@enbox/dwn-sdk-js 0.4.0 → 0.4.2

package/src/core/protocol-authorization.ts

@@ -1,6 +1,3 @@
-import type { CoreProtocolRegistry } from './core-protocol.js';
-import type { Filter } from '../types/query-types.js';
-import type { MessageStore } from '../types/message-store.js';
 import type { RecordsCount } from '../interfaces/records-count.js';
 import type { RecordsDelete } from '../interfaces/records-delete.js';
 import type { RecordsQuery } from '../interfaces/records-query.js';
@@ -8,16 +5,14 @@ import type { RecordsRead } from '../interfaces/records-read.js';
 import type { RecordsSubscribe } from '../interfaces/records-subscribe.js';
 import type { RecordsWrite } from '../interfaces/records-write.js';
 import type { RecordsWriteMessage } from '../types/records-types.js';
-import type { ProtocolDefinition, ProtocolRuleSet, ProtocolsConfigureMessage } from '../types/protocols-types.js';
+import type { ValidationStateReader } from '../types/validation-state-reader.js';
+import type { ProtocolDefinition, ProtocolRuleSet } from '../types/protocols-types.js';
 
 import { getRuleSetAtPath } from '../utils/protocols.js';
-import { SortDirection } from '../types/query-types.js';
 import { DwnError, DwnErrorCode } from './dwn-error.js';
-import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
 import { ProtocolAction, ProtocolActor } from '../types/protocols-types.js';
 
 import { authorizeAgainstAllowedActions, verifyInvokedRole } from './protocol-authorization-action.js';
-import { constructRecordChain, fetchInitialWrite, getGoverningTimestamp } from './record-chain.js';
 import {
   verifyAsRoleRecordIfNeeded,
   verifyImmutability,
@@ -29,17 +24,6 @@ import {
   verifyTypeWithComposition,
 } from './protocol-authorization-validation.js';
 
-/**
- * Function signature for fetching a protocol definition.
- * Used by extracted modules to break the circular dependency on `ProtocolAuthorization`.
- */
-export type FetchProtocolDefinitionFn = (
-  tenant: string,
-  protocolUri: string,
-  messageStore: MessageStore,
-  messageTimestamp?: string,
-) => Promise<ProtocolDefinition>;
-
 export class ProtocolAuthorization {
 
   /**
@@ -49,39 +33,26 @@ export class ProtocolAuthorization {
   public static async validateReferentialIntegrity(
     tenant: string,
     incomingMessage: RecordsWrite,
-    messageStore: MessageStore,
-    coreProtocols?: CoreProtocolRegistry,
-  ): Promise<void> {
-    // Determine the governing timestamp for protocol definition lookup.
-    // For an initial write, this is the message's own timestamp.
-    // For an update, this is the initial write's timestamp (the protocol version is locked at creation time).
-    const governingTimestamp = await getGoverningTimestamp(
-      tenant, incomingMessage, messageStore
-    );
+    validationStateReader: ValidationStateReader,
+  ): Promise<ProtocolRuleSet> {
+    const protocolDefinitionTimestamp = incomingMessage.message.descriptor.messageTimestamp;
 
-    // fetch the protocol definition that was active at the governing timestamp
-    const protocolDefinition = await ProtocolAuthorization.fetchProtocolDefinition(
+    // fetch the protocol definition active at the incoming message timestamp
+    const protocolDefinition = await validationStateReader.fetchProtocolDefinition(
       tenant,
       incomingMessage.message.descriptor.protocol,
-      messageStore,
-      governingTimestamp,
-      coreProtocols,
+      protocolDefinitionTimestamp,
     );
 
-    // Create a bound fetch function that captures the registry for downstream callbacks.
-    const boundFetchDefinition = ProtocolAuthorization.createBoundFetchDefinition(coreProtocols);
-
     // verify declared protocol type exists in protocol and that it conforms to type specification.
     // For cross-protocol composition, the type may be defined in a referenced protocol.
     await verifyTypeWithComposition(
-      tenant, incomingMessage.message, protocolDefinition, messageStore,
-      boundFetchDefinition, governingTimestamp
+      tenant, incomingMessage.message, protocolDefinition, validationStateReader, protocolDefinitionTimestamp
     );
 
     // validate `protocolPath`
     await verifyProtocolPathAndContextId(
-      tenant, incomingMessage, messageStore,
-      boundFetchDefinition, governingTimestamp,
+      tenant, incomingMessage, validationStateReader, protocolDefinitionTimestamp,
     );
 
     // get the rule set for the inbound message
@@ -95,7 +66,7 @@ export class ProtocolAuthorization {
       tenant,
       incomingMessage,
       ruleSet,
-      messageStore,
+      validationStateReader,
     );
 
     // Verify size limit
@@ -111,7 +82,9 @@ export class ProtocolAuthorization {
     await verifySquashEligibility(incomingMessage, ruleSet);
 
     // Verify record count limit
-    await verifyRecordLimit(tenant, incomingMessage, ruleSet, messageStore);
+    await verifyRecordLimit(incomingMessage, ruleSet);
+
+    return ruleSet;
   }
 
   /**
@@ -124,24 +97,19 @@ export class ProtocolAuthorization {
   public static async validateStoredInitialWrite(
     tenant: string,
     incomingMessage: RecordsWrite,
-    messageStore: MessageStore,
-    coreProtocols?: CoreProtocolRegistry,
+    validationStateReader: ValidationStateReader,
   ): Promise<void> {
     await ProtocolAuthorization.verifyStoredInitialWrite(incomingMessage);
 
-    const governingTimestamp = incomingMessage.message.descriptor.messageTimestamp;
-    const protocolDefinition = await ProtocolAuthorization.fetchProtocolDefinition(
+    const protocolDefinitionTimestamp = incomingMessage.message.descriptor.messageTimestamp;
+    const protocolDefinition = await validationStateReader.fetchProtocolDefinition(
       tenant,
       incomingMessage.message.descriptor.protocol,
-      messageStore,
-      governingTimestamp,
-      coreProtocols,
+      protocolDefinitionTimestamp,
     );
 
-    const boundFetchDefinition = ProtocolAuthorization.createBoundFetchDefinition(coreProtocols);
-
     await verifyTypeWithComposition(
-      tenant, incomingMessage.message, protocolDefinition, messageStore, boundFetchDefinition, governingTimestamp
+      tenant, incomingMessage.message, protocolDefinition, validationStateReader, protocolDefinitionTimestamp
     );
 
     const ruleSet = ProtocolAuthorization.getRuleSet(
@@ -155,9 +123,8 @@ export class ProtocolAuthorization {
     await verifySquashEligibility(incomingMessage, ruleSet);
     ProtocolAuthorization.verifyStoredInitialWriteCreateAction(tenant, incomingMessage, ruleSet);
 
-    // `verifyRecordLimit()` is not replayed here. It is stateful and counts the present
-    // latest live set, which would incorrectly reject the record being revalidated.
-    // Inbound writes continue to enforce record limits at admission time.
+    // `verifyRecordLimit()` is intentionally not replayed here. It only checks strategy
+    // support for new record candidates; read-time occupancy projection decides visibility.
   }
 
   /**
@@ -167,33 +134,27 @@ export class ProtocolAuthorization {
   public static async authorizeWrite(
     tenant: string,
     incomingMessage: RecordsWrite,
-    messageStore: MessageStore,
-    coreProtocols?: CoreProtocolRegistry,
+    validationStateReader: ValidationStateReader,
   ): Promise<void> {
-    const existingInitialWrite = await fetchInitialWrite(tenant, incomingMessage.message.recordId, messageStore);
+    const existingInitialWrite = await validationStateReader.fetchInitialWrite(tenant, incomingMessage.message.recordId);
 
     let recordChain;
     if (existingInitialWrite === undefined) {
       // NOTE: we can assume this message is an initial write because an existing initial write does not exist.
       // Additionally, we check further down in the `RecordsWriteHandler` if the incoming message is an initialWrite,
       // so we don't check explicitly here to avoid an unnecessary duplicate check.
-      recordChain = await constructRecordChain(tenant, incomingMessage.message.descriptor.parentId, messageStore);
+      recordChain = await validationStateReader.constructRecordChain(tenant, incomingMessage.message.descriptor.parentId);
     } else {
-      recordChain = await constructRecordChain(tenant, incomingMessage.message.recordId, messageStore);
+      recordChain = await validationStateReader.constructRecordChain(tenant, incomingMessage.message.recordId);
     }
 
-    // Determine the governing timestamp for protocol definition lookup.
-    const governingTimestamp = await getGoverningTimestamp(
-      tenant, incomingMessage, messageStore
-    );
+    const protocolDefinitionTimestamp = incomingMessage.message.descriptor.messageTimestamp;
 
-    // fetch the protocol definition that was active at the governing timestamp
-    const protocolDefinition = await ProtocolAuthorization.fetchProtocolDefinition(
+    // fetch the protocol definition active at the incoming message timestamp
+    const protocolDefinition = await validationStateReader.fetchProtocolDefinition(
       tenant,
       incomingMessage.message.descriptor.protocol,
-      messageStore,
-      governingTimestamp,
-      coreProtocols,
+      protocolDefinitionTimestamp,
     );
 
     // get the rule set for the inbound message
@@ -202,8 +163,6 @@ export class ProtocolAuthorization {
       protocolDefinition,
     );
 
-    const boundFetchDefinition = ProtocolAuthorization.createBoundFetchDefinition(coreProtocols);
-
     // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
     await verifyInvokedRole(
       tenant,
@@ -211,9 +170,8 @@ export class ProtocolAuthorization {
       incomingMessage.message.descriptor.protocol,
       incomingMessage.message.contextId,
       protocolDefinition,
-      messageStore,
-      boundFetchDefinition,
-      governingTimestamp,
+      validationStateReader,
+      protocolDefinitionTimestamp,
     );
 
     // verify method invoked against the allowed actions in the rule set
@@ -222,7 +180,7 @@ export class ProtocolAuthorization {
       incomingMessage,
       ruleSet,
       recordChain,
-      messageStore,
+      validationStateReader,
       protocolDefinition,
     );
   }
@@ -236,29 +194,19 @@ export class ProtocolAuthorization {
     tenant: string,
     incomingMessage: RecordsRead,
     newestRecordsWrite: RecordsWrite,
-    messageStore: MessageStore,
-    coreProtocols?: CoreProtocolRegistry,
+    validationStateReader: ValidationStateReader,
   ): Promise<void> {
     // fetch record chain
     const recordChain: RecordsWriteMessage[] =
-      await constructRecordChain(tenant, newestRecordsWrite.message.recordId, messageStore);
+      await validationStateReader.constructRecordChain(tenant, newestRecordsWrite.message.recordId);
 
-    // Use the initial write's timestamp to determine the governing protocol definition.
-    // The protocol version is locked at the time the record was first created.
-    const initialWrite = await fetchInitialWrite(
-      tenant, newestRecordsWrite.message.recordId, messageStore
-    );
-    const governingTimestamp = initialWrite === undefined
-      ? newestRecordsWrite.message.descriptor.messageTimestamp
-      : initialWrite.descriptor.messageTimestamp;
+    const protocolDefinitionTimestamp = incomingMessage.message.descriptor.messageTimestamp;
 
-    // fetch the protocol definition that was active when the record was created
-    const protocolDefinition = await ProtocolAuthorization.fetchProtocolDefinition(
+    // fetch the protocol definition active at the incoming message timestamp
+    const protocolDefinition = await validationStateReader.fetchProtocolDefinition(
       tenant,
       newestRecordsWrite.message.descriptor.protocol,
-      messageStore,
-      governingTimestamp,
-      coreProtocols,
+      protocolDefinitionTimestamp,
     );
 
     // get the rule set for the inbound message
@@ -267,8 +215,6 @@ export class ProtocolAuthorization {
       protocolDefinition,
     );
 
-    const boundFetchDefinition = ProtocolAuthorization.createBoundFetchDefinition(coreProtocols);
-
     // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
     await verifyInvokedRole(
       tenant,
@@ -276,9 +222,8 @@ export class ProtocolAuthorization {
       newestRecordsWrite.message.descriptor.protocol,
       newestRecordsWrite.message.contextId,
       protocolDefinition,
-      messageStore,
-      boundFetchDefinition,
-      governingTimestamp,
+      validationStateReader,
+      protocolDefinitionTimestamp,
     );
 
     // verify method invoked against the allowed actions in the rule set
@@ -287,7 +232,7 @@ export class ProtocolAuthorization {
       incomingMessage,
       ruleSet,
       recordChain,
-      messageStore,
+      validationStateReader,
       protocolDefinition,
     );
   }
@@ -295,18 +240,15 @@ export class ProtocolAuthorization {
   public static async authorizeQueryOrSubscribe(
     tenant: string,
     incomingMessage: RecordsCount | RecordsQuery | RecordsSubscribe,
-    messageStore: MessageStore,
-    coreProtocols?: CoreProtocolRegistry,
+    validationStateReader: ValidationStateReader,
   ): Promise<void> {
     const { protocol, protocolPath, contextId } = incomingMessage.message.descriptor.filter;
 
     // fetch the protocol definition
-    const protocolDefinition = await ProtocolAuthorization.fetchProtocolDefinition(
+    const protocolDefinition = await validationStateReader.fetchProtocolDefinition(
       tenant,
       protocol!, // `authorizeQueryOrSubscribe` is only called if `protocol` is present
-      messageStore,
-      undefined,
-      coreProtocols,
+      incomingMessage.message.descriptor.messageTimestamp,
     );
 
     // get the rule set for the inbound message
@@ -315,8 +257,6 @@ export class ProtocolAuthorization {
       protocolDefinition,
     );
 
-    const boundFetchDefinition = ProtocolAuthorization.createBoundFetchDefinition(coreProtocols);
-
     // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
     await verifyInvokedRole(
       tenant,
@@ -324,8 +264,7 @@ export class ProtocolAuthorization {
       protocol!,
       contextId,
       protocolDefinition,
-      messageStore,
-      boundFetchDefinition,
+      validationStateReader,
     );
 
     // verify method invoked against the allowed actions in the rule set
@@ -334,7 +273,7 @@ export class ProtocolAuthorization {
       incomingMessage,
       ruleSet,
       [], // record chain is not relevant to queries or subscriptions
-      messageStore,
+      validationStateReader,
       protocolDefinition,
     );
   }
@@ -347,29 +286,20 @@ export class ProtocolAuthorization {
     tenant: string,
     incomingMessage: RecordsDelete,
     recordsWrite: RecordsWrite,
-    messageStore: MessageStore,
-    coreProtocols?: CoreProtocolRegistry,
+    validationStateReader: ValidationStateReader,
   ): Promise<void> {
 
     // fetch record chain
     const recordChain: RecordsWriteMessage[] =
-      await constructRecordChain(tenant, incomingMessage.message.descriptor.recordId, messageStore);
+      await validationStateReader.constructRecordChain(tenant, incomingMessage.message.descriptor.recordId);
 
-    // Use the initial write's timestamp to determine the governing protocol definition.
-    const initialWrite = await fetchInitialWrite(
-      tenant, incomingMessage.message.descriptor.recordId, messageStore
-    );
-    const governingTimestamp = initialWrite === undefined
-      ? recordsWrite.message.descriptor.messageTimestamp
-      : initialWrite.descriptor.messageTimestamp;
+    const protocolDefinitionTimestamp = incomingMessage.message.descriptor.messageTimestamp;
 
-    // fetch the protocol definition that was active when the record was created
-    const protocolDefinition = await ProtocolAuthorization.fetchProtocolDefinition(
+    // fetch the protocol definition active at the incoming message timestamp
+    const protocolDefinition = await validationStateReader.fetchProtocolDefinition(
       tenant,
       recordsWrite.message.descriptor.protocol,
-      messageStore,
-      governingTimestamp,
-      coreProtocols,
+      protocolDefinitionTimestamp,
     );
 
     // get the rule set for the inbound message
@@ -378,8 +308,6 @@ export class ProtocolAuthorization {
       protocolDefinition,
     );
 
-    const boundFetchDefinition = ProtocolAuthorization.createBoundFetchDefinition(coreProtocols);
-
     // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
     await verifyInvokedRole(
       tenant,
@@ -387,9 +315,8 @@ export class ProtocolAuthorization {
       recordsWrite.message.descriptor.protocol,
       recordsWrite.message.contextId,
       protocolDefinition,
-      messageStore,
-      boundFetchDefinition,
-      governingTimestamp,
+      validationStateReader,
+      protocolDefinitionTimestamp,
     );
 
     // verify method invoked against the allowed actions in the rule set
@@ -398,84 +325,11 @@ export class ProtocolAuthorization {
       incomingMessage,
       ruleSet,
       recordChain,
-      messageStore,
+      validationStateReader,
       protocolDefinition,
     );
   }
 
-  /**
-   * Fetches the protocol definition based on the protocol specified in the given message.
-   * When `messageTimestamp` is provided, returns the protocol definition that was active at that
-   * point in time — i.e. the ProtocolsConfigure with the greatest `messageTimestamp` that is <= the
-   * given timestamp. When not provided, returns the latest (current) protocol definition.
-   *
-   * When `coreProtocols` is provided, core protocol definitions are returned directly from the
-   * registry without a message store query. The extra parameter does not affect the
-   * `FetchProtocolDefinitionFn` callback type — callers that pass this function as a callback
-   * should bind the registry via a closure (see `createBoundFetchDefinition`).
-   */
-  public static async fetchProtocolDefinition(
-    tenant: string,
-    protocolUri: string,
-    messageStore: MessageStore,
-    messageTimestamp?: string,
-    coreProtocols?: CoreProtocolRegistry,
-  ): Promise<ProtocolDefinition> {
-    // if the protocol is a registered core protocol, return the definition directly without a store query
-    if (coreProtocols !== undefined) {
-      const coreDefinition = coreProtocols.getDefinition(protocolUri);
-      if (coreDefinition !== undefined) {
-        return coreDefinition;
-      }
-    }
-
-    // fetch the corresponding protocol definition
-    const query: Filter = {
-      interface : DwnInterfaceName.Protocols,
-      method    : DwnMethodName.Configure,
-      protocol  : protocolUri,
-    };
-
-    if (messageTimestamp === undefined) {
-      // default: return only the latest protocol definition
-      query.isLatestBaseState = true;
-    } else {
-      // temporal lookup: find the protocol definition active at the given timestamp
-      query.messageTimestamp = { lte: messageTimestamp };
-    }
-
-    const { messages: protocols } = await messageStore.query(
-      tenant,
-      [query],
-      { messageTimestamp: SortDirection.Descending },
-      { limit: 1 },
-    );
-
-    if (protocols.length === 0) {
-      throw new DwnError(DwnErrorCode.ProtocolAuthorizationProtocolNotFound, `unable to find protocol definition for ${protocolUri}`);
-    }
-
-    const protocolMessage = protocols[0] as ProtocolsConfigureMessage;
-    return protocolMessage.descriptor.definition;
-  }
-
-  /**
-   * Creates a `FetchProtocolDefinitionFn` closure that binds the given `CoreProtocolRegistry`.
-   * This allows core protocol definitions to be resolved from the registry without changing
-   * the `FetchProtocolDefinitionFn` type signature — zero ripple to downstream consumers
-   * like `protocol-authorization-action.ts` and `protocol-authorization-validation.ts`.
-   */
-  private static createBoundFetchDefinition(coreProtocols?: CoreProtocolRegistry): FetchProtocolDefinitionFn {
-    return (
-      tenant: string,
-      protocolUri: string,
-      messageStore: MessageStore,
-      messageTimestamp?: string,
-    ): Promise<ProtocolDefinition> => {
-      return ProtocolAuthorization.fetchProtocolDefinition(tenant, protocolUri, messageStore, messageTimestamp, coreProtocols);
-    };
-  }
-
   /**
    * Gets the rule set corresponding to the given protocolPath.
    */
@@ -562,7 +416,7 @@ export class ProtocolAuthorization {
 
     throw new DwnError(
       DwnErrorCode.ProtocolAuthorizationStoredInitialWriteActionNotAllowed,
-      `stored RecordsWrite by author ${incomingMessage.author} is not allowed by the governing protocol config`
+      `stored RecordsWrite by author ${incomingMessage.author} is not allowed by the resolved protocol config`
     );
   }
 

package/src/core/protocols-grant-authorization.ts

@@ -1,6 +1,6 @@
-import type { MessageStore } from '../types/message-store.js';
 import type { PermissionGrant } from '../protocols/permission-grant.js';
 import type { ProtocolPermissionScope } from '../types/permission-types.js';
+import type { ValidationStateReader } from '../types/validation-state-reader.js';
 import type { ProtocolsConfigureMessage, ProtocolsQueryMessage } from '../types/protocols-types.js';
 
 import { GrantAuthorization } from './grant-authorization.js';
@@ -15,10 +15,10 @@ export class ProtocolsGrantAuthorization {
     expectedGrantor: string,
     expectedGrantee: string,
     permissionGrant: PermissionGrant,
-    messageStore: MessageStore,
+    validationStateReader: ValidationStateReader,
   }): Promise<void> {
     const {
-      protocolsConfigureMessage, expectedGrantor, expectedGrantee, permissionGrant, messageStore
+      protocolsConfigureMessage, expectedGrantor, expectedGrantee, permissionGrant, validationStateReader
     } = input;
 
     await GrantAuthorization.performBaseValidation({
@@ -26,7 +26,7 @@ export class ProtocolsGrantAuthorization {
       expectedGrantor,
       expectedGrantee,
       permissionGrant,
-      messageStore
+      validationStateReader
     });
 
     ProtocolsGrantAuthorization.verifyScope(protocolsConfigureMessage, permissionGrant.scope as ProtocolPermissionScope);
@@ -34,23 +34,23 @@ export class ProtocolsGrantAuthorization {
 
   /**
    * Authorizes the scope of a permission grant for a ProtocolsQuery message.
-   * @param messageStore Used to check if the grant has been revoked.
+   * @param validationStateReader Used to check if the grant has been revoked.
    */
   public static async authorizeQuery(input: {
     expectedGrantor: string,
     expectedGrantee: string,
     incomingMessage: ProtocolsQueryMessage;
     permissionGrant: PermissionGrant;
-    messageStore: MessageStore;
+    validationStateReader: ValidationStateReader;
   }): Promise<void> {
-    const { expectedGrantee, expectedGrantor, incomingMessage, permissionGrant, messageStore } = input;
+    const { expectedGrantee, expectedGrantor, incomingMessage, permissionGrant, validationStateReader } = input;
 
     await GrantAuthorization.performBaseValidation({
       incomingMessage: incomingMessage,
       expectedGrantor,
       expectedGrantee,
       permissionGrant,
-      messageStore
+      validationStateReader
     });
 
     // If the grant specifies a protocol, the query must specify the same protocol.
@@ -85,4 +85,4 @@ export class ProtocolsGrantAuthorization {
       );
     }
   }
-}
+}

package/src/core/recording-validation-state-reader.ts

@@ -0,0 +1,130 @@
+import type { GenericMessage } from '../types/message-types.js';
+import type { PermissionGrant } from '../protocols/permission-grant.js';
+import type { ProtocolDefinition } from '../types/protocols-types.js';
+import type { RecordsWrite } from '../interfaces/records-write.js';
+import type { RecordsWriteMessage } from '../types/records-types.js';
+import type { ValidationStateReader } from '../types/validation-state-reader.js';
+
+/**
+ * One recorded validation-time state read: the reader method invoked.
+ */
+export type RecordedValidationRead = {
+  method: keyof ValidationStateReader;
+};
+
+/**
+ * A `ValidationStateReader` decorator that records every read before delegating to the wrapped
+ * reader. Used by the replay-basis closure tests (and harnesses) to assert that admission
+ * performs no validation read outside the reader surface, and to keep recorded read-traces as a
+ * regression artifact when validation reads change.
+ *
+ * Inject via `DwnConfig.instrumentValidationStateReader`.
+ */
+export class RecordingValidationStateReader implements ValidationStateReader {
+  private readonly recordedReads: RecordedValidationRead[] = [];
+
+  public constructor(private readonly inner: ValidationStateReader) { }
+
+  /** All reads recorded since construction or the last `clearRecordedReads()`. */
+  public get reads(): RecordedValidationRead[] {
+    return [...this.recordedReads];
+  }
+
+  /** Clears the recorded reads, e.g. between closure-test scenarios. */
+  public clearRecordedReads(): void {
+    this.recordedReads.length = 0;
+  }
+
+  /** @inheritdoc */
+  public async fetchInitialRecordsWrite(tenant: string, recordId: string): Promise<RecordsWrite | undefined> {
+    this.recordedReads.push({ method: 'fetchInitialRecordsWrite' });
+    return this.inner.fetchInitialRecordsWrite(tenant, recordId);
+  }
+
+  /** @inheritdoc */
+  public async fetchInitialWrite(tenant: string, recordId: string): Promise<RecordsWriteMessage | undefined> {
+    this.recordedReads.push({ method: 'fetchInitialWrite' });
+    return this.inner.fetchInitialWrite(tenant, recordId);
+  }
+
+  /** @inheritdoc */
+  public async constructRecordChain(tenant: string, descendantRecordId: string | undefined): Promise<RecordsWriteMessage[]> {
+    this.recordedReads.push({ method: 'constructRecordChain' });
+    return this.inner.constructRecordChain(tenant, descendantRecordId);
+  }
+
+  /** @inheritdoc */
+  public async fetchParentRecord(input: {
+    tenant: string;
+    parentProtocolUri: string;
+    parentId: string;
+  }): Promise<RecordsWriteMessage | undefined> {
+    this.recordedReads.push({ method: 'fetchParentRecord' });
+    return this.inner.fetchParentRecord(input);
+  }
+
+  /** @inheritdoc */
+  public async hasMatchingRoleRecord(input: {
+    tenant: string;
+    protocol: string;
+    protocolPath: string;
+    recipient: string;
+    contextIdPrefix?: string;
+  }): Promise<boolean> {
+    this.recordedReads.push({ method: 'hasMatchingRoleRecord' });
+    return this.inner.hasMatchingRoleRecord(input);
+  }
+
+  /** @inheritdoc */
+  public async queryLatestRoleRecords(input: {
+    tenant: string;
+    protocol: string;
+    protocolPath: string;
+    recipient: string;
+    contextIdPrefix?: string;
+  }): Promise<RecordsWriteMessage[]> {
+    this.recordedReads.push({ method: 'queryLatestRoleRecords' });
+    return this.inner.queryLatestRoleRecords(input);
+  }
+
+  /** @inheritdoc */
+  public async fetchGrant(tenant: string, permissionGrantId: string): Promise<PermissionGrant> {
+    this.recordedReads.push({ method: 'fetchGrant' });
+    return this.inner.fetchGrant(tenant, permissionGrantId);
+  }
+
+  /** @inheritdoc */
+  public async fetchOldestGrantRevocation(tenant: string, permissionGrantId: string): Promise<GenericMessage | undefined> {
+    this.recordedReads.push({ method: 'fetchOldestGrantRevocation' });
+    return this.inner.fetchOldestGrantRevocation(tenant, permissionGrantId);
+  }
+
+  /** @inheritdoc */
+  public async fetchNewestRecordsWrite(tenant: string, recordId: string): Promise<RecordsWriteMessage> {
+    this.recordedReads.push({ method: 'fetchNewestRecordsWrite' });
+    return this.inner.fetchNewestRecordsWrite(tenant, recordId);
+  }
+
+  /** @inheritdoc */
+  public async fetchProtocolDefinition(tenant: string, protocolUri: string, messageTimestamp?: string): Promise<ProtocolDefinition> {
+    this.recordedReads.push({ method: 'fetchProtocolDefinition' });
+    return this.inner.fetchProtocolDefinition(tenant, protocolUri, messageTimestamp);
+  }
+
+  /** @inheritdoc */
+  public async fetchLatestSquashRecordAtScope(input: {
+    tenant: string;
+    protocol: string;
+    protocolPath: string;
+    contextIdPrefix?: string;
+  }): Promise<RecordsWriteMessage | undefined> {
+    this.recordedReads.push({ method: 'fetchLatestSquashRecordAtScope' });
+    return this.inner.fetchLatestSquashRecordAtScope(input);
+  }
+
+  /** @inheritdoc */
+  public async hasStoredData(tenant: string, recordId: string, dataCid: string): Promise<boolean> {
+    this.recordedReads.push({ method: 'hasStoredData' });
+    return this.inner.hasStoredData(tenant, recordId, dataCid);
+  }
+}