@enbox/dwn-sdk-js 0.4.0 → 0.4.1

package/src/interfaces/protocols-query.ts

@@ -1,11 +1,10 @@
 import type { AuthorizationModel } from '../types/message-types.js';
 import type { MessageSigner } from '../types/signer.js';
-import type { MessageStore } from '../types/message-store.js';
+import type { ValidationStateReader } from '../types/validation-state-reader.js';
 import type { ProtocolsQueryDescriptor, ProtocolsQueryFilter, ProtocolsQueryMessage } from '../types/protocols-types.js';
 
 import { AbstractMessage } from '../core/abstract-message.js';
 import { Message } from '../core/message.js';
-import { PermissionsProtocol } from '../protocols/permissions.js';
 import { ProtocolsGrantAuthorization } from '../core/protocols-grant-authorization.js';
 import { removeUndefinedProperties } from '@enbox/common';
 import { Time } from '../utils/time.js';
@@ -77,19 +76,19 @@ export class ProtocolsQuery extends AbstractMessage<ProtocolsQueryMessage> {
     };
   }
 
-  public async authorize(tenant: string, messageStore: MessageStore): Promise<void> {
+  public async authorize(tenant: string, validationStateReader: ValidationStateReader): Promise<void> {
     // if author is the same as the target tenant, we can directly grant access
     if (this.author === tenant) {
       return;
     } else if (this.author !== undefined && Message.getPermissionGrantId(this.signaturePayload!) !== undefined) {
       const permissionGrantId = Message.getPermissionGrantId(this.signaturePayload!)!;
-      const permissionGrant = await PermissionsProtocol.fetchGrant(tenant, messageStore, permissionGrantId);
+      const permissionGrant = await validationStateReader.fetchGrant(tenant, permissionGrantId);
       await ProtocolsGrantAuthorization.authorizeQuery({
         expectedGrantor : tenant,
         expectedGrantee : this.author,
         incomingMessage : this.message,
         permissionGrant,
-        messageStore
+        validationStateReader
       });
     } else {
       throw new DwnError(

package/src/interfaces/records-count.ts

@@ -1,5 +1,5 @@
 import type { MessageSigner } from '../types/signer.js';
-import type { MessageStore } from '../types/message-store.js';
+import type { ValidationStateReader } from '../types/validation-state-reader.js';
 import type { DataEncodedRecordsWriteMessage, RecordsCountDescriptor, RecordsCountMessage, RecordsFilter } from '../types/records-types.js';
 
 import { AbstractMessage } from '../core/abstract-message.js';
@@ -38,6 +38,11 @@ export class RecordsCount extends AbstractMessage<RecordsCountMessage> {
     }
 
     await Records.validateDelegatedGrantReferentialIntegrity(message, signaturePayload);
+    Records.validateNestedProtocolPathQueryScope(
+      message.descriptor.filter,
+      DwnErrorCode.RecordsCountNestedProtocolPathContextIdInvalid,
+      'RecordsCount'
+    );
 
     if (signaturePayload?.protocolRole !== undefined) {
       if (message.descriptor.filter.protocolPath === undefined) {
@@ -98,16 +103,16 @@ export class RecordsCount extends AbstractMessage<RecordsCountMessage> {
 
   /**
    * Authorizes the delegate who signed the message.
-   * @param messageStore Used to check if the grant has been revoked.
+   * @param validationStateReader Used to check if the grant has been revoked.
    */
-  public async authorizeDelegate(messageStore: MessageStore): Promise<void> {
+  public async authorizeDelegate(validationStateReader: ValidationStateReader): Promise<void> {
     const delegatedGrant = PermissionGrant.parse(this.message.authorization!.authorDelegatedGrant!);
     await RecordsGrantAuthorization.authorizeQueryOrSubscribe({
       incomingMessage : this.message,
       expectedGrantor : this.author!,
       expectedGrantee : this.signer!,
       permissionGrant : delegatedGrant,
-      messageStore
+      validationStateReader
     });
   }
 }

package/src/interfaces/records-delete.ts

@@ -1,6 +1,6 @@
 import type { KeyValues } from '../types/query-types.js';
 import type { MessageSigner } from '../types/signer.js';
-import type { MessageStore } from '../types//message-store.js';
+import type { ValidationStateReader } from '../types/validation-state-reader.js';
 import type { DataEncodedRecordsWriteMessage, RecordsDeleteDescriptor, RecordsDeleteMessage, RecordsWriteMessage } from '../types/records-types.js';
 
 import { AbstractMessage } from '../core/abstract-message.js';
@@ -87,9 +87,18 @@ export class RecordsDelete extends AbstractMessage<RecordsDeleteMessage> {
 
   /**
    * Indexed properties needed for MessageStore indexing.
+   *
+   * Immutable record facts (`protocol`, `protocolPath`, `recipient`, `schema`, `parentId`,
+   * `dateCreated`, `contextId`) come from the initial `RecordsWrite`. Mutable query-visibility
+   * facts (flattened `tag.*`, `published`, and `datePublished`) come from the newest retained
+   * `RecordsWrite` that existed immediately before this delete, because tombstone visibility must
+   * reflect the record state being deleted: without them, tombstones of tagged records never match
+   * tag filters (e.g. the permission shadow filters on `tag.protocol`) and tombstones of published
+   * records never match `published: true` or `datePublished` queries and subscriptions.
    */
   public constructIndexes(
     initialWrite: RecordsWriteMessage,
+    visibilitySourceWrite: RecordsWriteMessage,
   ): KeyValues {
     const message = this.message;
     const descriptor = { ...message.descriptor };
@@ -97,8 +106,13 @@ export class RecordsDelete extends AbstractMessage<RecordsDeleteMessage> {
     // we add the immutable properties from the initial RecordsWrite message in order to use them when querying relevant deletes.
     const { protocol, protocolPath, recipient, schema, parentId, dateCreated } = initialWrite.descriptor;
 
-    const indexes: { [key:string]: string | boolean | undefined } = {
+    // Mutable visibility facts come from the newest retained RecordsWrite that held them before deletion.
+    const { tags, published, datePublished } = visibilitySourceWrite.descriptor;
+
+    const indexes: { [key:string]: string | number | boolean | string[] | number[] | undefined } = {
       isLatestBaseState : true,
+      published         : !!published,
+      datePublished,
       protocol, protocolPath, recipient, schema, parentId, dateCreated,
       contextId         : initialWrite.contextId,
       author            : this.author!,
@@ -106,14 +120,20 @@ export class RecordsDelete extends AbstractMessage<RecordsDeleteMessage> {
     };
     removeUndefinedProperties(indexes);
 
+    // tags are flattened into `tag.<property>` keys to avoid name clashes with first-class index
+    // keys, matching the flattening the RecordsWrite indexing path performs.
+    if (tags !== undefined) {
+      return { ...indexes, ...Records.buildTagIndexes({ ...tags }) } as KeyValues;
+    }
+
     return indexes as KeyValues;
   }
 
   /*
    * Authorizes the delegate who signed the message.
-   * @param messageStore Used to check if the grant has been revoked.
+   * @param validationStateReader Used to check if the grant has been revoked.
    */
-  public async authorizeDelegate(recordsWriteToDelete: RecordsWriteMessage, messageStore: MessageStore): Promise<void> {
+  public async authorizeDelegate(recordsWriteToDelete: RecordsWriteMessage, validationStateReader: ValidationStateReader): Promise<void> {
     const delegatedGrant = PermissionGrant.parse(this.message.authorization.authorDelegatedGrant!);
     await RecordsGrantAuthorization.authorizeDelete({
       recordsDeleteMessage : this.message,
@@ -121,7 +141,7 @@ export class RecordsDelete extends AbstractMessage<RecordsDeleteMessage> {
       expectedGrantor      : this.author!,
       expectedGrantee      : this.signer!,
       permissionGrant      : delegatedGrant,
-      messageStore
+      validationStateReader
     });
   }
 }

package/src/interfaces/records-query.ts

@@ -1,6 +1,6 @@
 import type { MessageSigner } from '../types/signer.js';
-import type { MessageStore } from '../types//message-store.js';
 import type { Pagination } from '../types/message-types.js';
+import type { ValidationStateReader } from '../types/validation-state-reader.js';
 import type { DataEncodedRecordsWriteMessage, RecordsFilter, RecordsQueryDescriptor, RecordsQueryMessage } from '../types/records-types.js';
 
 import { AbstractMessage } from '../core/abstract-message.js';
@@ -52,6 +52,11 @@ export class RecordsQuery extends AbstractMessage<RecordsQueryMessage> {
     }
 
     await Records.validateDelegatedGrantReferentialIntegrity(message, signaturePayload);
+    Records.validateNestedProtocolPathQueryScope(
+      message.descriptor.filter,
+      DwnErrorCode.RecordsQueryNestedProtocolPathContextIdInvalid,
+      'RecordsQuery'
+    );
 
     if (signaturePayload?.protocolRole !== undefined) {
       if (message.descriptor.filter.protocolPath === undefined) {
@@ -123,16 +128,16 @@ export class RecordsQuery extends AbstractMessage<RecordsQueryMessage> {
 
   /**
    * Authorizes the delegate who signed this message.
-   * @param messageStore Used to check if the grant has been revoked.
+   * @param validationStateReader Used to check if the grant has been revoked.
    */
-  public async authorizeDelegate(messageStore: MessageStore): Promise<void> {
+  public async authorizeDelegate(validationStateReader: ValidationStateReader): Promise<void> {
     const delegatedGrant = PermissionGrant.parse(this.message.authorization!.authorDelegatedGrant!);
     await RecordsGrantAuthorization.authorizeQueryOrSubscribe({
       incomingMessage : this.message,
       expectedGrantee : this.signer!,
       expectedGrantor : this.author!,
       permissionGrant : delegatedGrant,
-      messageStore
+      validationStateReader
     });
   }
 }

package/src/interfaces/records-read.ts

@@ -1,5 +1,5 @@
 import type { MessageSigner } from '../types/signer.js';
-import type { MessageStore } from '../types//message-store.js';
+import type { ValidationStateReader } from '../types/validation-state-reader.js';
 import type { DataEncodedRecordsWriteMessage, RecordsFilter , RecordsReadDescriptor, RecordsReadMessage, RecordsWriteMessage } from '../types/records-types.js';
 
 import { AbstractMessage } from '../core/abstract-message.js';
@@ -110,9 +110,9 @@ export class RecordsRead extends AbstractMessage<RecordsReadMessage> {
 
   /**
    * Authorizes the delegate who signed this message.
-   * @param messageStore Used to check if the grant has been revoked.
+   * @param validationStateReader Used to check if the grant has been revoked.
    */
-  public async authorizeDelegate(matchedRecordsWrite: RecordsWriteMessage, messageStore: MessageStore): Promise<void> {
+  public async authorizeDelegate(matchedRecordsWrite: RecordsWriteMessage, validationStateReader: ValidationStateReader): Promise<void> {
     const delegatedGrant = PermissionGrant.parse(this.message.authorization!.authorDelegatedGrant!);
     await RecordsGrantAuthorization.authorizeRead({
       recordsReadMessage          : this.message,
@@ -120,7 +120,7 @@ export class RecordsRead extends AbstractMessage<RecordsReadMessage> {
       expectedGrantor             : this.author!,
       expectedGrantee             : this.signer!,
       permissionGrant             : delegatedGrant,
-      messageStore
+      validationStateReader
     });
   }
 }

package/src/interfaces/records-subscribe.ts

@@ -1,7 +1,7 @@
 import type { MessageSigner } from '../types/signer.js';
-import type { MessageStore } from '../types/message-store.js';
 import type { Pagination } from '../types/message-types.js';
 import type { ProgressToken } from '../types/subscriptions.js';
+import type { ValidationStateReader } from '../types/validation-state-reader.js';
 import type { DataEncodedRecordsWriteMessage, DateSort, RecordsFilter, RecordsSubscribeDescriptor, RecordsSubscribeMessage } from '../types/records-types.js';
 
 import { AbstractMessage } from '../core/abstract-message.js';
@@ -48,6 +48,11 @@ export class RecordsSubscribe extends AbstractMessage<RecordsSubscribeMessage> {
     }
 
     await Records.validateDelegatedGrantReferentialIntegrity(message, signaturePayload);
+    Records.validateNestedProtocolPathQueryScope(
+      message.descriptor.filter,
+      DwnErrorCode.RecordsSubscribeNestedProtocolPathContextIdInvalid,
+      'RecordsSubscribe'
+    );
 
     if (signaturePayload?.protocolRole !== undefined) {
       if (message.descriptor.filter.protocolPath === undefined) {
@@ -109,16 +114,16 @@ export class RecordsSubscribe extends AbstractMessage<RecordsSubscribeMessage> {
 
   /**
  * Authorizes the delegate who signed the message.
- * @param messageStore Used to check if the grant has been revoked.
+ * @param validationStateReader Used to check if the grant has been revoked.
  */
-  public async authorizeDelegate(messageStore: MessageStore): Promise<void> {
+  public async authorizeDelegate(validationStateReader: ValidationStateReader): Promise<void> {
     const delegatedGrant = PermissionGrant.parse(this.message.authorization!.authorDelegatedGrant!);
     await RecordsGrantAuthorization.authorizeQueryOrSubscribe({
       incomingMessage : this.message,
       expectedGrantor : this.author!,
       expectedGrantee : this.signer!,
       permissionGrant : delegatedGrant,
-      messageStore
+      validationStateReader
     });
   }
 }

package/src/interfaces/records-write.ts

@@ -4,6 +4,7 @@ import type { MessageInterface } from '../types/message-interface.js';
 import type { MessageSigner } from '../types/signer.js';
 import type { MessageStore } from '../types/message-store.js';
 import type { PublicKeyJwk } from '../types/jose-types.js';
+import type { ValidationStateReader } from '../types/validation-state-reader.js';
 import type {
   DataEncodedRecordsWriteMessage,
   InternalRecordsWriteMessage,
@@ -460,6 +461,35 @@ export class RecordsWrite implements MessageInterface<RecordsWriteMessage> {
     return recordsWrite;
   }
 
+  /**
+   * Validates the expected `dataCid` and `dataSize` in the descriptor against the actual data.
+   *
+   * @throws {DwnError} with `DwnErrorCode.RecordsWriteDataCidMismatch`
+   *                    if the actual data CID does not match `dataCid` in the descriptor.
+   * @throws {DwnError} with `DwnErrorCode.RecordsWriteDataSizeMismatch`
+   *                    if the actual byte size does not match `dataSize` in the descriptor.
+   */
+  public static validateDataIntegrity(
+    expectedDataCid: string,
+    expectedDataSize: number,
+    actualDataCid: string,
+    actualDataSize: number
+  ): void {
+    if (expectedDataCid !== actualDataCid) {
+      throw new DwnError(
+        DwnErrorCode.RecordsWriteDataCidMismatch,
+        `actual data CID ${actualDataCid} does not match dataCid in descriptor: ${expectedDataCid}`
+      );
+    }
+
+    if (expectedDataSize !== actualDataSize) {
+      throw new DwnError(
+        DwnErrorCode.RecordsWriteDataSizeMismatch,
+        `actual data size ${actualDataSize} bytes does not match dataSize in descriptor: ${expectedDataSize}`
+      );
+    }
+  }
+
   /**
    * Called by `JSON.stringify(...)` automatically.
    */
@@ -472,9 +502,7 @@ export class RecordsWrite implements MessageInterface<RecordsWriteMessage> {
    *
    * @param options.append - When `true`, appends new `recipients` entries to the existing
    *   `encryption` property instead of replacing it. Requires `this._message.encryption` to
-   *   already exist (i.e., the record must already be encrypted). This is used for the reactive
-   *   root-record upgrade: adding a ProtocolContext recipient entry alongside an existing
-   *   ProtocolPath entry so both the owner and context key holders can decrypt.
+   *   already exist (i.e., the record must already be encrypted).
    */
   public async encryptSymmetricEncryptionKey(
     encryptionInput: EncryptionInput,
@@ -693,10 +721,10 @@ export class RecordsWrite implements MessageInterface<RecordsWriteMessage> {
 
     // If `encryption` is given in message, make sure the correct `encryptionCid`
     // is in the payload of the message signature — UNLESS the message has an
-    // ownerSignature. When the DWN owner appends recipients to an
-    // externally-authored record (reactive root-record upgrade), the author's
-    // encryptionCid becomes stale. The owner's signature vouches for the
-    // updated encryption property, so the mismatch is expected and safe.
+    // ownerSignature. When the DWN owner appends recipients to an externally-authored
+    // record before normal admission, the author's encryptionCid becomes stale. The
+    // owner's signature vouches for the updated encryption property, so the mismatch
+    // is expected and safe.
     const hasOwnerSignature = this.message.authorization?.ownerSignature !== undefined;
     if (signaturePayload.encryptionCid !== undefined && !hasOwnerSignature) {
       const expectedEncryptionCid = await Cid.computeCid(this.message.encryption);
@@ -788,31 +816,31 @@ export class RecordsWrite implements MessageInterface<RecordsWriteMessage> {
 
   /**
    * Authorizes the author-delegate who signed this message.
-   * @param messageStore Used to check if the grant has been revoked.
+   * @param validationStateReader Used to check if the grant has been revoked.
    */
-  public async authorizeAuthorDelegate(messageStore: MessageStore): Promise<void> {
+  public async authorizeAuthorDelegate(validationStateReader: ValidationStateReader): Promise<void> {
     const delegatedGrant = PermissionGrant.parse(this.message.authorization.authorDelegatedGrant!);
     await RecordsGrantAuthorization.authorizeWrite({
       recordsWriteMessage : this.message,
       expectedGrantor     : this.author!,
       expectedGrantee     : this.signer!,
       permissionGrant     : delegatedGrant,
-      messageStore
+      validationStateReader
     });
   }
 
   /**
    * Authorizes the owner-delegate who signed this message.
-   * @param messageStore Used to check if the grant has been revoked.
+   * @param validationStateReader Used to check if the grant has been revoked.
    */
-  public async authorizeOwnerDelegate(messageStore: MessageStore): Promise<void> {
+  public async authorizeOwnerDelegate(validationStateReader: ValidationStateReader): Promise<void> {
     const delegatedGrant = PermissionGrant.parse(this.message.authorization.ownerDelegatedGrant!);
     await RecordsGrantAuthorization.authorizeWrite({
       recordsWriteMessage : this.message,
       expectedGrantor     : this.owner!,
       expectedGrantee     : this.ownerSignatureSigner!,
       permissionGrant     : delegatedGrant,
-      messageStore
+      validationStateReader
     });
   }
 

package/src/protocols/permissions.ts

@@ -1,14 +1,14 @@
 import type { Filter } from '../types/query-types.js';
-import type { GenericMessage } from '../types/message-types.js';
 import type { MessagesFilter } from '../types/messages-types.js';
 import type { MessageSigner } from '../types/signer.js';
-import type { MessageStore } from '../types/message-store.js';
 import type { ProtocolDefinition } from '../types/protocols-types.js';
+import type { ValidationStateReader } from '../types/validation-state-reader.js';
 import type { CoreProtocol, CoreProtocolStores } from '../core/core-protocol.js';
 import type { DataEncodedRecordsWriteMessage, RecordsWriteMessage } from '../types/records-types.js';
 import type { PermissionConditions, PermissionGrantData, PermissionRequestData, PermissionRevocationData, PermissionScope, RecordsPermissionScope } from '../types/permission-types.js';
 
 import { DwnConstant } from '../core/dwn-constant.js';
+import { DwnMethodName } from '../enums/dwn-interface-method.js';
 import { Encoder } from '../utils/encoder.js';
 import { FilterUtility } from '../utils/filter.js';
 import { Message } from '../core/message.js';
@@ -20,7 +20,6 @@ import { RecordsWrite } from '../interfaces/records-write.js';
 import { Time } from '../utils/time.js';
 import { validateJsonSchema } from '../schema-validator.js';
 import { DwnError, DwnErrorCode } from '../core/dwn-error.js';
-import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
 import { normalizeProtocolUrl, validateProtocolUrlNormalized } from '../utils/url.js';
 
 /**
@@ -113,6 +112,17 @@ export class PermissionsProtocol implements CoreProtocol {
    */
   public static readonly revocationPath = 'grant/revocation';
 
+  /**
+   * Canonical store predicate for the latest revocation of a permission grant.
+   */
+  public static grantRevocationFilter(grantId: string): Filter {
+    return {
+      isLatestBaseState : true,
+      parentId          : grantId,
+      protocolPath      : PermissionsProtocol.revocationPath,
+    };
+  }
+
   /**
    * The definition of the Permissions protocol.
    */
@@ -131,8 +141,15 @@ export class PermissionsProtocol implements CoreProtocol {
       }
     },
     structure: {
+      // All permission record paths are `$immutable`: requests, grants, and revocations are
+      // write-once by design (a grant is never amended — it is revoked and re-issued).
+      // Immutability locks each record's initial-write facts (notably the `protocol` tag),
+      // which replication fingerprint domains and protocol-scoped shadow filters depend on —
+      // a tag-mutated permission record would otherwise drift between the shadow-filter
+      // stream (current tags) and its fingerprint domain (initial tags).
       request: {
-        $size: {
+        $immutable : true,
+        $size      : {
           max: 10000
         },
         $actions: [
@@ -143,7 +160,8 @@ export class PermissionsProtocol implements CoreProtocol {
         ]
       },
       grant: {
-        $size: {
+        $immutable : true,
+        $size      : {
           max: 10000
         },
         $actions: [
@@ -154,7 +172,8 @@ export class PermissionsProtocol implements CoreProtocol {
           }
         ],
         revocation: {
-          $size: {
+          $immutable : true,
+          $size      : {
             max: 10000
           },
           $actions: [
@@ -194,7 +213,7 @@ export class PermissionsProtocol implements CoreProtocol {
   public async preProcessWrite(
     tenant: string,
     message: RecordsWriteMessage,
-    messageStore: MessageStore,
+    validationStateReader: ValidationStateReader,
   ): Promise<void> {
     if (message.descriptor.protocolPath !== PermissionsProtocol.revocationPath) {
       return;
@@ -202,7 +221,7 @@ export class PermissionsProtocol implements CoreProtocol {
 
     // fetch the parent grant to compare the scoped protocol against the revocation tag
     const permissionGrantId = message.descriptor.parentId!;
-    const grant = await PermissionsProtocol.fetchGrant(tenant, messageStore, permissionGrantId);
+    const grant = await validationStateReader.fetchGrant(tenant, permissionGrantId);
 
     const revokeTagProtocol = message.descriptor.tags?.protocol;
     const grantProtocol = 'protocol' in grant.scope ? grant.scope.protocol : undefined;
@@ -221,8 +240,7 @@ export class PermissionsProtocol implements CoreProtocol {
    *
    * Deletion order is deliberate to avoid orphaned data in case of crash:
    *   1. data store  (large blobs first)
-   *   2. state index (SMT entries)
-   *   3. message store
+   *   2. message store
    */
   public async postProcessWrite(
     tenant: string,
@@ -255,11 +273,9 @@ export class PermissionsProtocol implements CoreProtocol {
       }
     }
 
-    // 2. Compute CIDs and delete from state index before message store to avoid orphaned state entries.
     const messageCids = await Promise.all(grantAuthorizedMessages.map((message): Promise<string> => Message.getCid(message)));
-    await stores.stateIndex.delete(tenant, messageCids);
 
-    // 3. Finally delete all messages from the message store.
+    // 2. Finally delete all messages from the message store.
     await Promise.all(messageCids.map((cid): Promise<void> => stores.messageStore.delete(tenant, cid)));
   }
 
@@ -530,51 +546,15 @@ export class PermissionsProtocol implements CoreProtocol {
 
 
 
-  /**
-   * Fetches PermissionGrant with the specified `recordID`.
-   * @returns the PermissionGrant matching the `recordId` specified.
-   * @throws {Error} if PermissionGrant does not exist
-   */
-  public static async fetchGrant(
-    tenant: string,
-    messageStore: MessageStore,
-    permissionGrantId: string,
-  ): Promise<PermissionGrant> {
-
-    const grantQuery = {
-      recordId          : permissionGrantId,
-      isLatestBaseState : true
-    };
-    const { messages } = await messageStore.query(tenant, [grantQuery]);
-    const possibleGrantMessage: GenericMessage | undefined = messages[0];
-
-    const dwnInterface = possibleGrantMessage?.descriptor.interface;
-    const dwnMethod = possibleGrantMessage?.descriptor.method;
-
-    if (dwnInterface !== DwnInterfaceName.Records ||
-        dwnMethod !== DwnMethodName.Write ||
-        (possibleGrantMessage as RecordsWriteMessage).descriptor.protocolPath !== PermissionsProtocol.grantPath) {
-      throw new DwnError(
-        DwnErrorCode.GrantAuthorizationGrantMissing,
-        `Could not find permission grant with record ID ${permissionGrantId}.`
-      );
-    }
-
-    const permissionGrantMessage = possibleGrantMessage as DataEncodedRecordsWriteMessage;
-    const permissionGrant = PermissionGrant.parse(permissionGrantMessage);
-
-    return permissionGrant;
-  }
-
   /**
    * Gets the scope from the given permission record.
    * If the record is a revocation, the scope is fetched from the grant that is being revoked.
    *
-   * @param messageStore The message store to fetch the grant for a revocation.
+   * @param validationStateReader Used to fetch the grant for a revocation.
    */
   public static async getScopeFromPermissionRecord(
     tenant: string,
-    messageStore:MessageStore,
+    validationStateReader: ValidationStateReader,
     incomingMessage: DataEncodedRecordsWriteMessage,
   ): Promise<PermissionScope> {
     if (incomingMessage.descriptor.protocol !== PermissionsProtocol.uri) {
@@ -585,7 +565,7 @@ export class PermissionsProtocol implements CoreProtocol {
     }
 
     if (incomingMessage.descriptor.protocolPath === PermissionsProtocol.revocationPath) {
-      const grant = await PermissionsProtocol.fetchGrant(tenant, messageStore, incomingMessage.descriptor.parentId!);
+      const grant = await validationStateReader.fetchGrant(tenant, incomingMessage.descriptor.parentId!);
       return grant.scope;
     } else if (incomingMessage.descriptor.protocolPath === PermissionsProtocol.grantPath) {
       const grant = PermissionGrant.parse(incomingMessage);

package/src/store/index-level.ts

@@ -55,7 +55,7 @@ export class IndexLevel {
   config: IndexLevelConfig;
   private readonly _compoundIndexes: CompoundIndexDefinition[];
 
-  constructor(config: IndexLevelConfig) {
+  constructor(config: IndexLevelConfig, db?: LevelWrapper<string>) {
     this.config = {
       createLevelDatabase,
       ...config,
@@ -63,7 +63,7 @@ export class IndexLevel {
 
     this._compoundIndexes = config.compoundIndexes ?? [];
 
-    this.db = new LevelWrapper<string>({
+    this.db = db ?? new LevelWrapper<string>({
       location            : this.config.location,
       createLevelDatabase : this.config.createLevelDatabase,
       keyEncoding         : 'utf8'
@@ -99,7 +99,19 @@ export class IndexLevel {
     indexes: KeyValues,
     options?: IndexLevelOptions
   ): Promise<void> {
+    const indexOps = await this.createPutOperations(tenant, messageCid, indexes);
+    const tenantPartition = await this.db.partition(tenant);
+    await tenantPartition.batch(indexOps, options);
+  }
 
+  /**
+   * Creates the batch operations for indexing an item without executing them.
+   */
+  async createPutOperations(
+    tenant: string,
+    messageCid: string,
+    indexes: KeyValues,
+  ): Promise<LevelWrapperBatchOperation<string>[]> {
     // ensure we have something valid to index
     if (isEmptyObject(indexes)) {
       throw new DwnError(DwnErrorCode.IndexMissingIndexableProperty, 'Index must include at least one valid indexable property');
@@ -140,21 +152,32 @@ export class IndexLevel {
     );
     opCreationPromises.push(partitionOperationPromise);
 
-    const indexOps = await Promise.all(opCreationPromises);
-    const tenantPartition = await this.db.partition(tenant);
-    await tenantPartition.batch(indexOps, options);
+    return Promise.all(opCreationPromises);
   }
 
   /**
    *  Deletes all of the index data associated with the item.
    */
   async delete(tenant: string, messageCid: string, options?: IndexLevelOptions): Promise<void> {
+    const indexOps = await this.createDeleteOperations(tenant, messageCid);
+    if (indexOps.length === 0) {
+      return;
+    }
+
+    const tenantPartition = await this.db.partition(tenant);
+    await tenantPartition.batch(indexOps, options);
+  }
+
+  /**
+   * Creates the batch operations for removing an item's index data without executing them.
+   */
+  async createDeleteOperations(tenant: string, messageCid: string): Promise<LevelWrapperBatchOperation<string>[]> {
     const opCreationPromises: Promise<LevelWrapperBatchOperation<string>>[] = [];
 
     const indexes = await this.getIndexes(tenant, messageCid);
     if (indexes === undefined) {
       // invalid messageCid
-      return;
+      return [];
     }
 
     // delete the reverse lookup
@@ -185,9 +208,7 @@ export class IndexLevel {
       }
     }
 
-    const indexOps = await Promise.all(opCreationPromises);
-    const tenantPartition = await this.db.partition(tenant);
-    await tenantPartition.batch(indexOps, options);
+    return Promise.all(opCreationPromises);
   }
 
   /**

package/src/store/level-wrapper.ts

@@ -215,6 +215,14 @@ export class LevelWrapper<V> {
     }) };
   }
 
+  /**
+   * Wraps the given operation as targeting this wrapper's own partition, so it
+   * can be executed in a batch on an ancestor database.
+   */
+  createOperation(operation: LevelWrapperBatchOperation<V>): LevelWrapperBatchOperation<V> {
+    return { ...operation, sublevel: this.db as any };
+  }
+
   private async compactUnderlyingStorage(options?: LevelWrapperOptions): Promise<void> {
     options?.signal?.throwIfAborted();
 
@@ -269,4 +277,4 @@ export class LevelWrapper<V> {
 export type LevelWrapperConfig<V> = CreateLevelDatabaseOptions<V> & {
   location: string,
   createLevelDatabase?: typeof createLevelDatabase,
-};
+};