@enbox/dwn-sdk-js 0.3.7 → 0.3.9

package/dist/esm/tests/handlers/messages-sync.spec.js

@@ -1,5 +1,6 @@
 import freeForAll from '../vectors/protocol-definitions/free-for-all.json' with { type: 'json' };
 import { Jws } from '../../src/utils/jws.js';
+import { KEY_DELIVERY_PROTOCOL_URI } from '../../src/core/constants.js';
 import { Message } from '../../src/core/message.js';
 import { MessagesSync } from '../../src/interfaces/messages-sync.js';
 import { MessagesSyncHandler } from '../../src/handlers/messages-sync.js';
@@ -8,8 +9,8 @@ import { TestDataGenerator } from '../utils/test-data-generator.js';
 import { TestEventLog } from '../test-event-stream.js';
 import { TestStores } from '../test-stores.js';
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'bun:test';
+import { DataStream, Dwn, DwnErrorCode, DwnInterfaceName, DwnMethodName, Encoder, PermissionGrant, PermissionsProtocol, RECORDS_PROJECTION_ROOT_VERSION, RecordsProjection, Time } from '../../src/index.js';
 import { DidKey, UniversalResolver } from '@enbox/dids';
-import { Dwn, DwnErrorCode, DwnInterfaceName, DwnMethodName } from '../../src/index.js';
 export function testMessagesSyncHandler() {
     describe('MessagesSyncHandler.handle()', () => {
         let didResolver;
@@ -231,6 +232,126 @@ export function testMessagesSyncHandler() {
                 expect(reply.entries).toContain(protocolCid);
                 expect(reply.entries).toContain(recordCid);
             });
+            it('returns projected record leaves without protocol configs or out-of-path records', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const protocolDefinition = { ...freeForAll, published: true };
+                const protocol = protocolDefinition.protocol;
+                const { message: protocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                    author: alice,
+                    protocolDefinition,
+                });
+                expect((await dwn.processMessage(alice.did, protocolMessage)).status.code).toBe(202);
+                const { message: postMessage, dataStream: postDataStream } = await TestDataGenerator.generateRecordsWrite({
+                    author: alice,
+                    protocol,
+                    protocolPath: 'post',
+                    schema: protocolDefinition.types.post.schema,
+                });
+                expect((await dwn.processMessage(alice.did, postMessage, { dataStream: postDataStream })).status.code).toBe(202);
+                const { message: attachmentMessage, dataStream: attachmentDataStream } = await TestDataGenerator.generateRecordsWrite({
+                    author: alice,
+                    protocol,
+                    protocolPath: 'post/attachment',
+                    parentContextId: postMessage.contextId,
+                });
+                expect((await dwn.processMessage(alice.did, attachmentMessage, { dataStream: attachmentDataStream })).status.code).toBe(202);
+                const { message } = await MessagesSync.create({
+                    signer: Jws.createSigner(alice),
+                    action: 'leaves',
+                    prefix: '',
+                    projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                    projectionScopes: [{ protocol, protocolPath: 'post' }],
+                });
+                const reply = await dwn.processMessage(alice.did, message);
+                expect(reply.status.code).toBe(200);
+                expect(reply.entries).toEqual([await Message.getCid(postMessage)]);
+                expect(reply.entries).not.toContain(await Message.getCid(protocolMessage));
+                expect(reply.entries).not.toContain(await Message.getCid(attachmentMessage));
+            });
+            it('excludes infrastructure protocols from records-primary projection leaves', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const bob = await TestDataGenerator.generateDidKeyPersona();
+                const { message: permissionGrantMessage, dataStream: permissionGrantDataStream } = await TestDataGenerator.generateGrantCreate({
+                    author: alice,
+                    grantedTo: bob,
+                    scope: {
+                        interface: DwnInterfaceName.Messages,
+                        method: DwnMethodName.Read,
+                        protocol: 'http://projected-sync-app-protocol',
+                    },
+                });
+                expect((await dwn.processMessage(alice.did, permissionGrantMessage, { dataStream: permissionGrantDataStream })).status.code).toBe(202);
+                const keyDeliverySchema = 'https://identity.foundation/schemas/key-delivery/context-key';
+                const keyDeliveryProtocolDefinition = {
+                    protocol: KEY_DELIVERY_PROTOCOL_URI,
+                    published: false,
+                    types: {
+                        contextKey: {
+                            schema: keyDeliverySchema,
+                            dataFormats: ['application/json'],
+                        },
+                    },
+                    structure: {
+                        contextKey: {},
+                    },
+                };
+                const { message: keyDeliveryConfigureMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                    author: alice,
+                    protocolDefinition: keyDeliveryProtocolDefinition,
+                });
+                expect((await dwn.processMessage(alice.did, keyDeliveryConfigureMessage)).status.code).toBe(202);
+                const { message: keyDeliveryMessage, dataStream: keyDeliveryDataStream } = await TestDataGenerator.generateRecordsWrite({
+                    author: alice,
+                    protocol: KEY_DELIVERY_PROTOCOL_URI,
+                    protocolPath: 'contextKey',
+                    schema: keyDeliverySchema,
+                });
+                expect((await dwn.processMessage(alice.did, keyDeliveryMessage, { dataStream: keyDeliveryDataStream })).status.code).toBe(202);
+                for (const protocol of [PermissionsProtocol.uri, KEY_DELIVERY_PROTOCOL_URI]) {
+                    const { message } = await MessagesSync.create({
+                        signer: Jws.createSigner(alice),
+                        action: 'leaves',
+                        prefix: '',
+                        projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                        projectionScopes: [{ protocol }],
+                    });
+                    const reply = await dwn.processMessage(alice.did, message);
+                    expect(reply.status.code).toBe(200);
+                    expect(reply.entries).toEqual([]);
+                }
+            });
+            it('returns projected roots from the Records projection algorithm', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const protocolDefinition = { ...freeForAll, published: true };
+                const protocol = protocolDefinition.protocol;
+                const projectionScopes = [{ protocol, protocolPath: 'post' }];
+                const { message: protocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                    author: alice,
+                    protocolDefinition,
+                });
+                expect((await dwn.processMessage(alice.did, protocolMessage)).status.code).toBe(202);
+                const { message: postMessage, dataStream: postDataStream } = await TestDataGenerator.generateRecordsWrite({
+                    author: alice,
+                    protocol,
+                    protocolPath: 'post',
+                    schema: protocolDefinition.types.post.schema,
+                });
+                expect((await dwn.processMessage(alice.did, postMessage, { dataStream: postDataStream })).status.code).toBe(202);
+                const expectedRoot = await RecordsProjection.getRootHex({
+                    tenant: alice.did,
+                    messageStore: messageStore,
+                    scopes: projectionScopes,
+                });
+                const { message } = await MessagesSync.create({
+                    signer: Jws.createSigner(alice),
+                    action: 'root',
+                    projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                    projectionScopes,
+                });
+                const reply = await dwn.processMessage(alice.did, message);
+                expect(reply.status.code).toBe(200);
+                expect(reply.root).toBe(expectedRoot);
+            });
         });
         describe('authorization', () => {
             it('returns 401 if tenant is not the author', async () => {
@@ -278,7 +399,7 @@ export function testMessagesSyncHandler() {
                     const { message: syncMsg } = await MessagesSync.create({
                         signer: Jws.createSigner(bob),
                         action: 'root',
-                        permissionGrantId: grantMessage.recordId,
+                        permissionGrantIds: [grantMessage.recordId],
                     });
                     const reply = await dwn.processMessage(alice.did, syncMsg);
                     expect(reply.status.code).toBe(200);
@@ -309,7 +430,7 @@ export function testMessagesSyncHandler() {
                     const { message: syncMsg } = await MessagesSync.create({
                         signer: Jws.createSigner(bob),
                         action: 'root',
-                        permissionGrantId: grantMessage.recordId,
+                        permissionGrantIds: [grantMessage.recordId],
                     });
                     const reply2 = await dwn.processMessage(alice.did, syncMsg);
                     expect(reply2.status.code).toBe(200);
@@ -352,7 +473,7 @@ export function testMessagesSyncHandler() {
                         action: 'leaves',
                         prefix: '',
                         protocol: protocolDefinition.protocol,
-                        permissionGrantId: grantMessage.recordId,
+                        permissionGrantIds: [grantMessage.recordId],
                     });
                     const reply2 = await dwn.processMessage(alice.did, syncMsg);
                     expect(reply2.status.code).toBe(200);
@@ -394,7 +515,7 @@ export function testMessagesSyncHandler() {
                         action: 'leaves',
                         prefix: '',
                         protocol: protocolDefinition.protocol,
-                        permissionGrantId: grantMessage.recordId,
+                        permissionGrantIds: [grantMessage.recordId],
                     });
                     const reply = await dwn.processMessage(alice.did, syncMsg);
                     expect(reply.status.code).toBe(200);
@@ -406,6 +527,131 @@ export function testMessagesSyncHandler() {
                     expect(reply.entries).toContain(protocolCid);
                     expect(reply.entries).toContain(recordCid);
                 });
+                it('allows protocol sync when one grant in a plural grant set covers the protocol', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const protocol1 = { ...freeForAll, published: true, protocol: 'http://plural-grant-sync-1' };
+                    const protocol2 = { ...freeForAll, published: true, protocol: 'http://plural-grant-sync-2' };
+                    for (const protocolDefinition of [protocol1, protocol2]) {
+                        const { message: protocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                            author: alice,
+                            protocolDefinition,
+                        });
+                        await dwn.processMessage(alice.did, protocolMessage);
+                    }
+                    const { message: recordMessage, dataStream } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol: protocol2.protocol,
+                        protocolPath: 'post',
+                        schema: protocol2.types.post.schema,
+                    });
+                    await dwn.processMessage(alice.did, recordMessage, { dataStream });
+                    const grantIds = [];
+                    for (const protocolDefinition of [protocol1, protocol2]) {
+                        const { message: grantMessage, dataStream: grantDataStream } = await TestDataGenerator.generateGrantCreate({
+                            author: alice,
+                            grantedTo: bob,
+                            scope: {
+                                interface: DwnInterfaceName.Messages,
+                                method: DwnMethodName.Read,
+                                protocol: protocolDefinition.protocol,
+                            },
+                        });
+                        const grantReply = await dwn.processMessage(alice.did, grantMessage, { dataStream: grantDataStream });
+                        expect(grantReply.status.code).toBe(202);
+                        grantIds.push(grantMessage.recordId);
+                    }
+                    const { message: syncMsg } = await MessagesSync.create({
+                        signer: Jws.createSigner(bob),
+                        action: 'leaves',
+                        prefix: '',
+                        protocol: protocol2.protocol,
+                        permissionGrantIds: grantIds.reverse(),
+                    });
+                    const reply = await dwn.processMessage(alice.did, syncMsg);
+                    expect(reply.status.code).toBe(200);
+                    expect(reply.entries).toContain(await Message.getCid(recordMessage));
+                    expect(syncMsg.descriptor.permissionGrantIds).toEqual([...grantIds].sort());
+                });
+                it('rejects sync when any grant in a plural grant set is expired', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const protocol = 'http://plural-grant-sync-expired';
+                    const now = Time.getCurrentTimestamp();
+                    const { message: activeGrantMessage, dataStream: activeGrantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        dateExpires: Time.createOffsetTimestamp({ seconds: 60 * 60 }, now),
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol,
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, activeGrantMessage, { dataStream: activeGrantDataStream })).status.code).toBe(202);
+                    const { message: expiredGrantMessage, dataStream: expiredGrantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        dateGranted: Time.createOffsetTimestamp({ seconds: -120 }, now),
+                        dateExpires: Time.createOffsetTimestamp({ seconds: -60 }, now),
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol,
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, expiredGrantMessage, { dataStream: expiredGrantDataStream })).status.code).toBe(202);
+                    const { message: syncMsg } = await MessagesSync.create({
+                        signer: Jws.createSigner(bob),
+                        action: 'root',
+                        protocol,
+                        permissionGrantIds: [activeGrantMessage.recordId, expiredGrantMessage.recordId],
+                    });
+                    const reply = await dwn.processMessage(alice.did, syncMsg);
+                    expect(reply.status.code).toBe(401);
+                    expect(reply.status.detail).toContain(DwnErrorCode.GrantAuthorizationGrantExpired);
+                });
+                it('rejects sync when any grant in a plural grant set is revoked', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const protocol = 'http://plural-grant-sync-revoked';
+                    const { message: activeGrantMessage, dataStream: activeGrantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol,
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, activeGrantMessage, { dataStream: activeGrantDataStream })).status.code).toBe(202);
+                    const revokedGrant = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol,
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, revokedGrant.message, { dataStream: revokedGrant.dataStream })).status.code).toBe(202);
+                    const revocation = await PermissionsProtocol.createRevocation({
+                        signer: Jws.createSigner(alice),
+                        grant: PermissionGrant.parse(revokedGrant.dataEncodedMessage),
+                    });
+                    const revocationReply = await dwn.processMessage(alice.did, revocation.recordsWrite.message, { dataStream: DataStream.fromBytes(revocation.permissionRevocationBytes) });
+                    expect(revocationReply.status.code).toBe(202);
+                    await Time.minimalSleep();
+                    const { message: syncMsg } = await MessagesSync.create({
+                        signer: Jws.createSigner(bob),
+                        action: 'root',
+                        protocol,
+                        permissionGrantIds: [activeGrantMessage.recordId, revokedGrant.message.recordId],
+                    });
+                    const reply = await dwn.processMessage(alice.did, syncMsg);
+                    expect(reply.status.code).toBe(401);
+                    expect(reply.status.detail).toContain(DwnErrorCode.GrantAuthorizationGrantRevoked);
+                });
                 it('rejects sync with mismatching interface grant scope', async () => {
                     const alice = await TestDataGenerator.generateDidKeyPersona();
                     const bob = await TestDataGenerator.generateDidKeyPersona();
@@ -424,7 +670,7 @@ export function testMessagesSyncHandler() {
                     const { message: syncMsg } = await MessagesSync.create({
                         signer: Jws.createSigner(bob),
                         action: 'root',
-                        permissionGrantId: grantMessage.recordId,
+                        permissionGrantIds: [grantMessage.recordId],
                     });
                     const reply = await dwn.processMessage(alice.did, syncMsg);
                     expect(reply.status.code).toBe(401);
@@ -450,12 +696,695 @@ export function testMessagesSyncHandler() {
                         signer: Jws.createSigner(bob),
                         action: 'root',
                         protocol: 'http://protocol2',
-                        permissionGrantId: grantMessage.recordId,
+                        permissionGrantIds: [grantMessage.recordId],
                     });
                     const reply = await dwn.processMessage(alice.did, syncMsg);
                     expect(reply.status.code).toBe(401);
                     expect(reply.status.detail).toContain(DwnErrorCode.MessagesGrantAuthorizationMismatchedProtocol);
                 });
+                it('rejects full-tenant sync actions with a protocol-scoped grant', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const { message: grantMessage, dataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol: 'http://protocol-scoped-sync',
+                        },
+                    });
+                    const grantReply = await dwn.processMessage(alice.did, grantMessage, { dataStream });
+                    expect(grantReply.status.code).toBe(202);
+                    const syncActions = [
+                        { action: 'root' },
+                        { action: 'subtree', prefix: '' },
+                        { action: 'leaves', prefix: '' },
+                        { action: 'diff', hashes: {}, depth: 2 },
+                    ];
+                    for (const syncAction of syncActions) {
+                        const { message: syncMsg } = await MessagesSync.create({
+                            signer: Jws.createSigner(bob),
+                            ...syncAction,
+                            permissionGrantIds: [grantMessage.recordId],
+                        });
+                        const reply = await dwn.processMessage(alice.did, syncMsg);
+                        expect(reply.status.code).toBe(401);
+                        expect(reply.status.detail).toContain(DwnErrorCode.MessagesGrantAuthorizationMismatchedProtocol);
+                    }
+                });
+                it('rejects protocol sync with subtree-scoped grants', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const protocol = 'http://subtree-scoped-sync';
+                    const scopedGrants = [
+                        {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol,
+                            protocolPath: 'post',
+                        },
+                        {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol,
+                            contextId: 'root',
+                        },
+                    ];
+                    for (const scope of scopedGrants) {
+                        const { message: grantMessage, dataStream } = await TestDataGenerator.generateGrantCreate({
+                            author: alice,
+                            grantedTo: bob,
+                            scope,
+                        });
+                        const grantReply = await dwn.processMessage(alice.did, grantMessage, { dataStream });
+                        expect(grantReply.status.code).toBe(202);
+                        const { message: syncMsg } = await MessagesSync.create({
+                            signer: Jws.createSigner(bob),
+                            action: 'root',
+                            protocol,
+                            permissionGrantIds: [grantMessage.recordId],
+                        });
+                        const reply = await dwn.processMessage(alice.did, syncMsg);
+                        expect(reply.status.code).toBe(401);
+                        expect(reply.status.detail).toContain(DwnErrorCode.MessagesGrantAuthorizationMismatchedProtocol);
+                    }
+                });
+                it('allows projected sync with a matching protocolPath Messages.Read grant', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const protocolDefinition = { ...freeForAll, published: true };
+                    const protocol = protocolDefinition.protocol;
+                    const { message: protocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        protocolDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, protocolMessage)).status.code).toBe(202);
+                    const { message: postMessage, dataStream: postDataStream } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol,
+                        protocolPath: 'post',
+                        schema: protocolDefinition.types.post.schema,
+                    });
+                    expect((await dwn.processMessage(alice.did, postMessage, { dataStream: postDataStream })).status.code).toBe(202);
+                    const { message: attachmentMessage, dataStream: attachmentDataStream } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol,
+                        protocolPath: 'post/attachment',
+                        parentContextId: postMessage.contextId,
+                    });
+                    expect((await dwn.processMessage(alice.did, attachmentMessage, { dataStream: attachmentDataStream })).status.code).toBe(202);
+                    const { message: grantMessage, dataStream: grantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol,
+                            protocolPath: 'post',
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, grantMessage, { dataStream: grantDataStream })).status.code).toBe(202);
+                    const { message: diffMsg } = await MessagesSync.create({
+                        signer: Jws.createSigner(bob),
+                        action: 'diff',
+                        hashes: {},
+                        depth: 2,
+                        projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                        projectionScopes: [{ protocol, protocolPath: 'post' }],
+                        permissionGrantIds: [grantMessage.recordId],
+                    });
+                    const reply = await dwn.processMessage(alice.did, diffMsg);
+                    expect(reply.status.code).toBe(200);
+                    const protocolCid = await Message.getCid(protocolMessage);
+                    const postCid = await Message.getCid(postMessage);
+                    const remoteCids = reply.onlyRemote.map(entry => entry.messageCid);
+                    expect(remoteCids).toContain(postCid);
+                    expect(remoteCids).not.toContain(protocolCid);
+                    expect(remoteCids).not.toContain(await Message.getCid(attachmentMessage));
+                    expect(reply.dependencies).toEqual([{
+                            dependencyClass: 'protocolsConfigure',
+                            messageCid: protocolCid,
+                            message: protocolMessage,
+                            rootMessageCid: postCid,
+                        }]);
+                });
+                it('returns the governing protocol config dependency for projected sync', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const protocol = 'http://projected-sync-config-history';
+                    const protocolDefinition = {
+                        ...freeForAll,
+                        protocol,
+                        published: true,
+                    };
+                    const { message: firstProtocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        messageTimestamp: '2026-01-01T00:00:00.000000Z',
+                        protocolDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, firstProtocolMessage)).status.code).toBe(202);
+                    const { message: secondProtocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        messageTimestamp: '2026-01-02T00:00:00.000000Z',
+                        protocolDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, secondProtocolMessage)).status.code).toBe(202);
+                    const { message: postMessage, dataStream: postDataStream } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        dateCreated: '2026-01-03T00:00:00.000000Z',
+                        messageTimestamp: '2026-01-03T00:00:00.000000Z',
+                        protocol,
+                        protocolPath: 'post',
+                        schema: protocolDefinition.types.post.schema,
+                    });
+                    expect((await dwn.processMessage(alice.did, postMessage, { dataStream: postDataStream })).status.code).toBe(202);
+                    const { message: futureProtocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        messageTimestamp: '2026-01-04T00:00:00.000000Z',
+                        protocolDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, futureProtocolMessage)).status.code).toBe(202);
+                    const { message: grantMessage, dataStream: grantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol,
+                            protocolPath: 'post',
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, grantMessage, { dataStream: grantDataStream })).status.code).toBe(202);
+                    const { message: diffMsg } = await MessagesSync.create({
+                        signer: Jws.createSigner(bob),
+                        action: 'diff',
+                        hashes: {},
+                        depth: 2,
+                        projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                        projectionScopes: [{ protocol, protocolPath: 'post' }],
+                        permissionGrantIds: [grantMessage.recordId],
+                    });
+                    const reply = await dwn.processMessage(alice.did, diffMsg);
+                    expect(reply.status.code).toBe(200);
+                    const postCid = await Message.getCid(postMessage);
+                    expect(reply.onlyRemote.map(entry => entry.messageCid)).toContain(postCid);
+                    expect(reply.dependencies.map(entry => entry.messageCid)).not.toContain(await Message.getCid(firstProtocolMessage));
+                    expect(reply.dependencies.map(entry => entry.messageCid)).not.toContain(await Message.getCid(futureProtocolMessage));
+                    expect(reply.dependencies).toEqual([
+                        {
+                            dependencyClass: 'protocolsConfigure',
+                            messageCid: await Message.getCid(secondProtocolMessage),
+                            message: secondProtocolMessage,
+                            rootMessageCid: postCid,
+                        },
+                    ]);
+                });
+                it('returns initial write and protocol config dependencies for projected delete tombstones', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const protocolDefinition = { ...freeForAll, protocol: 'http://projected-sync-delete-hints', published: true };
+                    const unrelatedDefinition = { ...freeForAll, protocol: 'http://projected-sync-delete-hints-unrelated', published: true };
+                    const protocol = protocolDefinition.protocol;
+                    const { message: protocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        protocolDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, protocolMessage)).status.code).toBe(202);
+                    const { message: unrelatedProtocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        protocolDefinition: unrelatedDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, unrelatedProtocolMessage)).status.code).toBe(202);
+                    const { message: postMessage, dataStream: postDataStream } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol,
+                        protocolPath: 'post',
+                        schema: protocolDefinition.types.post.schema,
+                    });
+                    expect((await dwn.processMessage(alice.did, postMessage, { dataStream: postDataStream })).status.code).toBe(202);
+                    const { message: deleteMessage } = await TestDataGenerator.generateRecordsDelete({
+                        author: alice,
+                        recordId: postMessage.recordId,
+                    });
+                    expect((await dwn.processMessage(alice.did, deleteMessage)).status.code).toBe(202);
+                    const { message: grantMessage, dataStream: grantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol,
+                            protocolPath: 'post',
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, grantMessage, { dataStream: grantDataStream })).status.code).toBe(202);
+                    const { message: diffMsg } = await MessagesSync.create({
+                        signer: Jws.createSigner(bob),
+                        action: 'diff',
+                        hashes: {},
+                        depth: 2,
+                        projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                        projectionScopes: [{ protocol, protocolPath: 'post' }],
+                        permissionGrantIds: [grantMessage.recordId],
+                    });
+                    const reply = await dwn.processMessage(alice.did, diffMsg);
+                    expect(reply.status.code).toBe(200);
+                    const deleteCid = await Message.getCid(deleteMessage);
+                    const postCid = await Message.getCid(postMessage);
+                    const protocolCid = await Message.getCid(protocolMessage);
+                    expect(reply.onlyRemote.map(entry => entry.messageCid)).toEqual([deleteCid]);
+                    expect(reply.dependencies.map(entry => entry.messageCid)).not.toContain(await Message.getCid(unrelatedProtocolMessage));
+                    expect(reply.dependencies).toEqual([
+                        {
+                            dependencyClass: 'recordsInitialWrite',
+                            messageCid: postCid,
+                            message: postMessage,
+                            rootMessageCid: deleteCid,
+                        },
+                        {
+                            dependencyClass: 'protocolsConfigure',
+                            messageCid: protocolCid,
+                            message: protocolMessage,
+                            rootMessageCid: deleteCid,
+                        },
+                    ]);
+                    const initialWriteDependency = reply.dependencies.find(entry => entry.dependencyClass === 'recordsInitialWrite');
+                    expect(initialWriteDependency.encodedData).toBeUndefined();
+                    expect('encodedData' in initialWriteDependency.message).toBe(false);
+                });
+                it('returns composed protocol config dependencies for projected sync', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const socialDefinition = {
+                        ...freeForAll,
+                        protocol: 'http://projected-sync-composed-social',
+                        published: true,
+                    };
+                    const profileDefinition = {
+                        ...freeForAll,
+                        protocol: 'http://projected-sync-composed-profile',
+                        published: true,
+                        uses: { social: socialDefinition.protocol },
+                    };
+                    const unrelatedDefinition = {
+                        ...freeForAll,
+                        protocol: 'http://projected-sync-composed-unrelated',
+                        published: true,
+                    };
+                    const { message: socialProtocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        protocolDefinition: socialDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, socialProtocolMessage)).status.code).toBe(202);
+                    const { message: profileProtocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        protocolDefinition: profileDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, profileProtocolMessage)).status.code).toBe(202);
+                    const { message: unrelatedProtocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        protocolDefinition: unrelatedDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, unrelatedProtocolMessage)).status.code).toBe(202);
+                    const { message: postMessage, dataStream: postDataStream } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol: profileDefinition.protocol,
+                        protocolPath: 'post',
+                        schema: profileDefinition.types.post.schema,
+                    });
+                    expect((await dwn.processMessage(alice.did, postMessage, { dataStream: postDataStream })).status.code).toBe(202);
+                    const { message: grantMessage, dataStream: grantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol: profileDefinition.protocol,
+                            protocolPath: 'post',
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, grantMessage, { dataStream: grantDataStream })).status.code).toBe(202);
+                    const { message: diffMsg } = await MessagesSync.create({
+                        signer: Jws.createSigner(bob),
+                        action: 'diff',
+                        hashes: {},
+                        depth: 2,
+                        projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                        projectionScopes: [{ protocol: profileDefinition.protocol, protocolPath: 'post' }],
+                        permissionGrantIds: [grantMessage.recordId],
+                    });
+                    const reply = await dwn.processMessage(alice.did, diffMsg);
+                    expect(reply.status.code).toBe(200);
+                    const postCid = await Message.getCid(postMessage);
+                    expect(reply.onlyRemote.map(entry => entry.messageCid)).toContain(postCid);
+                    expect(reply.dependencies.map(entry => entry.messageCid)).not.toContain(await Message.getCid(unrelatedProtocolMessage));
+                    expect(reply.dependencies).toEqual([
+                        {
+                            dependencyClass: 'protocolsConfigure',
+                            messageCid: await Message.getCid(profileProtocolMessage),
+                            message: profileProtocolMessage,
+                            rootMessageCid: postCid,
+                        },
+                        {
+                            dependencyClass: 'protocolsConfigure',
+                            messageCid: await Message.getCid(socialProtocolMessage),
+                            message: socialProtocolMessage,
+                            rootMessageCid: postCid,
+                        },
+                    ]);
+                });
+                it('terminates cyclic composed protocol dependencies for projected sync', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const protocolA = 'http://projected-sync-cycle-a';
+                    const protocolB = 'http://projected-sync-cycle-b';
+                    const protocolBBaseDefinition = {
+                        ...freeForAll,
+                        protocol: protocolB,
+                        published: true,
+                    };
+                    const protocolADefinition = {
+                        ...freeForAll,
+                        protocol: protocolA,
+                        published: true,
+                        uses: { b: protocolB },
+                    };
+                    const protocolBCycleDefinition = {
+                        ...freeForAll,
+                        protocol: protocolB,
+                        published: true,
+                        uses: { a: protocolA },
+                    };
+                    const { message: protocolBBaseMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        messageTimestamp: '2026-01-01T00:00:00.000000Z',
+                        protocolDefinition: protocolBBaseDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, protocolBBaseMessage)).status.code).toBe(202);
+                    const { message: protocolAMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        messageTimestamp: '2026-01-02T00:00:00.000000Z',
+                        protocolDefinition: protocolADefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, protocolAMessage)).status.code).toBe(202);
+                    const { message: protocolBCycleMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        messageTimestamp: '2026-01-03T00:00:00.000000Z',
+                        protocolDefinition: protocolBCycleDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, protocolBCycleMessage)).status.code).toBe(202);
+                    const { message: postMessage, dataStream: postDataStream } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        dateCreated: '2026-01-04T00:00:00.000000Z',
+                        messageTimestamp: '2026-01-04T00:00:00.000000Z',
+                        protocol: protocolA,
+                        protocolPath: 'post',
+                        schema: protocolADefinition.types.post.schema,
+                    });
+                    expect((await dwn.processMessage(alice.did, postMessage, { dataStream: postDataStream })).status.code).toBe(202);
+                    const { message: grantMessage, dataStream: grantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol: protocolA,
+                            protocolPath: 'post',
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, grantMessage, { dataStream: grantDataStream })).status.code).toBe(202);
+                    const { message: diffMsg } = await MessagesSync.create({
+                        signer: Jws.createSigner(bob),
+                        action: 'diff',
+                        hashes: {},
+                        depth: 2,
+                        projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                        projectionScopes: [{ protocol: protocolA, protocolPath: 'post' }],
+                        permissionGrantIds: [grantMessage.recordId],
+                    });
+                    const reply = await dwn.processMessage(alice.did, diffMsg);
+                    expect(reply.status.code).toBe(200);
+                    const postCid = await Message.getCid(postMessage);
+                    const dependencyCids = reply.dependencies.map(entry => entry.messageCid);
+                    expect(reply.onlyRemote.map(entry => entry.messageCid)).toContain(postCid);
+                    expect(dependencyCids.sort()).toEqual([
+                        await Message.getCid(protocolAMessage),
+                        await Message.getCid(protocolBCycleMessage),
+                    ].sort());
+                    expect(dependencyCids).not.toContain(await Message.getCid(protocolBBaseMessage));
+                    expect(reply.dependencies.every(entry => entry.rootMessageCid === postCid)).toBe(true);
+                });
+                it('rejects projected sync when no grant covers a requested projection scope', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const protocol = 'http://projected-sync-scope-mismatch';
+                    const { message: grantMessage, dataStream: grantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol,
+                            protocolPath: 'post',
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, grantMessage, { dataStream: grantDataStream })).status.code).toBe(202);
+                    const { message: syncMsg } = await MessagesSync.create({
+                        signer: Jws.createSigner(bob),
+                        action: 'root',
+                        projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                        projectionScopes: [{ protocol }],
+                        permissionGrantIds: [grantMessage.recordId],
+                    });
+                    const reply = await dwn.processMessage(alice.did, syncMsg);
+                    expect(reply.status.code).toBe(401);
+                    expect(reply.status.detail).toContain(DwnErrorCode.MessagesGrantAuthorizationProjectionScopeMismatch);
+                });
+                it('rejects projected sync when any requested projection scope is uncovered', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const coveredProtocol = 'http://projected-sync-covered-scope';
+                    const uncoveredProtocol = 'http://projected-sync-uncovered-scope';
+                    const { message: grantMessage, dataStream: grantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol: coveredProtocol,
+                            protocolPath: 'post',
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, grantMessage, { dataStream: grantDataStream })).status.code).toBe(202);
+                    const { message: syncMsg } = await MessagesSync.create({
+                        signer: Jws.createSigner(bob),
+                        action: 'root',
+                        projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                        projectionScopes: [
+                            { protocol: coveredProtocol, protocolPath: 'post' },
+                            { protocol: uncoveredProtocol, protocolPath: 'post' },
+                        ],
+                        permissionGrantIds: [grantMessage.recordId],
+                    });
+                    const reply = await dwn.processMessage(alice.did, syncMsg);
+                    expect(reply.status.code).toBe(401);
+                    expect(reply.status.detail).toContain(DwnErrorCode.MessagesGrantAuthorizationProjectionScopeMismatch);
+                });
+                it('rejects delegated MessagesSync of infrastructure protocols', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const carol = await TestDataGenerator.generateDidKeyPersona();
+                    const { message: permissionsGrantMessage, dataStream: permissionsGrantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol: PermissionsProtocol.uri,
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, permissionsGrantMessage, { dataStream: permissionsGrantDataStream })).status.code).toBe(202);
+                    const { message: keyDeliveryGrantMessage, dataStream: keyDeliveryGrantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol: KEY_DELIVERY_PROTOCOL_URI,
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, keyDeliveryGrantMessage, { dataStream: keyDeliveryGrantDataStream })).status.code).toBe(202);
+                    const { message: carolGrantMessage, dataStream: carolGrantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: carol,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol: 'http://private-delegate-protocol',
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, carolGrantMessage, { dataStream: carolGrantDataStream })).status.code).toBe(202);
+                    const { message: readMessage } = await TestDataGenerator.generateMessagesRead({
+                        author: bob,
+                        messageCid: await Message.getCid(carolGrantMessage),
+                        permissionGrantIds: [permissionsGrantMessage.recordId],
+                    });
+                    const readReply = await dwn.processMessage(alice.did, readMessage);
+                    expect(readReply.status.code).toBe(401);
+                    expect(readReply.status.detail).toContain(DwnErrorCode.MessagesReadVerifyScopeFailed);
+                    const stateIndexSyncActions = [
+                        { action: 'root' },
+                        { action: 'subtree', prefix: '' },
+                        { action: 'leaves', prefix: '' },
+                        { action: 'diff', hashes: {}, depth: 2 },
+                    ];
+                    const infrastructureProtocolGrants = [
+                        { protocol: PermissionsProtocol.uri, grantId: permissionsGrantMessage.recordId },
+                        { protocol: KEY_DELIVERY_PROTOCOL_URI, grantId: keyDeliveryGrantMessage.recordId },
+                    ];
+                    for (const { protocol, grantId } of infrastructureProtocolGrants) {
+                        for (const syncAction of stateIndexSyncActions) {
+                            const { message: syncMessage } = await MessagesSync.create({
+                                signer: Jws.createSigner(bob),
+                                ...syncAction,
+                                protocol,
+                                permissionGrantIds: [grantId],
+                            });
+                            const syncReply = await dwn.processMessage(alice.did, syncMessage);
+                            expect(syncReply.status.code).toBe(401);
+                            expect(syncReply.status.detail).toContain(DwnErrorCode.MessagesGrantAuthorizationProtocolSyncInfrastructureProtocol);
+                        }
+                    }
+                    for (const { protocol, grantId } of infrastructureProtocolGrants) {
+                        const { message: projectedSyncMessage } = await MessagesSync.create({
+                            signer: Jws.createSigner(bob),
+                            action: 'diff',
+                            hashes: {},
+                            depth: 2,
+                            projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                            projectionScopes: [{ protocol }],
+                            permissionGrantIds: [grantId],
+                        });
+                        const projectedSyncReply = await dwn.processMessage(alice.did, projectedSyncMessage);
+                        expect(projectedSyncReply.status.code).toBe(401);
+                        expect(projectedSyncReply.status.detail).toContain(DwnErrorCode.MessagesGrantAuthorizationProjectionInfrastructureProtocol);
+                    }
+                });
+                it('allows projected sync with a matching contextId Messages.Read grant', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const protocolDefinition = { ...freeForAll, published: true };
+                    const protocol = protocolDefinition.protocol;
+                    const { message: protocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                        author: alice,
+                        protocolDefinition,
+                    });
+                    expect((await dwn.processMessage(alice.did, protocolMessage)).status.code).toBe(202);
+                    const { message: rootMessage, dataStream: rootDataStream } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol,
+                        protocolPath: 'post',
+                        schema: protocolDefinition.types.post.schema,
+                    });
+                    expect((await dwn.processMessage(alice.did, rootMessage, { dataStream: rootDataStream })).status.code).toBe(202);
+                    const { message: childMessage, dataStream: childDataStream } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol,
+                        protocolPath: 'post/attachment',
+                        parentContextId: rootMessage.contextId,
+                    });
+                    expect((await dwn.processMessage(alice.did, childMessage, { dataStream: childDataStream })).status.code).toBe(202);
+                    const { message: siblingMessage, dataStream: siblingDataStream } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol,
+                        protocolPath: 'post',
+                        schema: protocolDefinition.types.post.schema,
+                    });
+                    expect((await dwn.processMessage(alice.did, siblingMessage, { dataStream: siblingDataStream })).status.code).toBe(202);
+                    const { message: grantMessage, dataStream: grantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol,
+                            contextId: rootMessage.contextId,
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, grantMessage, { dataStream: grantDataStream })).status.code).toBe(202);
+                    const { message: syncMsg } = await MessagesSync.create({
+                        signer: Jws.createSigner(bob),
+                        action: 'leaves',
+                        prefix: '',
+                        projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                        projectionScopes: [{ protocol, contextId: rootMessage.contextId }],
+                        permissionGrantIds: [grantMessage.recordId],
+                    });
+                    const reply = await dwn.processMessage(alice.did, syncMsg);
+                    expect(reply.status.code).toBe(200);
+                    expect(reply.entries).toContain(await Message.getCid(rootMessage));
+                    expect(reply.entries).toContain(await Message.getCid(childMessage));
+                    expect(reply.entries).not.toContain(await Message.getCid(protocolMessage));
+                    expect(reply.entries).not.toContain(await Message.getCid(siblingMessage));
+                });
+                it('returns only protocol-scoped diff entries for a delegated protocol grant', async () => {
+                    const alice = await TestDataGenerator.generateDidKeyPersona();
+                    const bob = await TestDataGenerator.generateDidKeyPersona();
+                    const protocolA = { ...freeForAll, protocol: 'http://delegated-diff-protocol-a' };
+                    const protocolB = { ...freeForAll, protocol: 'http://delegated-diff-protocol-b' };
+                    for (const protocolDefinition of [protocolA, protocolB]) {
+                        const { message: protocolMessage } = await TestDataGenerator.generateProtocolsConfigure({
+                            author: alice,
+                            protocolDefinition,
+                        });
+                        expect((await dwn.processMessage(alice.did, protocolMessage)).status.code).toBe(202);
+                    }
+                    const { message: recordA, dataStream: dataStreamA } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol: protocolA.protocol,
+                        protocolPath: 'post',
+                        schema: protocolA.types.post.schema,
+                    });
+                    expect((await dwn.processMessage(alice.did, recordA, { dataStream: dataStreamA })).status.code).toBe(202);
+                    const { message: recordB, dataStream: dataStreamB } = await TestDataGenerator.generateRecordsWrite({
+                        author: alice,
+                        protocol: protocolB.protocol,
+                        protocolPath: 'post',
+                        schema: protocolB.types.post.schema,
+                    });
+                    expect((await dwn.processMessage(alice.did, recordB, { dataStream: dataStreamB })).status.code).toBe(202);
+                    const { message: grantMessage, dataStream: grantDataStream } = await TestDataGenerator.generateGrantCreate({
+                        author: alice,
+                        grantedTo: bob,
+                        scope: {
+                            interface: DwnInterfaceName.Messages,
+                            method: DwnMethodName.Read,
+                            protocol: protocolA.protocol,
+                        },
+                    });
+                    expect((await dwn.processMessage(alice.did, grantMessage, { dataStream: grantDataStream })).status.code).toBe(202);
+                    const { message: diffMsg } = await MessagesSync.create({
+                        signer: Jws.createSigner(bob),
+                        action: 'diff',
+                        hashes: {},
+                        depth: 2,
+                        protocol: protocolA.protocol,
+                        permissionGrantIds: [grantMessage.recordId],
+                    });
+                    const reply = await dwn.processMessage(alice.did, diffMsg);
+                    expect(reply.status.code).toBe(200);
+                    const remoteCids = reply.onlyRemote.map(entry => entry.messageCid);
+                    expect(remoteCids).toContain(await Message.getCid(recordA));
+                    expect(remoteCids).not.toContain(await Message.getCid(recordB));
+                    expect(reply.onlyRemote.every(entry => {
+                        if (entry.message?.descriptor.interface !== DwnInterfaceName.Records) {
+                            return true;
+                        }
+                        const recordsMessage = entry.message;
+                        return recordsMessage.descriptor.protocol === protocolA.protocol;
+                    })).toBe(true);
+                });
             });
         });
         describe('input validation', () => {
@@ -547,6 +1476,77 @@ export function testMessagesSyncHandler() {
                     parseStub.restore();
                 }
             });
+            it('returns 400 when projection scopes are provided without a projection root version', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const { message } = await MessagesSync.create({
+                    signer: Jws.createSigner(alice),
+                    action: 'root',
+                    projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                    projectionScopes: [{ protocol: 'http://projected-sync-schema' }],
+                });
+                delete message.descriptor.projectionRootVersion;
+                const reply = await dwn.processMessage(alice.did, message);
+                expect(reply.status.code).toBe(400);
+                expect(reply.status.detail).toContain('SchemaValidatorFailure');
+            });
+            it('returns 400 when projection root version is provided without projection scopes', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const { message } = await MessagesSync.create({
+                    signer: Jws.createSigner(alice),
+                    action: 'root',
+                    projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                    projectionScopes: [{ protocol: 'http://projected-sync-schema' }],
+                });
+                delete message.descriptor.projectionScopes;
+                const reply = await dwn.processMessage(alice.did, message);
+                expect(reply.status.code).toBe(400);
+                expect(reply.status.detail).toContain('SchemaValidatorFailure');
+            });
+            it('returns 400 when projection root version is unsupported', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const { message } = await MessagesSync.create({
+                    signer: Jws.createSigner(alice),
+                    action: 'root',
+                    projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                    projectionScopes: [{ protocol: 'http://projected-sync-schema' }],
+                });
+                const unsupportedProjectionRootVersion = 'records-primary-scope-root-v2';
+                const descriptor = {
+                    ...message.descriptor,
+                    projectionRootVersion: unsupportedProjectionRootVersion,
+                };
+                const authorization = await Message.createAuthorization({
+                    descriptor,
+                    signer: Jws.createSigner(alice),
+                });
+                const unsupportedVersionMessage = {
+                    ...message,
+                    descriptor,
+                    authorization,
+                };
+                const validateJsonSchemaStub = sinon.stub(Message, 'validateJsonSchema');
+                try {
+                    const reply = await dwn.processMessage(alice.did, unsupportedVersionMessage);
+                    expect(reply.status.code).toBe(400);
+                    expect(reply.status.detail).toContain(DwnErrorCode.MessagesSyncUnsupportedProjectionRootVersion);
+                }
+                finally {
+                    validateJsonSchemaStub.restore();
+                }
+            });
+            it('returns 400 when projected sync also specifies a protocol root', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const { message } = await MessagesSync.create({
+                    signer: Jws.createSigner(alice),
+                    action: 'root',
+                    projectionRootVersion: RECORDS_PROJECTION_ROOT_VERSION,
+                    projectionScopes: [{ protocol: 'http://projected-sync-schema' }],
+                });
+                message.descriptor.protocol = 'http://projected-sync-schema';
+                const reply = await dwn.processMessage(alice.did, message);
+                expect(reply.status.code).toBe(400);
+                expect(reply.status.detail).toContain('SchemaValidatorFailure');
+            });
         });
         describe('diff action', () => {
             it('returns empty diff when client hashes match server hashes', async () => {
@@ -619,6 +1619,26 @@ export function testMessagesSyncHandler() {
                 expect(reply.onlyLocal).toContain('00');
                 expect(reply.onlyLocal).toContain('01');
             });
+            it('prunes empty server subtrees at the current diff depth', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                const getSubtreeHashSpy = sinon.spy(stateIndex, 'getSubtreeHash');
+                try {
+                    const { message: diffMsg } = await MessagesSync.create({
+                        signer: Jws.createSigner(alice),
+                        action: 'diff',
+                        hashes: {},
+                        depth: 64,
+                    });
+                    const reply = await dwn.processMessage(alice.did, diffMsg);
+                    expect(reply.status.code).toBe(200);
+                    expect(reply.onlyRemote).toEqual([]);
+                    expect(reply.onlyLocal).toEqual([]);
+                    expect(getSubtreeHashSpy.callCount).toBe(1);
+                }
+                finally {
+                    getSubtreeHashSpy.restore();
+                }
+            });
             it('inlines small data payloads as encodedData in onlyRemote entries', async () => {
                 const alice = await TestDataGenerator.generateDidKeyPersona();
                 await TestDataGenerator.installDefaultTestProtocol(dwn, alice);
@@ -645,6 +1665,32 @@ export function testMessagesSyncHandler() {
                 expect(recordEntry.encodedData).toBeDefined();
                 expect(typeof recordEntry.encodedData).toBe('string');
             });
+            it('inlines small dataStore-backed payloads using the RecordsWrite recordId', async () => {
+                const alice = await TestDataGenerator.generateDidKeyPersona();
+                await TestDataGenerator.installDefaultTestProtocol(dwn, alice);
+                const dataBytes = new TextEncoder().encode('small data-store payload');
+                const { message: recordMessage, recordsWrite } = await TestDataGenerator.generateRecordsWrite({
+                    author: alice,
+                    data: dataBytes,
+                    dataFormat: 'text/plain',
+                });
+                const indexes = await recordsWrite.constructIndexes(true);
+                const messageCid = await Message.getCid(recordMessage);
+                await dataStore.put(alice.did, recordMessage.recordId, recordMessage.descriptor.dataCid, DataStream.fromBytes(dataBytes));
+                await messageStore.put(alice.did, recordMessage, indexes);
+                await stateIndex.insert(alice.did, messageCid, indexes);
+                const { message: diffMsg } = await MessagesSync.create({
+                    signer: Jws.createSigner(alice),
+                    action: 'diff',
+                    hashes: {},
+                    depth: 2,
+                });
+                const reply = await dwn.processMessage(alice.did, diffMsg);
+                expect(reply.status.code).toBe(200);
+                const recordEntry = reply.onlyRemote.find(entry => entry.messageCid === messageCid);
+                expect(recordEntry).toBeDefined();
+                expect(recordEntry.encodedData).toBe(Encoder.bytesToBase64Url(dataBytes));
+            });
             it('returns 400 when hashes or depth are missing', async () => {
                 const alice = await TestDataGenerator.generateDidKeyPersona();
                 // create a valid diff message then strip required fields