClosureCache } from './sync-closure-types.js';
+import { authenticate, DwnInterfaceName, DwnMethodName, Encoder, hashToHex, initDefaultHashes, Message, ProtocolsConfigure, RECORDS_PROJECTION_ROOT_VERSION, RecordsProjection, RecordsWrite } from '@enbox/dwn-sdk-js';
 import { AgentPermissionsApi } from './permissions-api.js';
+import { buildLinkId } from './sync-link-id.js';
 import { DwnInterface } from './types/dwn.js';
+import { evaluateClosure } from './sync-closure-resolver.js';
 import { isRecordsWrite } from './utils.js';
-import { SyncLinkReconciler } from './sync-link-reconciler.js';
+import { ReplicationLedger } from './sync-replication-ledger.js';
 import { topologicalSort } from './sync-topological-sort.js';
-import { buildLegacyCursorKey, buildLinkId } from './sync-link-id.js';
-import { fetchRemoteMessages, pullMessages, pushMessages } from './sync-messages.js';
+import { classifySyncEventScope, classifySyncMessageScope } from './sync-scope-acceptance.js';
+import { ClosureFailureCode, createClosureContext, invalidateClosureCache, isTerminalClosureFailureCode } from './sync-closure-types.js';
+import { computeAuthorizationEpoch, computeProjectionId, lexicographicalCompare, MAX_PENDING_TOKENS, protocolsForSyncScope, singleProtocolForSyncScope, syncScopeFromProtocols } from './types/sync.js';
+import { fetchRemoteMessages, getMessageCid, pullMessages, pushMessages, SyncPullAbortedError } from './sync-messages.js';
+import { partitionRemoteEntries, SyncLinkReconciler } from './sync-link-reconciler.js';
+import { permissionGrantIdsFromEntries, resolveMessagesSyncScopes, toMessagesPermissionGrantIds, toSyncAuthorizationGrants } from './sync-permission-grants.js';
 /**
- * Maximum bit prefix depth for the per-node tree walk (legacy fallback).
+ * Maximum bit prefix depth for the per-node tree walk fallback.
  * At depth 16, each subtree covers ~1/65536 of the key space.
  */
 const MAX_DIFF_DEPTH = 16;
@@ -49,50 +51,29 @@ const BATCHED_DIFF_DEPTH = 8;
  * once the in-flight push completes.
  */
 const PUSH_DEBOUNCE_MS = 100;
-/**
- * Checks whether a message's protocolPath and contextId match the link's
- * subset scope prefixes. Returns true if the message is in scope.
- *
- * When the scope has no prefixes (or is kind:'full'), all messages match.
- * When protocolPathPrefixes or contextIdPrefixes are specified, the message
- * must match at least one prefix in each specified set.
- *
- * This is agent-side filtering for subset scopes. The underlying
- * MessagesSubscribe filter only supports protocol-level scoping today —
- * protocolPath/contextId prefix filtering at the EventLog level is a
- * follow-up (requires dwn-sdk-js MessagesFilter extension).
- */
-function isEventInScope(message, scope) {
-    if (scope.kind === 'full') {
-        return true;
-    }
-    if (!scope.protocolPathPrefixes && !scope.contextIdPrefixes) {
-        return true;
-    }
-    const desc = message.descriptor;
-    // Check protocolPath prefix.
-    if (scope.protocolPathPrefixes && scope.protocolPathPrefixes.length > 0) {
-        const protocolPath = desc.protocolPath;
-        if (!protocolPath) {
-            return false;
-        }
-        const matches = scope.protocolPathPrefixes.some(prefix => protocolPath === prefix || protocolPath.startsWith(prefix + '/'));
-        if (!matches) {
-            return false;
-        }
+var LinkSubscriptionOpenResult;
+(function (LinkSubscriptionOpenResult) {
+    LinkSubscriptionOpenResult["ReadyForLive"] = "readyForLive";
+    LinkSubscriptionOpenResult["Polling"] = "polling";
+    LinkSubscriptionOpenResult["Repairing"] = "repairing";
+})(LinkSubscriptionOpenResult || (LinkSubscriptionOpenResult = {}));
+var LinkInitializationStatus;
+(function (LinkInitializationStatus) {
+    LinkInitializationStatus["Active"] = "active";
+    LinkInitializationStatus["Failed"] = "failed";
+})(LinkInitializationStatus || (LinkInitializationStatus = {}));
+function syncEventScope(scope) {
+    if (scope === undefined) {
+        return {};
     }
-    // Check contextId prefix.
-    if (scope.contextIdPrefixes && scope.contextIdPrefixes.length > 0) {
-        const contextId = message.contextId;
-        if (!contextId) {
-            return false;
-        }
-        const matches = scope.contextIdPrefixes.some(prefix => contextId === prefix || contextId.startsWith(prefix + '/'));
-        if (!matches) {
-            return false;
-        }
+    const coveredProtocols = protocolsForSyncScope(scope);
+    if (coveredProtocols === undefined) {
+        return {};
     }
-    return true;
+    const protocols = [...coveredProtocols];
+    return protocols.length === 1
+        ? { protocol: protocols[0], protocols }
+        : { protocols };
 }
 export class SyncEngineLevel {
     /** Validate `SyncIdentityOptions` for `registerIdentity` and `updateIdentityOptions`. */
@@ -107,6 +88,54 @@ export class SyncEngineLevel {
             throw new Error('SyncEngineLevel: protocols must be \'all\' or a non-empty array of protocol URIs. An empty array is ambiguous.');
         }
     }
+    buildSyncTargetsForEndpoint(did, dwnUrl, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const requestedScope = syncScopeFromProtocols(options.protocols);
+            const resolutions = yield this.buildSyncTargetResolutions(did, requestedScope, options);
+            return resolutions.map(resolution => (Object.assign({ did,
+                dwnUrl }, resolution)));
+        });
+    }
+    buildSyncTargetResolutions(did, requestedScope, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { delegateDid } = options;
+            if (delegateDid === undefined) {
+                return [{
+                        scope: requestedScope,
+                        authorization: { kind: 'owner' },
+                        authorizationEpoch: yield computeAuthorizationEpoch({ kind: 'owner' }),
+                    }];
+            }
+            const resolvedScopes = yield resolveMessagesSyncScopes({
+                did,
+                delegateDid,
+                requestedScope,
+                messageType: DwnInterface.MessagesSync,
+                permissionsApi: this._permissionsApi,
+            });
+            return Promise.all(resolvedScopes.map((_a) => __awaiter(this, [_a], void 0, function* ({ scope, permissionGrants }) {
+                const permissionGrantIds = permissionGrantIdsFromEntries(permissionGrants);
+                if (permissionGrantIds === undefined) {
+                    throw new Error(`SyncEngineLevel: delegate ${delegateDid} has no active sync grants for ${did}.`);
+                }
+                return {
+                    scope,
+                    delegateDid,
+                    authorization: {
+                        kind: 'delegate',
+                        delegateDid,
+                        permissionGrantIds,
+                    },
+                    authorizationEpoch: yield computeAuthorizationEpoch({
+                        kind: 'delegate',
+                        delegateDid,
+                        grants: toSyncAuthorizationGrants(permissionGrants),
+                    }),
+                    permissionGrantIds,
+                };
+            })));
+        });
+    }
     constructor({ agent, dataPath, db }) {
         this._syncLock = false;
         /**
@@ -157,6 +186,8 @@ export class SyncEngineLevel {
          * tenant. Keyed by tenantDid to prevent cross-tenant cache pollution.
          */
         this._closureContexts = new Map();
+        /** Deduplicates concurrent live-sync repairs for the same tenant/protocol. */
+        this._protocolMetadataRepairs = new Map();
         /**
          * Monotonic generation counter for sync target cache invalidation.
          * Bumped on every invalidation (register/unregister/update/clear/close/stopSync).
@@ -300,7 +331,13 @@ export class SyncEngineLevel {
             this._syncTargetsCacheGeneration++;
             // If live sync is active, hot-add subscriptions for this identity.
             if (this._syncMode === 'live') {
-                yield this.addIdentityToLiveSync(did, options);
+                const currentIdentityKeys = yield this.addIdentityToLiveSync(did, options);
+                if (currentIdentityKeys.size > 0) {
+                    yield this.pruneSupersededDurableLinksForIdentity(did, currentIdentityKeys);
+                }
+            }
+            else {
+                yield this.tryPruneSupersededDurableLinksForRegisteredIdentity(did, options);
             }
         });
     }
@@ -318,6 +355,7 @@ export class SyncEngineLevel {
             yield registeredIdentities.del(did);
             this._syncTargetsCache = undefined;
             this._syncTargetsCacheGeneration++;
+            yield this.pruneSupersededDurableLinksForIdentity(did, new Set());
         });
     }
     getIdentityOptions(did) {
@@ -352,18 +390,18 @@ export class SyncEngineLevel {
             yield registeredIdentities.put(did, JSON.stringify(options));
             this._syncTargetsCache = undefined;
             this._syncTargetsCacheGeneration++;
-            // Always persist the new delegate to durable links, regardless of
-            // sync mode. If sync is stopped or polling, existing persisted links
-            // would otherwise keep the old delegateDid. When live sync starts
-            // later, initializeLinkTarget() loads the link from LevelDB without
-            // normalizing delegateDid, so repair/reconcile paths could use stale
-            // delegate data.
-            yield this.ledger.updateDelegateDid(did, options.delegateDid);
             // If live sync is active, tear down and rebuild subscriptions with
-            // the new options.
+            // the new options. Delegate/scope changes derive a new authorization
+            // epoch, so existing durable links are not mutated in place.
             if (this._syncMode === 'live' && this.hasActiveLinksForDid(did)) {
                 yield this.removeIdentityFromLiveSync(did);
-                yield this.addIdentityToLiveSync(did, options);
+                const currentIdentityKeys = yield this.addIdentityToLiveSync(did, options);
+                if (currentIdentityKeys.size > 0) {
+                    yield this.pruneSupersededDurableLinksForIdentity(did, currentIdentityKeys);
+                }
+            }
+            else {
+                yield this.tryPruneSupersededDurableLinksForRegisteredIdentity(did, options);
             }
         });
     }
@@ -394,16 +432,13 @@ export class SyncEngineLevel {
                 let groupsFailed = 0;
                 const results = yield Promise.allSettled([...byUrl.entries()].map((_a) => __awaiter(this, [_a], void 0, function* ([dwnUrl, targets]) {
                     for (const target of targets) {
-                        const { did, delegateDid, protocol } = target;
                         try {
-                            yield this.createLinkReconciler().reconcile({
-                                did, dwnUrl, delegateDid, protocol,
-                            }, { direction });
+                            yield this.reconcileProjectionTarget(target, { direction });
                         }
                         catch (error) {
                             // Skip remaining targets for this DWN endpoint.
                             groupsFailed++;
-                            console.error(`SyncEngineLevel: Error syncing ${did} with ${dwnUrl}`, error);
+                            console.error(`SyncEngineLevel: Error syncing ${target.did} with ${dwnUrl}`, error);
                             return;
                         }
                     }
@@ -502,7 +537,7 @@ export class SyncEngineLevel {
         });
     }
     // ---------------------------------------------------------------------------
-    // Poll-mode sync (legacy)
+    // Poll-mode sync
     // ---------------------------------------------------------------------------
     startPollSync(intervalMilliseconds) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -635,30 +670,75 @@ export class SyncEngineLevel {
      */
     transitionToRepairing(linkKey, link, options) {
         return __awaiter(this, void 0, void 0, function* () {
-            const prevStatus = link.status;
-            const prevConnectivity = link.connectivity;
-            link.connectivity = 'offline';
-            yield this.ledger.setStatus(link, 'repairing');
-            this.emitEvent({ type: 'link:status-change', tenantDid: link.tenantDid, remoteEndpoint: link.remoteEndpoint, protocol: link.protocol, from: prevStatus, to: 'repairing' });
-            if (prevConnectivity !== 'offline') {
-                this.emitEvent({ type: 'link:connectivity-change', tenantDid: link.tenantDid, remoteEndpoint: link.remoteEndpoint, protocol: link.protocol, from: prevConnectivity, to: 'offline' });
+            if (link.status === 'terminal_incomplete') {
+                return;
             }
+            yield this.setLinkOfflineStatus(link, 'repairing');
             if (options === null || options === void 0 ? void 0 : options.resumeToken) {
                 this._repairContext.set(linkKey, { resumeToken: options.resumeToken });
             }
             // Clear runtime ordinals immediately — stale state must not linger
             // across repair attempts.
-            const rt = this._linkRuntimes.get(linkKey);
-            if (rt) {
-                rt.inflight.clear();
-                rt.nextCommitOrdinal = rt.nextDeliveryOrdinal;
-            }
+            this.clearLinkRuntimeInflight(linkKey);
             // Kick off repair with retry scheduling on failure.
             void this.repairLink(linkKey).catch(() => {
                 this.scheduleRepairRetry(linkKey);
             });
         });
     }
+    transitionToTerminalIncomplete(linkKey, link) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (link.status === 'terminal_incomplete') {
+                return;
+            }
+            yield this.setLinkOfflineStatus(link, 'terminal_incomplete');
+            yield this.closeLinkSubscriptions(link);
+            this.clearLinkRuntimeInflight(linkKey);
+            const retryTimer = this._repairRetryTimers.get(linkKey);
+            if (retryTimer) {
+                clearTimeout(retryTimer);
+                this._repairRetryTimers.delete(linkKey);
+            }
+            const degradedTimer = this._degradedPollTimers.get(linkKey);
+            if (degradedTimer) {
+                clearInterval(degradedTimer);
+                this._degradedPollTimers.delete(linkKey);
+            }
+            const reconcileTimer = this._reconcileTimers.get(linkKey);
+            if (reconcileTimer) {
+                clearTimeout(reconcileTimer);
+                this._reconcileTimers.delete(linkKey);
+            }
+            const pushRuntime = this._pushRuntimes.get(linkKey);
+            if (pushRuntime === null || pushRuntime === void 0 ? void 0 : pushRuntime.timer) {
+                clearTimeout(pushRuntime.timer);
+            }
+            this._pushRuntimes.delete(linkKey);
+            this._repairAttempts.delete(linkKey);
+            this._repairContext.delete(linkKey);
+        });
+    }
+    setLinkOfflineStatus(link, status) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const prevStatus = link.status;
+            const prevConnectivity = link.connectivity;
+            link.connectivity = 'offline';
+            yield this.ledger.setStatus(link, status);
+            const eventScope = syncEventScope(link.scope);
+            this.emitEvent(Object.assign(Object.assign({ type: 'link:status-change', tenantDid: link.tenantDid, remoteEndpoint: link.remoteEndpoint }, eventScope), { from: prevStatus, to: status }));
+            if (prevConnectivity !== 'offline') {
+                this.emitEvent(Object.assign(Object.assign({ type: 'link:connectivity-change', tenantDid: link.tenantDid, remoteEndpoint: link.remoteEndpoint }, eventScope), { from: prevConnectivity, to: 'offline' }));
+            }
+        });
+    }
+    clearLinkRuntimeInflight(linkKey) {
+        const rt = this._linkRuntimes.get(linkKey);
+        if (!rt) {
+            return;
+        }
+        rt.inflight.clear();
+        rt.nextCommitOrdinal = rt.nextDeliveryOrdinal;
+    }
     /**
      * Schedule a retry for a failed repair. Uses exponential backoff.
      * No-op if the link is already in `degraded_poll` (timer loop owns retries)
@@ -748,8 +828,9 @@ export class SyncEngineLevel {
             // `_activeLinks` may contain a *different* link object for the same key.
             // The old repair closure must not mutate the replacement link's state.
             const isStaleLink = () => this._activeLinks.get(linkKey) !== link;
-            const { tenantDid: did, remoteEndpoint: dwnUrl, delegateDid, protocol } = link;
-            this.emitEvent({ type: 'repair:started', tenantDid: did, remoteEndpoint: dwnUrl, protocol, attempt: ((_a = this._repairAttempts.get(linkKey)) !== null && _a !== void 0 ? _a : 0) + 1 });
+            const { tenantDid: did, remoteEndpoint: dwnUrl, delegateDid, scope, authorization } = link;
+            const eventScope = syncEventScope(scope);
+            this.emitEvent(Object.assign(Object.assign({ type: 'repair:started', tenantDid: did, remoteEndpoint: dwnUrl }, eventScope), { attempt: ((_a = this._repairAttempts.get(linkKey)) !== null && _a !== void 0 ? _a : 0) + 1 }));
             const attempts = ((_b = this._repairAttempts.get(linkKey)) !== null && _b !== void 0 ? _b : 0) + 1;
             this._repairAttempts.set(linkKey, attempts);
             // Step 1: Close existing subscriptions FIRST to stop old events from
@@ -766,7 +847,13 @@ export class SyncEngineLevel {
             rt.nextCommitOrdinal = 0;
             try {
                 // Step 3: Run SMT reconciliation for this link.
-                const reconcileOutcome = yield this.createLinkReconciler(() => this._engineGeneration === generation && !isStaleLink()).reconcile({ did, dwnUrl, delegateDid, protocol });
+                const reconcileOutcome = yield this.reconcileProjectionTarget({
+                    did,
+                    dwnUrl,
+                    delegateDid,
+                    scope,
+                    authorization,
+                }, undefined, () => this._engineGeneration === generation && !isStaleLink());
                 if (reconcileOutcome.aborted) {
                     return;
                 }
@@ -794,7 +881,16 @@ export class SyncEngineLevel {
                 if (this._engineGeneration !== generation || isStaleLink()) {
                     return;
                 }
-                const target = { did, dwnUrl, delegateDid, protocol, linkKey };
+                const target = {
+                    did,
+                    dwnUrl,
+                    delegateDid,
+                    scope,
+                    authorization,
+                    authorizationEpoch: link.authorizationEpoch,
+                    permissionGrantIds: this.getAuthorizationGrantIds(authorization),
+                    linkKey,
+                };
                 try {
                     yield this.openLivePullSubscription(target);
                 }
@@ -847,16 +943,15 @@ export class SyncEngineLevel {
                 const prevRepairConnectivity = link.connectivity;
                 link.connectivity = 'online';
                 yield this.ledger.setStatus(link, 'live');
-                // Auto-clear dead letters for this link — repair has verified
-                // convergence via SMT reconciliation so any previously recorded
-                // failures (closure, push-exhausted, pull-processing) for this
-                // specific link are no longer current.
-                void this.clearDeadLettersForLink(did, dwnUrl, protocol);
-                this.emitEvent({ type: 'repair:completed', tenantDid: did, remoteEndpoint: dwnUrl, protocol });
+                // Root convergence proves primary CID membership matches, but it does
+                // not prove dependencies are usable. Keep closure failures until a later
+                // successful apply/closure pass clears the specific CID.
+                yield this.clearRootConvergenceDeadLettersForScope(did, dwnUrl, scope);
+                this.emitEvent(Object.assign({ type: 'repair:completed', tenantDid: did, remoteEndpoint: dwnUrl }, eventScope));
                 if (prevRepairConnectivity !== 'online') {
-                    this.emitEvent({ type: 'link:connectivity-change', tenantDid: did, remoteEndpoint: dwnUrl, protocol, from: prevRepairConnectivity, to: 'online' });
+                    this.emitEvent(Object.assign(Object.assign({ type: 'link:connectivity-change', tenantDid: did, remoteEndpoint: dwnUrl }, eventScope), { from: prevRepairConnectivity, to: 'online' }));
                 }
-                this.emitEvent({ type: 'link:status-change', tenantDid: did, remoteEndpoint: dwnUrl, protocol, from: 'repairing', to: 'live' });
+                this.emitEvent(Object.assign(Object.assign({ type: 'link:status-change', tenantDid: did, remoteEndpoint: dwnUrl }, eventScope), { from: 'repairing', to: 'live' }));
             }
             catch (error) {
                 // If teardown occurred during repair or the link was replaced by a
@@ -865,7 +960,7 @@ export class SyncEngineLevel {
                     return;
                 }
                 console.error(`SyncEngineLevel: Repair failed for ${did} -> ${dwnUrl} (attempt ${attempts})`, error);
-                this.emitEvent({ type: 'repair:failed', tenantDid: did, remoteEndpoint: dwnUrl, protocol, attempt: attempts, error: String((_d = error.message) !== null && _d !== void 0 ? _d : error) });
+                this.emitEvent(Object.assign(Object.assign({ type: 'repair:failed', tenantDid: did, remoteEndpoint: dwnUrl }, eventScope), { attempt: attempts, error: String((_d = error.message) !== null && _d !== void 0 ? _d : error) }));
                 if (attempts >= SyncEngineLevel.MAX_REPAIR_ATTEMPTS) {
                     console.warn(`SyncEngineLevel: Max repair attempts reached for ${did} -> ${dwnUrl}, entering degraded_poll`);
                     yield this.enterDegradedPoll(linkKey);
@@ -882,25 +977,35 @@ export class SyncEngineLevel {
     closeLinkSubscriptions(link) {
         return __awaiter(this, void 0, void 0, function* () {
             const { tenantDid: did, remoteEndpoint: dwnUrl } = link;
-            const linkKey = this.buildLinkKey(did, dwnUrl, link.scopeId);
-            // Close pull subscription.
+            const linkKey = this.buildLinkKey(did, dwnUrl, link.projectionId, link.authorizationEpoch);
+            yield this.closeLiveSubscription(linkKey);
+            yield this.closeLocalSubscription(linkKey);
+        });
+    }
+    closeLiveSubscription(linkKey) {
+        return __awaiter(this, void 0, void 0, function* () {
             const pullSub = this._liveSubscriptions.find((s) => s.linkKey === linkKey);
-            if (pullSub) {
-                try {
-                    yield pullSub.close();
-                }
-                catch ( /* best effort */_a) { /* best effort */ }
-                this._liveSubscriptions = this._liveSubscriptions.filter(s => s !== pullSub);
+            if (!pullSub) {
+                return;
+            }
+            try {
+                yield pullSub.close();
             }
-            // Close local push subscription.
+            catch ( /* best effort */_a) { /* best effort */ }
+            this._liveSubscriptions = this._liveSubscriptions.filter(s => s !== pullSub);
+        });
+    }
+    closeLocalSubscription(linkKey) {
+        return __awaiter(this, void 0, void 0, function* () {
             const pushSub = this._localSubscriptions.find((s) => s.linkKey === linkKey);
-            if (pushSub) {
-                try {
-                    yield pushSub.close();
-                }
-                catch ( /* best effort */_b) { /* best effort */ }
-                this._localSubscriptions = this._localSubscriptions.filter(s => s !== pushSub);
+            if (!pushSub) {
+                return;
+            }
+            try {
+                yield pushSub.close();
             }
+            catch ( /* best effort */_a) { /* best effort */ }
+            this._localSubscriptions = this._localSubscriptions.filter(s => s !== pushSub);
         });
     }
     /**
@@ -918,8 +1023,9 @@ export class SyncEngineLevel {
             const prevDegradedStatus = link.status;
             yield this.ledger.setStatus(link, 'degraded_poll');
             this._repairAttempts.delete(linkKey);
-            this.emitEvent({ type: 'link:status-change', tenantDid: link.tenantDid, remoteEndpoint: link.remoteEndpoint, protocol: link.protocol, from: prevDegradedStatus, to: 'degraded_poll' });
-            this.emitEvent({ type: 'degraded-poll:entered', tenantDid: link.tenantDid, remoteEndpoint: link.remoteEndpoint, protocol: link.protocol });
+            const eventScope = syncEventScope(link.scope);
+            this.emitEvent(Object.assign(Object.assign({ type: 'link:status-change', tenantDid: link.tenantDid, remoteEndpoint: link.remoteEndpoint }, eventScope), { from: prevDegradedStatus, to: 'degraded_poll' }));
+            this.emitEvent(Object.assign({ type: 'degraded-poll:entered', tenantDid: link.tenantDid, remoteEndpoint: link.remoteEndpoint }, eventScope));
             // Clear any existing timer for this link.
             const existing = this._degradedPollTimers.get(linkKey);
             if (existing) {
@@ -1025,14 +1131,7 @@ export class SyncEngineLevel {
                 const prev = link.connectivity;
                 if (prev !== 'offline') {
                     link.connectivity = 'offline';
-                    this.emitEvent({
-                        type: 'link:connectivity-change',
-                        tenantDid: link.tenantDid,
-                        remoteEndpoint: link.remoteEndpoint,
-                        protocol: link.protocol,
-                        from: prev,
-                        to: 'offline',
-                    });
+                    this.emitEvent(Object.assign(Object.assign({ type: 'link:connectivity-change', tenantDid: link.tenantDid, remoteEndpoint: link.remoteEndpoint }, syncEventScope(link.scope)), { from: prev, to: 'offline' }));
                 }
             }
         };
@@ -1132,6 +1231,7 @@ export class SyncEngineLevel {
             this._reconcileInFlight.clear();
             // Clear closure evaluation contexts.
             this._closureContexts.clear();
+            this._protocolMetadataRepairs.clear();
             this._recentlyPulledCids.clear();
             // Clear the in-memory link and runtime state.
             this._activeLinks.clear();
@@ -1143,78 +1243,123 @@ export class SyncEngineLevel {
     // ---------------------------------------------------------------------------
     /**
      * Initialize a single replication link target: create or resume the durable
-     * link, migrate legacy cursors, open pull + push subscriptions, and
-     * transition the link to `'live'`.
+     * link, open pull + push subscriptions, and transition the link to `'live'`.
      */
     initializeLinkTarget(target) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a;
             let link;
             try {
-                const linkScope = target.protocol
-                    ? { kind: 'protocol', protocol: target.protocol }
-                    : { kind: 'full' };
-                link = yield this.ledger.getOrCreateLink({
-                    tenantDid: target.did,
-                    remoteEndpoint: target.dwnUrl,
-                    scope: linkScope,
-                    delegateDid: target.delegateDid,
-                    protocol: target.protocol,
-                });
-                const linkKey = this.buildLinkKey(target.did, target.dwnUrl, link.scopeId);
-                if (!link.pull.contiguousAppliedToken) {
-                    const legacyKey = buildLegacyCursorKey(target.did, target.dwnUrl, target.protocol);
-                    const legacyCursor = yield this.getCursor(legacyKey);
-                    if (legacyCursor) {
-                        ReplicationLedger.resetCheckpoint(link.pull, legacyCursor);
-                        yield this.ledger.saveLink(link);
-                        yield this.deleteLegacyCursor(legacyKey);
-                    }
-                }
+                link = yield this.getOrCreateReplicationLink(target);
+                const linkKey = this.getReplicationLinkKey(target, link);
                 this._activeLinks.set(linkKey, link);
-                const targetWithKey = Object.assign(Object.assign({}, target), { linkKey });
-                yield this.openLivePullSubscription(targetWithKey);
-                try {
-                    yield this.openLocalPushSubscription(targetWithKey);
+                if (link.status === 'terminal_incomplete') {
+                    return this.createActiveLinkInitializationResult(link);
                 }
-                catch (pushError) {
-                    const pullSub = this._liveSubscriptions.find((s) => s.linkKey === linkKey);
-                    if (pullSub) {
-                        try {
-                            yield pullSub.close();
-                        }
-                        catch ( /* best effort */_b) { /* best effort */ }
-                        this._liveSubscriptions = this._liveSubscriptions.filter(s => s !== pullSub);
-                    }
-                    throw pushError;
+                const subscriptionResult = yield this.openLinkSubscriptions(Object.assign(Object.assign({}, target), { linkKey }));
+                if (subscriptionResult === LinkSubscriptionOpenResult.ReadyForLive) {
+                    yield this.markLinkLive(target, link, linkKey);
                 }
-                this.emitEvent({ type: 'link:status-change', tenantDid: target.did, remoteEndpoint: target.dwnUrl, protocol: target.protocol, from: 'initializing', to: 'live' });
-                yield this.ledger.setStatus(link, 'live');
-                if (link.needsReconcile) {
-                    this.scheduleReconcile(linkKey, 1000);
+                else if (subscriptionResult === LinkSubscriptionOpenResult.Polling) {
+                    yield this.markLinkPolling(target, link);
                 }
+                return this.createActiveLinkInitializationResult(link);
             }
             catch (error) {
-                const linkKey = link
-                    ? this.buildLinkKey(target.did, target.dwnUrl, link.scopeId)
-                    : buildLegacyCursorKey(target.did, target.dwnUrl, target.protocol);
-                if (error.isProgressGap && link) {
-                    console.warn(`SyncEngineLevel: ProgressGap detected for ${target.did} -> ${target.dwnUrl}, initiating repair`);
-                    this.emitEvent({ type: 'gap:detected', tenantDid: target.did, remoteEndpoint: target.dwnUrl, protocol: target.protocol, reason: 'ProgressGap' });
-                    yield this.transitionToRepairing(linkKey, link, {
-                        resumeToken: (_a = error.gapInfo) === null || _a === void 0 ? void 0 : _a.latestAvailable,
-                    });
-                    return;
-                }
-                console.error(`SyncEngineLevel: Failed to open live subscription for ${target.did} -> ${target.dwnUrl}`, error);
-                this._activeLinks.delete(linkKey);
-                this._linkRuntimes.delete(linkKey);
-                if (this._liveSubscriptions.length === 0) {
-                    this._connectivityState = 'unknown';
-                }
+                return this.handleInitializeLinkTargetError(target, link, error);
+            }
+        });
+    }
+    getOrCreateReplicationLink(target) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.ledger.getOrCreateLink({
+                tenantDid: target.did,
+                remoteEndpoint: target.dwnUrl,
+                scope: target.scope,
+                authorization: target.authorization,
+                authorizationEpoch: target.authorizationEpoch,
+                delegateDid: target.delegateDid,
+            });
+        });
+    }
+    getReplicationLinkKey(target, link) {
+        return this.buildLinkKey(target.did, target.dwnUrl, link.projectionId, link.authorizationEpoch);
+    }
+    openLinkSubscriptions(target) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!SyncEngineLevel.supportsLiveSubscriptions(target.scope)) {
+                return LinkSubscriptionOpenResult.Polling;
+            }
+            yield this.openLivePullSubscription(target);
+            const link = this._activeLinks.get(target.linkKey);
+            if ((link === null || link === void 0 ? void 0 : link.status) === 'repairing') {
+                yield this.closeLiveSubscription(target.linkKey);
+                return LinkSubscriptionOpenResult.Repairing;
+            }
+            try {
+                yield this.openLocalPushSubscription(target);
+            }
+            catch (error) {
+                yield this.closeLiveSubscription(target.linkKey);
+                throw error;
+            }
+            return LinkSubscriptionOpenResult.ReadyForLive;
+        });
+    }
+    static supportsLiveSubscriptions(scope) {
+        // Records-primary projected links reconcile by root/diff polling until the
+        // DWN has explicit path/context live subscription semantics.
+        return scope.kind !== 'recordsProjection';
+    }
+    markLinkLive(target, link, linkKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.emitEvent(Object.assign(Object.assign({ type: 'link:status-change', tenantDid: target.did, remoteEndpoint: target.dwnUrl }, syncEventScope(target.scope)), { from: 'initializing', to: 'live' }));
+            yield this.ledger.setStatus(link, 'live');
+            if (link.needsReconcile) {
+                this.scheduleReconcile(linkKey, 1000);
             }
         });
     }
+    markLinkPolling(target, link) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.emitEvent(Object.assign(Object.assign({ type: 'link:status-change', tenantDid: target.did, remoteEndpoint: target.dwnUrl }, syncEventScope(target.scope)), { from: 'initializing', to: 'polling' }));
+            yield this.ledger.setStatus(link, 'polling');
+        });
+    }
+    handleInitializeLinkTargetError(target, link, error) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (error.isProgressGap && link) {
+                const linkKey = this.getReplicationLinkKey(target, link);
+                console.warn(`SyncEngineLevel: ProgressGap detected for ${target.did} -> ${target.dwnUrl}, initiating repair`);
+                this.emitEvent(Object.assign(Object.assign({ type: 'gap:detected', tenantDid: target.did, remoteEndpoint: target.dwnUrl }, syncEventScope(target.scope)), { reason: 'ProgressGap' }));
+                yield this.transitionToRepairing(linkKey, link, {
+                    resumeToken: (_a = error.gapInfo) === null || _a === void 0 ? void 0 : _a.latestAvailable,
+                });
+                return this.createActiveLinkInitializationResult(link);
+            }
+            console.error(`SyncEngineLevel: Failed to open live subscription for ${target.did} -> ${target.dwnUrl}`, error);
+            if (link) {
+                this.cleanupFailedLinkInitialization(this.getReplicationLinkKey(target, link));
+            }
+            if (this.isDidResolutionFailure(error)) {
+                throw error;
+            }
+            return { status: LinkInitializationStatus.Failed };
+        });
+    }
+    createActiveLinkInitializationResult(link) {
+        return {
+            status: LinkInitializationStatus.Active,
+            durableLinkIdentityKey: this.getDurableLinkIdentityKey(link),
+        };
+    }
+    cleanupFailedLinkInitialization(linkKey) {
+        this._activeLinks.delete(linkKey);
+        this._linkRuntimes.delete(linkKey);
+        if (this._liveSubscriptions.length === 0) {
+            this._connectivityState = 'unknown';
+        }
+    }
     /**
      * Wrapper around {@link initializeLinkTarget} that retries on DID
      * resolution failures. Newly published `did:dht` DIDs take a few
@@ -1225,32 +1370,33 @@ export class SyncEngineLevel {
      */
     initializeLinkTargetWithRetry(target) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a;
             try {
-                yield this.initializeLinkTarget(target);
+                return yield this.initializeLinkTarget(target);
             }
             catch (error) {
-                const msg = (_a = error.message) !== null && _a !== void 0 ? _a : '';
-                const isDidResolutionFailure = msg.includes('GetPublicKeyNotFound') || msg.includes('notFound');
-                if (!isDidResolutionFailure) {
+                if (!this.isDidResolutionFailure(error)) {
                     throw error;
                 }
-                const delays = [2000, 4000, 8000];
-                for (const delay of delays) {
+                for (const delay of SyncEngineLevel.DID_RESOLUTION_RETRY_BACKOFF_MS) {
                     yield sleep(delay);
                     try {
-                        yield this.initializeLinkTarget(target);
-                        return;
+                        return yield this.initializeLinkTarget(target);
                     }
-                    catch (_b) {
+                    catch (_a) {
                         // Continue to next attempt.
                     }
                 }
                 // All retries exhausted — the original error was already logged
                 // by initializeLinkTarget's catch block.
+                return { status: LinkInitializationStatus.Failed };
             }
         });
     }
+    isDidResolutionFailure(error) {
+        var _a;
+        const message = (_a = error.message) !== null && _a !== void 0 ? _a : '';
+        return message.includes('GetPublicKeyNotFound');
+    }
     // ---------------------------------------------------------------------------
     // Hot-add / hot-remove: per-identity live sync management
     // ---------------------------------------------------------------------------
@@ -1270,23 +1416,22 @@ export class SyncEngineLevel {
     /** Hot-add a single identity to the active live sync session. */
     addIdentityToLiveSync(did, options) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { protocols, delegateDid } = options;
             const dwnEndpointUrls = yield this.agent.dwn.getDwnEndpointUrlsForTarget(did);
             if (dwnEndpointUrls.length === 0) {
-                return;
+                return new Set();
             }
             const targets = [];
             for (const dwnUrl of dwnEndpointUrls) {
-                if (protocols === 'all') {
-                    targets.push({ did, delegateDid, dwnUrl });
-                }
-                else {
-                    for (const protocol of protocols) {
-                        targets.push({ did, delegateDid, dwnUrl, protocol });
-                    }
+                targets.push(...yield this.buildSyncTargetsForEndpoint(did, dwnUrl, options));
+            }
+            const results = yield Promise.allSettled(targets.map(t => this.initializeLinkTargetWithRetry(t)));
+            const currentIdentityKeys = new Set();
+            for (const result of results) {
+                if (result.status === 'fulfilled' && result.value.status === LinkInitializationStatus.Active) {
+                    currentIdentityKeys.add(result.value.durableLinkIdentityKey);
                 }
             }
-            yield Promise.allSettled(targets.map(t => this.initializeLinkTargetWithRetry(t)));
+            return currentIdentityKeys;
         });
     }
     /** Hot-remove a single identity from the active live sync session. */
@@ -1361,6 +1506,40 @@ export class SyncEngineLevel {
             this._closureContexts.delete(did);
         });
     }
+    tryPruneSupersededDurableLinksForRegisteredIdentity(did, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const currentIdentityKeys = yield this.getDurableLinkIdentityKeysForRegisteredIdentity(did, options);
+                yield this.pruneSupersededDurableLinksForIdentity(did, currentIdentityKeys);
+            }
+            catch (error) {
+                console.warn(`SyncEngineLevel: Failed to prune superseded durable links for ${did}`, error);
+            }
+        });
+    }
+    getDurableLinkIdentityKeysForRegisteredIdentity(did, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const scope = syncScopeFromProtocols(options.protocols);
+            const resolutions = yield this.buildSyncTargetResolutions(did, scope, options);
+            const keys = new Set();
+            for (const resolution of resolutions) {
+                const projectionId = yield computeProjectionId(did, resolution.scope);
+                keys.add(SyncEngineLevel.durableLinkIdentityKey(did, projectionId, resolution.authorizationEpoch));
+            }
+            return keys;
+        });
+    }
+    pruneSupersededDurableLinksForIdentity(did, currentIdentityKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const links = yield this.ledger.getLinksForTenant(did);
+            yield Promise.all(links.map((link) => __awaiter(this, void 0, void 0, function* () {
+                if (currentIdentityKeys.has(this.getDurableLinkIdentityKey(link))) {
+                    return;
+                }
+                yield this.ledger.deleteLink(link.tenantDid, link.remoteEndpoint, link.projectionId, link.authorizationEpoch);
+            })));
+        });
+    }
     // ---------------------------------------------------------------------------
     // Live pull: MessagesSubscribe to remote DWN
     // ---------------------------------------------------------------------------
@@ -1370,52 +1549,14 @@ export class SyncEngineLevel {
      */
     openLivePullSubscription(target) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const { did, delegateDid, dwnUrl, protocol } = target;
-            // Resolve the cursor from the link's durable pull checkpoint.
-            // Legacy syncCursors migration happens at link load time in startLiveSync().
+            const { did, delegateDid, dwnUrl } = target;
+            const eventScope = syncEventScope(target.scope);
             const cursorKey = target.linkKey;
             const link = this._activeLinks.get(cursorKey);
-            let cursor = link === null || link === void 0 ? void 0 : link.pull.contiguousAppliedToken;
-            // Guard against corrupted tokens with empty fields — these would fail
-            // MessagesSubscribe JSON schema validation (minLength: 1). Discard and
-            // start from the beginning rather than crash the subscription.
-            if (cursor && (!cursor.streamId || !cursor.messageCid || !cursor.epoch || !cursor.position)) {
-                console.warn(`SyncEngineLevel: Discarding stored cursor with empty field(s) for ${did} -> ${dwnUrl}`);
-                cursor = undefined;
-                if (link) {
-                    ReplicationLedger.resetCheckpoint(link.pull);
-                    yield this.ledger.saveLink(link);
-                }
-            }
-            // Build the MessagesSubscribe filters.
-            // When the link has protocolPathPrefixes, include them in the filter so the
-            // EventLog delivers only matching events (server-side filtering). This replaces
-            // the less efficient agent-side isEventInScope filtering for the pull path.
-            // Note: only the first prefix is used as the MessagesFilter field because
-            // MessagesFilter.protocolPathPrefix is a single string. Multiple prefixes
-            // would need multiple filters (OR semantics) — for now we use the first one.
-            const protocolPathPrefix = (link === null || link === void 0 ? void 0 : link.scope.kind) === 'protocol'
-                ? (_a = link.scope.protocolPathPrefixes) === null || _a === void 0 ? void 0 : _a[0]
-                : undefined;
-            const filters = protocol
-                ? [Object.assign({ protocol }, (protocolPathPrefix ? { protocolPathPrefix } : {}))]
+            const cursor = yield this.getInitialPullCursor({ did, dwnUrl, link });
+            const filters = target.scope.kind === 'protocolSet'
+                ? target.scope.protocols.map(protocol => ({ protocol }))
                 : [];
-            // Look up permission grant for MessagesSubscribe if using a delegate.
-            // The unified scope matching in AgentPermissionsApi accepts a
-            // Messages.Read grant for MessagesSubscribe requests, so a single
-            // lookup is sufficient.
-            let permissionGrantId;
-            if (delegateDid) {
-                const grant = yield this._permissionsApi.getPermissionForRequest({
-                    connectedDid: did,
-                    messageType: DwnInterface.MessagesSubscribe,
-                    delegateDid,
-                    protocol,
-                    cached: true
-                });
-                permissionGrantId = grant.grant.id;
-            }
             const handlerGeneration = this._engineGeneration;
             // Define the subscription handler that processes incoming events.
             // NOTE: The WebSocket client fires handlers without awaiting (fire-and-forget),
@@ -1423,236 +1564,19 @@ export class SyncEngineLevel {
             // ensures the checkpoint advances only when all earlier deliveries are committed.
             // Capture the link reference at subscription-open time so we can
             // detect remove+re-add via object identity, not just key existence.
-            const capturedLink = link;
-            const isStale = () => this._engineGeneration !== handlerGeneration ||
-                !this._activeLinks.has(cursorKey) ||
-                (capturedLink !== undefined && this._activeLinks.get(cursorKey) !== capturedLink);
+            const isStale = this.createLinkStalePredicate(cursorKey, link, handlerGeneration);
+            const pullContext = {
+                did,
+                dwnUrl,
+                delegateDid,
+                eventScope,
+                linkKey: cursorKey,
+                link,
+                permissionGrantIds: target.permissionGrantIds,
+                isStale,
+            };
             const subscriptionHandler = (subMessage) => __awaiter(this, void 0, void 0, function* () {
-                var _a;
-                if (isStale()) {
-                    return;
-                }
-                if (subMessage.type === 'eose') {
-                    // End-of-stored-events — catch-up complete.
-                    if (link) {
-                        // Guard: if the link transitioned to repairing while catch-up events
-                        // were being processed, skip all mutations — repair owns the state now.
-                        if (link.status !== 'live' && link.status !== 'initializing') {
-                            return;
-                        }
-                        if (!ReplicationLedger.validateTokenDomain(link.pull, subMessage.cursor)) {
-                            console.warn(`SyncEngineLevel: Token domain mismatch on EOSE for ${did} -> ${dwnUrl}, transitioning to repairing`);
-                            if (!isStale()) {
-                                yield this.transitionToRepairing(cursorKey, link);
-                            }
-                            return;
-                        }
-                        ReplicationLedger.setReceivedToken(link.pull, subMessage.cursor);
-                        this.drainCommittedPull(cursorKey);
-                        if (isStale()) {
-                            return;
-                        }
-                        yield this.ledger.saveLink(link);
-                    }
-                    // Transport is reachable — set connectivity to online.
-                    if (link) {
-                        const prevEoseConnectivity = link.connectivity;
-                        link.connectivity = 'online';
-                        if (prevEoseConnectivity !== 'online') {
-                            this.emitEvent({ type: 'link:connectivity-change', tenantDid: did, remoteEndpoint: dwnUrl, protocol, from: prevEoseConnectivity, to: 'online' });
-                        }
-                        // If the link was marked dirty, schedule reconciliation now that it's healthy.
-                        if (link.needsReconcile) {
-                            this.scheduleReconcile(cursorKey, 500);
-                        }
-                    }
-                    else {
-                        this._connectivityState = 'online';
-                    }
-                    return;
-                }
-                if (subMessage.type === 'event') {
-                    const event = subMessage.event;
-                    // Guard: if the link is not live (e.g., repairing, degraded_poll, paused),
-                    // skip all processing. Old subscription handlers may still fire after the
-                    // link transitions — these events should be ignored entirely, not just
-                    // skipped at the checkpoint level.
-                    if (link && link.status !== 'live' && link.status !== 'initializing') {
-                        return;
-                    }
-                    // Domain validation: reject tokens from a different stream/epoch.
-                    if (link && !ReplicationLedger.validateTokenDomain(link.pull, subMessage.cursor)) {
-                        console.warn(`SyncEngineLevel: Token domain mismatch for ${did} -> ${dwnUrl}, transitioning to repairing`);
-                        if (!isStale()) {
-                            yield this.transitionToRepairing(cursorKey, link);
-                        }
-                        return;
-                    }
-                    // Subset scope filtering: if the link has protocolPath/contextId prefixes,
-                    // skip events that don't match. This is agent-side filtering because
-                    // MessagesSubscribe only supports protocol-level filtering today.
-                    //
-                    // Skipped events MUST advance contiguousAppliedToken — otherwise the
-                    // link would replay the same filtered-out events indefinitely after
-                    // reconnect/repair. This is safe because the event is intentionally
-                    // excluded from this scope and doesn't need processing.
-                    if (link && !isEventInScope(event.message, link.scope)) {
-                        if (!isStale()) {
-                            ReplicationLedger.setReceivedToken(link.pull, subMessage.cursor);
-                            ReplicationLedger.commitContiguousToken(link.pull, subMessage.cursor);
-                            yield this.ledger.saveLink(link);
-                        }
-                        return;
-                    }
-                    // Assign a delivery ordinal BEFORE async processing begins.
-                    // This captures the delivery order even if processing completes out of order.
-                    const rt = link ? this.getOrCreateRuntime(cursorKey) : undefined;
-                    const ordinal = rt ? rt.nextDeliveryOrdinal++ : -1;
-                    if (rt) {
-                        rt.inflight.set(ordinal, { ordinal, token: subMessage.cursor, committed: false });
-                    }
-                    try {
-                        // Extract inline data from the event (available for records <= 30 KB).
-                        let dataStream = this.extractDataStream(event);
-                        // For large RecordsWrite messages (no inline data), fetch the data
-                        // from the remote DWN via MessagesRead before storing locally.
-                        if (!dataStream && isRecordsWrite(event) && event.message.descriptor.dataCid) {
-                            const messageCid = yield Message.getCid(event.message);
-                            const fetched = yield fetchRemoteMessages({
-                                did, dwnUrl, delegateDid, protocol,
-                                messageCids: [messageCid],
-                                agent: this.agent,
-                                permissionsApi: this._permissionsApi,
-                            });
-                            if (fetched.length > 0 && fetched[0].dataStream) {
-                                dataStream = fetched[0].dataStream;
-                            }
-                        }
-                        yield this.agent.dwn.processRawMessage(did, event.message, { dataStream });
-                        if (isStale()) {
-                            return;
-                        }
-                        // Invalidate closure cache entries that may be affected by this message.
-                        // Must run before closure validation so subsequent evaluations in the
-                        // same session see the updated local state.
-                        const closureCtxForInvalidation = this._closureContexts.get(did);
-                        if (closureCtxForInvalidation) {
-                            invalidateClosureCache(closureCtxForInvalidation, event.message);
-                        }
-                        // Closure validation for scoped subset sync (Phase 3).
-                        // For protocol-scoped links, verify that all hard dependencies for
-                        // this operation are locally present before considering it committed.
-                        // Full-tenant scope bypasses this entirely (returns complete with 0 queries).
-                        if ((link === null || link === void 0 ? void 0 : link.scope.kind) === 'protocol') {
-                            const messageStore = this.agent.dwn.node.storage.messageStore;
-                            let closureCtx = this._closureContexts.get(did);
-                            if (!closureCtx) {
-                                closureCtx = createClosureContext(did, undefined, {
-                                    isDelegateSession: !!delegateDid,
-                                });
-                                this._closureContexts.set(did, closureCtx);
-                            }
-                            const closureResult = yield evaluateClosure(event.message, messageStore, link.scope, closureCtx);
-                            if (isStale()) {
-                                return;
-                            }
-                            if (!closureResult.complete) {
-                                const failureCode = closureResult.failure.code;
-                                const failureDetail = closureResult.failure.detail;
-                                console.warn(`SyncEngineLevel: Closure incomplete for ${did} -> ${dwnUrl}: ` +
-                                    `${failureCode} — ${failureDetail}`);
-                                // Record the message that triggered the closure failure.
-                                const closureCid = yield Message.getCid(event.message);
-                                void this.recordDeadLetter({
-                                    messageCid: closureCid,
-                                    tenantDid: did,
-                                    remoteEndpoint: dwnUrl,
-                                    protocol,
-                                    category: 'closure',
-                                    errorCode: failureCode,
-                                    errorDetail: failureDetail,
-                                });
-                                if (!isStale()) {
-                                    yield this.transitionToRepairing(cursorKey, link);
-                                }
-                                return;
-                            }
-                        }
-                        // Squash convergence: processRawMessage triggers the DWN's built-in
-                        // squash resumable task (performRecordsSquash) which runs inline and
-                        // handles subset consumers correctly:
-                        // - If older siblings are locally present → purges them
-                        // - If squash arrives before older siblings → backstop rejects them (409)
-                        // - If no older siblings are local → no-op (correct)
-                        // Both sync orderings (squash-first or siblings-first) converge to
-                        // the same final state. No additional sync-engine side-effect is needed.
-                        // Track this CID for echo-loop suppression, scoped to the source endpoint.
-                        const pulledCid = yield Message.getCid(event.message);
-                        this._recentlyPulledCids.set(`${pulledCid}|${dwnUrl}`, Date.now() + SyncEngineLevel.ECHO_SUPPRESS_TTL_MS);
-                        this.evictExpiredEchoEntries();
-                        // Auto-clear any dead letter for this CID — it was processed
-                        // successfully, so a previous failure has been self-healed.
-                        this.clearFailedMessage(pulledCid, dwnUrl).catch(() => { });
-                        // Mark this ordinal as committed and drain the checkpoint.
-                        // Guard: if the link transitioned to repairing while this handler was
-                        // in-flight (e.g., an earlier ordinal's handler failed concurrently),
-                        // skip all state mutations — the repair process owns progression now.
-                        if (link && rt && link.status === 'live' && !isStale()) {
-                            const entry = rt.inflight.get(ordinal);
-                            if (entry) {
-                                entry.committed = true;
-                            }
-                            ReplicationLedger.setReceivedToken(link.pull, subMessage.cursor);
-                            const drained = this.drainCommittedPull(cursorKey);
-                            if (drained > 0) {
-                                yield this.ledger.saveLink(link);
-                                // Emit after durable save — "advanced" means persisted.
-                                if (link.pull.contiguousAppliedToken) {
-                                    this.emitEvent({
-                                        type: 'checkpoint:pull-advance',
-                                        tenantDid: link.tenantDid,
-                                        remoteEndpoint: link.remoteEndpoint,
-                                        protocol: link.protocol,
-                                        position: link.pull.contiguousAppliedToken.position,
-                                        messageCid: link.pull.contiguousAppliedToken.messageCid,
-                                    });
-                                }
-                            }
-                            // Overflow: too many in-flight ordinals without draining.
-                            if (rt.inflight.size > MAX_PENDING_TOKENS) {
-                                console.warn(`SyncEngineLevel: Pull in-flight overflow for ${did} -> ${dwnUrl}, transitioning to repairing`);
-                                yield this.transitionToRepairing(cursorKey, link);
-                            }
-                        }
-                    }
-                    catch (error) {
-                        console.error(`SyncEngineLevel: Error processing live-pull event for ${did}`, error);
-                        // Record the failing message in the dead letter store before
-                        // transitioning to repair. The CID identifies which specific
-                        // message caused the transition.
-                        try {
-                            const failedCid = yield Message.getCid(event.message);
-                            void this.recordDeadLetter({
-                                messageCid: failedCid,
-                                tenantDid: did,
-                                remoteEndpoint: dwnUrl,
-                                protocol,
-                                category: 'pull-processing',
-                                errorDetail: (_a = error.message) !== null && _a !== void 0 ? _a : String(error),
-                            });
-                        }
-                        catch (_b) {
-                            // Best effort — don't let dead letter recording block repair.
-                        }
-                        // A failed processRawMessage means local state is incomplete.
-                        // Transition to repairing immediately — do NOT advance the checkpoint
-                        // past this failure or let later ordinals commit past it. SMT
-                        // reconciliation will discover and fill the gap.
-                        if (link && !isStale()) {
-                            yield this.transitionToRepairing(cursorKey, link);
-                        }
-                    }
-                }
+                yield this.handleLivePullMessage(pullContext, subMessage);
             });
             // Construct the subscribe message and send it directly to the specific
             // dwnUrl via WebSocket.  We do NOT use agent.dwn.sendRequest() because
@@ -1664,7 +1588,7 @@ export class SyncEngineLevel {
                 target: did,
                 messageType: DwnInterface.MessagesSubscribe,
                 granteeDid: delegateDid,
-                messageParams: { filters, cursor, permissionGrantId },
+                messageParams: { filters, cursor, permissionGrantIds: toMessagesPermissionGrantIds(target.permissionGrantIds) },
             };
             const { message } = yield this.agent.dwn.processRequest(subscribeRequest);
             if (!message) {
@@ -1710,13 +1634,14 @@ export class SyncEngineLevel {
             if (reply.status.code !== 200 || !reply.subscription) {
                 throw new Error(`SyncEngineLevel: MessagesSubscribe failed for ${did} -> ${dwnUrl}: ${reply.status.code} ${reply.status.detail}`);
             }
+            const linkKey = cursorKey;
+            const close = () => __awaiter(this, void 0, void 0, function* () { yield reply.subscription.close(); });
             this._liveSubscriptions.push({
-                linkKey: cursorKey,
+                linkKey,
                 did,
                 dwnUrl,
                 delegateDid,
-                protocol,
-                close: () => __awaiter(this, void 0, void 0, function* () { yield reply.subscription.close(); }),
+                close,
             });
             // Set per-link connectivity to online after successful subscription setup.
             const pullLink = this._activeLinks.get(cursorKey);
@@ -1724,36 +1649,642 @@ export class SyncEngineLevel {
                 const prevPullConnectivity = pullLink.connectivity;
                 pullLink.connectivity = 'online';
                 if (prevPullConnectivity !== 'online') {
-                    this.emitEvent({ type: 'link:connectivity-change', tenantDid: did, remoteEndpoint: dwnUrl, protocol, from: prevPullConnectivity, to: 'online' });
+                    this.emitEvent(Object.assign(Object.assign({ type: 'link:connectivity-change', tenantDid: did, remoteEndpoint: dwnUrl }, eventScope), { from: prevPullConnectivity, to: 'online' }));
                 }
             }
         });
     }
-    // ---------------------------------------------------------------------------
-    // Live push: local EventLog subscription for immediate push
-    // ---------------------------------------------------------------------------
-    /**
-     * Subscribes to the local DWN's EventLog so that writes by the user are
-     * immediately pushed to the remote DWN instead of waiting for the next poll.
-     */
-    openLocalPushSubscription(target) {
+    getInitialPullCursor(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, link }) {
+            // Resolve the cursor from the link's durable pull checkpoint.
+            if (!link) {
+                return undefined;
+            }
+            const cursor = link.pull.contiguousAppliedToken;
+            if (!cursor || this.isValidProgressToken(cursor)) {
+                return cursor;
+            }
+            // Guard against corrupted tokens with empty fields — these would fail
+            // MessagesSubscribe JSON schema validation (minLength: 1). Discard and
+            // start from the beginning rather than crash the subscription.
+            console.warn(`SyncEngineLevel: Discarding stored cursor with empty field(s) for ${did} -> ${dwnUrl}`);
+            ReplicationLedger.resetCheckpoint(link.pull);
+            yield this.ledger.saveLink(link);
+            return undefined;
+        });
+    }
+    isValidProgressToken(token) {
+        return !!(token.streamId && token.messageCid && token.epoch && token.position);
+    }
+    createLinkStalePredicate(linkKey, capturedLink, generation) {
+        return () => this._engineGeneration !== generation ||
+            !this._activeLinks.has(linkKey) ||
+            (capturedLink !== undefined && this._activeLinks.get(linkKey) !== capturedLink);
+    }
+    handleLivePullMessage(context, subMessage) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const { did, delegateDid, dwnUrl, protocol } = target;
-            // Build filters scoped to the protocol (if any).
-            const filters = protocol ? [{ protocol }] : [];
-            // Look up permission grant for local subscription.
-            let permissionGrantId;
-            if (delegateDid) {
-                const grant = yield this._permissionsApi.getPermissionForRequest({
-                    connectedDid: did,
-                    messageType: DwnInterface.MessagesSubscribe,
-                    delegateDid,
-                    protocol,
-                    cached: true,
-                });
-                permissionGrantId = grant.grant.id;
+            if (context.isStale()) {
+                return;
             }
+            if (subMessage.type === 'eose') {
+                yield this.handleLivePullEose(context, subMessage);
+                return;
+            }
+            if (subMessage.type === 'error') {
+                yield this.handleLivePullSubscriptionError(context, subMessage);
+                return;
+            }
+            if (subMessage.type === 'event') {
+                yield this.handleLivePullEvent(context, subMessage);
+            }
+        });
+    }
+    handleLivePullEose(_a, subMessage_1) {
+        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, eventScope, linkKey, link, isStale }, subMessage) {
+            if (link) {
+                // Guard: if the link transitioned to repairing while catch-up events
+                // were being processed, skip all mutations — repair owns the state now.
+                if (link.status !== 'live' && link.status !== 'initializing') {
+                    return;
+                }
+                if (!ReplicationLedger.validateTokenDomain(link.pull, subMessage.cursor)) {
+                    console.warn(`SyncEngineLevel: Token domain mismatch on EOSE for ${did} -> ${dwnUrl}, transitioning to repairing`);
+                    if (!isStale()) {
+                        yield this.transitionToRepairing(linkKey, link);
+                    }
+                    return;
+                }
+                ReplicationLedger.setReceivedToken(link.pull, subMessage.cursor);
+                this.drainCommittedPull(linkKey);
+                if (isStale()) {
+                    return;
+                }
+                yield this.ledger.saveLink(link);
+            }
+            this.markPullLinkOnline({ did, dwnUrl, eventScope, linkKey, link });
+        });
+    }
+    markPullLinkOnline({ did, dwnUrl, eventScope, linkKey, link }) {
+        if (!link) {
+            this._connectivityState = 'online';
+            return;
+        }
+        const previous = link.connectivity;
+        link.connectivity = 'online';
+        if (previous !== 'online') {
+            this.emitEvent(Object.assign(Object.assign({ type: 'link:connectivity-change', tenantDid: did, remoteEndpoint: dwnUrl }, eventScope), { from: previous, to: 'online' }));
+        }
+        if (link.needsReconcile) {
+            this.scheduleReconcile(linkKey, 500);
+        }
+    }
+    handleLivePullSubscriptionError(_a, subMessage_1) {
+        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, linkKey, link, isStale }, subMessage) {
+            console.warn(`SyncEngineLevel: subscription error for ${did} -> ${dwnUrl}: ${subMessage.error.code}`);
+            if (link && !isStale()) {
+                yield this.transitionToRepairing(linkKey, link);
+            }
+        });
+    }
+    handleLivePullEvent(context, subMessage) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const event = subMessage.event;
+            if (yield this.shouldSkipLivePullEvent(context, subMessage)) {
+                return;
+            }
+            const delivery = this.startPullDelivery(context, subMessage.cursor);
+            try {
+                const pulledCid = yield this.processLivePullEvent(context, event);
+                if (!pulledCid) {
+                    return;
+                }
+                this.trackRecentlyPulledMessage(pulledCid, context.dwnUrl);
+                this.clearFailedMessage(pulledCid, context.dwnUrl).catch(() => { });
+                yield this.commitPullDelivery(context, subMessage.cursor, delivery);
+            }
+            catch (error) {
+                yield this.handleLivePullProcessingError(context, event, error);
+            }
+        });
+    }
+    shouldSkipLivePullEvent(_a, subMessage_1) {
+        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, linkKey, link, isStale }, subMessage) {
+            // Guard: if the link is not live (e.g., repairing, degraded_poll, paused),
+            // skip all processing. Old subscription handlers may still fire after the
+            // link transitions — these events should be ignored entirely, not just
+            // skipped at the checkpoint level.
+            if (link && link.status !== 'live' && link.status !== 'initializing') {
+                return true;
+            }
+            // Domain validation: reject tokens from a different stream/epoch.
+            if (link && !ReplicationLedger.validateTokenDomain(link.pull, subMessage.cursor)) {
+                console.warn(`SyncEngineLevel: Token domain mismatch for ${did} -> ${dwnUrl}, transitioning to repairing`);
+                if (!isStale()) {
+                    yield this.transitionToRepairing(linkKey, link);
+                }
+                return true;
+            }
+            if (link) {
+                const scopeClassification = classifySyncEventScope(subMessage.event, link.scope);
+                if (scopeClassification === 'out-of-scope') {
+                    yield this.skipOutOfScopePullEvent({ link, cursor: subMessage.cursor, isStale });
+                    return true;
+                }
+                if (scopeClassification === 'unknown') {
+                    console.warn(`SyncEngineLevel: Unable to classify scoped pull event for ${did} -> ${dwnUrl}, transitioning to repair`);
+                    if (!isStale()) {
+                        yield this.transitionToRepairing(linkKey, link);
+                    }
+                    return true;
+                }
+            }
+            return false;
+        });
+    }
+    skipOutOfScopePullEvent(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ link, cursor, isStale }) {
+            // Skipped events MUST advance contiguousAppliedToken — otherwise the link
+            // would replay the same filtered-out events indefinitely after reconnect or
+            // repair. This is safe because the event is intentionally excluded from
+            // this scope and doesn't need processing.
+            if (isStale()) {
+                return;
+            }
+            ReplicationLedger.setReceivedToken(link.pull, cursor);
+            ReplicationLedger.commitContiguousToken(link.pull, cursor);
+            yield this.ledger.saveLink(link);
+        });
+    }
+    startPullDelivery({ linkKey, link }, cursor) {
+        // Assign a delivery ordinal BEFORE async processing begins. This captures
+        // delivery order even if processing completes out of order.
+        const runtime = link ? this.getOrCreateRuntime(linkKey) : undefined;
+        const ordinal = runtime ? runtime.nextDeliveryOrdinal++ : -1;
+        if (runtime) {
+            runtime.inflight.set(ordinal, { ordinal, token: cursor, committed: false });
+        }
+        return { runtime, ordinal };
+    }
+    processLivePullEvent(context, event) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dataStreamFactory = yield this.createLivePullDataStreamFactory(context, event);
+            let applyStatus = yield this.applyLivePullEvent(context, event, dataStreamFactory);
+            if (context.isStale()) {
+                return undefined;
+            }
+            let applied = SyncEngineLevel.isApplySuccess(applyStatus.code);
+            if (applied) {
+                this.invalidateClosureCacheForMessage(context.did, event.message);
+            }
+            if (!(yield this.ensureClosureComplete(context, event))) {
+                return undefined;
+            }
+            if (!applied) {
+                applyStatus = yield this.applyLivePullEvent(context, event, dataStreamFactory);
+                if (context.isStale()) {
+                    return undefined;
+                }
+                applied = SyncEngineLevel.isApplySuccess(applyStatus.code);
+                if (!applied) {
+                    throw yield this.createLivePullApplyError(event, applyStatus);
+                }
+                this.invalidateClosureCacheForMessage(context.did, event.message);
+            }
+            // Squash convergence: processRawMessage triggers the DWN's built-in
+            // squash resumable task (performRecordsSquash), so no additional
+            // sync-engine side effect is needed here.
+            return Message.getCid(event.message);
+        });
+    }
+    applyLivePullEvent(context, event, dataStreamFactory) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dataStream = yield dataStreamFactory();
+            const reply = yield this.agent.dwn.processRawMessage(context.did, event.message, { dataStream });
+            return reply.status;
+        });
+    }
+    createLivePullDataStreamFactory(context, event) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!isRecordsWrite(event)) {
+                return () => __awaiter(this, void 0, void 0, function* () { return undefined; });
+            }
+            const encodedData = event.message.encodedData;
+            if (encodedData) {
+                delete event.message.encodedData;
+                const bytes = Encoder.base64UrlToBytes(encodedData);
+                return () => __awaiter(this, void 0, void 0, function* () { return SyncEngineLevel.dataStreamFromBytes(bytes); });
+            }
+            const eventData = event.data;
+            if (eventData) {
+                const bytes = yield SyncEngineLevel.readStreamBytes(eventData);
+                return () => __awaiter(this, void 0, void 0, function* () { return SyncEngineLevel.dataStreamFromBytes(bytes); });
+            }
+            if (!event.message.descriptor.dataCid) {
+                return () => __awaiter(this, void 0, void 0, function* () { return undefined; });
+            }
+            // For large RecordsWrite messages (no inline data), fetch the data from
+            // the remote DWN via MessagesRead before each store attempt. ReadableStream
+            // instances are single-use, so a repair-triggered retry needs a fresh fetch.
+            const { did, dwnUrl, delegateDid, permissionGrantIds } = context;
+            const messageCid = yield Message.getCid(event.message);
+            return () => __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                const fetched = yield fetchRemoteMessages({
+                    did,
+                    dwnUrl,
+                    delegateDid,
+                    permissionGrantIds,
+                    messageCids: [messageCid],
+                    agent: this.agent,
+                });
+                return (_a = fetched[0]) === null || _a === void 0 ? void 0 : _a.dataStream;
+            });
+        });
+    }
+    createLivePullApplyError(event, status) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const cid = yield Message.getCid(event.message);
+            return new Error(`SyncEngineLevel: live pull apply failed for ${cid}: ${status.code} ${(_a = status.detail) !== null && _a !== void 0 ? _a : ''}`.trim());
+        });
+    }
+    static dataStreamFromBytes(bytes) {
+        return new ReadableStream({
+            start(controller) {
+                controller.enqueue(bytes);
+                controller.close();
+            }
+        });
+    }
+    static readStreamBytes(stream) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const reader = stream.getReader();
+            const chunks = [];
+            let totalSize = 0;
+            try {
+                for (;;) {
+                    const { done, value } = yield reader.read();
+                    if (done) {
+                        break;
+                    }
+                    chunks.push(value);
+                    totalSize += value.byteLength;
+                }
+            }
+            finally {
+                reader.releaseLock();
+            }
+            const bytes = new Uint8Array(totalSize);
+            let offset = 0;
+            for (const chunk of chunks) {
+                bytes.set(chunk, offset);
+                offset += chunk.byteLength;
+            }
+            return bytes;
+        });
+    }
+    static isApplySuccess(code) {
+        return (code >= 200 && code < 300) || code === 409;
+    }
+    invalidateClosureCacheForMessage(did, message) {
+        // Must run before closure validation so subsequent evaluations in the same
+        // session see the updated local state.
+        const closureCtx = this._closureContexts.get(did);
+        if (closureCtx) {
+            invalidateClosureCache(closureCtx, message);
+        }
+    }
+    ensureClosureComplete(context, event) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { did, delegateDid, link, isStale } = context;
+            if (!link || link.scope.kind === 'full') {
+                return true;
+            }
+            let closureCtx = this._closureContexts.get(did);
+            if (!closureCtx) {
+                closureCtx = createClosureContext(did, undefined, {
+                    isDelegateSession: !!delegateDid,
+                });
+                this._closureContexts.set(did, closureCtx);
+            }
+            const messageStore = this.agent.dwn.node.storage.messageStore;
+            let closureResult = yield evaluateClosure(event.message, messageStore, link.scope, closureCtx);
+            if (isStale()) {
+                return false;
+            }
+            if (closureResult.complete) {
+                return true;
+            }
+            if (yield this.tryRepairMissingProtocolMetadata(context, closureCtx, closureResult)) {
+                if (isStale()) {
+                    return false;
+                }
+                closureResult = yield evaluateClosure(event.message, messageStore, link.scope, closureCtx);
+                if (isStale()) {
+                    return false;
+                }
+                if (closureResult.complete) {
+                    return true;
+                }
+            }
+            yield this.recordClosureFailure(context, event, closureResult.failure.code, closureResult.failure.detail);
+            return false;
+        });
+    }
+    tryRepairMissingProtocolMetadata(context, closureCtx, closureResult) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const failure = closureResult.failure;
+            if (!SyncEngineLevel.isRepairableProtocolMetadataFailure(failure)) {
+                return false;
+            }
+            const { did } = context;
+            const repairKey = `${did}|${failure.edge.identifier}`;
+            const activeRepair = this._protocolMetadataRepairs.get(repairKey);
+            if (activeRepair) {
+                return activeRepair;
+            }
+            const repair = this.repairMissingProtocolMetadata(context, closureCtx, failure.edge.identifier);
+            this._protocolMetadataRepairs.set(repairKey, repair);
+            repair.finally(() => {
+                if (this._protocolMetadataRepairs.get(repairKey) === repair) {
+                    this._protocolMetadataRepairs.delete(repairKey);
+                }
+            }).catch(() => { });
+            return repair;
+        });
+    }
+    repairMissingProtocolMetadata(_a, closureCtx_1, protocol_1) {
+        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, delegateDid, isStale }, closureCtx, protocol) {
+            if (isStale()) {
+                return false;
+            }
+            const configs = yield this.fetchRemoteProtocolConfigClosure({
+                authorDid: delegateDid !== null && delegateDid !== void 0 ? delegateDid : did,
+                delegateDid,
+                dwnUrl,
+                protocol,
+                tenantDid: did,
+            });
+            if (isStale() || configs.length === 0) {
+                return false;
+            }
+            // Live subscriptions can deliver scoped records before the local replica
+            // has the tenant's protocol metadata. Reuse the DWN ProtocolsQuery path and
+            // only install configs that are signed by the tenant, including composed
+            // protocol dependencies needed to authorize the record.
+            let repaired = false;
+            for (const config of configs) {
+                if (isStale()) {
+                    return repaired;
+                }
+                const reply = yield this.agent.dwn.processRawMessage(did, config);
+                if (isStale()) {
+                    return repaired;
+                }
+                if (!SyncEngineLevel.protocolConfigApplySucceeded(reply.status.code)) {
+                    return repaired;
+                }
+                invalidateClosureCache(closureCtx, config);
+                repaired = true;
+            }
+            return repaired;
+        });
+    }
+    fetchRemoteProtocolConfigClosure(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ authorDid, delegateDid, dwnUrl, protocol, tenantDid, }) {
+            const configsByProtocol = new Map();
+            const visiting = new Set();
+            const visit = (protocolUri) => __awaiter(this, void 0, void 0, function* () {
+                if (configsByProtocol.has(protocolUri)) {
+                    return true;
+                }
+                if (visiting.has(protocolUri)) {
+                    return true;
+                }
+                visiting.add(protocolUri);
+                const config = yield this.fetchRemoteProtocolConfig({
+                    authorDid,
+                    delegateDid,
+                    dwnUrl,
+                    protocol: protocolUri,
+                    tenantDid,
+                });
+                if (config === undefined) {
+                    visiting.delete(protocolUri);
+                    return false;
+                }
+                for (const usedProtocol of SyncEngineLevel.protocolsConfigureUses(config)) {
+                    if (!(yield visit(usedProtocol))) {
+                        visiting.delete(protocolUri);
+                        return false;
+                    }
+                }
+                configsByProtocol.set(protocolUri, config);
+                visiting.delete(protocolUri);
+                return true;
+            });
+            return (yield visit(protocol)) ? [...configsByProtocol.values()] : [];
+        });
+    }
+    fetchRemoteProtocolConfig(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ authorDid, delegateDid, dwnUrl, protocol, tenantDid, }) {
+            try {
+                const permissionGrantId = yield this.getProtocolsQueryPermissionGrantId({
+                    delegateDid,
+                    protocol,
+                    tenantDid,
+                });
+                const { message } = yield this.agent.processDwnRequest({
+                    author: authorDid,
+                    messageParams: Object.assign({ filter: { protocol } }, (permissionGrantId === undefined ? {} : { permissionGrantId })),
+                    messageType: DwnInterface.ProtocolsQuery,
+                    store: false,
+                    target: tenantDid,
+                });
+                const reply = yield this.agent.rpc.sendDwnRequest({
+                    dwnUrl,
+                    message,
+                    targetDid: tenantDid,
+                });
+                if (reply.status.code !== 200 || reply.entries === undefined) {
+                    return undefined;
+                }
+                const candidates = [];
+                for (const entry of reply.entries) {
+                    const config = yield this.toAuthenticatedTenantProtocolConfig(tenantDid, entry);
+                    if ((config === null || config === void 0 ? void 0 : config.descriptor.definition.protocol) === protocol) {
+                        candidates.push(config);
+                    }
+                }
+                return SyncEngineLevel.newestProtocolConfig(candidates);
+            }
+            catch (_b) {
+                return undefined;
+            }
+        });
+    }
+    getProtocolsQueryPermissionGrantId(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ delegateDid, protocol, tenantDid, }) {
+            if (delegateDid === undefined) {
+                return undefined;
+            }
+            try {
+                const { grant } = yield this._permissionsApi.getPermissionForRequest({
+                    connectedDid: tenantDid,
+                    delegateDid,
+                    protocol,
+                    cached: true,
+                    messageType: DwnInterface.ProtocolsQuery,
+                });
+                return grant.id;
+            }
+            catch (_b) {
+                return undefined;
+            }
+        });
+    }
+    toAuthenticatedTenantProtocolConfig(tenantDid, message) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!SyncEngineLevel.isProtocolsConfigureDefinitionMessage(message)) {
+                return undefined;
+            }
+            try {
+                yield ProtocolsConfigure.parse(message);
+                if (Message.getAuthor(message) !== tenantDid) {
+                    return undefined;
+                }
+                yield authenticate(message.authorization, this.agent.did);
+                return message;
+            }
+            catch (_a) {
+                return undefined;
+            }
+        });
+    }
+    static newestProtocolConfig(configs) {
+        let newest;
+        for (const config of configs) {
+            if (newest === undefined || SyncEngineLevel.isProtocolConfigNewer(config, newest)) {
+                newest = config;
+            }
+        }
+        return newest;
+    }
+    static isProtocolConfigNewer(candidate, current) {
+        return candidate.descriptor.messageTimestamp > current.descriptor.messageTimestamp;
+    }
+    static protocolConfigApplySucceeded(code) {
+        return (code >= 200 && code < 300) || code === 409;
+    }
+    static isRepairableProtocolMetadataFailure(failure) {
+        return (failure === null || failure === void 0 ? void 0 : failure.edge.identifierType) === 'protocol' &&
+            (failure.code === ClosureFailureCode.ProtocolMetadataMissing ||
+                failure.code === ClosureFailureCode.CrossProtocolReferenceMissing ||
+                failure.code === ClosureFailureCode.EncryptionDependencyMissing);
+    }
+    recordClosureFailure(_a, event_1, failureCode_1, failureDetail_1) {
+        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, linkKey, link, isStale }, event, failureCode, failureDetail) {
+            console.warn(`SyncEngineLevel: Closure incomplete for ${did} -> ${dwnUrl}: ` +
+                `${failureCode} — ${failureDetail}`);
+            const closureCid = yield Message.getCid(event.message);
+            void this.recordDeadLetter({
+                messageCid: closureCid,
+                tenantDid: did,
+                remoteEndpoint: dwnUrl,
+                protocol: event.message.descriptor.protocol,
+                category: 'closure',
+                errorCode: failureCode,
+                errorDetail: failureDetail,
+            });
+            if (link && !isStale() && isTerminalClosureFailureCode(failureCode)) {
+                yield this.transitionToTerminalIncomplete(linkKey, link);
+                return;
+            }
+            if (link && !isStale()) {
+                yield this.transitionToRepairing(linkKey, link);
+            }
+        });
+    }
+    trackRecentlyPulledMessage(messageCid, dwnUrl) {
+        this._recentlyPulledCids.set(`${messageCid}|${dwnUrl}`, Date.now() + SyncEngineLevel.ECHO_SUPPRESS_TTL_MS);
+        this.evictExpiredEchoEntries();
+    }
+    commitPullDelivery(_a, cursor_1, delivery_1) {
+        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, linkKey, link, isStale }, cursor, delivery) {
+            // Guard: if the link transitioned to repairing while this handler was
+            // in-flight, skip all state mutations — the repair process owns progression.
+            if (!link || !delivery.runtime || link.status !== 'live' || isStale()) {
+                return;
+            }
+            const entry = delivery.runtime.inflight.get(delivery.ordinal);
+            if (entry) {
+                entry.committed = true;
+            }
+            ReplicationLedger.setReceivedToken(link.pull, cursor);
+            const drained = this.drainCommittedPull(linkKey);
+            if (drained > 0) {
+                yield this.ledger.saveLink(link);
+                this.emitPullCheckpointAdvance(link);
+            }
+            if (delivery.runtime.inflight.size > MAX_PENDING_TOKENS) {
+                console.warn(`SyncEngineLevel: Pull in-flight overflow for ${did} -> ${dwnUrl}, transitioning to repairing`);
+                yield this.transitionToRepairing(linkKey, link);
+            }
+        });
+    }
+    emitPullCheckpointAdvance(link) {
+        if (!link.pull.contiguousAppliedToken) {
+            return;
+        }
+        // Emit after durable save — "advanced" means persisted.
+        this.emitEvent(Object.assign(Object.assign({ type: 'checkpoint:pull-advance', tenantDid: link.tenantDid, remoteEndpoint: link.remoteEndpoint }, syncEventScope(link.scope)), { position: link.pull.contiguousAppliedToken.position, messageCid: link.pull.contiguousAppliedToken.messageCid }));
+    }
+    handleLivePullProcessingError(_a, event_1, error_1) {
+        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, linkKey, link, isStale }, event, error) {
+            console.error(`SyncEngineLevel: Error processing live-pull event for ${did}`, error);
+            yield this.recordPullProcessingFailure({ did, dwnUrl, event, error });
+            // A failed processRawMessage means local state is incomplete. Transition
+            // to repairing immediately — do NOT advance the checkpoint past this
+            // failure or let later ordinals commit past it. SMT reconciliation will
+            // discover and fill the gap.
+            if (link && !isStale()) {
+                yield this.transitionToRepairing(linkKey, link);
+            }
+        });
+    }
+    recordPullProcessingFailure(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, event, error }) {
+            var _b;
+            try {
+                const failedCid = yield Message.getCid(event.message);
+                void this.recordDeadLetter({
+                    messageCid: failedCid,
+                    tenantDid: did,
+                    remoteEndpoint: dwnUrl,
+                    protocol: event.message.descriptor.protocol,
+                    category: 'pull-processing',
+                    errorDetail: (_b = error.message) !== null && _b !== void 0 ? _b : String(error),
+                });
+            }
+            catch (_c) {
+                // Best effort — don't let dead letter recording block repair.
+            }
+        });
+    }
+    // ---------------------------------------------------------------------------
+    // Live push: local EventLog subscription for immediate push
+    // ---------------------------------------------------------------------------
+    /**
+     * Subscribes to the local DWN's EventLog so that writes by the user are
+     * immediately pushed to the remote DWN instead of waiting for the next poll.
+     */
+    openLocalPushSubscription(target) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { did, delegateDid, dwnUrl } = target;
+            const protocol = singleProtocolForSyncScope(target.scope);
+            const filters = target.scope.kind === 'protocolSet'
+                ? target.scope.protocols.map(protocol => ({ protocol }))
+                : [];
             const handlerGeneration = this._engineGeneration;
             // Capture the link for identity-based staleness detection.
             const capturedPushLink = this._activeLinks.get(target.linkKey);
@@ -1768,12 +2299,19 @@ export class SyncEngineLevel {
                 if (subMessage.type !== 'event') {
                     return;
                 }
-                // Subset scope filtering: only push events that match the link's
-                // scope prefixes. Events outside the scope are not our responsibility.
+                // Subset scope filtering: only push events that match the link scope.
+                // Events outside the scope are not this link's responsibility.
                 const pushLinkKey = target.linkKey;
                 const pushLink = this._activeLinks.get(pushLinkKey);
-                if (pushLink && !isEventInScope(subMessage.event.message, pushLink.scope)) {
-                    return;
+                if (pushLink) {
+                    const scopeClassification = classifySyncEventScope(subMessage.event, pushLink.scope);
+                    if (scopeClassification === 'out-of-scope') {
+                        return;
+                    }
+                    if (scopeClassification === 'unknown') {
+                        this.markLinkNeedsReconcile(pushLinkKey, pushLink, 'push-scope-unclassified');
+                        return;
+                    }
                 }
                 // Accumulate the message CID for a debounced push.
                 const targetKey = pushLinkKey;
@@ -1788,7 +2326,11 @@ export class SyncEngineLevel {
                     return;
                 }
                 const pushRuntime = this.getOrCreatePushRuntime(targetKey, {
-                    did, dwnUrl, delegateDid, protocol,
+                    did,
+                    dwnUrl,
+                    delegateDid,
+                    protocol,
+                    permissionGrantIds: target.permissionGrantIds,
                 });
                 pushRuntime.entries.push({ cid });
                 // Immediate-first: if no push is in flight and no batch timer is
@@ -1806,20 +2348,20 @@ export class SyncEngineLevel {
                 target: did,
                 messageType: DwnInterface.MessagesSubscribe,
                 granteeDid: delegateDid,
-                messageParams: { filters, permissionGrantId },
+                messageParams: { filters, permissionGrantIds: toMessagesPermissionGrantIds(target.permissionGrantIds) },
                 subscriptionHandler: subscriptionHandler,
             });
             const reply = response.reply;
             if (reply.status.code !== 200 || !reply.subscription) {
                 throw new Error(`SyncEngineLevel: Local MessagesSubscribe failed for ${did}: ${reply.status.code} ${reply.status.detail}`);
             }
+            const close = () => __awaiter(this, void 0, void 0, function* () { yield reply.subscription.close(); });
             this._localSubscriptions.push({
-                linkKey: (_a = target.linkKey) !== null && _a !== void 0 ? _a : buildLegacyCursorKey(did, dwnUrl, protocol),
+                linkKey: target.linkKey,
                 did,
                 dwnUrl,
                 delegateDid,
-                protocol,
-                close: () => __awaiter(this, void 0, void 0, function* () { yield reply.subscription.close(); }),
+                close,
             });
         });
     }
@@ -1835,108 +2377,148 @@ export class SyncEngineLevel {
     }
     flushPendingPushesForLink(linkKey) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
-            // Guard: bail if this link was hot-removed. Without this, a stale
-            // debounce timer or retry callback could send pushes after the DID
-            // was removed.
-            if (!this._activeLinks.has(linkKey)) {
-                return;
-            }
-            const pushRuntime = this._pushRuntimes.get(linkKey);
-            if (!pushRuntime) {
-                return;
-            }
-            // Capture the current active link identity so we can detect
-            // remove+re-add during the await pushMessages() call.
-            const flushLink = this._activeLinks.get(linkKey);
-            const isFlushStale = () => !this._activeLinks.has(linkKey) ||
-                (flushLink !== undefined && this._activeLinks.get(linkKey) !== flushLink);
-            const { did, dwnUrl, delegateDid, protocol, entries: pushEntries, retryCount } = pushRuntime;
-            pushRuntime.entries = [];
-            if (pushEntries.length === 0) {
-                if (!pushRuntime.timer && !pushRuntime.flushing && retryCount === 0) {
-                    this._pushRuntimes.delete(linkKey);
-                }
+            const batch = this.takePushFlushBatch(linkKey);
+            if (!batch) {
                 return;
             }
-            const cids = pushEntries.map((entry) => entry.cid);
-            pushRuntime.flushing = true;
+            const { pushRuntime, pushEntries, isStale } = batch;
+            const { did, dwnUrl, delegateDid, protocol, permissionGrantIds, retryCount } = pushRuntime;
             try {
                 const result = yield pushMessages({
-                    did, dwnUrl, delegateDid, protocol,
-                    messageCids: cids,
+                    did,
+                    dwnUrl,
+                    delegateDid,
+                    permissionGrantIds,
+                    messageCids: pushEntries.map((entry) => entry.cid),
                     agent: this.agent,
-                    permissionsApi: this._permissionsApi,
                 });
-                // If the link was replaced during pushMessages, abandon all
-                // post-push state mutations — the replacement session owns this key.
-                if (isFlushStale()) {
-                    return;
-                }
-                // Auto-clear dead letters for CIDs that succeeded — a previously
-                // failed message may have been repaired by reconciliation.
-                for (const cid of result.succeeded) {
-                    this.clearFailedMessage(cid, dwnUrl).catch(() => { });
-                }
-                // Record permanently failed messages in the dead letter store.
-                for (const entry of result.permanentlyFailed) {
-                    yield this.recordDeadLetter({
-                        messageCid: entry.cid,
-                        tenantDid: did,
-                        remoteEndpoint: dwnUrl,
-                        protocol,
-                        category: 'push-permanent',
-                        errorCode: String((_a = entry.statusCode) !== null && _a !== void 0 ? _a : ''),
-                        errorDetail: (_b = entry.detail) !== null && _b !== void 0 ? _b : 'permanent push failure',
-                    });
-                }
-                if (result.failed.length > 0) {
-                    if (isFlushStale()) {
-                        return;
-                    }
-                    const failedSet = new Set(result.failed);
-                    const failedEntries = pushEntries.filter((entry) => failedSet.has(entry.cid));
-                    this.requeueOrReconcile(linkKey, {
-                        did, dwnUrl, delegateDid, protocol,
-                        entries: failedEntries,
-                        retryCount: retryCount + 1,
-                    });
-                }
-                else {
-                    // Successful push — reset retry count so subsequent unrelated
-                    // batches on this link start with a fresh budget.
-                    pushRuntime.retryCount = 0;
-                    if (!pushRuntime.timer && pushRuntime.entries.length === 0) {
-                        this._pushRuntimes.delete(linkKey);
-                    }
-                }
-            }
-            catch (error) {
-                if (isFlushStale()) {
+                yield this.handlePushBatchResult(linkKey, batch, result);
+            }
+            catch (error) {
+                if (isStale()) {
                     return;
                 }
                 console.error(`SyncEngineLevel: Push batch failed for ${did} -> ${dwnUrl}`, error);
                 this.requeueOrReconcile(linkKey, {
-                    did, dwnUrl, delegateDid, protocol,
+                    did,
+                    dwnUrl,
+                    delegateDid,
+                    protocol,
+                    permissionGrantIds,
                     entries: pushEntries,
                     retryCount: retryCount + 1,
                 });
             }
             finally {
-                pushRuntime.flushing = false;
-                // If new entries accumulated while this push was in flight, schedule
-                // a short drain to flush them. This gives a brief batching window
-                // for burst writes while keeping single-write latency low.
-                const rt = this._pushRuntimes.get(linkKey);
-                if (rt && rt.entries.length > 0 && !rt.timer) {
-                    rt.timer = setTimeout(() => {
-                        rt.timer = undefined;
-                        void this.flushPendingPushesForLink(linkKey);
-                    }, PUSH_DEBOUNCE_MS);
-                }
+                this.finishPushFlush(linkKey, pushRuntime);
+            }
+        });
+    }
+    takePushFlushBatch(linkKey) {
+        // Guard: bail if this link was hot-removed or is no longer live. Without
+        // this, a stale debounce timer or retry callback could send pushes after
+        // the DID was removed or the link entered repair/terminal state.
+        const flushLink = this._activeLinks.get(linkKey);
+        if ((flushLink === null || flushLink === void 0 ? void 0 : flushLink.status) !== 'live') {
+            const staleRuntime = this._pushRuntimes.get(linkKey);
+            if (staleRuntime === null || staleRuntime === void 0 ? void 0 : staleRuntime.timer) {
+                clearTimeout(staleRuntime.timer);
+            }
+            this._pushRuntimes.delete(linkKey);
+            return undefined;
+        }
+        const pushRuntime = this._pushRuntimes.get(linkKey);
+        if (!pushRuntime) {
+            return undefined;
+        }
+        const { entries: pushEntries, retryCount } = pushRuntime;
+        pushRuntime.entries = [];
+        if (pushEntries.length === 0) {
+            if (!pushRuntime.timer && !pushRuntime.flushing && retryCount === 0) {
+                this._pushRuntimes.delete(linkKey);
+            }
+            return undefined;
+        }
+        // Capture the current active link identity so we can detect
+        // remove+re-add during the await pushMessages() call.
+        const isStale = () => !this._activeLinks.has(linkKey) ||
+            (flushLink !== undefined && this._activeLinks.get(linkKey) !== flushLink);
+        pushRuntime.flushing = true;
+        return { pushRuntime, pushEntries, isStale };
+    }
+    handlePushBatchResult(linkKey, batch, result) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (batch.isStale()) {
+                return;
+            }
+            this.clearSucceededPushFailures(result.succeeded, batch.pushRuntime.dwnUrl);
+            yield this.recordPermanentPushFailures(batch.pushRuntime, result.permanentlyFailed);
+            if (result.failed.length > 0) {
+                this.requeueFailedPushes(linkKey, batch, result.failed);
+                return;
+            }
+            this.cleanupSuccessfulPushRuntime(linkKey, batch.pushRuntime);
+        });
+    }
+    clearSucceededPushFailures(cids, dwnUrl) {
+        for (const cid of cids) {
+            this.clearFailedMessage(cid, dwnUrl).catch(() => { });
+        }
+    }
+    recordPermanentPushFailures(pushRuntime, permanentlyFailed) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            for (const entry of permanentlyFailed) {
+                yield this.recordDeadLetter({
+                    messageCid: entry.cid,
+                    tenantDid: pushRuntime.did,
+                    remoteEndpoint: pushRuntime.dwnUrl,
+                    protocol: pushRuntime.protocol,
+                    category: 'push-permanent',
+                    errorCode: String((_a = entry.statusCode) !== null && _a !== void 0 ? _a : ''),
+                    errorDetail: (_b = entry.detail) !== null && _b !== void 0 ? _b : 'permanent push failure',
+                });
             }
         });
     }
+    requeueFailedPushes(linkKey, batch, failedCids) {
+        if (batch.isStale()) {
+            return;
+        }
+        const { did, dwnUrl, delegateDid, protocol, permissionGrantIds, retryCount } = batch.pushRuntime;
+        const failedSet = new Set(failedCids);
+        const failedEntries = batch.pushEntries.filter((entry) => failedSet.has(entry.cid));
+        this.requeueOrReconcile(linkKey, {
+            did,
+            dwnUrl,
+            delegateDid,
+            protocol,
+            permissionGrantIds,
+            entries: failedEntries,
+            retryCount: retryCount + 1,
+        });
+    }
+    cleanupSuccessfulPushRuntime(linkKey, pushRuntime) {
+        // Successful push — reset retry count so subsequent unrelated batches on
+        // this link start with a fresh budget.
+        pushRuntime.retryCount = 0;
+        if (!pushRuntime.timer && pushRuntime.entries.length === 0) {
+            this._pushRuntimes.delete(linkKey);
+        }
+    }
+    finishPushFlush(linkKey, pushRuntime) {
+        pushRuntime.flushing = false;
+        // If new entries accumulated while this push was in flight, schedule a
+        // short drain to flush them. This gives a brief batching window for burst
+        // writes while keeping single-write latency low.
+        const rt = this._pushRuntimes.get(linkKey);
+        if (rt && rt.entries.length > 0 && !rt.timer) {
+            rt.timer = setTimeout(() => {
+                rt.timer = undefined;
+                void this.flushPendingPushesForLink(linkKey);
+            }, PUSH_DEBOUNCE_MS);
+        }
+    }
     /**
      * Re-queues a failed push batch for retry, or marks the link
      * `needsReconcile` if retries are exhausted. Bounded to prevent
@@ -1964,34 +2546,692 @@ export class SyncEngineLevel {
             }
             this._pushRuntimes.delete(targetKey);
             const link = this._activeLinks.get(targetKey);
-            if (link && !link.needsReconcile) {
-                link.needsReconcile = true;
-                void this.ledger.saveLink(link).then(() => {
-                    this.emitEvent({ type: 'reconcile:needed', tenantDid: pending.did, remoteEndpoint: pending.dwnUrl, protocol: pending.protocol, reason: 'push-retry-exhausted' });
-                    this.scheduleReconcile(targetKey);
+            if (link) {
+                this.markLinkNeedsReconcile(targetKey, link, 'push-retry-exhausted');
+            }
+            return;
+        }
+        pushRuntime.entries.push(...pending.entries);
+        pushRuntime.retryCount = pending.retryCount;
+        const delayMs = (_a = SyncEngineLevel.PUSH_RETRY_BACKOFF_MS[pending.retryCount]) !== null && _a !== void 0 ? _a : 2000;
+        if (pushRuntime.timer) {
+            clearTimeout(pushRuntime.timer);
+        }
+        pushRuntime.timer = setTimeout(() => {
+            pushRuntime.timer = undefined;
+            void this.flushPendingPushesForLink(targetKey);
+        }, delayMs);
+    }
+    markLinkNeedsReconcile(linkKey, link, reason) {
+        if (link.needsReconcile) {
+            this.scheduleReconcile(linkKey);
+            return;
+        }
+        link.needsReconcile = true;
+        void this.ledger.saveLink(link).then(() => {
+            this.emitEvent(Object.assign(Object.assign({ type: 'reconcile:needed', tenantDid: link.tenantDid, remoteEndpoint: link.remoteEndpoint }, syncEventScope(link.scope)), { reason }));
+            this.scheduleReconcile(linkKey);
+        }).catch((error) => {
+            console.error(`SyncEngineLevel: Failed to mark link for reconciliation ${link.tenantDid} -> ${link.remoteEndpoint}`, error);
+        });
+    }
+    createLinkReconciler(shouldContinue) {
+        return new SyncLinkReconciler({
+            getLocalRoot: (did, delegateDid, protocol, permissionGrantIds) => __awaiter(this, void 0, void 0, function* () { return this.getLocalRoot(did, delegateDid, protocol, permissionGrantIds); }),
+            getRemoteRoot: (did, dwnUrl, delegateDid, protocol, permissionGrantIds) => __awaiter(this, void 0, void 0, function* () { return this.getRemoteRoot(did, dwnUrl, delegateDid, protocol, permissionGrantIds); }),
+            diffWithRemote: (target) => __awaiter(this, void 0, void 0, function* () { return this.diffWithRemote(target); }),
+            pullMessages: (params) => __awaiter(this, void 0, void 0, function* () { return this.pullMessages(params); }),
+            pushMessages: (params) => __awaiter(this, void 0, void 0, function* () { return this.pushMessages(params); }),
+            shouldContinue,
+        });
+    }
+    getReconcileProtocols(scope) {
+        var _a;
+        return (_a = protocolsForSyncScope(scope)) !== null && _a !== void 0 ? _a : [undefined];
+    }
+    getAuthorizationGrantIds(authorization) {
+        return authorization.kind === 'delegate' ? authorization.permissionGrantIds : undefined;
+    }
+    reconcileProjectionTarget(target, options, shouldContinue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (target.scope.kind === 'recordsProjection') {
+                return this.reconcileRecordsProjectionTarget(target, target.scope, options, shouldContinue);
+            }
+            if (target.scope.kind === 'protocolSet' && target.scope.protocols.length > 1) {
+                return this.reconcileProtocolSetProjectionTarget(target, options, shouldContinue);
+            }
+            let converged = true;
+            const permissionGrantIds = this.getAuthorizationGrantIds(target.authorization);
+            const reconciler = this.createLinkReconciler(shouldContinue);
+            for (const protocol of this.getReconcileProtocols(target.scope)) {
+                const outcome = yield reconciler.reconcile({
+                    did: target.did,
+                    dwnUrl: target.dwnUrl,
+                    delegateDid: target.delegateDid,
+                    protocol,
+                    permissionGrantIds,
+                }, options);
+                if (outcome.aborted) {
+                    return { aborted: true };
+                }
+                if ((options === null || options === void 0 ? void 0 : options.verifyConvergence) === true && outcome.converged !== true) {
+                    converged = false;
+                }
+            }
+            return (options === null || options === void 0 ? void 0 : options.verifyConvergence) === true ? { converged } : {};
+        });
+    }
+    reconcileRecordsProjectionTarget(target, scope, options, shouldContinue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const permissionGrantIds = this.getAuthorizationGrantIds(target.authorization);
+            const localRoot = yield this.getLocalProjectedRoot(target.did, target.delegateDid, scope.scopes, permissionGrantIds);
+            if ((shouldContinue === null || shouldContinue === void 0 ? void 0 : shouldContinue()) === false) {
+                return { aborted: true };
+            }
+            const remoteRoot = yield this.getRemoteProjectedRoot(target.did, target.dwnUrl, target.delegateDid, scope.scopes, permissionGrantIds);
+            if ((shouldContinue === null || shouldContinue === void 0 ? void 0 : shouldContinue()) === false) {
+                return { aborted: true };
+            }
+            if (localRoot !== remoteRoot) {
+                const diff = yield this.diffProjectedWithRemote({
+                    did: target.did,
+                    dwnUrl: target.dwnUrl,
+                    delegateDid: target.delegateDid,
+                    scopes: scope.scopes,
+                    permissionGrantIds,
+                });
+                if ((shouldContinue === null || shouldContinue === void 0 ? void 0 : shouldContinue()) === false) {
+                    return { aborted: true };
+                }
+                const aborted = yield this.applyProjectedDiff(target, scope, diff, permissionGrantIds, options, shouldContinue);
+                if (aborted) {
+                    return { aborted: true };
+                }
+            }
+            if ((options === null || options === void 0 ? void 0 : options.verifyConvergence) !== true) {
+                return {};
+            }
+            const postLocalRoot = yield this.getLocalProjectedRoot(target.did, target.delegateDid, scope.scopes, permissionGrantIds);
+            if ((shouldContinue === null || shouldContinue === void 0 ? void 0 : shouldContinue()) === false) {
+                return { aborted: true };
+            }
+            const postRemoteRoot = yield this.getRemoteProjectedRoot(target.did, target.dwnUrl, target.delegateDid, scope.scopes, permissionGrantIds);
+            if ((shouldContinue === null || shouldContinue === void 0 ? void 0 : shouldContinue()) === false) {
+                return { aborted: true };
+            }
+            return { converged: postLocalRoot === postRemoteRoot };
+        });
+    }
+    reconcileProtocolSetProjectionTarget(target, options, shouldContinue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (target.scope.kind !== 'protocolSet') {
+                return {};
+            }
+            const scope = target.scope;
+            const permissionGrantIds = this.getAuthorizationGrantIds(target.authorization);
+            const diffPlan = yield this.collectProtocolSetDiffPlan(target, scope, permissionGrantIds, shouldContinue);
+            if (!diffPlan) {
+                return { aborted: true };
+            }
+            if (diffPlan.changedProtocols.length === 0) {
+                return (options === null || options === void 0 ? void 0 : options.verifyConvergence) === true ? { converged: true } : {};
+            }
+            const aborted = yield this.applyProtocolSetDiffPlan(target, scope, diffPlan, permissionGrantIds, options, shouldContinue);
+            if (aborted) {
+                return { aborted: true };
+            }
+            if ((options === null || options === void 0 ? void 0 : options.verifyConvergence) !== true) {
+                return {};
+            }
+            return this.verifyProtocolSetConvergence(target, diffPlan.changedProtocols, permissionGrantIds, shouldContinue);
+        });
+    }
+    collectProtocolSetDiffPlan(target, scope, permissionGrantIds, shouldContinue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const plan = { changedProtocols: [], onlyRemote: [], onlyLocal: [] };
+            for (const protocol of scope.protocols) {
+                const roots = yield this.getProtocolRoots(target, protocol, permissionGrantIds, shouldContinue);
+                if (!roots) {
+                    return undefined;
+                }
+                if (roots.localRoot === roots.remoteRoot) {
+                    continue;
+                }
+                plan.changedProtocols.push(protocol);
+                const diff = yield this.diffWithRemote({
+                    did: target.did,
+                    dwnUrl: target.dwnUrl,
+                    delegateDid: target.delegateDid,
+                    protocol,
+                    permissionGrantIds,
+                });
+                if ((shouldContinue === null || shouldContinue === void 0 ? void 0 : shouldContinue()) === false) {
+                    return undefined;
+                }
+                plan.onlyRemote.push(...diff.onlyRemote);
+                plan.onlyLocal.push(...diff.onlyLocal);
+            }
+            return plan;
+        });
+    }
+    getProtocolRoots(target, protocol, permissionGrantIds, shouldContinue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const localRoot = yield this.getLocalRoot(target.did, target.delegateDid, protocol, permissionGrantIds);
+            if ((shouldContinue === null || shouldContinue === void 0 ? void 0 : shouldContinue()) === false) {
+                return undefined;
+            }
+            const remoteRoot = yield this.getRemoteRoot(target.did, target.dwnUrl, target.delegateDid, protocol, permissionGrantIds);
+            if ((shouldContinue === null || shouldContinue === void 0 ? void 0 : shouldContinue()) === false) {
+                return undefined;
+            }
+            return { localRoot, remoteRoot };
+        });
+    }
+    applyProtocolSetDiffPlan(target, scope, diffPlan, permissionGrantIds, options, shouldContinue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Keep the remote diff combined across protocols so topologicalSort can
+            // order composed protocol configs before records that use them. Any future
+            // chunking for large protocol sets must preserve this global dependency
+            // order instead of reverting to independent per-protocol chunks.
+            if ((options === null || options === void 0 ? void 0 : options.direction) !== 'push' &&
+                diffPlan.onlyRemote.length > 0 &&
+                (yield this.pullRemoteDiffEntries(target, scope, diffPlan.onlyRemote, permissionGrantIds, shouldContinue))) {
+                return true;
+            }
+            if ((options === null || options === void 0 ? void 0 : options.direction) === 'pull' || diffPlan.onlyLocal.length === 0) {
+                return false;
+            }
+            return this.pushLocalDiffEntries(target, diffPlan.onlyLocal, permissionGrantIds, shouldContinue);
+        });
+    }
+    applyProjectedDiff(target, scope, diff, permissionGrantIds, options, shouldContinue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (yield this.pullProjectedRemoteDiff(target, scope, diff, permissionGrantIds, options, shouldContinue)) {
+                return true;
+            }
+            return this.pushProjectedLocalDiff(target, diff.onlyLocal, permissionGrantIds, options, shouldContinue);
+        });
+    }
+    pullProjectedRemoteDiff(target, scope, diff, permissionGrantIds, options, shouldContinue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if ((options === null || options === void 0 ? void 0 : options.direction) === 'push' || diff.onlyRemote.length === 0) {
+                return false;
+            }
+            return this.pullRemoteDiffEntries(target, scope, diff.onlyRemote, permissionGrantIds, shouldContinue, (_a = diff.dependencies) !== null && _a !== void 0 ? _a : []);
+        });
+    }
+    pushProjectedLocalDiff(target, onlyLocal, permissionGrantIds, options, shouldContinue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if ((options === null || options === void 0 ? void 0 : options.direction) === 'pull' || onlyLocal.length === 0) {
+                return false;
+            }
+            return this.pushLocalDiffEntries(target, onlyLocal, permissionGrantIds, shouldContinue);
+        });
+    }
+    pullRemoteDiffEntries(target_1, scope_1, onlyRemote_1, permissionGrantIds_1, shouldContinue_1) {
+        return __awaiter(this, arguments, void 0, function* (target, scope, onlyRemote, permissionGrantIds, shouldContinue, dependencies = []) {
+            const primaryEntries = SyncEngineLevel.dedupeRemoteEntries(onlyRemote);
+            try {
+                let verifiedInitialWrites = [];
+                if (scope.kind === 'recordsProjection') {
+                    verifiedInitialWrites = yield this.pullProjectedDependencyHints(target, scope, primaryEntries, dependencies, permissionGrantIds, shouldContinue);
+                }
+                const { prefetched, needsFetchCids } = partitionRemoteEntries(primaryEntries);
+                yield this.pullMessages({
+                    did: target.did,
+                    dwnUrl: target.dwnUrl,
+                    delegateDid: target.delegateDid,
+                    scope,
+                    permissionGrantIds,
+                    messageCids: needsFetchCids,
+                    prefetched,
+                    verifiedInitialWrites,
+                    shouldContinue,
                 });
             }
+            catch (error) {
+                if (error instanceof SyncPullAbortedError) {
+                    return true;
+                }
+                throw error;
+            }
+            return (shouldContinue === null || shouldContinue === void 0 ? void 0 : shouldContinue()) === false;
+        });
+    }
+    pullProjectedDependencyHints(target, scope, primaryEntries, dependencies, permissionGrantIds, shouldContinue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const verified = yield this.verifyProjectedDependencies(target.did, scope, primaryEntries, dependencies);
+            if (verified.length === 0) {
+                return [];
+            }
+            yield this.pullMessages({
+                did: target.did,
+                dwnUrl: target.dwnUrl,
+                delegateDid: target.delegateDid,
+                scope: SyncEngineLevel.protocolSetScopeForProjectedDependencies(verified),
+                permissionGrantIds,
+                messageCids: [],
+                prefetched: verified,
+                shouldContinue,
+            });
+            return SyncEngineLevel.recordsInitialWritesFromVerifiedDependencies(verified);
+        });
+    }
+    verifyProjectedDependencies(tenantDid, scope, primaryEntries, dependencies) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const primaryByCid = SyncEngineLevel.indexEntriesWithMessage(primaryEntries);
+            const initialWritesByRoot = yield this.collectProjectedRecordsInitialWriteDependencies(scope, primaryByCid, dependencies);
+            const protocolConfigs = yield this.verifyProjectedProtocolConfigDependencies(tenantDid, scope, primaryEntries, dependencies, initialWritesByRoot);
+            return SyncEngineLevel.dedupeDependencyEntries([
+                ...protocolConfigs,
+                ...initialWritesByRoot.values(),
+            ]);
+        });
+    }
+    verifyProjectedProtocolConfigDependencies(tenantDid_1, scope_1, primaryEntries_1, dependencies_1) {
+        return __awaiter(this, arguments, void 0, function* (tenantDid, scope, primaryEntries, dependencies, initialWritesByRoot = new Map()) {
+            var _a;
+            // Projected sync dependency entries are untrusted server hints. Before any
+            // config is applied, bind it to an accepted primary record by CID,
+            // tenant authorship, signature, timestamp, scope, and protocol closure;
+            // malformed or unrelated hints are ignored.
+            const primaryByCid = SyncEngineLevel.indexEntriesWithMessage(primaryEntries);
+            const candidatesByRoot = yield this.collectProjectedProtocolConfigCandidates(tenantDid, scope, primaryByCid, dependencies, initialWritesByRoot);
+            const verified = new Map();
+            for (const [rootMessageCid, rootCandidates] of candidatesByRoot) {
+                const primary = primaryByCid.get(rootMessageCid);
+                const rootRecordsWrite = primary === undefined
+                    ? undefined
+                    : SyncEngineLevel.protocolConfigRootRecordsWrite(primary.message, (_a = initialWritesByRoot.get(rootMessageCid)) === null || _a === void 0 ? void 0 : _a.message);
+                const rootProtocol = SyncEngineLevel.recordsWriteProtocol(rootRecordsWrite);
+                if (rootProtocol === undefined) {
+                    continue;
+                }
+                for (const dependency of SyncEngineLevel.filterProtocolConfigClosure(rootProtocol, rootCandidates)) {
+                    verified.set(dependency.messageCid, dependency);
+                }
+            }
+            return [...verified.values()];
+        });
+    }
+    static indexEntriesWithMessage(entries) {
+        const entriesByCid = new Map();
+        for (const entry of entries) {
+            if (SyncEngineLevel.hasMessage(entry)) {
+                entriesByCid.set(entry.messageCid, entry);
+            }
+        }
+        return entriesByCid;
+    }
+    static recordsInitialWritesFromVerifiedDependencies(entries) {
+        const initialWrites = [];
+        for (const entry of entries) {
+            if (SyncEngineLevel.hasMessage(entry) && SyncEngineLevel.isRecordsWriteMessage(entry.message)) {
+                initialWrites.push(entry.message);
+            }
+        }
+        return initialWrites;
+    }
+    collectProjectedRecordsInitialWriteDependencies(scope, primaryByCid, dependencies) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dependenciesByRoot = new Map();
+            for (const dependency of dependencies) {
+                const verified = yield this.verifyRecordsInitialWriteCandidate(scope, primaryByCid, dependency);
+                if (verified === undefined) {
+                    continue;
+                }
+                dependenciesByRoot.set(verified.rootMessageCid, verified.dependency);
+            }
+            return dependenciesByRoot;
+        });
+    }
+    verifyRecordsInitialWriteCandidate(scope, primaryByCid, dependency) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (dependency.dependencyClass !== 'recordsInitialWrite' ||
+                !SyncEngineLevel.hasMessage(dependency) ||
+                SyncEngineLevel.hasDependencyPayloadBytes(dependency)) {
+                return undefined;
+            }
+            const primary = primaryByCid.get(dependency.rootMessageCid);
+            if (primary === undefined ||
+                !SyncEngineLevel.isRecordsDeleteMessage(primary.message) ||
+                !(yield SyncEngineLevel.projectedDependencyCidsMatch({
+                    dependencyCid: dependency.messageCid,
+                    dependencyMessage: dependency.message,
+                    primaryCid: primary.messageCid,
+                    primaryMessage: primary.message,
+                }))) {
+                return undefined;
+            }
+            const initialWrite = yield this.toAuthenticatedRecordsInitialWriteDependency(dependency);
+            if (initialWrite === undefined ||
+                initialWrite.message.recordId !== SyncEngineLevel.recordsDeleteRecordId(primary.message) ||
+                classifySyncMessageScope({ message: primary.message, initialWrite: initialWrite.message, scope }) !== 'in-scope') {
+                return undefined;
+            }
+            return { dependency: initialWrite, rootMessageCid: dependency.rootMessageCid };
+        });
+    }
+    toAuthenticatedRecordsInitialWriteDependency(dependency) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!SyncEngineLevel.isRecordsWriteMessage(dependency.message)) {
+                return undefined;
+            }
+            try {
+                const recordsWrite = yield RecordsWrite.parse(dependency.message);
+                yield authenticate(recordsWrite.message.authorization, this.agent.did, recordsWrite.message.attestation);
+                return (yield recordsWrite.isInitialWrite())
+                    ? Object.assign(Object.assign({}, dependency), { message: recordsWrite.message }) : undefined;
+            }
+            catch (_a) {
+                return undefined;
+            }
+        });
+    }
+    collectProjectedProtocolConfigCandidates(tenantDid, scope, primaryByCid, dependencies, initialWritesByRoot) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const candidatesByRoot = new Map();
+            for (const dependency of dependencies) {
+                const verified = yield this.verifyProtocolConfigCandidate(tenantDid, scope, primaryByCid, dependency, initialWritesByRoot);
+                if (verified === undefined) {
+                    continue;
+                }
+                const rootCandidates = (_a = candidatesByRoot.get(verified.rootMessageCid)) !== null && _a !== void 0 ? _a : [];
+                rootCandidates.push(verified.dependency);
+                candidatesByRoot.set(verified.rootMessageCid, rootCandidates);
+            }
+            return candidatesByRoot;
+        });
+    }
+    verifyProtocolConfigCandidate(tenantDid, scope, primaryByCid, dependency, initialWritesByRoot) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (dependency.dependencyClass !== 'protocolsConfigure' || !SyncEngineLevel.hasMessage(dependency)) {
+                return undefined;
+            }
+            const primary = primaryByCid.get(dependency.rootMessageCid);
+            if (primary === undefined) {
+                return undefined;
+            }
+            const verifiedDependency = yield this.verifyProtocolConfigCandidateMessage(tenantDid, scope, primary, dependency, (_a = initialWritesByRoot.get(dependency.rootMessageCid)) === null || _a === void 0 ? void 0 : _a.message);
+            return verifiedDependency === undefined
+                ? undefined
+                : { dependency: verifiedDependency, rootMessageCid: dependency.rootMessageCid };
+        });
+    }
+    verifyProtocolConfigCandidateMessage(tenantDid, scope, primary, dependency, initialWrite) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Protocol authorization is temporal: a record is governed by the protocol
+            // definition active at its creation timestamp. Future configs may add
+            // unrelated `uses` dependencies, so they must not widen this primary's
+            // dependency closure.
+            if (!(yield SyncEngineLevel.projectedDependencyCidsMatch({
+                dependencyCid: dependency.messageCid,
+                dependencyMessage: dependency.message,
+                primaryCid: primary.messageCid,
+                primaryMessage: primary.message,
+            }))) {
+                return undefined;
+            }
+            const authenticatedDependency = yield this.toAuthenticatedProtocolConfigDependency(tenantDid, dependency);
+            if (authenticatedDependency === undefined) {
+                return undefined;
+            }
+            const rootRecordsWrite = SyncEngineLevel.protocolConfigRootRecordsWrite(primary.message, initialWrite);
+            const primaryIsInScope = rootRecordsWrite !== undefined &&
+                classifySyncMessageScope({ message: primary.message, initialWrite, scope }) === 'in-scope';
+            if (!primaryIsInScope ||
+                !SyncEngineLevel.protocolsConfigureIsNotNewerThanRecordsWrite(authenticatedDependency.message, rootRecordsWrite)) {
+                return undefined;
+            }
+            return authenticatedDependency;
+        });
+    }
+    toAuthenticatedProtocolConfigDependency(tenantDid, dependency) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const config = yield this.toAuthenticatedTenantProtocolConfig(tenantDid, dependency.message);
+            if (config === undefined) {
+                return undefined;
+            }
+            return Object.assign(Object.assign({}, dependency), { message: config });
+        });
+    }
+    static projectedDependencyCidsMatch(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ dependencyCid, dependencyMessage, primaryCid, primaryMessage, }) {
+            return (yield Message.getCid(primaryMessage)) === primaryCid &&
+                (yield Message.getCid(dependencyMessage)) === dependencyCid;
+        });
+    }
+    static recordsWriteProtocol(message) {
+        if (!SyncEngineLevel.isRecordsWriteProtocolMessage(message)) {
+            return undefined;
+        }
+        const { protocol } = message.descriptor;
+        return typeof protocol === 'string' ? protocol : undefined;
+    }
+    static recordsDeleteRecordId(message) {
+        if (!SyncEngineLevel.isRecordsDeleteMessage(message)) {
+            return undefined;
+        }
+        const recordId = message.descriptor.recordId;
+        return typeof recordId === 'string' ? recordId : undefined;
+    }
+    static protocolConfigRootRecordsWrite(primary, initialWrite) {
+        if (SyncEngineLevel.isRecordsWriteMessage(primary)) {
+            return primary;
+        }
+        return SyncEngineLevel.isRecordsDeleteMessage(primary) ? initialWrite : undefined;
+    }
+    static protocolsConfigureProtocol(message) {
+        return message.descriptor.definition.protocol;
+    }
+    static protocolsConfigureProtocolFromGenericMessage(message) {
+        if (!SyncEngineLevel.isProtocolsConfigureDefinitionMessage(message)) {
+            return undefined;
+        }
+        return message.descriptor.definition.protocol;
+    }
+    static protocolsConfigureIsNotNewerThanRecordsWrite(protocolsConfigureMessage, recordsWriteMessage) {
+        return protocolsConfigureMessage.descriptor.messageTimestamp <= recordsWriteMessage.descriptor.messageTimestamp;
+    }
+    static protocolsConfigureUses(message) {
+        var _a;
+        const uses = (_a = message.descriptor.definition) === null || _a === void 0 ? void 0 : _a.uses;
+        return uses === undefined
+            ? []
+            : Object.values(uses).filter((protocol) => typeof protocol === 'string');
+    }
+    static hasMessage(entry) {
+        return (entry === null || entry === void 0 ? void 0 : entry.message) !== undefined;
+    }
+    static isRecordsWriteProtocolMessage(message) {
+        return (message === null || message === void 0 ? void 0 : message.descriptor.interface) === DwnInterfaceName.Records &&
+            message.descriptor.method === DwnMethodName.Write;
+    }
+    static isRecordsWriteMessage(message) {
+        return SyncEngineLevel.isRecordsWriteProtocolMessage(message) &&
+            'recordId' in message &&
+            typeof message.recordId === 'string' &&
+            'contextId' in message &&
+            typeof message.contextId === 'string';
+    }
+    static isRecordsDeleteMessage(message) {
+        return message.descriptor.interface === DwnInterfaceName.Records &&
+            message.descriptor.method === DwnMethodName.Delete;
+    }
+    static isProtocolsConfigureDefinitionMessage(message) {
+        return message.descriptor.interface === DwnInterfaceName.Protocols &&
+            message.descriptor.method === DwnMethodName.Configure &&
+            message.authorization !== undefined &&
+            SyncEngineLevel.hasProtocolsConfigureDefinition(message.descriptor);
+    }
+    static hasProtocolsConfigureDefinition(descriptor) {
+        return SyncEngineLevel.isProtocolsConfigureDefinition(descriptor.definition);
+    }
+    static isProtocolsConfigureDefinition(definition) {
+        return typeof definition === 'object' &&
+            definition !== null &&
+            'protocol' in definition &&
+            typeof definition.protocol === 'string';
+    }
+    static filterProtocolConfigClosure(primaryProtocol, candidates) {
+        // Start from the primary record's protocol and walk only protocols named by
+        // accepted, signed config definitions. This keeps composed-protocol support
+        // narrow: the governing config can admit its `uses` targets, but arbitrary
+        // protocol config hints cannot enter the apply set.
+        const candidatesByProtocol = SyncEngineLevel.groupGoverningProtocolConfigCandidatesByProtocol(candidates);
+        const visitedProtocols = new Set();
+        const pendingProtocols = [primaryProtocol];
+        const accepted = new Map();
+        for (let protocol = SyncEngineLevel.takeNextUnvisitedProtocol(pendingProtocols, visitedProtocols); protocol !== undefined; protocol = SyncEngineLevel.takeNextUnvisitedProtocol(pendingProtocols, visitedProtocols)) {
+            SyncEngineLevel.acceptProtocolConfigCandidates({
+                protocol,
+                candidatesByProtocol,
+                visitedProtocols,
+                pendingProtocols,
+                accepted,
+            });
+        }
+        return [...accepted.values()];
+    }
+    static groupGoverningProtocolConfigCandidatesByProtocol(candidates) {
+        const candidatesByProtocol = new Map();
+        for (const candidate of candidates) {
+            const protocol = SyncEngineLevel.protocolsConfigureProtocol(candidate.message);
+            const existing = candidatesByProtocol.get(protocol);
+            if (existing !== undefined && SyncEngineLevel.isProtocolConfigCandidateAtLeastAsNew(existing, candidate)) {
+                continue;
+            }
+            candidatesByProtocol.set(protocol, candidate);
+        }
+        return candidatesByProtocol;
+    }
+    static isProtocolConfigCandidateAtLeastAsNew(existing, candidate) {
+        const existingTimestamp = existing.message.descriptor.messageTimestamp;
+        const candidateTimestamp = candidate.message.descriptor.messageTimestamp;
+        if (existingTimestamp !== candidateTimestamp) {
+            return existingTimestamp > candidateTimestamp;
+        }
+        return lexicographicalCompare(existing.messageCid, candidate.messageCid) >= 0;
+    }
+    static takeNextUnvisitedProtocol(pendingProtocols, visitedProtocols) {
+        while (pendingProtocols.length > 0) {
+            const protocol = pendingProtocols.shift();
+            if (visitedProtocols.has(protocol)) {
+                continue;
+            }
+            visitedProtocols.add(protocol);
+            return protocol;
+        }
+        return undefined;
+    }
+    static acceptProtocolConfigCandidates({ protocol, candidatesByProtocol, visitedProtocols, pendingProtocols, accepted, }) {
+        const candidate = candidatesByProtocol.get(protocol);
+        if (candidate === undefined) {
             return;
         }
-        pushRuntime.entries.push(...pending.entries);
-        pushRuntime.retryCount = pending.retryCount;
-        const delayMs = (_a = SyncEngineLevel.PUSH_RETRY_BACKOFF_MS[pending.retryCount]) !== null && _a !== void 0 ? _a : 2000;
-        if (pushRuntime.timer) {
-            clearTimeout(pushRuntime.timer);
+        accepted.set(candidate.messageCid, candidate);
+        SyncEngineLevel.queueUnvisitedProtocols(SyncEngineLevel.protocolsConfigureUses(candidate.message), visitedProtocols, pendingProtocols);
+    }
+    static queueUnvisitedProtocols(protocols, visitedProtocols, pendingProtocols) {
+        for (const protocol of protocols) {
+            if (!visitedProtocols.has(protocol)) {
+                pendingProtocols.push(protocol);
+            }
+        }
+    }
+    static protocolSetScopeForProjectedDependencies(dependencies) {
+        // Verification above is the security boundary. This protocolSet scope only
+        // routes already-verified config dependencies through the existing
+        // pull/apply path, which expects every prefetched message to be accepted by
+        // the supplied sync scope before it reaches processRawMessage().
+        const protocols = SyncEngineLevel.dedupeStrings(dependencies
+            .flatMap(dependency => SyncEngineLevel.projectedDependencyProtocols(dependency))).sort(lexicographicalCompare);
+        if (protocols.length === 0) {
+            throw new Error('SyncEngineLevel: projected dependency hints contained no protocols.');
+        }
+        return {
+            kind: 'protocolSet',
+            protocols: protocols,
+        };
+    }
+    static projectedDependencyProtocols(dependency) {
+        if (dependency.message === undefined) {
+            return [];
+        }
+        const protocol = dependency.dependencyClass === 'protocolsConfigure'
+            ? SyncEngineLevel.protocolsConfigureProtocolFromGenericMessage(dependency.message)
+            : SyncEngineLevel.recordsWriteProtocol(dependency.message);
+        return protocol === undefined ? [] : [protocol];
+    }
+    static hasDependencyPayloadBytes(dependency) {
+        if (dependency.encodedData !== undefined) {
+            return true;
+        }
+        const message = dependency.message;
+        return message !== undefined && 'encodedData' in message;
+    }
+    static dedupeDependencyEntries(dependencies) {
+        const deduped = new Map();
+        for (const dependency of dependencies) {
+            deduped.set(dependency.messageCid, dependency);
+        }
+        return [...deduped.values()];
+    }
+    pushLocalDiffEntries(target, onlyLocal, permissionGrantIds, shouldContinue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.pushMessages({
+                did: target.did,
+                dwnUrl: target.dwnUrl,
+                delegateDid: target.delegateDid,
+                permissionGrantIds,
+                messageCids: SyncEngineLevel.dedupeStrings(onlyLocal),
+            });
+            return (shouldContinue === null || shouldContinue === void 0 ? void 0 : shouldContinue()) === false;
+        });
+    }
+    verifyProtocolSetConvergence(target, changedProtocols, permissionGrantIds, shouldContinue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            for (const protocol of changedProtocols) {
+                const roots = yield this.getProtocolRoots(target, protocol, permissionGrantIds, shouldContinue);
+                if (!roots) {
+                    return { aborted: true };
+                }
+                if (roots.localRoot !== roots.remoteRoot) {
+                    return { converged: false };
+                }
+            }
+            return { converged: true };
+        });
+    }
+    static dedupeRemoteEntries(entries) {
+        const seen = new Set();
+        const unique = [];
+        for (const entry of entries) {
+            if (seen.has(entry.messageCid)) {
+                continue;
+            }
+            seen.add(entry.messageCid);
+            unique.push(entry);
         }
-        pushRuntime.timer = setTimeout(() => {
-            pushRuntime.timer = undefined;
-            void this.flushPendingPushesForLink(targetKey);
-        }, delayMs);
+        return unique;
     }
-    createLinkReconciler(shouldContinue) {
-        return new SyncLinkReconciler({
-            getLocalRoot: (did, delegateDid, protocol) => __awaiter(this, void 0, void 0, function* () { return this.getLocalRoot(did, delegateDid, protocol); }),
-            getRemoteRoot: (did, dwnUrl, delegateDid, protocol) => __awaiter(this, void 0, void 0, function* () { return this.getRemoteRoot(did, dwnUrl, delegateDid, protocol); }),
-            diffWithRemote: (target) => __awaiter(this, void 0, void 0, function* () { return this.diffWithRemote(target); }),
-            pullMessages: (params) => __awaiter(this, void 0, void 0, function* () { return this.pullMessages(params); }),
-            pushMessages: (params) => __awaiter(this, void 0, void 0, function* () { return this.pushMessages(params); }),
-            shouldContinue,
+    static dedupeStrings(values) {
+        return [...new Set(values)];
+    }
+    clearRootConvergenceDeadLettersForScope(tenantDid, remoteEndpoint, scope) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (scope.kind === 'recordsProjection' || (scope.kind === 'protocolSet' && scope.protocols.length > 1)) {
+                // Batched multi-protocol and projected pulls pass the full scope to
+                // pullMessages, so pull dead letters can be recorded without a single
+                // protocol bucket.
+                yield this.clearRootConvergenceDeadLetters(tenantDid, remoteEndpoint);
+            }
+            for (const protocol of this.getReconcileProtocols(scope)) {
+                yield this.clearRootConvergenceDeadLetters(tenantDid, remoteEndpoint, protocol);
+            }
         });
     }
     /**
@@ -2068,18 +3308,28 @@ export class SyncEngineLevel {
             // closure's captured `link` reference may no longer be the active
             // link object. Bail before mutating the replacement's state.
             const isStaleLink = () => this._activeLinks.get(linkKey) !== link;
-            const { tenantDid: did, remoteEndpoint: dwnUrl, delegateDid, protocol } = link;
+            const shouldContinue = () => this._engineGeneration === generation &&
+                !isStaleLink() &&
+                link.status === 'live';
+            const { tenantDid: did, remoteEndpoint: dwnUrl, delegateDid, scope, authorization } = link;
+            const eventScope = syncEventScope(scope);
             try {
-                const reconcileOutcome = yield this.createLinkReconciler(() => this._engineGeneration === generation && !isStaleLink()).reconcile({ did, dwnUrl, delegateDid, protocol }, { verifyConvergence: true });
+                const reconcileOutcome = yield this.reconcileProjectionTarget({
+                    did,
+                    dwnUrl,
+                    delegateDid,
+                    scope,
+                    authorization,
+                }, { verifyConvergence: true }, shouldContinue);
                 if (reconcileOutcome.aborted || isStaleLink()) {
                     return;
                 }
                 if (reconcileOutcome.converged) {
                     yield this.ledger.clearNeedsReconcile(link);
-                    // SMT roots match — this link is converged. Clear dead letters
-                    // scoped to this specific link (tenantDid, remoteEndpoint, protocol).
-                    void this.clearDeadLettersForLink(did, dwnUrl, protocol);
-                    this.emitEvent({ type: 'reconcile:completed', tenantDid: did, remoteEndpoint: dwnUrl, protocol });
+                    // SMT roots match, so transport/apply failures for this link may no
+                    // longer be current. Closure failures are not cleared by root equality.
+                    yield this.clearRootConvergenceDeadLettersForScope(did, dwnUrl, scope);
+                    this.emitEvent(Object.assign({ type: 'reconcile:completed', tenantDid: did, remoteEndpoint: dwnUrl }, eventScope));
                 }
                 else {
                     // Roots still differ — retry after a delay. This can happen when
@@ -2117,101 +3367,11 @@ export class SyncEngineLevel {
      * Live-mode subscription methods (`openLivePullSubscription`,
      * `openLocalPushSubscription`) receive `linkKey` directly and never
      * call this. The remaining callers are poll-mode `sync()` and the
-     * live-mode startup/error paths that already have `link.scopeId`.
-     *
-     * The `undefined` fallback (which produces a legacy cursor key) exists
-     * only for the no-protocol full-tenant targets in poll mode.
-     */
-    buildLinkKey(did, dwnUrl, scopeIdOrProtocol) {
-        return scopeIdOrProtocol ? buildLinkId(did, dwnUrl, scopeIdOrProtocol) : buildLegacyCursorKey(did, dwnUrl);
-    }
-    /**
-     * @deprecated Used by poll-mode sync and one-time migration only. Live mode
-     * uses ReplicationLedger checkpoints. Handles migration from old string cursors:
-     * if the stored value is a bare string (pre-ProgressToken format), it is treated
-     * as absent — the sync engine will do a full SMT reconciliation on first startup
-     * after upgrade, which is correct and safe.
-     */
-    getCursor(key) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const cursors = this._db.sublevel('syncCursors');
-            try {
-                const raw = yield cursors.get(key);
-                try {
-                    const parsed = JSON.parse(raw);
-                    if (parsed && typeof parsed === 'object' &&
-                        typeof parsed.streamId === 'string' && parsed.streamId.length > 0 &&
-                        typeof parsed.epoch === 'string' && parsed.epoch.length > 0 &&
-                        typeof parsed.position === 'string' && parsed.position.length > 0 &&
-                        typeof parsed.messageCid === 'string' && parsed.messageCid.length > 0) {
-                        return parsed;
-                    }
-                }
-                catch (_a) {
-                    // Not valid JSON (old string cursor) — fall through to delete.
-                }
-                // Entry exists but is unparseable or has invalid/empty fields. Delete it
-                // so subsequent startups don't re-check it on every launch.
-                yield this.deleteLegacyCursor(key);
-                return undefined;
-            }
-            catch (error) {
-                const e = error;
-                if (e.code === 'LEVEL_NOT_FOUND') {
-                    return undefined;
-                }
-                throw error;
-            }
-        });
-    }
-    /**
-     * Delete a legacy cursor from the old syncCursors sublevel.
-     * Called as part of one-time migration to ReplicationLedger.
-     */
-    deleteLegacyCursor(key) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const cursors = this._db.sublevel('syncCursors');
-            try {
-                yield cursors.del(key);
-            }
-            catch (_a) {
-                // Best-effort — ignore LEVEL_NOT_FOUND and transient I/O errors alike.
-                // A failed delete leaves the bad entry for one more re-check on the
-                // next startup, which is harmless.
-            }
-        });
-    }
-    // ---------------------------------------------------------------------------
-    // Utility helpers
-    // ---------------------------------------------------------------------------
-    /**
-     * Extracts a ReadableStream from a MessageEvent if it contains a
-     * RecordsWrite with data — either as an inline `encodedData` field
-     * (for records <= 30 KB) or as a pre-existing data stream.
+     * live-mode startup/error paths that already have a projection ID and
+     * authorization epoch.
      */
-    extractDataStream(event) {
-        if (!isRecordsWrite(event)) {
-            return undefined;
-        }
-        // Check for inline base64url-encoded data (small records from EventLog).
-        // Delete the transport-level field so the DWN schema validator does not
-        // reject the message for having unevaluated properties.
-        const encodedData = event.message.encodedData;
-        if (encodedData) {
-            delete event.message.encodedData;
-            const bytes = Encoder.base64UrlToBytes(encodedData);
-            return new ReadableStream({
-                start(controller) {
-                    controller.enqueue(bytes);
-                    controller.close();
-                }
-            });
-        }
-        // Check for a pre-existing data stream (e.g. from a direct message read).
-        if (event.data) {
-            return event.data;
-        }
-        return undefined;
+    buildLinkKey(did, dwnUrl, projectionId, authorizationEpoch) {
+        return buildLinkId(did, dwnUrl, projectionId, authorizationEpoch);
     }
     // ---------------------------------------------------------------------------
     // Default Hash Cache
@@ -2270,7 +3430,7 @@ export class SyncEngineLevel {
      *
      * Returns a hex-encoded root hash string.
      */
-    getLocalRoot(did, delegateDid, protocol) {
+    getLocalRoot(did, delegateDid, protocol, permissionGrantIds) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
             const si = this.stateIndex;
@@ -2281,7 +3441,6 @@ export class SyncEngineLevel {
                 return hashToHex(rootHash);
             }
             // Remote mode fallback: go through processRequest → RPC.
-            const permissionGrantId = yield this.getSyncPermissionGrantId(did, delegateDid, protocol);
             const response = yield this.agent.dwn.processRequest({
                 author: did,
                 target: did,
@@ -2290,7 +3449,7 @@ export class SyncEngineLevel {
                 messageParams: {
                     action: 'root',
                     protocol,
-                    permissionGrantId
+                    permissionGrantIds: toMessagesPermissionGrantIds(permissionGrantIds),
                 }
             });
             const reply = response.reply;
@@ -2301,10 +3460,9 @@ export class SyncEngineLevel {
      * Get the SMT root hash from a remote DWN via a MessagesSync 'root' action.
      * Returns a hex-encoded root hash string.
      */
-    getRemoteRoot(did, dwnUrl, delegateDid, protocol) {
+    getRemoteRoot(did, dwnUrl, delegateDid, protocol, permissionGrantIds) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
-            const permissionGrantId = yield this.getSyncPermissionGrantId(did, delegateDid, protocol);
             const syncMessage = yield this.agent.dwn.processRequest({
                 store: false,
                 author: did,
@@ -2314,7 +3472,59 @@ export class SyncEngineLevel {
                 messageParams: {
                     action: 'root',
                     protocol,
-                    permissionGrantId
+                    permissionGrantIds: toMessagesPermissionGrantIds(permissionGrantIds)
+                }
+            });
+            const reply = yield this.agent.rpc.sendDwnRequest({
+                dwnUrl,
+                targetDid: did,
+                message: syncMessage.message,
+            });
+            return (_a = reply.root) !== null && _a !== void 0 ? _a : '';
+        });
+    }
+    getLocalProjectedRoot(did, delegateDid, scopes, permissionGrantIds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (this.stateIndex) {
+                // Local projected roots use the already-derived scope directly. The
+                // remote root/diff request still re-authorizes the invoked grant set.
+                return RecordsProjection.getRootHex({
+                    tenant: did,
+                    messageStore: this.agent.dwn.node.storage.messageStore,
+                    scopes,
+                });
+            }
+            const response = yield this.agent.dwn.processRequest({
+                author: did,
+                target: did,
+                messageType: DwnInterface.MessagesSync,
+                granteeDid: delegateDid,
+                messageParams: {
+                    action: 'root',
+                    projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                    projectionScopes: [...scopes],
+                    permissionGrantIds: toMessagesPermissionGrantIds(permissionGrantIds),
+                }
+            });
+            const reply = response.reply;
+            return (_a = reply.root) !== null && _a !== void 0 ? _a : '';
+        });
+    }
+    getRemoteProjectedRoot(did, dwnUrl, delegateDid, scopes, permissionGrantIds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const syncMessage = yield this.agent.dwn.processRequest({
+                store: false,
+                author: did,
+                target: did,
+                messageType: DwnInterface.MessagesSync,
+                granteeDid: delegateDid,
+                messageParams: {
+                    action: 'root',
+                    projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                    projectionScopes: [...scopes],
+                    permissionGrantIds: toMessagesPermissionGrantIds(permissionGrantIds),
                 }
             });
             const reply = yield this.agent.rpc.sendDwnRequest({
@@ -2343,43 +3553,62 @@ export class SyncEngineLevel {
      * This replaces `walkTreeDiff()` which required one HTTP call per tree node.
      */
     diffWithRemote(_a) {
-        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, delegateDid, protocol }) {
-            var _b, _c;
+        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, delegateDid, protocol, permissionGrantIds }) {
             // Step 1: Collect local subtree hashes at BATCHED_DIFF_DEPTH directly from StateIndex.
-            const localHashes = yield this.collectLocalSubtreeHashes(did, protocol, BATCHED_DIFF_DEPTH);
+            const localHashes = yield this.collectLocalSubtreeHashes(did, protocol, BATCHED_DIFF_DEPTH, permissionGrantIds);
             // Step 2: Send a single 'diff' request to the remote with our hashes.
-            const permissionGrantId = yield this.getSyncPermissionGrantId(did, delegateDid, protocol);
+            const messageParams = {
+                action: 'diff',
+                protocol,
+                hashes: localHashes,
+                depth: BATCHED_DIFF_DEPTH,
+                permissionGrantIds: toMessagesPermissionGrantIds(permissionGrantIds),
+            };
+            // Step 3: Enumerate local leaves for prefixes the remote reported as onlyLocal.
+            // Reuse the same grant set from step 2.
+            return this.diffRemoteMessages({ did, dwnUrl, delegateDid }, messageParams, prefix => this.getLocalLeaves(did, prefix, delegateDid, protocol, permissionGrantIds), 'diff');
+        });
+    }
+    diffProjectedWithRemote(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, delegateDid, scopes, permissionGrantIds }) {
+            const localHashes = yield this.collectLocalProjectedSubtreeHashes(did, scopes, BATCHED_DIFF_DEPTH, delegateDid, permissionGrantIds);
+            const messageParams = {
+                action: 'diff',
+                projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                projectionScopes: [...scopes],
+                hashes: localHashes,
+                depth: BATCHED_DIFF_DEPTH,
+                permissionGrantIds: toMessagesPermissionGrantIds(permissionGrantIds),
+            };
+            return this.diffRemoteMessages({ did, dwnUrl, delegateDid }, messageParams, prefix => this.getLocalProjectedLeaves(did, prefix, delegateDid, scopes, permissionGrantIds), 'projected diff');
+        });
+    }
+    diffRemoteMessages(target, messageParams, getLocalLeavesForPrefix, operationName) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
             const syncMessage = yield this.agent.dwn.processRequest({
                 store: false,
-                author: did,
-                target: did,
+                author: target.did,
+                target: target.did,
                 messageType: DwnInterface.MessagesSync,
-                granteeDid: delegateDid,
-                messageParams: {
-                    action: 'diff',
-                    protocol,
-                    hashes: localHashes,
-                    depth: BATCHED_DIFF_DEPTH,
-                    permissionGrantId,
-                }
+                granteeDid: target.delegateDid,
+                messageParams,
             });
             const reply = yield this.agent.rpc.sendDwnRequest({
-                dwnUrl,
-                targetDid: did,
+                dwnUrl: target.dwnUrl,
+                targetDid: target.did,
                 message: syncMessage.message,
             });
             if (reply.status.code !== 200) {
-                throw new Error(`SyncEngineLevel: diff failed with ${reply.status.code}: ${reply.status.detail}`);
+                throw new Error(`SyncEngineLevel: ${operationName} failed with ${reply.status.code}: ${reply.status.detail}`);
             }
-            // Step 3: Enumerate local leaves for prefixes the remote reported as onlyLocal.
-            // Reuse the same grant ID from step 2 (avoids redundant lookup).
-            const permissionGrantIdForLeaves = permissionGrantId;
             const onlyLocalCids = [];
-            for (const prefix of (_b = reply.onlyLocal) !== null && _b !== void 0 ? _b : []) {
-                const leaves = yield this.getLocalLeaves(did, prefix, delegateDid, protocol, permissionGrantIdForLeaves);
+            for (const prefix of (_a = reply.onlyLocal) !== null && _a !== void 0 ? _a : []) {
+                const leaves = yield getLocalLeavesForPrefix(prefix);
                 onlyLocalCids.push(...leaves);
             }
             return {
+                dependencies: (_b = reply.dependencies) !== null && _b !== void 0 ? _b : [],
                 onlyRemote: (_c = reply.onlyRemote) !== null && _c !== void 0 ? _c : [],
                 onlyLocal: onlyLocalCids,
             };
@@ -2393,7 +3622,7 @@ export class SyncEngineLevel {
      * Uses direct StateIndex access in local mode. In remote mode, falls back
      * to `getLocalSubtreeHash` which routes through RPC.
      */
-    collectLocalSubtreeHashes(did, protocol, depth) {
+    collectLocalSubtreeHashes(did, protocol, depth, permissionGrantIds) {
         return __awaiter(this, void 0, void 0, function* () {
             const result = {};
             const defaultHash = yield this.getDefaultHashHex(depth);
@@ -2410,7 +3639,7 @@ export class SyncEngineLevel {
                 }
                 else {
                     // Remote mode fallback.
-                    hexHash = yield this.getLocalSubtreeHash(did, prefix, undefined, protocol);
+                    hexHash = yield this.getLocalSubtreeHash(did, prefix, undefined, protocol, permissionGrantIds);
                 }
                 if (hexHash === defaultHash) {
                     // Empty subtree — omit from the map.
@@ -2430,13 +3659,50 @@ export class SyncEngineLevel {
             return result;
         });
     }
+    collectLocalProjectedSubtreeHashes(did, scopes, depth, delegateDid, permissionGrantIds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = {};
+            const snapshot = this.stateIndex
+                ? yield RecordsProjection.createSnapshot({
+                    tenant: did,
+                    messageStore: this.agent.dwn.node.storage.messageStore,
+                    scopes,
+                })
+                : undefined;
+            try {
+                const walk = (prefix, currentDepth) => __awaiter(this, void 0, void 0, function* () {
+                    const bitPath = SyncEngineLevel.parseBitPrefix(prefix);
+                    const hexHash = snapshot
+                        ? hashToHex(yield snapshot.getSubtreeHash(bitPath))
+                        : yield this.getLocalProjectedSubtreeHash(did, prefix, delegateDid, scopes, permissionGrantIds);
+                    const defaultHash = yield this.getDefaultHashHex(currentDepth);
+                    if (hexHash === defaultHash) {
+                        return;
+                    }
+                    if (currentDepth >= depth) {
+                        result[prefix] = hexHash;
+                        return;
+                    }
+                    yield Promise.all([
+                        walk(prefix + '0', currentDepth + 1),
+                        walk(prefix + '1', currentDepth + 1),
+                    ]);
+                });
+                yield walk('', 0);
+                return result;
+            }
+            finally {
+                yield (snapshot === null || snapshot === void 0 ? void 0 : snapshot.close());
+            }
+        });
+    }
     /**
      * Get the subtree hash at a given bit prefix from the local DWN.
      *
      * In local mode: queries the StateIndex directly.
      * In remote mode: constructs a signed MessagesSync message and routes through RPC.
      */
-    getLocalSubtreeHash(did, prefix, delegateDid, protocol, permissionGrantId) {
+    getLocalSubtreeHash(did, prefix, delegateDid, protocol, permissionGrantIds) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
             const si = this.stateIndex;
@@ -2457,7 +3723,27 @@ export class SyncEngineLevel {
                     action: 'subtree',
                     prefix,
                     protocol,
-                    permissionGrantId
+                    permissionGrantIds: toMessagesPermissionGrantIds(permissionGrantIds)
+                }
+            });
+            const reply = response.reply;
+            return (_a = reply.hash) !== null && _a !== void 0 ? _a : '';
+        });
+    }
+    getLocalProjectedSubtreeHash(did, prefix, delegateDid, scopes, permissionGrantIds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const response = yield this.agent.dwn.processRequest({
+                author: did,
+                target: did,
+                messageType: DwnInterface.MessagesSync,
+                granteeDid: delegateDid,
+                messageParams: {
+                    action: 'subtree',
+                    prefix,
+                    projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                    projectionScopes: [...scopes],
+                    permissionGrantIds: toMessagesPermissionGrantIds(permissionGrantIds)
                 }
             });
             const reply = response.reply;
@@ -2470,7 +3756,7 @@ export class SyncEngineLevel {
      * In local mode: queries the StateIndex directly.
      * In remote mode: constructs a signed MessagesSync message and routes through RPC.
      */
-    getLocalLeaves(did, prefix, delegateDid, protocol, permissionGrantId) {
+    getLocalLeaves(did, prefix, delegateDid, protocol, permissionGrantIds) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
             const si = this.stateIndex;
@@ -2490,7 +3776,35 @@ export class SyncEngineLevel {
                     action: 'leaves',
                     prefix,
                     protocol,
-                    permissionGrantId
+                    permissionGrantIds: toMessagesPermissionGrantIds(permissionGrantIds)
+                }
+            });
+            const reply = response.reply;
+            return (_a = reply.entries) !== null && _a !== void 0 ? _a : [];
+        });
+    }
+    getLocalProjectedLeaves(did, prefix, delegateDid, scopes, permissionGrantIds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (this.stateIndex) {
+                return RecordsProjection.getLeaves({
+                    tenant: did,
+                    messageStore: this.agent.dwn.node.storage.messageStore,
+                    scopes,
+                    prefix: SyncEngineLevel.parseBitPrefix(prefix),
+                });
+            }
+            const response = yield this.agent.dwn.processRequest({
+                author: did,
+                target: did,
+                messageType: DwnInterface.MessagesSync,
+                granteeDid: delegateDid,
+                messageParams: {
+                    action: 'leaves',
+                    prefix,
+                    projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                    projectionScopes: [...scopes],
+                    permissionGrantIds: toMessagesPermissionGrantIds(permissionGrantIds)
                 }
             });
             const reply = response.reply;
@@ -2509,25 +3823,109 @@ export class SyncEngineLevel {
      * Only `messageCids` that were NOT prefetched are fetched individually.
      */
     pullMessages(_a) {
-        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, delegateDid, protocol, messageCids, prefetched }) {
+        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, delegateDid, protocol, scope, permissionGrantIds, messageCids, prefetched, verifiedInitialWrites, shouldContinue, }) {
+            const acceptanceScope = scope !== null && scope !== void 0 ? scope : (protocol === undefined
+                ? { kind: 'full' }
+                : { kind: 'protocolSet', protocols: [protocol] });
+            const rejectedPullEntries = new Map();
             const failedCids = yield pullMessages({
-                did, dwnUrl, delegateDid, protocol, messageCids, prefetched,
+                did,
+                dwnUrl,
+                delegateDid,
+                permissionGrantIds,
+                messageCids,
+                prefetched,
+                shouldContinue,
                 agent: this.agent,
-                permissionsApi: this._permissionsApi,
+                acceptEntry: (entry, entries) => __awaiter(this, void 0, void 0, function* () {
+                    const result = yield this.acceptPulledSyncEntry(did, acceptanceScope, entry, entries, verifiedInitialWrites);
+                    if (!result.accepted) {
+                        rejectedPullEntries.set(yield getMessageCid(entry.message), result);
+                    }
+                    return result.accepted;
+                }),
             });
             // Record permanently failed pull entries in the dead letter store.
             for (const cid of failedCids) {
+                const rejection = rejectedPullEntries.get(cid);
                 yield this.recordDeadLetter({
                     messageCid: cid,
                     tenantDid: did,
                     remoteEndpoint: dwnUrl,
                     protocol,
-                    category: 'pull-processing',
-                    errorDetail: 'pull processing failed after retry passes exhausted',
+                    category: rejection ? 'pull-scope-rejected' : 'pull-processing',
+                    errorCode: rejection === null || rejection === void 0 ? void 0 : rejection.classification,
+                    errorDetail: rejection
+                        ? `pulled message rejected by ${rejection.classification} sync scope gate`
+                        : 'pull processing failed after retry passes exhausted',
                 });
             }
         });
     }
+    acceptPulledSyncEntry(did_1, scope_1, entry_1, entries_1) {
+        return __awaiter(this, arguments, void 0, function* (did, scope, entry, entries, verifiedInitialWrites = []) {
+            if (scope.kind === 'full') {
+                return { accepted: true };
+            }
+            const initialWrite = yield this.resolvePulledDeleteInitialWrite(did, entry.message, entries, verifiedInitialWrites);
+            const classification = classifySyncMessageScope({
+                message: entry.message,
+                initialWrite,
+                scope,
+            });
+            if (classification === 'in-scope') {
+                return { accepted: true };
+            }
+            const messageCid = yield getMessageCid(entry.message);
+            console.warn(`SyncEngineLevel: refusing to apply ${classification} pulled message ${messageCid}`);
+            return { accepted: false, classification };
+        });
+    }
+    resolvePulledDeleteInitialWrite(did_1, message_1, entries_1) {
+        return __awaiter(this, arguments, void 0, function* (did, message, entries, verifiedInitialWrites = []) {
+            const descriptor = message.descriptor;
+            if (descriptor.interface !== DwnInterfaceName.Records ||
+                descriptor.method !== DwnMethodName.Delete ||
+                typeof descriptor.recordId !== 'string') {
+                return undefined;
+            }
+            if (!this.agent.dwn.isRemoteMode) {
+                const localInitialWrite = yield RecordsWrite.fetchInitialRecordsWriteMessage(this.agent.dwn.node.storage.messageStore, did, descriptor.recordId);
+                if (localInitialWrite) {
+                    return localInitialWrite;
+                }
+            }
+            const verifiedInitialWrite = SyncEngineLevel.findInitialWriteByRecordId(descriptor.recordId, verifiedInitialWrites);
+            if (verifiedInitialWrite !== undefined) {
+                return verifiedInitialWrite;
+            }
+            // Batch entries are only used when the initial write has not been applied
+            // locally yet. Verified dependency hints cover the projected remote-mode
+            // path where the initial write was applied in the previous pull batch and
+            // no embedded local message store is available. Batch entries are still
+            // parsed as initial RecordsWrite messages, and processRawMessage
+            // authenticates the delete before any local mutation occurs.
+            return this.findInitialWriteInPullBatch(descriptor.recordId, entries);
+        });
+    }
+    static findInitialWriteByRecordId(recordId, initialWrites) {
+        return initialWrites.find(initialWrite => initialWrite.recordId === recordId);
+    }
+    findInitialWriteInPullBatch(recordId, entries) {
+        return __awaiter(this, void 0, void 0, function* () {
+            for (const entry of entries) {
+                if (entry.message.descriptor.interface !== DwnInterfaceName.Records ||
+                    entry.message.descriptor.method !== DwnMethodName.Write) {
+                    continue;
+                }
+                const candidate = entry.message;
+                if (candidate.recordId === recordId && (yield RecordsWrite.isInitialWrite(candidate))) {
+                    return candidate;
+                }
+            }
+            return undefined;
+        });
+    }
     // ---------------------------------------------------------------------------
     // Echo-loop suppression
     // ---------------------------------------------------------------------------
@@ -2578,11 +3976,10 @@ export class SyncEngineLevel {
      * in dependency order (topological sort).
      */
     pushMessages(_a) {
-        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, delegateDid, protocol, messageCids }) {
+        return __awaiter(this, arguments, void 0, function* ({ did, dwnUrl, delegateDid, permissionGrantIds, messageCids }) {
             return pushMessages({
-                did, dwnUrl, delegateDid, protocol, messageCids,
+                did, dwnUrl, delegateDid, permissionGrantIds, messageCids,
                 agent: this.agent,
-                permissionsApi: this._permissionsApi,
             });
         });
     }
@@ -2606,8 +4003,8 @@ export class SyncEngineLevel {
      * When `protocol` is undefined (full-tenant link), clears entries that
      * also have no protocol.
      */
-    clearDeadLettersForLink(tenantDid, remoteEndpoint, protocol) {
-        return __awaiter(this, void 0, void 0, function* () {
+    clearDeadLettersForLink(tenantDid_1, remoteEndpoint_1, protocol_1) {
+        return __awaiter(this, arguments, void 0, function* (tenantDid, remoteEndpoint, protocol, options = {}) {
             var _a, e_1, _b, _c;
             const batch = [];
             try {
@@ -2619,7 +4016,8 @@ export class SyncEngineLevel {
                         const entry = JSON.parse(value);
                         if (entry.tenantDid === tenantDid &&
                             entry.remoteEndpoint === remoteEndpoint &&
-                            entry.protocol === protocol) {
+                            entry.protocol === protocol &&
+                            (options.categories === undefined || options.categories.has(entry.category))) {
                             batch.push({ type: 'del', key });
                         }
                     }
@@ -2643,6 +4041,18 @@ export class SyncEngineLevel {
             }
         });
     }
+    clearRootConvergenceDeadLetters(tenantDid, remoteEndpoint, protocol) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                yield this.clearDeadLettersForLink(tenantDid, remoteEndpoint, protocol, {
+                    categories: SyncEngineLevel.ROOT_CONVERGENCE_CLEARABLE_DEAD_LETTER_CATEGORIES,
+                });
+            }
+            catch (error) {
+                console.warn(`SyncEngineLevel: Failed to clear root-convergence dead letters for ${tenantDid} -> ${remoteEndpoint}`, error);
+            }
+        });
+    }
     /**
      * Build a compound dead letter key. Different remotes can fail the same CID
      * for different reasons, so the key includes the remote endpoint.
@@ -2689,7 +4099,7 @@ export class SyncEngineLevel {
                 finally { if (e_2) throw e_2.error; }
             }
             // Deterministic ordering: newest first so apps see the most recent failures.
-            entries.sort((a, b) => b.failedAt.localeCompare(a.failedAt));
+            entries.sort((a, b) => lexicographicalCompare(b.failedAt, a.failedAt));
             return entries;
         });
     }
@@ -2775,12 +4185,17 @@ export class SyncEngineLevel {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, e_5, _b, _c;
             let failedMessageCount = 0;
+            let closureFailureCount = 0;
             try {
                 for (var _d = true, _e = __asyncValues(this._deadLetters.iterator()), _f; _f = yield _e.next(), _a = _f.done, !_a; _d = true) {
                     _c = _f.value;
                     _d = false;
-                    const _ = _c;
+                    const [, value] = _c;
                     failedMessageCount++;
+                    const entry = JSON.parse(value);
+                    if (entry.category === 'closure') {
+                        closureFailureCount++;
+                    }
                 }
             }
             catch (e_5_1) { e_5 = { error: e_5_1 }; }
@@ -2790,35 +4205,90 @@ export class SyncEngineLevel {
                 }
                 finally { if (e_5) throw e_5.error; }
             }
-            // Count degraded links from the durable ledger, not just in-memory
-            // _activeLinks. Links persist across restarts; a repairing/degraded_poll
-            // link from a previous session must still be reported.
+            // Superseded authorization epochs can leave durable link state behind. Only
+            // links that still belong to the current registered projection/epoch should
+            // affect health. Endpoint-level orphan cleanup is a separate GC concern.
+            const currentLinkIdentityKeys = yield this.getCurrentDurableLinkIdentityKeys();
             let degradedLinkCount = 0;
             const allLinks = yield this.ledger.getAllLinks();
             for (const link of allLinks) {
-                if (link.status === 'repairing' || link.status === 'degraded_poll') {
+                const isCurrentLink = currentLinkIdentityKeys === undefined || currentLinkIdentityKeys.has(this.getDurableLinkIdentityKey(link));
+                if (isCurrentLink && SyncEngineLevel.isUnhealthyLinkStatus(link.status)) {
                     degradedLinkCount++;
                 }
             }
             return {
                 connectivity: this.connectivityState,
-                failedMessageCount,
-                degradedLinkCount,
+                failedMessageCount: failedMessageCount,
+                closureFailureCount: closureFailureCount,
+                degradedLinkCount: degradedLinkCount,
+                syncHealthy: failedMessageCount === 0 && degradedLinkCount === 0,
             };
         });
     }
+    getCurrentDurableLinkIdentityKeys() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, e_6, _b, _c;
+            try {
+                const identityKeys = new Set();
+                try {
+                    for (var _d = true, _e = __asyncValues(this._db.sublevel('registeredIdentities').iterator()), _f; _f = yield _e.next(), _a = _f.done, !_a; _d = true) {
+                        _c = _f.value;
+                        _d = false;
+                        const [did, options] = _c;
+                        let parsed;
+                        try {
+                            parsed = JSON.parse(options);
+                        }
+                        catch (error) {
+                            console.warn(`SyncEngineLevel: Corrupt sync options for ${did}, skipping health target:`, error);
+                            continue;
+                        }
+                        const scope = syncScopeFromProtocols(parsed.protocols);
+                        const resolutions = yield this.buildSyncTargetResolutions(did, scope, parsed);
+                        for (const resolution of resolutions) {
+                            const projectionId = yield computeProjectionId(did, resolution.scope);
+                            identityKeys.add(SyncEngineLevel.durableLinkIdentityKey(did, projectionId, resolution.authorizationEpoch));
+                        }
+                    }
+                }
+                catch (e_6_1) { e_6 = { error: e_6_1 }; }
+                finally {
+                    try {
+                        if (!_d && !_a && (_b = _e.return)) yield _b.call(_e);
+                    }
+                    finally { if (e_6) throw e_6.error; }
+                }
+                return identityKeys;
+            }
+            catch (error) {
+                console.warn('SyncEngineLevel: Failed to resolve current durable link identity keys for health; falling back to all durable links', error);
+                return undefined;
+            }
+        });
+    }
+    getDurableLinkIdentityKey(link) {
+        return SyncEngineLevel.durableLinkIdentityKey(link.tenantDid, link.projectionId, link.authorizationEpoch);
+    }
+    static durableLinkIdentityKey(tenantDid, projectionId, authorizationEpoch) {
+        return `${tenantDid}^${projectionId}^${authorizationEpoch}`;
+    }
+    static isUnhealthyLinkStatus(status) {
+        return status === 'repairing' || status === 'degraded_poll' || status === 'terminal_incomplete';
+    }
     // ---------------------------------------------------------------------------
     // Sync targets
     // ---------------------------------------------------------------------------
     /**
-     * Returns the list of sync targets: (did, dwnUrl, delegateDid?, protocol?) tuples.
+     * Returns the list of sync targets: one canonical projection target per
+     * registered DID and resolved DWN endpoint.
      * Results are cached for up to 30 seconds to avoid redundant DID resolution
      * on every sync tick. The cache is invalidated when identities are registered,
      * unregistered, or updated.
      */
     getSyncTargets() {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, e_6, _b, _c;
+            var _a, e_7, _b, _c;
             // Return cached targets if still valid.
             if (this._syncTargetsCache
                 && (Date.now() - this._syncTargetsCache.timestamp) < SyncEngineLevel.SYNC_TARGETS_CACHE_TTL_MS) {
@@ -2845,31 +4315,22 @@ export class SyncEngineLevel {
                         console.warn(`SyncEngineLevel: Corrupt sync options for ${did}, skipping identity:`, error);
                         continue;
                     }
-                    const { protocols, delegateDid } = parsed;
                     const dwnEndpointUrls = yield this.agent.dwn.getDwnEndpointUrlsForTarget(did);
                     if (dwnEndpointUrls.length === 0) {
                         anyEndpointMissing = true;
                         continue;
                     }
                     for (const dwnUrl of dwnEndpointUrls) {
-                        if (protocols === 'all') {
-                            // Sync all protocols (global tree).
-                            targets.push({ did, delegateDid, dwnUrl });
-                        }
-                        else {
-                            for (const protocol of protocols) {
-                                targets.push({ did, delegateDid, dwnUrl, protocol });
-                            }
-                        }
+                        targets.push(...yield this.buildSyncTargetsForEndpoint(did, dwnUrl, parsed));
                     }
                 }
             }
-            catch (e_6_1) { e_6 = { error: e_6_1 }; }
+            catch (e_7_1) { e_7 = { error: e_7_1 }; }
             finally {
                 try {
                     if (!_d && !_a && (_b = _e.return)) yield _b.call(_e);
                 }
-                finally { if (e_6) throw e_6.error; }
+                finally { if (e_7) throw e_7.error; }
             }
             // Only cache when:
             // - The result is non-empty (empty = transient resolution failure).
@@ -2885,25 +4346,6 @@ export class SyncEngineLevel {
             return targets;
         });
     }
-    /**
-     * Gets the permission grant ID for MessagesSync if a delegateDid is provided.
-     * Returns undefined if no delegate is in use (owner access).
-     */
-    getSyncPermissionGrantId(did, delegateDid, protocol) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!delegateDid) {
-                return undefined;
-            }
-            const messagesSyncGrant = yield this._permissionsApi.getPermissionForRequest({
-                connectedDid: did,
-                messageType: DwnInterface.MessagesSync,
-                delegateDid,
-                protocol,
-                cached: true
-            });
-            return messagesSyncGrant.grant.id;
-        });
-    }
 }
 /** TTL for echo-loop suppression entries (60 seconds). */
 SyncEngineLevel.ECHO_SUPPRESS_TTL_MS = 60000;
@@ -2911,12 +4353,14 @@ SyncEngineLevel.ECHO_SUPPRESS_TTL_MS = 60000;
 SyncEngineLevel.ECHO_SUPPRESS_MAX_ENTRIES = 10000;
 /** TTL for the sync targets cache (30 seconds). */
 SyncEngineLevel.SYNC_TARGETS_CACHE_TTL_MS = 30000;
+/** Backoff schedule for recently published did:dht records. */
+SyncEngineLevel.DID_RESOLUTION_RETRY_BACKOFF_MS = [2000, 4000, 8000];
 /** Maximum consecutive failures before entering backoff. */
 SyncEngineLevel.MAX_CONSECUTIVE_FAILURES = 5;
 /** Backoff multiplier for consecutive failures (caps at 4x the configured interval). */
 SyncEngineLevel.MAX_BACKOFF_MULTIPLIER = 4;
 // ---------------------------------------------------------------------------
-// Per-link repair and degraded-poll orchestration (Phase 2)
+// Per-link repair and degraded-poll orchestration
 // ---------------------------------------------------------------------------
 /** Maximum consecutive repair attempts before falling back to degraded_poll. */
 SyncEngineLevel.MAX_REPAIR_ATTEMPTS = 3;
@@ -2924,4 +4368,5 @@ SyncEngineLevel.MAX_REPAIR_ATTEMPTS = 3;
 SyncEngineLevel.REPAIR_BACKOFF_MS = [1000, 3000, 10000];
 /** Push retry backoff schedule: immediate, 250ms, 1s, 2s, then give up. */
 SyncEngineLevel.PUSH_RETRY_BACKOFF_MS = [0, 250, 1000, 2000];
+SyncEngineLevel.ROOT_CONVERGENCE_CLEARABLE_DEAD_LETTER_CATEGORIES = new Set(['push-permanent', 'push-exhausted', 'pull-processing', 'pull-scope-rejected']);
 //# sourceMappingURL=sync-engine-level.js.map