@enbox/dwn-sdk-js 0.3.4 → 0.3.5

package/src/handlers/records-subscribe.ts

@@ -20,7 +20,7 @@ import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.j
 
 export class RecordsSubscribeHandler implements MethodHandler {
 
-  constructor(private deps: HandlerDependencies) { }
+  constructor(private readonly deps: HandlerDependencies) { }
 
   public async handle({
     tenant,
@@ -97,7 +97,7 @@ export class RecordsSubscribeHandler implements MethodHandler {
           const gapInfo = (error as any).gapInfo as ProgressGapInfo | undefined;
           return {
             status : { code: 410, detail: 'Progress token gap' },
-            error  : gapInfo !== undefined ? { code: 'ProgressGap' as const, ...gapInfo } : undefined,
+            error  : gapInfo === undefined ? undefined : { code: 'ProgressGap' as const, ...gapInfo },
           };
         }
         return messageReplyFromError(error, 500);

package/src/handlers/records-write.ts

@@ -27,7 +27,7 @@ type HandlerArgs = { tenant: string, message: RecordsWriteMessage, dataStream?:
 
 export class RecordsWriteHandler implements MethodHandler {
 
-  constructor(private deps: HandlerDependencies) { }
+  constructor(private readonly deps: HandlerDependencies) { }
 
   public async handle({
     tenant,
@@ -106,7 +106,7 @@ export class RecordsWriteHandler implements MethodHandler {
         if (isInitial) {
           const hasInlineData = !!(newestExistingMessage as any).encodedData;
           const hasStoredData = this.deps.dataStore
-            ? !!(await this.deps.dataStore.get(tenant, recordsWrite.message.recordId, message.descriptor.dataCid!))
+            ? !!(await this.deps.dataStore.get(tenant, recordsWrite.message.recordId, message.descriptor.dataCid))
             : false;
           existingLacksData = !hasInlineData && !hasStoredData;
         }
@@ -121,9 +121,9 @@ export class RecordsWriteHandler implements MethodHandler {
 
     // Look up the core protocol (if any) for the incoming message so that lifecycle hooks
     // can be dispatched generically rather than checking for specific protocol URIs.
-    const coreProtocol = message.descriptor.protocol !== undefined
-      ? this.deps.coreProtocols?.get(message.descriptor.protocol)
-      : undefined;
+    const coreProtocol = message.descriptor.protocol === undefined
+      ? undefined
+      : this.deps.coreProtocols?.get(message.descriptor.protocol);
 
     try {
       if (newestExistingMessage?.descriptor.method === DwnMethodName.Delete) {
@@ -148,11 +148,8 @@ export class RecordsWriteHandler implements MethodHandler {
       let isLatestBaseState = false;
       let messageWithOptionalEncodedData = message as RecordsQueryReplyEntry;
 
-      if (dataStream !== undefined) {
-        messageWithOptionalEncodedData = await this.processMessageWithDataStream(tenant, message, dataStream);
-        isLatestBaseState = true;
-      } else {
-        // else data stream is NOT provided
+      if (dataStream === undefined) {
+        // data stream is NOT provided
 
         // if the incoming message is not an initial write, and no dataStream is provided, we would allow it provided it passes validation
         // processMessageWithoutDataStream() abstracts that logic
@@ -161,6 +158,9 @@ export class RecordsWriteHandler implements MethodHandler {
           messageWithOptionalEncodedData = await this.processMessageWithoutDataStream(tenant, message, newestExistingWrite );
           isLatestBaseState = true;
         }
+      } else {
+        messageWithOptionalEncodedData = await this.processMessageWithDataStream(tenant, message, dataStream);
+        isLatestBaseState = true;
       }
 
       const indexes = await recordsWrite.constructIndexes(isLatestBaseState);
@@ -252,14 +252,14 @@ export class RecordsWriteHandler implements MethodHandler {
     // if data is below the threshold, we store it within MessageStore
     if (message.descriptor.dataSize <= DwnConstant.maxDataSizeAllowedToBeEncoded) {
       // validate data integrity before setting.
-      const dataBytes = await DataStream.toBytes(dataStream!);
+      const dataBytes = await DataStream.toBytes(dataStream);
       const dataCid = await Cid.computeDagPbCidFromBytes(dataBytes);
       RecordsWriteHandler.validateDataIntegrity(message.descriptor.dataCid, message.descriptor.dataSize, dataCid, dataBytes.length);
 
       // Dispatch schema validation to the core protocol, if applicable.
-      const coreProtocol = message.descriptor.protocol !== undefined
-        ? this.deps.coreProtocols?.get(message.descriptor.protocol)
-        : undefined;
+      const coreProtocol = message.descriptor.protocol === undefined
+        ? undefined
+        : this.deps.coreProtocols?.get(message.descriptor.protocol);
       if (coreProtocol?.validateRecord !== undefined) {
         coreProtocol.validateRecord(message, dataBytes);
       }
@@ -304,13 +304,13 @@ export class RecordsWriteHandler implements MethodHandler {
 
     if (dataSize <= DwnConstant.maxDataSizeAllowedToBeEncoded) {
       // we encode the data from the original write if it is smaller than the data-store threshold
-      if (newestExistingWrite.encodedData !== undefined) {
-        messageWithOptionalEncodedData.encodedData = newestExistingWrite.encodedData;
-      } else {
+      if (newestExistingWrite.encodedData === undefined) {
         throw new DwnError(
           DwnErrorCode.RecordsWriteMissingEncodedDataInPrevious,
           `No dataStream was provided and unable to get data from previous message`
         );
+      } else {
+        messageWithOptionalEncodedData.encodedData = newestExistingWrite.encodedData;
       }
     } else {
       // else just make sure the data is in the data store
@@ -396,7 +396,7 @@ export class RecordsWriteHandler implements MethodHandler {
       ruleSet = ruleSet[pathSegments[i]] as typeof ruleSet;
     }
 
-    if (ruleSet === undefined || ruleSet.$squash !== true) {
+    if (ruleSet?.$squash !== true) {
       return;
     }
 

package/src/index.ts

@@ -2,7 +2,7 @@
 export type { DwnConfig } from './dwn.js';
 export type { EventListener, EventLog, EventLogEntry, EventLogReadOptions, EventLogReadResult, EventLogSubscribeOptions, EventSubscription, MessageEvent, ProgressGapInfo, ProgressGapReason, ProgressToken, SubscriptionEose, SubscriptionEvent, SubscriptionListener, SubscriptionMessage, SubscriptionReply } from './types/subscriptions.js';
 export type { AuthorizationModel, Descriptor, DelegatedGrantRecordsWriteMessage, GenericMessage, GenericMessageReply, GenericSignaturePayload, MessageSort, MessageSubscription, Pagination, QueryResultEntry, Status } from './types/message-types.js';
-export type { MessagesFilter, MessagesReadMessage as MessagesReadMessage, MessagesReadReply as MessagesReadReply, MessagesReadReplyEntry as MessagesReadReplyEntry, MessagesReadDescriptor, MessagesSubscribeDescriptor, MessagesSubscribeMessage, MessagesSubscribeReply, MessagesSubscribeMessageOptions, MessagesSyncAction, MessagesSyncDescriptor, MessagesSyncDiffEntry, MessagesSyncMessage, MessagesSyncReply } from './types/messages-types.js';
+export type { MessagesFilter, MessagesReadMessage, MessagesReadReply, MessagesReadReplyEntry, MessagesReadDescriptor, MessagesSubscribeDescriptor, MessagesSubscribeMessage, MessagesSubscribeReply, MessagesSubscribeMessageOptions, MessagesSyncAction, MessagesSyncDescriptor, MessagesSyncDiffEntry, MessagesSyncMessage, MessagesSyncReply } from './types/messages-types.js';
 export type { GT, LT, Filter, FilterValue, KeyValues, EqualFilter, OneOfFilter, RangeFilter, RangeCriterion, PaginationCursor, QueryOptions, RangeValue, StartsWithFilter } from './types/query-types.js';
 export type { ProtocolsConfigureDescriptor, ProtocolDefinition, ProtocolTypes, ProtocolRuleSet, ProtocolsQueryFilter, ProtocolsConfigureMessage, ProtocolsQueryMessage, ProtocolsQueryReply, ProtocolActionRule, ProtocolDeliveryStrategy, ProtocolPathEncryption, ProtocolsQueryDescriptor, ProtocolRecordLimitDefinition, ProtocolSizeDefinition, ProtocolTagsDefinition, ProtocolTagSchema, ProtocolType, ProtocolUses } from './types/protocols-types.js';
 export { ProtocolRecordLimitStrategy } from './types/protocols-types.js';
@@ -30,8 +30,8 @@ export { DwnConstant } from './core/dwn-constant.js';
 export { DwnError, DwnErrorCode } from './core/dwn-error.js';
 export { DwnInterfaceName, DwnMethodName } from './enums/dwn-interface-method.js';
 export { Encoder } from './utils/encoder.js';
-export { MessagesSubscribe as MessagesSubscribe } from './interfaces/messages-subscribe.js';
-export type { MessagesSubscribeOptions as MessagesSubscribeOptions } from './interfaces/messages-subscribe.js';
+export { MessagesSubscribe } from './interfaces/messages-subscribe.js';
+export type { MessagesSubscribeOptions } from './interfaces/messages-subscribe.js';
 export { Encryption, ContentEncryptionAlgorithm, KeyAgreementAlgorithm } from './utils/encryption.js';
 export type { JweEncryption, JweRecipient, JweRecipientHeader, JweProtectedHeader, JweKeyUnwrapPayload } from './utils/encryption.js';
 export { RecordsWrite } from './interfaces/records-write.js';
@@ -40,8 +40,8 @@ export { executeUnlessAborted } from './utils/abort.js';
 export { Jws } from './utils/jws.js';
 export type { KeyMaterial, PrivateKeyJwk, PublicKeyJwk, Jwk } from './types/jose-types.js';
 export { Message } from './core/message.js';
-export { MessagesRead as MessagesRead } from './interfaces/messages-read.js';
-export type { MessagesReadOptions as MessagesReadOptions } from './interfaces/messages-read.js';
+export { MessagesRead } from './interfaces/messages-read.js';
+export type { MessagesReadOptions } from './interfaces/messages-read.js';
 export { MessagesSync } from './interfaces/messages-sync.js';
 export type { MessagesSyncOptions } from './interfaces/messages-sync.js';
 export type { UnionMessageReply } from './core/message-reply.js';

package/src/interfaces/protocols-configure.ts

@@ -377,16 +377,8 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
       for (let j = i + 1; j < actionRules.length; j++) {
         const otherActionRule = actionRules[j];
 
-        if (actionRule.who !== undefined) {
-          if (actionRule.who === otherActionRule.who && actionRule.of === otherActionRule.of) {
-            throw new DwnError(
-              DwnErrorCode.ProtocolsConfigureDuplicateActorInRuleSet,
-              `More than one action rule per actor ${actionRule.who} of ${actionRule.of} ` +
-              `not allowed within a rule set: ${JSON.stringify(actionRule)}`
-            );
-          }
-        } else {
-          // else implicitly a role-based action rule
+        if (actionRule.who === undefined) {
+          // implicitly a role-based action rule
 
           if (actionRule.role === otherActionRule.role) {
             throw new DwnError(
@@ -394,6 +386,14 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
               `More than one action rule per role ${actionRule.role} not allowed within a rule set: ${JSON.stringify(actionRule)}`
             );
           }
+        } else {
+          if (actionRule.who === otherActionRule.who && actionRule.of === otherActionRule.of) {
+            throw new DwnError(
+              DwnErrorCode.ProtocolsConfigureDuplicateActorInRuleSet,
+              `More than one action rule per actor ${actionRule.who} of ${actionRule.of} ` +
+              `not allowed within a rule set: ${JSON.stringify(actionRule)}`
+            );
+          }
         }
       }
     }
@@ -497,7 +497,7 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
     }
 
     // validate alias exists in `uses`
-    if (uses === undefined || uses[parsed.alias] === undefined) {
+    if (uses?.[parsed.alias] === undefined) {
       throw new DwnError(
         DwnErrorCode.ProtocolsConfigureInvalidRefAlias,
         `'$ref' alias '${parsed.alias}' at protocol path '${ruleSetProtocolPath}' does not exist in the 'uses' map.`
@@ -543,7 +543,7 @@ export class ProtocolsConfigure extends AbstractMessage<ProtocolsConfigureMessag
       );
     }
 
-    if (uses === undefined || uses[parsed.alias] === undefined) {
+    if (uses?.[parsed.alias] === undefined) {
       const errorCode = fieldName === 'role'
         ? DwnErrorCode.ProtocolsConfigureInvalidCrossProtocolRole
         : DwnErrorCode.ProtocolsConfigureInvalidCrossProtocolOf;

package/src/interfaces/records-delete.ts

@@ -110,7 +110,7 @@ export class RecordsDelete extends AbstractMessage<RecordsDeleteMessage> {
    * @param messageStore Used to check if the grant has been revoked.
    */
   public async authorizeDelegate(recordsWriteToDelete: RecordsWriteMessage, messageStore: MessageStore): Promise<void> {
-    const delegatedGrant = PermissionGrant.parse(this.message.authorization!.authorDelegatedGrant!);
+    const delegatedGrant = PermissionGrant.parse(this.message.authorization.authorDelegatedGrant!);
     await RecordsGrantAuthorization.authorizeDelete({
       recordsDeleteMessage : this.message,
       recordsWriteToDelete,

package/src/interfaces/records-write.ts

@@ -135,9 +135,9 @@ export type CreateFromOptions = {
  * NOTE: Unable to extend `AbstractMessage` directly because the incompatible `_message` type, which is not just a generic `<M>` type.
  */
 export class RecordsWrite implements MessageInterface<RecordsWriteMessage> {
-  private parentContextId: string | undefined;
+  private readonly parentContextId: string | undefined;
 
-  private _message: InternalRecordsWriteMessage;
+  private readonly _message: InternalRecordsWriteMessage;
   /**
    * Valid JSON message representing this RecordsWrite.
    * @throws `DwnErrorCode.RecordsWriteMissingSigner` if the message is not signed yet.
@@ -232,10 +232,10 @@ export class RecordsWrite implements MessageInterface<RecordsWriteMessage> {
       if (message.authorization.ownerSignature !== undefined) {
         // if the message authorization contains owner delegated grant, the owner would be the grantor of the grant
         // else the owner would be the signer of the owner signature
-        if (message.authorization.ownerDelegatedGrant !== undefined) {
-          this._owner = Message.getSigner(message.authorization.ownerDelegatedGrant);
-        } else {
+        if (message.authorization.ownerDelegatedGrant === undefined) {
           this._owner = Jws.getSignerDid(message.authorization.ownerSignature.signatures[0]);
+        } else {
+          this._owner = Message.getSigner(message.authorization.ownerDelegatedGrant);
         }
 
         this._ownerSignaturePayload = Jws.decodePlainObjectPayload(message.authorization.ownerSignature);
@@ -321,7 +321,7 @@ export class RecordsWrite implements MessageInterface<RecordsWriteMessage> {
       protocol          : normalizeProtocolUrl(options.protocol),
       protocolPath      : options.protocolPath,
       recipient         : options.recipient,
-      schema            : options.schema !== undefined ? normalizeSchemaUrl(options.schema) : undefined,
+      schema            : options.schema === undefined ? undefined : normalizeSchemaUrl(options.schema),
       tags              : options.tags,
       parentId          : RecordsWrite.getRecordIdFromContextId(options.parentContextId),
       dataCid,
@@ -524,11 +524,11 @@ export class RecordsWrite implements MessageInterface<RecordsWriteMessage> {
     // compute delegated grant ID and author if delegated grant is given
     let delegatedGrantId;
     let authorDid;
-    if (delegatedGrant !== undefined) {
+    if (delegatedGrant === undefined) {
+      authorDid = Jws.extractDid(signer.keyId);
+    } else {
       delegatedGrantId = await Message.getCid(delegatedGrant);
       authorDid = Jws.getSignerDid(delegatedGrant.authorization.signature.signatures[0]);
-    } else {
-      authorDid = Jws.extractDid(signer.keyId);
     }
 
     const descriptor = this._message.descriptor;
@@ -549,7 +549,7 @@ export class RecordsWrite implements MessageInterface<RecordsWriteMessage> {
     // `signature` generation
     const signature = await createSignerSignature({
       recordId    : this._message.recordId,
-      contextId   : this._message.contextId!, // contextId is computed just above, always defined here
+      contextId   : this._message.contextId, // contextId is computed just above, always defined here
       descriptorCid,
       attestation : this._message.attestation,
       encryption  : this._message.encryption,
@@ -872,7 +872,7 @@ export class RecordsWrite implements MessageInterface<RecordsWriteMessage> {
   public static async fetchInitialRecordsWrite(
     messageStore: MessageStore, tenant: string, recordId: string
   ): Promise<RecordsWrite | undefined> {
-    return fetchInitialRecordsWrite(messageStore, tenant, recordId) as Promise<RecordsWrite | undefined>;
+    return fetchInitialRecordsWrite(messageStore, tenant, recordId);
   }
 
   /** Delegate to `fetchInitialRecordsWriteMessage` in `records-write-query.ts`. */

package/src/jose/jws/general/builder.ts

@@ -4,7 +4,7 @@ import type { MessageSigner } from '../../../types/signer.js';
 import { Encoder } from '../../../utils/encoder.js';
 
 export class GeneralJwsBuilder {
-  private jws: GeneralJws;
+  private readonly jws: GeneralJws;
 
   private constructor(jws: GeneralJws) {
     this.jws = jws;

package/src/jose/jws/general/verifier.ts

@@ -1,7 +1,7 @@
 import type { Cache } from '../../../types/cache.js';
 import type { GeneralJws } from '../../../types/jws-types.js';
 import type { PublicKeyJwk } from '../../../types/jose-types.js';
-import type { DidResolver, DidVerificationMethod } from '@enbox/dids';
+import type { DidResolutionResult, DidResolver, DidVerificationMethod } from '@enbox/dids';
 
 import { Encoder } from '../../../utils/encoder.js';
 import { Jws } from '../../../utils/jws.js';
@@ -89,12 +89,19 @@ export class GeneralJwsVerifier {
 
   /**
    * Gets the public key given a fully qualified key ID (`kid`) by resolving the DID to its DID Document.
+   *
+   * Throws `GeneralJwsVerifierGetPublicKeyNotFound` when the public key cannot be located.
+   * The error message distinguishes between two failure modes so callers can tell them apart:
+   *   1. DID resolution failed (network error, DID not published, method not supported, etc.).
+   *      The resolution metadata error code and message are included.
+   *   2. DID resolved successfully but the requested `kid` does not match any verification
+   *      method in the DID Document. The list of available verification method IDs is included.
    */
   private static async getPublicKey(kid: string, didResolver: DidResolver): Promise<PublicKeyJwk> {
     // `resolve` throws exception if DID is invalid, DID method is not supported,
     // or resolving DID fails
     const did = Jws.extractDid(kid);
-    const { didDocument } = await didResolver.resolve(did);
+    const { didDocument, didResolutionMetadata } = await didResolver.resolve(did);
     const { verificationMethod: verificationMethods = [] } = didDocument || {};
 
     let verificationMethod: DidVerificationMethod | undefined;
@@ -110,7 +117,10 @@ export class GeneralJwsVerifier {
     }
 
     if (!verificationMethod) {
-      throw new DwnError(DwnErrorCode.GeneralJwsVerifierGetPublicKeyNotFound, 'public key needed to verify signature not found in DID Document');
+      throw new DwnError(
+        DwnErrorCode.GeneralJwsVerifierGetPublicKeyNotFound,
+        GeneralJwsVerifier.buildPublicKeyNotFoundMessage(kid, did, didDocument, didResolutionMetadata, verificationMethods),
+      );
     }
 
     validateJsonSchema('JwkVerificationMethod', verificationMethod);
@@ -119,4 +129,35 @@ export class GeneralJwsVerifier {
 
     return publicJwk as PublicKeyJwk;
   }
+
+  /**
+   * Builds a diagnostic error message for `GeneralJwsVerifierGetPublicKeyNotFound`.
+   * Surfaces resolution metadata or available verification methods so operators can
+   * distinguish between an unreachable DID and a `kid` mismatch.
+   */
+  private static buildPublicKeyNotFoundMessage(
+    kid: string,
+    did: string,
+    didDocument: DidResolutionResult['didDocument'],
+    didResolutionMetadata: DidResolutionResult['didResolutionMetadata'] | undefined,
+    verificationMethods: DidVerificationMethod[],
+  ): string {
+    const resolutionError = didResolutionMetadata?.error;
+    if (resolutionError !== undefined) {
+      const resolutionErrorMessage = didResolutionMetadata?.errorMessage;
+      const detail = resolutionErrorMessage ? `${resolutionError} — ${resolutionErrorMessage}` : resolutionError;
+      return `unable to resolve DID '${did}' to verify signature with kid '${kid}': ${detail}`;
+    }
+
+    if (didDocument === undefined || didDocument === null) {
+      return `DID Document not found for '${did}' when verifying signature with kid '${kid}'`;
+    }
+
+    if (verificationMethods.length === 0) {
+      return `DID Document for '${did}' has no verification methods to verify signature with kid '${kid}'`;
+    }
+
+    const availableIds = verificationMethods.map((method) => method.id).join(', ');
+    return `public key for kid '${kid}' not found in DID Document for '${did}' (available verification methods: [${availableIds}])`;
+  }
 }

package/src/protocols/permissions.ts

@@ -605,7 +605,7 @@ export class PermissionsProtocol implements CoreProtocol {
    */
   private static validateTags(requestOrGrant: RecordsWriteMessage, scopedProtocol: string): void {
     // the protocol tag must be included with the record.
-    if (requestOrGrant.descriptor.tags === undefined || requestOrGrant.descriptor.tags.protocol === undefined) {
+    if (requestOrGrant.descriptor.tags?.protocol === undefined) {
       throw new DwnError(
         DwnErrorCode.PermissionsProtocolValidateScopeMissingProtocolTag,
         'Permission grants must have a `tags` property that contains a protocol tag'

package/src/smt/smt-store-level.ts

@@ -31,7 +31,7 @@ type SerializedLeafNode = {
 type SerializedNode = SerializedInternalNode | SerializedLeafNode;
 
 export class SMTStoreLevel implements SMTNodeStore {
-  private db: LevelWrapper<string>;
+  private readonly db: LevelWrapper<string>;
   private nodesPartition!: LevelWrapper<string>;
   private metaPartition!: LevelWrapper<string>;
   private initialized = false;

package/src/smt/smt-store-memory.ts

@@ -8,7 +8,7 @@ import type { Hash, SMTNode, SMTNodeStore } from '../types/smt-types.js';
 import { hashToHex } from './smt-utils.js';
 
 export class SMTStoreMemory implements SMTNodeStore {
-  private nodes: Map<string, SMTNode> = new Map();
+  private readonly nodes: Map<string, SMTNode> = new Map();
   private root: Hash | undefined;
 
   async open(): Promise<void> {

package/src/smt/sparse-merkle-tree.ts

@@ -19,7 +19,7 @@ import type { Hash, SMTDiffResult, SMTInternalNode, SMTLeafNode, SMTNodeStore, S
 import { getBit, hashChildren, hashEquals, hashKey, hashLeaf, initDefaultHashes, SMT_DEPTH } from './smt-utils.js';
 
 export class SparseMerkleTree {
-  private store: SMTNodeStore;
+  private readonly store: SMTNodeStore;
   private defaultHashes!: Hash[];
 
   constructor(store: SMTNodeStore) {
@@ -142,13 +142,13 @@ export class SparseMerkleTree {
         // subtree hash would be if this leaf were pushed down to the prefix depth.
         // For simplicity, if we've hit a leaf, the subtree at this prefix
         // either contains this leaf or is empty.
-        if (node !== undefined && node.type === 'leaf') {
+        if (node?.type === 'leaf') {
           return this.computeSubtreeHashForLeaf(node, i, prefix);
         }
         return this.defaultHashes[prefix.length];
       }
 
-      const internalNode = node as SMTInternalNode;
+      const internalNode = node;
       if (prefix[i]) {
         currentHash = internalNode.rightHash;
       } else {
@@ -186,7 +186,7 @@ export class SparseMerkleTree {
         return [];
       }
 
-      const internalNode = node as SMTInternalNode;
+      const internalNode = node;
       if (prefix[i]) {
         currentHash = internalNode.rightHash;
       } else {
@@ -266,7 +266,7 @@ export class SparseMerkleTree {
     }
 
     // Internal node — recurse into the appropriate child
-    const internalNode = node as SMTInternalNode;
+    const internalNode = node;
     const goRight = getBit(keyHash, depth);
 
     let newLeftHash: Hash;
@@ -405,7 +405,7 @@ export class SparseMerkleTree {
     }
 
     // Internal node — recurse into the appropriate child
-    const internalNode = node as SMTInternalNode;
+    const internalNode = node;
     const goRight = getBit(keyHash, depth);
 
     let newLeftHash: Hash;
@@ -433,7 +433,7 @@ export class SparseMerkleTree {
     if (leftIsDefault || rightIsDefault) {
       const survivingHash = leftIsDefault ? newRightHash : newLeftHash;
       const survivingNode = await this.store.getNode(survivingHash);
-      if (survivingNode !== undefined && survivingNode.type === 'leaf') {
+      if (survivingNode?.type === 'leaf') {
         // Collapse: remove the internal node, return the leaf hash directly
         await this.store.deleteNode(currentHash);
         return survivingHash;
@@ -477,7 +477,7 @@ export class SparseMerkleTree {
       return hashEquals(node.keyHash, keyHash);
     }
 
-    const internalNode = node as SMTInternalNode;
+    const internalNode = node;
     const goRight = getBit(keyHash, depth);
 
     if (goRight) {
@@ -508,7 +508,7 @@ export class SparseMerkleTree {
       return { siblings: [], leafNode: node, depth };
     }
 
-    const internalNode = node as SMTInternalNode;
+    const internalNode = node;
     const goRight = getBit(keyHash, depth);
 
     let childHash: Hash;
@@ -578,7 +578,7 @@ export class SparseMerkleTree {
       return [node.valueCid];
     }
 
-    const internalNode = node as SMTInternalNode;
+    const internalNode = node;
     const leftLeaves = await this.collectLeaves(internalNode.leftHash, depth + 1);
     const rightLeaves = await this.collectLeaves(internalNode.rightHash, depth + 1);
 

package/src/state-index/state-index-level.ts

@@ -28,7 +28,7 @@ export type StateIndexLevelConfig = {
 };
 
 export class StateIndexLevel implements StateIndex {
-  private config: StateIndexLevelConfig;
+  private readonly config: StateIndexLevelConfig;
   private db!: LevelWrapper<string>;
 
   /**
@@ -36,13 +36,13 @@ export class StateIndexLevel implements StateIndex {
    * Stores promises to avoid race conditions when multiple concurrent operations
    * trigger lazy initialization of the same tenant's SMT.
    */
-  private globalTrees: Map<string, Promise<SparseMerkleTree>> = new Map();
+  private readonly globalTrees: Map<string, Promise<SparseMerkleTree>> = new Map();
 
   /**
    * Cache of per-tenant, per-protocol SMTs. Key format: `{tenant}\x00{protocol}`
    * Stores promises to avoid race conditions (same reason as globalTrees).
    */
-  private protocolTrees: Map<string, Promise<SparseMerkleTree>> = new Map();
+  private readonly protocolTrees: Map<string, Promise<SparseMerkleTree>> = new Map();
 
   constructor(config?: StateIndexLevelConfig) {
     this.config = {

package/src/store/index-level-compound.ts

@@ -203,28 +203,28 @@ export async function queryWithCompoundIndex(
   // determine the iterator bounds from the prefix
   const iteratorOptions: LevelWrapperIteratorOptions<string> = {};
 
-  if (cursor !== undefined) {
-    // build the full compound key for the cursor position
-    const cursorSortEncoded = encodeValue(cursor.value);
-    const cursorKey = prefix + cursorSortEncoded + delimiter + cursor.messageCid;
-
+  if (cursor === undefined) {
     if (sortDirection === SortDirection.Ascending) {
-      iteratorOptions.gt = cursorKey;
-      // upper bound: everything with this prefix (prefix + \xff is past all valid compound keys with this prefix)
+      iteratorOptions.gt = prefix;
       iteratorOptions.lt = prefix + '\xff';
     } else {
-      iteratorOptions.lt = cursorKey;
+      // for descending without cursor, start from the end of the prefix range
       iteratorOptions.gt = prefix;
+      iteratorOptions.lt = prefix + '\xff';
       iteratorOptions.reverse = true;
     }
   } else {
+    // build the full compound key for the cursor position
+    const cursorSortEncoded = encodeValue(cursor.value);
+    const cursorKey = prefix + cursorSortEncoded + delimiter + cursor.messageCid;
+
     if (sortDirection === SortDirection.Ascending) {
-      iteratorOptions.gt = prefix;
+      iteratorOptions.gt = cursorKey;
+      // upper bound: everything with this prefix (prefix + \xff is past all valid compound keys with this prefix)
       iteratorOptions.lt = prefix + '\xff';
     } else {
-      // for descending without cursor, start from the end of the prefix range
+      iteratorOptions.lt = cursorKey;
       iteratorOptions.gt = prefix;
-      iteratorOptions.lt = prefix + '\xff';
       iteratorOptions.reverse = true;
     }
   }

package/src/store/index-level.ts

@@ -53,7 +53,7 @@ export interface IndexLevelOptions {
 export class IndexLevel {
   db: LevelWrapper<string>;
   config: IndexLevelConfig;
-  private _compoundIndexes: CompoundIndexDefinition[];
+  private readonly _compoundIndexes: CompoundIndexDefinition[];
 
   constructor(config: IndexLevelConfig) {
     this.config = {
@@ -498,13 +498,13 @@ export class IndexLevel {
 
     const sortedValues = [...matches.values()].sort((a,b) => this.sortItems(a,b, sortProperty, sortDirection));
 
-    const start = cursorStartingKey !== undefined ? this.findCursorStartingIndex(sortedValues, sortDirection, sortProperty, cursorStartingKey) : 0;
+    const start = cursorStartingKey === undefined ? 0 : this.findCursorStartingIndex(sortedValues, sortDirection, sortProperty, cursorStartingKey);
     if (start < 0) {
       // if the provided cursor does not come before any of the results, we return no results
       return [];
     }
 
-    const end = limit !== undefined ? start + limit: undefined;
+    const end = limit === undefined ? undefined : start + limit;
     return sortedValues.slice(start, end);
   }
 
@@ -735,7 +735,7 @@ export class IndexLevel {
   /**
    * Joins the given values using the `\x00` (\u0000) character.
    */
-  private static delimiter = `\x00`;
+  private static readonly delimiter = `\x00`;
   private static keySegmentJoin(...values: string[]): string {
     return values.join(IndexLevel.delimiter);
   }

package/src/store/level-wrapper.ts

@@ -183,7 +183,7 @@ export class LevelWrapper<V> {
   }
 
   async isEmpty(options?: LevelWrapperOptions): Promise<boolean> {
-    for await (const _key of this.keys(options)) {
+    for await (const _key of this.keys(options)) { // NOSONAR — intentional single-iteration check
       return false;
     }
     return true;