@enbox/dwn-sdk-js 0.3.9 → 0.4.1

package/src/handlers/messages-query.ts

@@ -0,0 +1,203 @@
+import type { EventLogEntry, ProgressGapInfo, ReplicationFeedReader } from '../types/subscriptions.js';
+import type { Filter, KeyValues } from '../types/query-types.js';
+import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
+import type { MessagesFilter, MessagesQueryMessage, MessagesQueryReply, MessagesQueryReplyEntry } from '../types/messages-types.js';
+
+import { authenticate } from '../core/auth.js';
+import { Message } from '../core/message.js';
+import { messageReplyFromError } from '../core/message-reply.js';
+import { Messages } from '../utils/messages.js';
+import { MessagesGrantAuthorization } from '../core/messages-grant-authorization.js';
+import { MessagesQuery } from '../interfaces/messages-query.js';
+import { PermissionsProtocol } from '../protocols/permissions.js';
+import { Replication } from '../utils/replication.js';
+import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
+
+export class MessagesQueryHandler implements MethodHandler {
+
+  constructor(private readonly deps: HandlerDependencies) { }
+
+  public async handle({ tenant, message }: { tenant: string, message: MessagesQueryMessage }): Promise<MessagesQueryReply> {
+    let messagesQuery: MessagesQuery;
+    try {
+      messagesQuery = await MessagesQuery.parse(message);
+    } catch (e) {
+      return messageReplyFromError(e, 400);
+    }
+
+    try {
+      await authenticate(message.authorization, this.deps.didResolver);
+      await this.authorizeMessagesQuery(tenant, messagesQuery);
+    } catch (e) {
+      return messageReplyFromError(e, 401);
+    }
+
+    const replicationFeedReader = MessagesQueryHandler.asReplicationFeedReader(this.deps.messageStore);
+    if (replicationFeedReader === undefined) {
+      return {
+        status: {
+          code   : 501,
+          detail : `${DwnErrorCode.MessagesQueryReplicationFeedUnimplemented}: MessagesQuery requires a replication feed reader`,
+        }
+      };
+    }
+
+    try {
+      const filters = MessagesQueryHandler.convertFilters(message.descriptor.filters, this.deps);
+      const result = await replicationFeedReader.logRead(tenant, {
+        cursor : message.descriptor.cursor,
+        filters,
+        limit  : message.descriptor.limit,
+      });
+
+      const reply: MessagesQueryReply = {
+        status  : { code: 200, detail: 'OK' },
+        entries : await MessagesQueryHandler.buildEntries(result.events, message.descriptor.cidsOnly ?? false),
+        cursor  : result.cursor,
+        drained : result.drained,
+      };
+
+      const fingerprintScopes = MessagesQueryHandler.computeFingerprintScopes(message.descriptor.filters);
+      if (fingerprintScopes !== undefined) {
+        reply.fingerprint = await replicationFeedReader.fingerprint(tenant, fingerprintScopes);
+      }
+
+      return reply;
+    } catch (e) {
+      if (e instanceof DwnError && e.code === DwnErrorCode.EventLogProgressGap) {
+        const gapInfo = MessagesQueryHandler.getProgressGapInfo(e);
+        return {
+          status : { code: 410, detail: 'Progress token gap' },
+          error  : gapInfo === undefined ? undefined : { code: 'ProgressGap', ...gapInfo },
+        };
+      }
+
+      return messageReplyFromError(e, 500);
+    }
+  }
+
+  private async authorizeMessagesQuery(
+    tenant: string,
+    messagesQuery: MessagesQuery,
+  ): Promise<void> {
+    if (messagesQuery.author === tenant) {
+      return;
+    }
+
+    const permissionGrantIds = Message.getPermissionGrantIds(messagesQuery.signaturePayload!);
+    if (messagesQuery.author !== undefined && permissionGrantIds.length > 0) {
+      const permissionGrants = await MessagesGrantAuthorization.fetchPermissionGrants(
+        tenant,
+        this.deps.validationStateReader,
+        permissionGrantIds
+      );
+      await MessagesGrantAuthorization.authorizeQueryOrSubscribe({
+        incomingMessage       : messagesQuery.message,
+        expectedGrantor       : tenant,
+        expectedGrantee       : messagesQuery.author,
+        permissionGrants,
+        validationStateReader : this.deps.validationStateReader
+      });
+      return;
+    }
+
+    throw new DwnError(DwnErrorCode.MessagesQueryAuthorizationFailed, 'message failed authorization');
+  }
+
+  private static asReplicationFeedReader(candidate: unknown): ReplicationFeedReader | undefined {
+    const partial = candidate as Partial<ReplicationFeedReader>;
+    if (
+      typeof partial.logRead === 'function' &&
+      typeof partial.logBounds === 'function' &&
+      typeof partial.fingerprint === 'function' &&
+      typeof partial.epoch === 'function'
+    ) {
+      return partial as ReplicationFeedReader;
+    }
+  }
+
+  private static convertFilters(filters: MessagesFilter[], deps: HandlerDependencies): Filter[] | undefined {
+    if (filters.length === 0) {
+      return undefined;
+    }
+
+    return Messages.convertFilters(filters, deps.coreProtocols);
+  }
+
+  private static async buildEntries(
+    events: EventLogEntry[],
+    cidsOnly: boolean,
+  ): Promise<MessagesQueryReplyEntry[]> {
+    const entries: MessagesQueryReplyEntry[] = [];
+
+    for (const event of events) {
+      entries.push(await MessagesQueryHandler.buildEntry(event, cidsOnly));
+    }
+
+    return entries;
+  }
+
+  private static async buildEntry(
+    event: EventLogEntry,
+    cidsOnly: boolean,
+  ): Promise<MessagesQueryReplyEntry> {
+    const messageCid = event.messageCid ?? await Message.getCid(event.event.message);
+    const protocol = MessagesQueryHandler.getStringIndex(event.indexes, 'protocol');
+    const entry: MessagesQueryReplyEntry = {
+      seq               : event.seq,
+      messageCid,
+      isLatestBaseState : MessagesQueryHandler.isLatestBaseState(event.indexes),
+      protocol,
+    };
+
+    if (cidsOnly) {
+      return entry;
+    }
+
+    const { message, encodedData } = Messages.detachEncodedData(event.event.message);
+    entry.message = message;
+    if (encodedData !== undefined) {
+      entry.encodedData = encodedData;
+    }
+
+    return entry;
+  }
+
+  private static getStringIndex(indexes: KeyValues, key: string): string | undefined {
+    const value = indexes[key];
+    return typeof value === 'string' ? value : undefined;
+  }
+
+  private static isLatestBaseState(indexes: KeyValues): boolean {
+    return indexes.isLatestBaseState === true || indexes.isLatestBaseState === 'true';
+  }
+
+  private static computeFingerprintScopes(filters: MessagesFilter[]): string[] | undefined {
+    if (filters.length === 0) {
+      return [Replication.globalDomain];
+    }
+
+    const protocols = new Set<string>();
+    for (const filter of filters) {
+      const keys = Object.keys(filter);
+      if (keys.length !== 1 || typeof filter.protocol !== 'string') {
+        return undefined;
+      }
+
+      protocols.add(filter.protocol);
+    }
+
+    const protocolList = [...protocols];
+    const scopes = protocolList.map(protocol => Replication.protocolDomain(protocol));
+    if (!protocols.has(PermissionsProtocol.uri)) {
+      scopes.push(...protocolList.map(protocol => Replication.permissionDomain(protocol)));
+    }
+
+    return scopes;
+  }
+
+  private static getProgressGapInfo(error: DwnError): ProgressGapInfo | undefined {
+    const gapInfo = (error as DwnError & { gapInfo?: ProgressGapInfo }).gapInfo;
+    return gapInfo;
+  }
+}

package/src/handlers/messages-read.ts

@@ -1,5 +1,4 @@
 import type { GenericMessage } from '../types/message-types.js';
-import type { MessageStore } from '../types/message-store.js';
 import type { RecordsQueryReplyEntry } from '../types/records-types.js';
 import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 import type { MessagesReadMessage, MessagesReadReply, MessagesReadReplyEntry } from '../types/messages-types.js';
@@ -41,7 +40,7 @@ export class MessagesReadHandler implements MethodHandler {
     }
 
     try {
-      await MessagesReadHandler.authorizeMessagesRead(tenant, messagesRead, messageResult, this.deps.messageStore);
+      await MessagesReadHandler.authorizeMessagesRead(tenant, messagesRead, messageResult, this.deps);
     } catch (error) {
       return messageReplyFromError(error, 401);
     }
@@ -72,13 +71,13 @@ export class MessagesReadHandler implements MethodHandler {
   }
 
   /**
-   * @param messageStore Used to fetch related permission grant, permission revocation, and/or RecordsWrites for permission scope validation.
+   * @param deps Used to fetch related permission grant, permission revocation, and/or RecordsWrites for permission scope validation.
    */
   private static async authorizeMessagesRead(
     tenant: string,
     messagesRead: MessagesRead,
     matchedMessage: GenericMessage,
-    messageStore: MessageStore
+    deps: HandlerDependencies
   ): Promise<void> {
 
     if (messagesRead.author === tenant) {
@@ -88,14 +87,14 @@ export class MessagesReadHandler implements MethodHandler {
 
     const permissionGrantIds = Message.getPermissionGrantIds(messagesRead.signaturePayload!);
     if (messagesRead.author !== undefined && permissionGrantIds.length > 0) {
-      const permissionGrants = await MessagesGrantAuthorization.fetchPermissionGrants(tenant, messageStore, permissionGrantIds);
+      const permissionGrants = await MessagesGrantAuthorization.fetchPermissionGrants(tenant, deps.validationStateReader, permissionGrantIds);
       await MessagesGrantAuthorization.authorizeMessagesRead({
-        messagesReadMessage : messagesRead.message,
-        messageToRead       : matchedMessage,
-        expectedGrantor     : tenant,
-        expectedGrantee     : messagesRead.author,
+        messagesReadMessage   : messagesRead.message,
+        messageToRead         : matchedMessage,
+        expectedGrantor       : tenant,
+        expectedGrantee       : messagesRead.author,
         permissionGrants,
-        messageStore
+        validationStateReader : deps.validationStateReader
       });
     } else {
       throw new DwnError(DwnErrorCode.MessagesReadAuthorizationFailed, 'protocol message failed authorization');

package/src/handlers/messages-subscribe.ts

@@ -1,4 +1,3 @@
-import type { MessageStore } from '../types/message-store.js';
 import type { PermissionGrant } from '../protocols/permission-grant.js';
 import type { EventSubscription, ProgressGapInfo, SubscriptionEvent, SubscriptionListener, SubscriptionMessage } from '../types/subscriptions.js';
 import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
@@ -57,7 +56,7 @@ export class MessagesSubscribeHandler implements MethodHandler {
     let authorization: MessagesSubscribeAuthorization;
     try {
       await authenticate(message.authorization, this.deps.didResolver);
-      authorization = await MessagesSubscribeHandler.authorizeMessagesSubscribe(tenant, messagesSubscribe, this.deps.messageStore);
+      authorization = await MessagesSubscribeHandler.authorizeMessagesSubscribe(tenant, messagesSubscribe, this.deps);
     } catch (error) {
       return messageReplyFromError(error, 401);
     }
@@ -65,7 +64,7 @@ export class MessagesSubscribeHandler implements MethodHandler {
     const guardedHandler = MessagesSubscribeHandler.createAuthorizationGuard({
       authorization,
       messagesSubscribe,
-      messageStore: this.deps.messageStore,
+      validationStateReader: this.deps.validationStateReader,
       subscriptionHandler,
     });
 
@@ -99,7 +98,7 @@ export class MessagesSubscribeHandler implements MethodHandler {
   private static async authorizeMessagesSubscribe(
     tenant: string,
     messagesSubscribe: MessagesSubscribe,
-    messageStore: MessageStore
+    deps: HandlerDependencies
   ): Promise<MessagesSubscribeAuthorization> {
     // if `MessagesSubscribe` author is the same as the target tenant, we can directly grant access
     if (messagesSubscribe.author === tenant) {
@@ -108,13 +107,13 @@ export class MessagesSubscribeHandler implements MethodHandler {
 
     const permissionGrantIds = Message.getPermissionGrantIds(messagesSubscribe.signaturePayload!);
     if (messagesSubscribe.author !== undefined && permissionGrantIds.length > 0) {
-      const permissionGrants = await MessagesGrantAuthorization.fetchPermissionGrants(tenant, messageStore, permissionGrantIds);
-      await MessagesGrantAuthorization.authorizeSubscribeOrSync({
-        incomingMessage : messagesSubscribe.message,
-        expectedGrantor : tenant,
-        expectedGrantee : messagesSubscribe.author,
+      const permissionGrants = await MessagesGrantAuthorization.fetchPermissionGrants(tenant, deps.validationStateReader, permissionGrantIds);
+      await MessagesGrantAuthorization.authorizeQueryOrSubscribe({
+        incomingMessage       : messagesSubscribe.message,
+        expectedGrantor       : tenant,
+        expectedGrantee       : messagesSubscribe.author,
         permissionGrants,
-        messageStore
+        validationStateReader : deps.validationStateReader
       });
       return {
         kind            : 'delegate',
@@ -130,10 +129,10 @@ export class MessagesSubscribeHandler implements MethodHandler {
   private static createAuthorizationGuard(input: {
     authorization: MessagesSubscribeAuthorization;
     messagesSubscribe: MessagesSubscribe;
-    messageStore: MessageStore;
+    validationStateReader: HandlerDependencies['validationStateReader'];
     subscriptionHandler: SubscriptionListener;
   }): GuardedSubscriptionHandler {
-    const { authorization, messagesSubscribe, messageStore, subscriptionHandler } = input;
+    const { authorization, messagesSubscribe, validationStateReader, subscriptionHandler } = input;
     if (authorization.kind === 'owner') {
       return {
         listener        : subscriptionHandler,
@@ -182,7 +181,7 @@ export class MessagesSubscribeHandler implements MethodHandler {
           expectedGrantor          : authorization.expectedGrantor,
           expectedGrantee          : authorization.expectedGrantee,
           permissionGrants         : authorization.permissionGrants,
-          messageStore,
+          validationStateReader,
           deliveryTimestamp        : Time.getCurrentTimestamp(),
         });
       } catch {

package/src/handlers/protocols-configure.ts

@@ -1,13 +1,13 @@
 import type { GenericMessageReply } from '../types/message-types.js';
-import type { MessageStore } from '../types//message-store.js';
+import type { ProgressToken } from '../types/subscriptions.js';
 import type { RecordsWriteMessage } from '../types/records-types.js';
+import type { ValidationStateReader } from '../types/validation-state-reader.js';
 import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 import type { ProtocolDefinition, ProtocolRuleSet, ProtocolsConfigureMessage } from '../types/protocols-types.js';
 
 import { authenticate } from '../core/auth.js';
 import { Message } from '../core/message.js';
 import { messageReplyFromError } from '../core/message-reply.js';
-import { PermissionsProtocol } from '../protocols/permissions.js';
 import { ProtocolAuthorization } from '../core/protocol-authorization.js';
 import { ProtocolsConfigure } from '../interfaces/protocols-configure.js';
 import { ProtocolsGrantAuthorization } from '../core/protocols-grant-authorization.js';
@@ -43,7 +43,7 @@ export class ProtocolsConfigureHandler implements MethodHandler {
   public async handle({
     tenant,
     message,
-  }: {tenant: string, message: ProtocolsConfigureMessage }): Promise<GenericMessageReply> {
+  }: { tenant: string, message: ProtocolsConfigureMessage }): Promise<GenericMessageReply> {
     let protocolsConfigure: ProtocolsConfigure;
     try {
       protocolsConfigure = await ProtocolsConfigure.parse(message);
@@ -54,7 +54,7 @@ export class ProtocolsConfigureHandler implements MethodHandler {
     // authentication & authorization
     try {
       await authenticate(message.authorization, this.deps.didResolver);
-      await ProtocolsConfigureHandler.authorizeProtocolsConfigure(tenant, protocolsConfigure, this.deps.messageStore);
+      await ProtocolsConfigureHandler.authorizeProtocolsConfigure(tenant, protocolsConfigure, this.deps);
     } catch (e) {
       return messageReplyFromError(e, 401);
     }
@@ -63,7 +63,9 @@ export class ProtocolsConfigureHandler implements MethodHandler {
     // `$ref` paths must exist in the referenced protocols, and cross-protocol roles must exist.
     try {
       await ProtocolsConfigureHandler.validateCompositionDependencies(
-        tenant, message.descriptor.definition, this.deps.messageStore
+        tenant,
+        message.descriptor.definition,
+        this.deps.validationStateReader,
       );
     } catch (e) {
       return messageReplyFromError(e, 400);
@@ -78,8 +80,8 @@ export class ProtocolsConfigureHandler implements MethodHandler {
     const { messages: existingMessages } = await this.deps.messageStore.query(tenant, [ query ]);
 
     // If the exact same message already exists, return 409 immediately.
-    // This prevents duplicate key violations in the MessageStore and StateIndex
-    // when sync pushes a message that the remote already has.
+    // This prevents duplicate key violations in the MessageStore when sync pushes
+    // a message that the remote already has.
     const incomingCid = await Message.getCid(message);
     for (const existing of existingMessages) {
       if (await Message.getCid(existing) === incomingCid) {
@@ -97,44 +99,38 @@ export class ProtocolsConfigureHandler implements MethodHandler {
 
     // write the incoming message to DB if incoming message is newest
     let messageReply: GenericMessageReply;
+    let position: ProgressToken | undefined;
     if (incomingMessageIsNewest) {
       const indexes = ProtocolsConfigureHandler.constructIndexes(protocolsConfigure, true);
 
-      await this.deps.messageStore.put(tenant, message, indexes);
-      const messageCid = await Message.getCid(message);
-      await this.deps.stateIndex!.insert(tenant, messageCid, indexes);
-
-      // only emit if the event log is set
-      if (this.deps.eventLog !== undefined) {
-        await this.deps.eventLog.emit(tenant, { message }, indexes, messageCid);
-      }
+      const putResult = await this.deps.messageStore.put(tenant, message, indexes);
+      position = putResult.position;
 
       messageReply = {
-        status: { code: 202, detail: 'Accepted' }
+        status: { code: 202, detail: 'Accepted' },
+        position,
       };
     } else {
       // incoming message is older — still store it as a historical version (not the latest)
       const indexes = ProtocolsConfigureHandler.constructIndexes(protocolsConfigure, false);
 
-      await this.deps.messageStore.put(tenant, message, indexes);
-      const messageCid = await Message.getCid(message);
-      await this.deps.stateIndex!.insert(tenant, messageCid, indexes);
+      const putResult = await this.deps.messageStore.put(tenant, message, indexes);
+      position = putResult.position;
 
       messageReply = {
-        status: { code: 202, detail: 'Accepted' }
+        status: { code: 202, detail: 'Accepted' },
+        position,
       };
     }
 
     // re-index previously-latest messages as no longer the latest base state.
-    // We must delete and re-put (not just put) to properly replace old index entries.
     for (const existingMessage of existingMessages) {
       if (existingMessage !== newestMessage) {
         const existingProtocolsConfigure = await ProtocolsConfigure.parse(existingMessage as ProtocolsConfigureMessage);
         const updatedIndexes = ProtocolsConfigureHandler.constructIndexes(existingProtocolsConfigure, false);
         const existingCid = await Message.getCid(existingMessage);
 
-        await this.deps.messageStore.delete(tenant, existingCid);
-        await this.deps.messageStore.put(tenant, existingMessage, updatedIndexes);
+        await this.deps.messageStore.updateIndexes(tenant, existingCid, updatedIndexes);
       }
     }
 
@@ -159,23 +155,23 @@ export class ProtocolsConfigureHandler implements MethodHandler {
     return indexes;
   }
 
-  private static async authorizeProtocolsConfigure(tenant: string, protocolConfigure: ProtocolsConfigure, messageStore: MessageStore): Promise<void> {
+  private static async authorizeProtocolsConfigure(tenant: string, protocolConfigure: ProtocolsConfigure, deps: HandlerDependencies): Promise<void> {
 
     if (protocolConfigure.isSignedByAuthorDelegate) {
-      await protocolConfigure.authorizeAuthorDelegate(messageStore);
+      await protocolConfigure.authorizeAuthorDelegate(deps.validationStateReader);
     }
 
     if (protocolConfigure.author === tenant) {
       return;
     } else if (protocolConfigure.author !== undefined && Message.getPermissionGrantId(protocolConfigure.signaturePayload!) !== undefined) {
       const permissionGrantId = Message.getPermissionGrantId(protocolConfigure.signaturePayload!)!;
-      const permissionGrant = await PermissionsProtocol.fetchGrant(tenant, messageStore, permissionGrantId);
+      const permissionGrant = await deps.validationStateReader.fetchGrant(tenant, permissionGrantId);
       await ProtocolsGrantAuthorization.authorizeConfigure({
         protocolsConfigureMessage : protocolConfigure.message,
         expectedGrantor           : tenant,
         expectedGrantee           : protocolConfigure.author,
         permissionGrant,
-        messageStore
+        validationStateReader     : deps.validationStateReader
       });
     } else {
       throw new DwnError(DwnErrorCode.ProtocolsConfigureAuthorizationFailed, 'message failed authorization');
@@ -184,8 +180,7 @@ export class ProtocolsConfigureHandler implements MethodHandler {
 
   private async purgeRecordsInvalidatedByProtocolConfig(tenant: string, protocol: string): Promise<void> {
     const dataStore = this.deps.dataStore;
-    const stateIndex = this.deps.stateIndex;
-    if (dataStore === undefined || stateIndex === undefined) {
+    if (dataStore === undefined) {
       return;
     }
 
@@ -227,7 +222,7 @@ export class ProtocolsConfigureHandler implements MethodHandler {
       // record. Descendants are evaluated independently so valid child records are not
       // destroyed as collateral.
       await StorageController.purgeRecordMessages(
-        tenant, recordMessages, this.deps.messageStore, dataStore, stateIndex
+        tenant, recordMessages, this.deps.messageStore, dataStore
       );
     }
   }
@@ -241,7 +236,7 @@ export class ProtocolsConfigureHandler implements MethodHandler {
       // Stored records were authenticated when admitted. Reconciliation should not make
       // record retention depend on fresh DID resolution availability or mutable dependency state.
       await ProtocolAuthorization.validateStoredInitialWrite(
-        tenant, recordsWrite, this.deps.messageStore, this.deps.coreProtocols
+        tenant, recordsWrite, this.deps.validationStateReader
       );
       return 'valid';
     } catch (error) {
@@ -266,7 +261,10 @@ export class ProtocolsConfigureHandler implements MethodHandler {
    * This is a no-op if the protocol definition has no `uses` map.
    */
   private static async validateCompositionDependencies(
-    tenant: string, definition: ProtocolDefinition, messageStore: MessageStore
+    tenant: string,
+    definition: ProtocolDefinition,
+    validationStateReader: ValidationStateReader,
+    messageTimestamp?: string,
   ): Promise<void> {
     const { uses } = definition;
     if (uses === undefined) {
@@ -277,44 +275,25 @@ export class ProtocolsConfigureHandler implements MethodHandler {
     const referencedDefinitions = new Map<string, ProtocolDefinition>();
     for (const alias in uses) {
       const protocolUri = uses[alias];
-      const refDefinition = await ProtocolsConfigureHandler.fetchInstalledProtocolDefinition(tenant, protocolUri, messageStore);
+      try {
+        const refDefinition = await validationStateReader.fetchProtocolDefinition(tenant, protocolUri, messageTimestamp);
+        referencedDefinitions.set(alias, refDefinition);
+      } catch (error) {
+        if (!(error instanceof DwnError) || error.code !== DwnErrorCode.ProtocolAuthorizationProtocolNotFound) {
+          throw error;
+        }
 
-      if (refDefinition === undefined) {
         throw new DwnError(
           DwnErrorCode.ProtocolsConfigureComposedProtocolNotInstalled,
           `composed protocol '${protocolUri}' (alias '${alias}') is not installed for tenant '${tenant}'.`
         );
       }
-
-      referencedDefinitions.set(alias, refDefinition);
     }
 
     // Walk the structure and validate all $ref paths and cross-protocol role references
     ProtocolsConfigureHandler.validateRefsAndRolesRecursively(definition.structure as ProtocolRuleSet, '', referencedDefinitions);
   }
 
-  /**
-   * Fetches the latest installed protocol definition for the given protocol URI.
-   * @returns The protocol definition, or `undefined` if not installed.
-   */
-  private static async fetchInstalledProtocolDefinition(
-    tenant: string, protocolUri: string, messageStore: MessageStore
-  ): Promise<ProtocolDefinition | undefined> {
-    const query = {
-      interface         : DwnInterfaceName.Protocols,
-      method            : DwnMethodName.Configure,
-      protocol          : protocolUri,
-      isLatestBaseState : true
-    };
-    const { messages } = await messageStore.query(tenant, [query]);
-
-    if (messages.length === 0) {
-      return undefined;
-    }
-
-    return (messages[0] as ProtocolsConfigureMessage).descriptor.definition;
-  }
-
   /**
    * Recursively walks the structure tree to validate:
    * - `$ref` type paths exist in the referenced protocol's structure

package/src/handlers/protocols-query.ts

@@ -28,7 +28,7 @@ export class ProtocolsQueryHandler implements MethodHandler {
     // authentication & authorization
     try {
       await authenticate(message.authorization, this.deps.didResolver);
-      await protocolsQuery.authorize(tenant, this.deps.messageStore);
+      await protocolsQuery.authorize(tenant, this.deps.validationStateReader);
     } catch (error: any) {
 
       // return public ProtocolsConfigures if query fails with a certain authentication or authorization code

package/src/handlers/records-count.ts

@@ -1,13 +1,11 @@
-import type { CoreProtocolRegistry } from '../core/core-protocol.js';
 import type { Filter } from '../types/query-types.js';
-import type { MessageStore } from '../types//message-store.js';
 import type { HandlerDependencies, MethodHandler } from '../types/method-handler.js';
 import type { RecordsCountMessage, RecordsCountReply } from '../types/records-types.js';
 
 import { authenticate } from '../core/auth.js';
+import { countRecordsWithRecordLimitOccupancy } from '../utils/record-limit-occupancy.js';
 import { Message } from '../core/message.js';
 import { messageReplyFromError } from '../core/message-reply.js';
-import { PermissionsProtocol } from '../protocols/permissions.js';
 import { ProtocolAuthorization } from '../core/protocol-authorization.js';
 import { Records } from '../utils/records.js';
 import { RecordsCount } from '../interfaces/records-count.js';
@@ -20,7 +18,7 @@ export class RecordsCountHandler implements MethodHandler {
 
   public async handle({
     tenant,
-    message
+    message,
   }: {tenant: string, message: RecordsCountMessage}): Promise<RecordsCountReply> {
     let recordsCount: RecordsCount;
     try {
@@ -39,7 +37,7 @@ export class RecordsCountHandler implements MethodHandler {
       try {
         await authenticate(message.authorization!, this.deps.didResolver);
 
-        await RecordsCountHandler.authorizeRecordsCount(tenant, recordsCount, this.deps.messageStore, this.deps.coreProtocols);
+        await RecordsCountHandler.authorizeRecordsCount(tenant, recordsCount, this.deps);
       } catch (e) {
         return messageReplyFromError(e, 401);
       }
@@ -69,7 +67,7 @@ export class RecordsCountHandler implements MethodHandler {
       isLatestBaseState : true
     };
 
-    return this.deps.messageStore.count(tenant, [countFilter]);
+    return this.countProjectedRecords(tenant, recordsCount, [countFilter]);
   }
 
   /**
@@ -101,7 +99,7 @@ export class RecordsCountHandler implements MethodHandler {
       }
     }
 
-    return this.deps.messageStore.count(tenant, filters);
+    return this.countProjectedRecords(tenant, recordsCount, filters);
   }
 
   /**
@@ -109,7 +107,17 @@ export class RecordsCountHandler implements MethodHandler {
    */
   private async countPublishedRecords(tenant: string, recordsCount: RecordsCount): Promise<number> {
     const filter = RecordsCountHandler.buildPublishedRecordsFilter(recordsCount);
-    return this.deps.messageStore.count(tenant, [filter]);
+    return this.countProjectedRecords(tenant, recordsCount, [filter]);
+  }
+
+  private async countProjectedRecords(tenant: string, recordsCount: RecordsCount, filters: Filter[]): Promise<number> {
+    return countRecordsWithRecordLimitOccupancy({
+      messageStore          : this.deps.messageStore,
+      validationStateReader : this.deps.validationStateReader,
+      tenant,
+      filters,
+      messageTimestamp      : recordsCount.message.descriptor.messageTimestamp,
+    });
   }
 
   private static buildPublishedRecordsFilter(recordsCount: RecordsCount): Filter {
@@ -187,23 +195,22 @@ export class RecordsCountHandler implements MethodHandler {
   private static async authorizeRecordsCount(
     tenant: string,
     recordsCount: RecordsCount,
-    messageStore: MessageStore,
-    coreProtocols?: CoreProtocolRegistry,
+    deps: HandlerDependencies,
   ): Promise<void> {
 
     if (Message.isSignedByAuthorDelegate(recordsCount.message)) {
-      await recordsCount.authorizeDelegate(messageStore);
+      await recordsCount.authorizeDelegate(deps.validationStateReader);
     }
 
     const permissionGrantId = Message.getPermissionGrantId(recordsCount.signaturePayload!);
     if (permissionGrantId !== undefined) {
-      const permissionGrant = await PermissionsProtocol.fetchGrant(tenant, messageStore, permissionGrantId);
+      const permissionGrant = await deps.validationStateReader.fetchGrant(tenant, permissionGrantId);
       await RecordsGrantAuthorization.authorizeQueryOrSubscribe({
-        incomingMessage : recordsCount.message,
-        expectedGrantor : tenant,
-        expectedGrantee : recordsCount.author!,
+        incomingMessage       : recordsCount.message,
+        expectedGrantor       : tenant,
+        expectedGrantee       : recordsCount.author!,
         permissionGrant,
-        messageStore,
+        validationStateReader : deps.validationStateReader,
       });
       return;
     }
@@ -212,7 +219,7 @@ export class RecordsCountHandler implements MethodHandler {
     // this is because we dynamically filter out records that the caller is not authorized to see.
     // Currently only run protocol authorization if message deliberately invokes a protocol role.
     if (Records.shouldProtocolAuthorize(recordsCount.signaturePayload!)) {
-      await ProtocolAuthorization.authorizeQueryOrSubscribe(tenant, recordsCount, messageStore, coreProtocols);
+      await ProtocolAuthorization.authorizeQueryOrSubscribe(tenant, recordsCount, deps.validationStateReader);
     }
   }
 }