@enbox/dwn-sdk-js 0.3.9 → 0.4.1

package/dist/esm/src/core/validation-state-reader.js

@@ -0,0 +1,237 @@
+import { FilterUtility } from '../utils/filter.js';
+import { PermissionGrant } from '../protocols/permission-grant.js';
+import { PermissionsProtocol } from '../protocols/permissions.js';
+import { RecordsWrite } from '../interfaces/records-write.js';
+import { SortDirection } from '../types/query-types.js';
+import { DwnError, DwnErrorCode } from './dwn-error.js';
+import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
+import { fetchInitialRecordsWrite, fetchInitialRecordsWriteMessage, getInitialWrite } from '../interfaces/records-write-query.js';
+/**
+ * The store-backed `ValidationStateReader` — the single place where validation-time state reads
+ * touch the `MessageStore`/`DataStore`.
+ */
+export class StoreValidationStateReader {
+    messageStore;
+    dataStore;
+    coreProtocols;
+    constructor(input) {
+        this.messageStore = input.messageStore;
+        this.dataStore = input.dataStore;
+        this.coreProtocols = input.coreProtocols;
+    }
+    /** @inheritdoc */
+    async fetchInitialRecordsWrite(tenant, recordId) {
+        return fetchInitialRecordsWrite(this.messageStore, tenant, recordId);
+    }
+    /** @inheritdoc */
+    async fetchInitialWrite(tenant, recordId) {
+        const query = {
+            interface: DwnInterfaceName.Records,
+            method: DwnMethodName.Write,
+            recordId: recordId
+        };
+        const { messages } = await this.messageStore.query(tenant, [query]);
+        if (messages.length === 0) {
+            return undefined;
+        }
+        const initialWrite = await getInitialWrite(messages);
+        return initialWrite;
+    }
+    /** @inheritdoc */
+    async constructRecordChain(tenant, descendantRecordId) {
+        if (descendantRecordId === undefined) {
+            return [];
+        }
+        const recordChain = [];
+        // keep walking up the chain from the inbound message's parent, until there is no more parent
+        let currentRecordId = descendantRecordId;
+        while (currentRecordId !== undefined) {
+            const initialWrite = await this.fetchInitialWrite(tenant, currentRecordId);
+            // RecordsWrite needed should be available since we perform necessary checks at the time of writes,
+            // eg. check the immediate parent in `verifyProtocolPathAndContextId` at the time of writing,
+            // so if this condition is triggered, it means there is an unexpected bug that caused an incomplete chain.
+            // We add additional defensive check here because returning an unexpected/incorrect record chain could lead to security vulnerabilities.
+            if (initialWrite === undefined) {
+                throw new DwnError(DwnErrorCode.ProtocolAuthorizationParentNotFoundConstructingRecordChain, `Unexpected error that should never trigger: no parent found with ID ${currentRecordId} when constructing record chain.`);
+            }
+            recordChain.push(initialWrite);
+            currentRecordId = initialWrite.descriptor.parentId;
+        }
+        return recordChain.reverse(); // root record first
+    }
+    /** @inheritdoc */
+    async fetchParentRecord(input) {
+        const { tenant, parentProtocolUri, parentId } = input;
+        const latestStateQuery = {
+            isLatestBaseState: true, // NOTE: this filter is critical, to ensure are are not returning a deleted parent
+            interface: DwnInterfaceName.Records,
+            method: DwnMethodName.Write,
+            protocol: parentProtocolUri,
+            recordId: parentId
+        };
+        const { messages: parentMessages } = await this.messageStore.query(tenant, [latestStateQuery]);
+        const latestParent = parentMessages[0];
+        if (latestParent !== undefined) {
+            return latestParent;
+        }
+        const initialWrite = await fetchInitialRecordsWriteMessage(this.messageStore, tenant, parentId);
+        if (initialWrite?.descriptor.protocol !== parentProtocolUri) {
+            return undefined;
+        }
+        if (await this.recordHasLocalTombstone(tenant, parentId)) {
+            return undefined;
+        }
+        return initialWrite;
+    }
+    /** @inheritdoc */
+    async hasMatchingRoleRecord(input) {
+        const latestStateFilter = StoreValidationStateReader.constructRoleRecordFilter({ ...input, latestStateOnly: true });
+        const { messages: matchingMessages } = await this.messageStore.query(input.tenant, [latestStateFilter]);
+        if (matchingMessages.length > 0) {
+            return true;
+        }
+        const anyWriteFilter = StoreValidationStateReader.constructRoleRecordFilter({ ...input, latestStateOnly: false });
+        const { messages: candidates } = await this.messageStore.query(input.tenant, [anyWriteFilter]);
+        for (const candidate of candidates) {
+            if (!await RecordsWrite.isInitialWrite(candidate)) {
+                continue;
+            }
+            if (!await this.recordHasLocalTombstone(input.tenant, candidate.recordId)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /** @inheritdoc */
+    async queryLatestRoleRecords(input) {
+        const filter = StoreValidationStateReader.constructRoleRecordFilter({ ...input, latestStateOnly: true });
+        const { messages: matchingMessages } = await this.messageStore.query(input.tenant, [filter]);
+        return matchingMessages;
+    }
+    /** @inheritdoc */
+    async fetchGrant(tenant, permissionGrantId) {
+        const grantQuery = {
+            recordId: permissionGrantId,
+            isLatestBaseState: true
+        };
+        const { messages } = await this.messageStore.query(tenant, [grantQuery]);
+        const possibleGrantMessage = messages[0];
+        const dwnInterface = possibleGrantMessage?.descriptor.interface;
+        const dwnMethod = possibleGrantMessage?.descriptor.method;
+        if (dwnInterface !== DwnInterfaceName.Records ||
+            dwnMethod !== DwnMethodName.Write ||
+            possibleGrantMessage.descriptor.protocolPath !== PermissionsProtocol.grantPath) {
+            throw new DwnError(DwnErrorCode.GrantAuthorizationGrantMissing, `Could not find permission grant with record ID ${permissionGrantId}.`);
+        }
+        const permissionGrantMessage = possibleGrantMessage;
+        const permissionGrant = PermissionGrant.parse(permissionGrantMessage);
+        return permissionGrant;
+    }
+    /** @inheritdoc */
+    async fetchOldestGrantRevocation(tenant, permissionGrantId) {
+        const query = PermissionsProtocol.grantRevocationFilter(permissionGrantId);
+        const { messages } = await this.messageStore.query(tenant, [query], { messageTimestamp: SortDirection.Ascending }, { limit: 1 });
+        return messages[0];
+    }
+    /** @inheritdoc */
+    async fetchNewestRecordsWrite(tenant, recordId) {
+        return RecordsWrite.fetchNewestRecordsWrite(this.messageStore, tenant, recordId);
+    }
+    /** @inheritdoc */
+    async fetchProtocolDefinition(tenant, protocolUri, messageTimestamp) {
+        // if the protocol is a registered core protocol, return the definition directly without a store query
+        if (this.coreProtocols !== undefined) {
+            const coreDefinition = this.coreProtocols.getDefinition(protocolUri);
+            if (coreDefinition !== undefined) {
+                return coreDefinition;
+            }
+        }
+        // fetch the corresponding protocol definition
+        const query = {
+            interface: DwnInterfaceName.Protocols,
+            method: DwnMethodName.Configure,
+            protocol: protocolUri,
+        };
+        if (messageTimestamp === undefined) {
+            // default: return only the latest protocol definition
+            query.isLatestBaseState = true;
+        }
+        else {
+            // temporal lookup: find the protocol definition active at the given timestamp
+            query.messageTimestamp = { lte: messageTimestamp };
+        }
+        let { messages: protocols } = await this.messageStore.query(tenant, [query], { messageTimestamp: SortDirection.Descending }, { limit: 1 });
+        if (protocols.length === 0 && messageTimestamp !== undefined) {
+            // A record can be authored before the protocol's earliest retained config yet still have
+            // been admitted under that config: admission order, not timestamp order, governed the
+            // source. When no config predates the record, reconstruct the historical answer from the
+            // earliest retained config. A protocol that is genuinely not installed still has zero
+            // configs and fails below.
+            ({ messages: protocols } = await this.messageStore.query(tenant, [{
+                    interface: DwnInterfaceName.Protocols,
+                    method: DwnMethodName.Configure,
+                    protocol: protocolUri,
+                }], { messageTimestamp: SortDirection.Ascending }, { limit: 1 }));
+        }
+        if (protocols.length === 0) {
+            throw new DwnError(DwnErrorCode.ProtocolAuthorizationProtocolNotFound, `unable to find protocol definition for ${protocolUri}`);
+        }
+        const protocolMessage = protocols[0];
+        return protocolMessage.descriptor.definition;
+    }
+    /** @inheritdoc */
+    async fetchLatestSquashRecordAtScope(input) {
+        const filter = {
+            interface: DwnInterfaceName.Records,
+            method: DwnMethodName.Write,
+            isLatestBaseState: true,
+            protocol: input.protocol,
+            protocolPath: input.protocolPath,
+            squash: true,
+        };
+        if (input.contextIdPrefix !== undefined) {
+            filter.contextId = FilterUtility.constructPrefixFilterAsRangeFilter(input.contextIdPrefix);
+        }
+        const { messages } = await this.messageStore.query(input.tenant, [filter], { messageTimestamp: SortDirection.Descending }, { limit: 1 });
+        return messages[0];
+    }
+    /** @inheritdoc */
+    async hasStoredData(tenant, recordId, dataCid) {
+        const dataStoreGetResult = await this.dataStore.get(tenant, recordId, dataCid);
+        return dataStoreGetResult !== undefined;
+    }
+    /**
+     * Checks whether a `RecordsDelete` tombstone for the given record is locally present.
+     * Retained initial writes can prove immutable parent/role facts, but a tombstone still wins.
+     */
+    async recordHasLocalTombstone(tenant, recordId) {
+        const tombstoneQuery = {
+            interface: DwnInterfaceName.Records,
+            method: DwnMethodName.Delete,
+            recordId: recordId
+        };
+        const { messages } = await this.messageStore.query(tenant, [tombstoneQuery]);
+        return messages.length > 0;
+    }
+    /**
+     * Constructs the role-record selector filter shared by the invoked-role lookup and the
+     * duplicate-role-recipient uniqueness check.
+     */
+    static constructRoleRecordFilter(input) {
+        const filter = {
+            interface: DwnInterfaceName.Records,
+            method: DwnMethodName.Write,
+            protocol: input.protocol,
+            protocolPath: input.protocolPath,
+            recipient: input.recipient,
+        };
+        if (input.latestStateOnly) {
+            filter.isLatestBaseState = true;
+        }
+        if (input.contextIdPrefix !== undefined) {
+            filter.contextId = FilterUtility.constructPrefixFilterAsRangeFilter(input.contextIdPrefix);
+        }
+        return filter;
+    }
+}
+//# sourceMappingURL=validation-state-reader.js.map

package/dist/esm/src/core/validation-state-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation-state-reader.js","sourceRoot":"","sources":["../../../../src/core/validation-state-reader.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAElI;;;GAGG;AACH,MAAM,OAAO,0BAA0B;IACpB,YAAY,CAAe;IAC3B,SAAS,CAAY;IACrB,aAAa,CAAwB;IAEtD,YAAmB,KAIlB;QACC,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC3C,CAAC;IAED,kBAAkB;IACX,KAAK,CAAC,wBAAwB,CAAC,MAAc,EAAE,QAAgB;QACpE,OAAO,wBAAwB,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvE,CAAC;IAED,kBAAkB;IACX,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,QAAgB;QAC7D,MAAM,KAAK,GAAW;YACpB,SAAS,EAAG,gBAAgB,CAAC,OAAO;YACpC,MAAM,EAAM,aAAa,CAAC,KAAK;YAC/B,QAAQ,EAAI,QAAQ;SACrB,CAAC;QACF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAEpE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QACrD,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,kBAAkB;IACX,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,kBAAsC;QACtF,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,WAAW,GAA0B,EAAE,CAAC;QAE9C,6FAA6F;QAC7F,IAAI,eAAe,GAAuB,kBAAkB,CAAC;QAC7D,OAAO,eAAe,KAAK,SAAS,EAAE,CAAC;YAErC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAE3E,mGAAmG;YACnG,6FAA6F;YAC7F,0GAA0G;YAC1G,wIAAwI;YACxI,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,0DAA0D,EACvE,uEAAuE,eAAe,kCAAkC,CACzH,CAAC;YACJ,CAAC;YAED,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC/B,eAAe,GAAG,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC;QACrD,CAAC;QAED,OAAO,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,oBAAoB;IACpD,CAAC;IAED,kBAAkB;IACX,KAAK,CAAC,iBAAiB,CAAC,KAI9B;QACC,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAEtD,MAAM,gBAAgB,GAAW;YAC/B,iBAAiB,EAAG,IAAI,EAAE,kFAAkF;YAC5G,SAAS,EAAW,gBAAgB,CAAC,OAAO;YAC5C,MAAM,EAAc,aAAa,CAAC,KAAK;YACvC,QAAQ,EAAY,iBAAiB;YACrC,QAAQ,EAAY,QAAQ;SAC7B,CAAC;QACF,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC/F,MAAM,YAAY,GAAI,cAAwC,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,+BAA+B,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChG,IAAI,YAAY,EAAE,UAAU,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YAC5D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,kBAAkB;IACX,KAAK,CAAC,qBAAqB,CAAC,KAMlC;QACC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,yBAAyB,CAAC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QACpH,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACxG,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,cAAc,GAAG,0BAA0B,CAAC,yBAAyB,CAAC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QAClH,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;QAE/F,KAAK,MAAM,SAAS,IAAI,UAAmC,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,YAAY,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClD,SAAS;YACX,CAAC;YAED,IAAI,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1E,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kBAAkB;IACX,KAAK,CAAC,sBAAsB,CAAC,KAMnC;QACC,MAAM,MAAM,GAAG,0BAA0B,CAAC,yBAAyB,CAAC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QACzG,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7F,OAAO,gBAAyC,CAAC;IACnD,CAAC;IAED,kBAAkB;IACX,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,iBAAyB;QAC/D,MAAM,UAAU,GAAG;YACjB,QAAQ,EAAY,iBAAiB;YACrC,iBAAiB,EAAG,IAAI;SACzB,CAAC;QACF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QACzE,MAAM,oBAAoB,GAA+B,QAAQ,CAAC,CAAC,CAAC,CAAC;QAErE,MAAM,YAAY,GAAG,oBAAoB,EAAE,UAAU,CAAC,SAAS,CAAC;QAChE,MAAM,SAAS,GAAG,oBAAoB,EAAE,UAAU,CAAC,MAAM,CAAC;QAE1D,IAAI,YAAY,KAAK,gBAAgB,CAAC,OAAO;YACzC,SAAS,KAAK,aAAa,CAAC,KAAK;YAChC,oBAA4C,CAAC,UAAU,CAAC,YAAY,KAAK,mBAAmB,CAAC,SAAS,EAAE,CAAC;YAC5G,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,8BAA8B,EAC3C,kDAAkD,iBAAiB,GAAG,CACvE,CAAC;QACJ,CAAC;QAED,MAAM,sBAAsB,GAAG,oBAAsD,CAAC;QACtF,MAAM,eAAe,GAAG,eAAe,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAEtE,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,kBAAkB;IACX,KAAK,CAAC,0BAA0B,CAAC,MAAc,EAAE,iBAAyB;QAC/E,MAAM,KAAK,GAAG,mBAAmB,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;QAC3E,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAChD,MAAM,EACN,CAAC,KAAK,CAAC,EACP,EAAE,gBAAgB,EAAE,aAAa,CAAC,SAAS,EAAE,EAC7C,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QAEF,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,kBAAkB;IACX,KAAK,CAAC,uBAAuB,CAAC,MAAc,EAAE,QAAgB;QACnE,OAAO,YAAY,CAAC,uBAAuB,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnF,CAAC;IAED,kBAAkB;IACX,KAAK,CAAC,uBAAuB,CAAC,MAAc,EAAE,WAAmB,EAAE,gBAAyB;QACjG,sGAAsG;QACtG,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YACrE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,cAAc,CAAC;YACxB,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,MAAM,KAAK,GAAW;YACpB,SAAS,EAAG,gBAAgB,CAAC,SAAS;YACtC,MAAM,EAAM,aAAa,CAAC,SAAS;YACnC,QAAQ,EAAI,WAAW;SACxB,CAAC;QAEF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,sDAAsD;YACtD,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,8EAA8E;YAC9E,KAAK,CAAC,gBAAgB,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;QACrD,CAAC;QAED,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CACzD,MAAM,EACN,CAAC,KAAK,CAAC,EACP,EAAE,gBAAgB,EAAE,aAAa,CAAC,UAAU,EAAE,EAC9C,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC7D,yFAAyF;YACzF,sFAAsF;YACtF,yFAAyF;YACzF,sFAAsF;YACtF,2BAA2B;YAC3B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CACtD,MAAM,EACN,CAAC;oBACC,SAAS,EAAG,gBAAgB,CAAC,SAAS;oBACtC,MAAM,EAAM,aAAa,CAAC,SAAS;oBACnC,QAAQ,EAAI,WAAW;iBACxB,CAAC,EACF,EAAE,gBAAgB,EAAE,aAAa,CAAC,SAAS,EAAE,EAC7C,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC,CAAC;QACL,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,qCAAqC,EAAE,0CAA0C,WAAW,EAAE,CAAC,CAAC;QAClI,CAAC;QAED,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,CAA8B,CAAC;QAClE,OAAO,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC;IAC/C,CAAC;IAED,kBAAkB;IACX,KAAK,CAAC,8BAA8B,CAAC,KAK3C;QACC,MAAM,MAAM,GAAW;YACrB,SAAS,EAAW,gBAAgB,CAAC,OAAO;YAC5C,MAAM,EAAc,aAAa,CAAC,KAAK;YACvC,iBAAiB,EAAG,IAAI;YACxB,QAAQ,EAAY,KAAK,CAAC,QAAQ;YAClC,YAAY,EAAQ,KAAK,CAAC,YAAY;YACtC,MAAM,EAAc,IAAI;SACzB,CAAC;QAEF,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,kCAAkC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAChD,KAAK,CAAC,MAAM,EACZ,CAAC,MAAM,CAAC,EACR,EAAE,gBAAgB,EAAE,aAAa,CAAC,UAAU,EAAE,EAC9C,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QAEF,OAAO,QAAQ,CAAC,CAAC,CAAoC,CAAC;IACxD,CAAC;IAED,kBAAkB;IACX,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,QAAgB,EAAE,OAAe;QAC1E,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/E,OAAO,kBAAkB,KAAK,SAAS,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CAAC,MAAc,EAAE,QAAgB;QACpE,MAAM,cAAc,GAAW;YAC7B,SAAS,EAAG,gBAAgB,CAAC,OAAO;YACpC,MAAM,EAAM,aAAa,CAAC,MAAM;YAChC,QAAQ,EAAI,QAAQ;SACrB,CAAC;QACF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,yBAAyB,CAAC,KAMxC;QACC,MAAM,MAAM,GAAW;YACrB,SAAS,EAAM,gBAAgB,CAAC,OAAO;YACvC,MAAM,EAAS,aAAa,CAAC,KAAK;YAClC,QAAQ,EAAO,KAAK,CAAC,QAAQ;YAC7B,YAAY,EAAG,KAAK,CAAC,YAAY;YACjC,SAAS,EAAM,KAAK,CAAC,SAAS;SAC/B,CAAC;QAEF,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAClC,CAAC;QAED,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,kCAAkC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC7F,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/esm/src/dwn.js

@@ -1,35 +1,44 @@
 import { AllowAllTenantGate } from './core/tenant-gate.js';
+import { Cid } from './utils/cid.js';
 import { CoreProtocolRegistry } from './core/core-protocol.js';
+import { DataStream } from './utils/data-stream.js';
+import { DwnConstant } from './core/dwn-constant.js';
 import { Message } from './core/message.js';
 import { messageReplyFromError } from './core/message-reply.js';
+import { MessagesQueryHandler } from './handlers/messages-query.js';
 import { MessagesReadHandler } from './handlers/messages-read.js';
 import { MessagesSubscribeHandler } from './handlers/messages-subscribe.js';
-import { MessagesSyncHandler } from './handlers/messages-sync.js';
 import { PermissionsProtocol } from './protocols/permissions.js';
 import { ProtocolsConfigureHandler } from './handlers/protocols-configure.js';
 import { ProtocolsQueryHandler } from './handlers/protocols-query.js';
+import { Records } from './utils/records.js';
 import { RecordsCountHandler } from './handlers/records-count.js';
+import { RecordsDelete } from './interfaces/records-delete.js';
 import { RecordsDeleteHandler } from './handlers/records-delete.js';
 import { RecordsQueryHandler } from './handlers/records-query.js';
 import { RecordsReadHandler } from './handlers/records-read.js';
 import { RecordsSubscribeHandler } from './handlers/records-subscribe.js';
+import { RecordsWrite } from './interfaces/records-write.js';
 import { RecordsWriteHandler } from './handlers/records-write.js';
 import { ResumableTaskManager } from './core/resumable-task-manager.js';
 import { StorageController } from './store/storage-controller.js';
+import { StoreValidationStateReader } from './core/validation-state-reader.js';
 import { DidDht, DidJwk, DidKey, DidResolverCacheMemory, DidWeb, UniversalResolver } from '@enbox/dids';
+import { DwnError, DwnErrorCode } from './core/dwn-error.js';
 import { DwnInterfaceName, DwnMethodName } from './enums/dwn-interface-method.js';
+import { missingAncestorRecordIdsFromReply, replicationApplyResultFromReply } from './core/replication-apply.js';
 export class Dwn {
     methodHandlers;
     didResolver;
     messageStore;
     dataStore;
     resumableTaskStore;
-    stateIndex;
     tenantGate;
     eventLog;
     storageController;
     resumableTaskManager;
     _coreProtocols;
+    validationStateReader;
     /** Whether the DWN owns the resolver's lifecycle (i.e., created it via defaults). */
     ownsResolver;
     constructor(config) {
@@ -39,33 +48,37 @@ export class Dwn {
         this.messageStore = config.messageStore;
         this.dataStore = config.dataStore;
         this.resumableTaskStore = config.resumableTaskStore;
-        this.stateIndex = config.stateIndex;
+        // Initialize the core protocol registry with built-in system protocols.
+        this._coreProtocols = new CoreProtocolRegistry();
+        this._coreProtocols.register(new PermissionsProtocol());
+        // The single narrow surface through which validation logic reads state (replay-basis closure).
+        const validationStateReader = new StoreValidationStateReader({
+            messageStore: this.messageStore,
+            dataStore: this.dataStore,
+            coreProtocols: this._coreProtocols,
+        });
+        this.validationStateReader = config.instrumentValidationStateReader?.(validationStateReader) ?? validationStateReader;
         this.eventLog = config.eventLog;
         this.storageController = new StorageController({
             messageStore: this.messageStore,
             dataStore: this.dataStore,
-            stateIndex: this.stateIndex,
-            eventLog: this.eventLog
         });
         this.resumableTaskManager = new ResumableTaskManager(config.resumableTaskStore, this.storageController);
-        // Initialize the core protocol registry with built-in system protocols.
-        this._coreProtocols = new CoreProtocolRegistry();
-        this._coreProtocols.register(new PermissionsProtocol());
         // Build the shared dependency bag once; every handler receives the same object
         // and accesses only the dependencies it needs.
         const deps = {
             didResolver: this.didResolver,
             messageStore: this.messageStore,
+            validationStateReader: this.validationStateReader,
             dataStore: this.dataStore,
-            stateIndex: this.stateIndex,
             resumableTaskManager: this.resumableTaskManager,
             coreProtocols: this._coreProtocols,
             eventLog: this.eventLog,
         };
         this.methodHandlers = {
             [DwnInterfaceName.Messages + DwnMethodName.Read]: new MessagesReadHandler(deps),
+            [DwnInterfaceName.Messages + DwnMethodName.Query]: new MessagesQueryHandler(deps),
             [DwnInterfaceName.Messages + DwnMethodName.Subscribe]: new MessagesSubscribeHandler(deps),
-            [DwnInterfaceName.Messages + DwnMethodName.Sync]: new MessagesSyncHandler(deps),
             [DwnInterfaceName.Protocols + DwnMethodName.Configure]: new ProtocolsConfigureHandler(deps),
             [DwnInterfaceName.Protocols + DwnMethodName.Query]: new ProtocolsQueryHandler(deps),
             [DwnInterfaceName.Records + DwnMethodName.Count]: new RecordsCountHandler(deps),
@@ -107,7 +120,6 @@ export class Dwn {
         await this.messageStore.open();
         await this.dataStore.open();
         await this.resumableTaskStore.open();
-        await this.stateIndex.open();
         await this.eventLog?.open();
         await this.resumableTaskManager.resumeTasksAndWaitForCompletion();
     }
@@ -116,7 +128,6 @@ export class Dwn {
         await this.messageStore.close();
         await this.dataStore.close();
         await this.resumableTaskStore.close();
-        await this.stateIndex.close();
         // Close the resolver's cache if the DWN owns it.
         const lifecycleResolver = this.didResolver;
         if (this.ownsResolver && typeof lifecycleResolver.close === 'function') {
@@ -133,15 +144,14 @@ export class Dwn {
     }
     /**
      * Returns the internal storage components for advanced operations that
-     * cannot be expressed through the standard `processMessage()` pipeline
-     * (e.g., owner-upgrade of externally authored encrypted records).
+     * cannot be expressed through the standard `processMessage()` pipeline.
      *
      * Callers are responsible for maintaining consistency across stores.
      */
     get storage() {
         return {
+            dataStore: this.dataStore,
             messageStore: this.messageStore,
-            stateIndex: this.stateIndex,
             eventLog: this.eventLog,
         };
     }
@@ -156,10 +166,245 @@ export class Dwn {
             tenant,
             message: rawMessage,
             dataStream,
-            subscriptionHandler
+            subscriptionHandler,
         });
         return methodHandlerReply;
     }
+    /**
+     * Applies a message obtained through replication and returns a structured
+     * outcome instead of an HTTP-like handler status. Normal authoring still
+     * uses `processMessage`; sync uses this entry point so missing local
+     * dependencies can be fetched and retried without treating the replicated
+     * message as permanently invalid.
+     */
+    async applyReplicatedMessage(tenant, rawMessage, options = {}) {
+        const tenantError = await this.validateTenant(tenant);
+        if (tenantError !== undefined) {
+            return { kind: 'Deferred', reason: 'tenant-inactive' };
+        }
+        const integrityError = await this.validateMessageIntegrity(rawMessage);
+        if (integrityError !== undefined) {
+            return { kind: 'Invalid', reason: integrityError.status.detail };
+        }
+        if (await this.replicatedMessageAlreadyStored(tenant, rawMessage)) {
+            return { kind: 'Duplicate' };
+        }
+        const reply = await this.processMessage(tenant, rawMessage, options);
+        const replicatedWriteBeatenByDeleteResult = await this.storeReplicatedWriteBeatenByDelete(tenant, rawMessage, reply, options);
+        if (replicatedWriteBeatenByDeleteResult !== undefined) {
+            return replicatedWriteBeatenByDeleteResult;
+        }
+        const protocolDefinition = await this.getReplicationApplyProtocolDefinition(tenant, rawMessage, reply);
+        const missingAncestorRecordIds = await this.getReplicationApplyMissingAncestors(tenant, rawMessage, reply);
+        return replicationApplyResultFromReply(rawMessage, reply, { protocolDefinition, missingAncestorRecordIds });
+    }
+    /**
+     * Computes the layer-batched missing-ancestor set for a replicated message that failed on a
+     * missing ancestor (immediate parent or record-chain construction), so the resulting
+     * `Incomplete` names every locally-absent ancestor at once. Returns `undefined`
+     * (single-ancestor emission) when the set cannot be computed.
+     */
+    async getReplicationApplyMissingAncestors(tenant, message, reply) {
+        try {
+            return await missingAncestorRecordIdsFromReply(tenant, message, reply, this.validationStateReader);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async storeReplicatedWriteBeatenByDelete(tenant, message, reply, options) {
+        const detail = reply.status.detail ?? '';
+        if (!detail.startsWith(`${DwnErrorCode.RecordsWriteNotAllowedAfterDelete}:`) || !Records.isRecordsWrite(message)) {
+            return undefined;
+        }
+        const query = {
+            interface: DwnInterfaceName.Records,
+            recordId: message.recordId,
+        };
+        const { messages: existingMessages } = await this.messageStore.query(tenant, [query]);
+        const initialWrite = await RecordsWrite.getInitialWrite(existingMessages);
+        const existingDelete = await Records.getNewestRecordsDelete(existingMessages);
+        if (existingDelete === undefined) {
+            return undefined;
+        }
+        const validationReply = await this.validateReplicatedWriteBeatenByDelete(tenant, message, existingMessages, options);
+        if (validationReply !== undefined) {
+            return replicationApplyResultFromReply(message, validationReply);
+        }
+        const recordsWrite = await RecordsWrite.parse(message);
+        const storedWriteMessage = { ...message };
+        delete storedWriteMessage.encodedData;
+        const recordsWriteIndexes = await recordsWrite.constructIndexes(false);
+        await this.messageStore.put(tenant, storedWriteMessage, recordsWriteIndexes);
+        const recordsDelete = await RecordsDelete.parse(existingDelete);
+        const visibilitySourceWrite = await Records.getNewestRecordsWrite([...existingMessages, storedWriteMessage]) ?? initialWrite;
+        const recordsDeleteIndexes = recordsDelete.constructIndexes(initialWrite, visibilitySourceWrite);
+        const recordsDeleteCid = await Message.getCid(existingDelete);
+        await this.messageStore.updateIndexes(tenant, recordsDeleteCid, recordsDeleteIndexes);
+        return { kind: 'Superseded' };
+    }
+    async validateReplicatedWriteBeatenByDelete(tenant, message, existingMessages, options) {
+        try {
+            await this.validateReplicatedWriteBeatenByDeleteOrThrow(tenant, message, existingMessages, options);
+            return undefined;
+        }
+        catch (error) {
+            const statusCode = error instanceof DwnError
+                ? this._coreProtocols.mapErrorToStatusCode(error.code) ?? 400
+                : 400;
+            return messageReplyFromError(error, statusCode);
+        }
+    }
+    async validateReplicatedWriteBeatenByDeleteOrThrow(tenant, message, existingMessages, options) {
+        const coreProtocol = message.descriptor.protocol === undefined
+            ? undefined
+            : this._coreProtocols.get(message.descriptor.protocol);
+        if (coreProtocol?.preProcessWrite !== undefined) {
+            await coreProtocol.preProcessWrite(tenant, message, this.validationStateReader);
+        }
+        if (options.dataStream !== undefined) {
+            await Dwn.validateReplicatedWriteBeatenByDeleteDataStream(message, options.dataStream, coreProtocol);
+            return;
+        }
+        if (await RecordsWrite.isInitialWrite(message)) {
+            return;
+        }
+        await this.validateReplicatedWriteBeatenByDeleteExistingData(tenant, message, existingMessages);
+    }
+    static async validateReplicatedWriteBeatenByDeleteDataStream(message, dataStream, coreProtocol) {
+        if (message.descriptor.dataSize <= DwnConstant.maxDataSizeAllowedToBeEncoded) {
+            const dataBytes = await DataStream.toBytes(dataStream);
+            const dataCid = await Cid.computeDagPbCidFromBytes(dataBytes);
+            RecordsWrite.validateDataIntegrity(message.descriptor.dataCid, message.descriptor.dataSize, dataCid, dataBytes.length);
+            if (coreProtocol?.validateRecord !== undefined) {
+                coreProtocol.validateRecord(message, dataBytes);
+            }
+            return;
+        }
+        const [dataCidStream, dataSizeStream] = DataStream.duplicateDataStream(dataStream, 2);
+        const [dataCid, dataSize] = await Promise.all([
+            Cid.computeDagPbCidFromStream(dataCidStream),
+            Dwn.getDataStreamByteLength(dataSizeStream),
+        ]);
+        RecordsWrite.validateDataIntegrity(message.descriptor.dataCid, message.descriptor.dataSize, dataCid, dataSize);
+    }
+    async validateReplicatedWriteBeatenByDeleteExistingData(tenant, message, existingMessages) {
+        const newestExistingWrite = await Records.getNewestRecordsWrite(existingMessages);
+        if (newestExistingWrite === undefined) {
+            throw new DwnError(DwnErrorCode.RecordsWriteGetInitialWriteNotFound, `initial write is missing for record ${message.recordId}`);
+        }
+        const { dataCid, dataSize } = message.descriptor;
+        RecordsWrite.validateDataIntegrity(dataCid, dataSize, newestExistingWrite.descriptor.dataCid, newestExistingWrite.descriptor.dataSize);
+        if (dataSize <= DwnConstant.maxDataSizeAllowedToBeEncoded) {
+            const newestExistingWriteWithData = newestExistingWrite;
+            if (newestExistingWriteWithData.encodedData === undefined) {
+                throw new DwnError(DwnErrorCode.RecordsWriteMissingEncodedDataInPrevious, `No dataStream was provided and unable to get data from previous message`);
+            }
+            return;
+        }
+        const priorDataExists = await this.validationStateReader.hasStoredData(tenant, newestExistingWrite.recordId, dataCid);
+        if (!priorDataExists) {
+            throw new DwnError(DwnErrorCode.RecordsWriteMissingDataInPrevious, `No dataStream was provided and unable to get data from previous message`);
+        }
+    }
+    static async getDataStreamByteLength(dataStream) {
+        let byteLength = 0;
+        for await (const chunk of DataStream.asAsyncIterable(dataStream)) {
+            byteLength += chunk.length;
+        }
+        return byteLength;
+    }
+    async getReplicationApplyProtocolDefinition(tenant, message, reply) {
+        const detail = reply.status.detail ?? '';
+        if (!detail.startsWith(`${DwnErrorCode.ProtocolAuthorizationMatchingRoleRecordNotFound}:`)) {
+            return undefined;
+        }
+        const lookup = Dwn.getReplicationApplyProtocolDefinitionLookup(message);
+        if (lookup === undefined) {
+            return undefined;
+        }
+        try {
+            return await this.validationStateReader.fetchProtocolDefinition(tenant, lookup.protocol, lookup.messageTimestamp);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    static getReplicationApplyProtocolDefinitionLookup(message) {
+        if (Dwn.isRecordsWriteMessage(message)) {
+            return {
+                protocol: message.descriptor.protocol,
+                messageTimestamp: message.descriptor.messageTimestamp,
+            };
+        }
+        const protocol = Dwn.getMessageProtocolForReplicationApply(message);
+        return protocol === undefined ? undefined : { protocol };
+    }
+    static getMessageProtocolForReplicationApply(message) {
+        const descriptor = message.descriptor;
+        if (typeof descriptor.protocol === 'string') {
+            return descriptor.protocol;
+        }
+        if (typeof descriptor.filter?.protocol === 'string') {
+            return descriptor.filter.protocol;
+        }
+    }
+    static isRecordsWriteMessage(message) {
+        return message.descriptor.interface === DwnInterfaceName.Records &&
+            message.descriptor.method === DwnMethodName.Write;
+    }
+    async replicatedMessageAlreadyStored(tenant, message) {
+        const existingMessages = await this.getExistingMessagesForReplicationDedup(tenant, message);
+        if (existingMessages.length === 0) {
+            return false;
+        }
+        const incomingCid = await Message.getCid(message);
+        for (const existing of existingMessages) {
+            if (await Message.getCid(existing) !== incomingCid) {
+                continue;
+            }
+            return true;
+        }
+        return false;
+    }
+    async getExistingMessagesForReplicationDedup(tenant, message) {
+        const { descriptor } = message;
+        if (descriptor.interface === DwnInterfaceName.Records && descriptor.method === DwnMethodName.Write) {
+            const recordId = message.recordId;
+            if (typeof recordId !== 'string') {
+                return [];
+            }
+            const { messages } = await this.messageStore.query(tenant, [{
+                    interface: DwnInterfaceName.Records,
+                    recordId,
+                }]);
+            return messages;
+        }
+        if (descriptor.interface === DwnInterfaceName.Records && descriptor.method === DwnMethodName.Delete) {
+            const recordId = descriptor.recordId;
+            if (typeof recordId !== 'string') {
+                return [];
+            }
+            const { messages } = await this.messageStore.query(tenant, [{
+                    interface: DwnInterfaceName.Records,
+                    recordId,
+                }]);
+            return messages;
+        }
+        if (descriptor.interface === DwnInterfaceName.Protocols && descriptor.method === DwnMethodName.Configure) {
+            const protocol = descriptor.definition?.protocol;
+            if (typeof protocol !== 'string') {
+                return [];
+            }
+            const { messages } = await this.messageStore.query(tenant, [{
+                    interface: DwnInterfaceName.Protocols,
+                    method: DwnMethodName.Configure,
+                    protocol,
+                }]);
+            return messages;
+        }
+        return [];
+    }
     /**
      * Checks tenant gate to see if tenant is allowed.
      * @param tenant The tenant DID to route the given message to.