@enbox/dwn-sdk-js 0.4.0 → 0.4.2

package/dist/esm/src/core/protocol-authorization-validation.js

@@ -1,16 +1,14 @@
 import { ProtocolRecordLimitStrategy } from '../types/protocols-types.js';
-import Ajv from 'ajv/dist/2020.js';
-import { FilterUtility } from '../utils/filter.js';
 import { Records } from '../utils/records.js';
+import { validateProtocolTags } from '../utils/protocol-tags.js';
 import { DwnError, DwnErrorCode } from './dwn-error.js';
-import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
 import { getTypeName, parseCrossProtocolRef } from '../utils/protocols.js';
 /**
  * Verifies the `protocolPath` declared in the given message matches the path of actual record chain.
  * For cross-protocol composition, the parent record may belong to a different protocol (resolved via `$ref` in the composing protocol).
  * @throws {DwnError} if fails verification.
  */
-export async function verifyProtocolPathAndContextId(tenant, inboundMessage, messageStore, fetchProtocolDefinition, governingTimestamp) {
+export async function verifyProtocolPathAndContextId(tenant, inboundMessage, validationStateReader, protocolDefinitionTimestamp) {
     const declaredProtocolPath = inboundMessage.message.descriptor.protocolPath;
     const declaredTypeName = getTypeName(declaredProtocolPath);
     const parentId = inboundMessage.message.descriptor.parentId;
@@ -24,17 +22,13 @@ export async function verifyProtocolPathAndContextId(tenant, inboundMessage, mes
     // Determine the protocol URI for the parent query.
     // If the parent path segment has a `$ref` in the composing protocol, the parent lives in a different protocol.
     const childProtocol = inboundMessage.message.descriptor.protocol;
-    const parentProtocolUri = await resolveParentProtocolUri(tenant, childProtocol, declaredProtocolPath, messageStore, fetchProtocolDefinition, governingTimestamp);
+    const parentProtocolUri = await resolveParentProtocolUri(tenant, childProtocol, declaredProtocolPath, validationStateReader, protocolDefinitionTimestamp);
     // fetch the parent message
-    const query = {
-        isLatestBaseState: true, // NOTE: this filter is critical, to ensure are are not returning a deleted parent
-        interface: DwnInterfaceName.Records,
-        method: DwnMethodName.Write,
-        protocol: parentProtocolUri,
-        recordId: parentId
-    };
-    const { messages: parentMessages } = await messageStore.query(tenant, [query]);
-    const parentMessage = parentMessages[0];
+    const parentMessage = await validationStateReader.fetchParentRecord({
+        tenant,
+        parentProtocolUri,
+        parentId,
+    });
     if (parentMessage === undefined) {
         // if this is a cross-protocol composition lookup, use a more descriptive error
         if (parentProtocolUri !== childProtocol) {
@@ -68,14 +62,14 @@ export async function verifyProtocolPathAndContextId(tenant, inboundMessage, mes
  * live in the referenced protocol. Specifically, the `$ref` at the topmost ancestor tells us
  * the parent's protocol URI.
  */
-export async function resolveParentProtocolUri(tenant, childProtocolUri, childProtocolPath, messageStore, fetchProtocolDefinition, governingTimestamp) {
+export async function resolveParentProtocolUri(tenant, childProtocolUri, childProtocolPath, validationStateReader, protocolDefinitionTimestamp) {
     const segments = childProtocolPath.split('/');
     // A root-level record (no `/` in path) has no parent or uses the same protocol
     if (segments.length <= 1) {
         return childProtocolUri;
     }
-    // Fetch the composing protocol's definition at the governing timestamp
-    const composingDefinition = await fetchProtocolDefinition(tenant, childProtocolUri, messageStore, governingTimestamp);
+    // Fetch the composing protocol's definition at the incoming message timestamp
+    const composingDefinition = await validationStateReader.fetchProtocolDefinition(tenant, childProtocolUri, protocolDefinitionTimestamp);
     // Walk the structure to find the parent's path segment
     // The parent's position in the structure is at segments[0..n-2]
     // We check if the first segment has a `$ref`, which means the parent is in a different protocol
@@ -107,12 +101,12 @@ export async function resolveParentProtocolUri(tenant, childProtocolUri, childPr
  * For cross-protocol composition, if the type is at a `$ref` position in the structure,
  * the type definition is looked up in the referenced protocol's `types` map instead.
  */
-export async function verifyTypeWithComposition(tenant, inboundMessage, protocolDefinition, messageStore, fetchProtocolDefinition, governingTimestamp) {
+export async function verifyTypeWithComposition(tenant, inboundMessage, protocolDefinition, validationStateReader, protocolDefinitionTimestamp) {
     const declaredProtocolPath = inboundMessage.descriptor.protocolPath;
     const declaredTypeName = getTypeName(declaredProtocolPath);
     // Resolve which protocol types map to use.
     // If the first path segment has `$ref`, this record's type might be defined in a referenced protocol.
-    const protocolTypes = await resolveProtocolTypesForPath(tenant, declaredProtocolPath, protocolDefinition, messageStore, fetchProtocolDefinition, governingTimestamp);
+    const protocolTypes = await resolveProtocolTypesForPath(tenant, declaredProtocolPath, protocolDefinition, validationStateReader, protocolDefinitionTimestamp);
     verifyType(inboundMessage, protocolTypes, declaredTypeName);
 }
 /**
@@ -120,7 +114,7 @@ export async function verifyTypeWithComposition(tenant, inboundMessage, protocol
  * For non-composed records, this is the protocol definition's own `types` map.
  * For records at a `$ref` position, this is the referenced protocol's `types` map.
  */
-export async function resolveProtocolTypesForPath(tenant, protocolPath, protocolDefinition, messageStore, fetchProtocolDefinition, governingTimestamp) {
+export async function resolveProtocolTypesForPath(tenant, protocolPath, protocolDefinition, validationStateReader, protocolDefinitionTimestamp) {
     const segments = protocolPath.split('/');
     // Check if the first segment has a `$ref`
     const firstSegmentRuleSet = protocolDefinition.structure[segments[0]];
@@ -130,7 +124,7 @@ export async function resolveProtocolTypesForPath(tenant, protocolPath, protocol
         if (parsed !== undefined && protocolDefinition.uses !== undefined) {
             const refProtocolUri = protocolDefinition.uses[parsed.alias];
             if (refProtocolUri !== undefined) {
-                const refDefinition = await fetchProtocolDefinition(tenant, refProtocolUri, messageStore, governingTimestamp);
+                const refDefinition = await validationStateReader.fetchProtocolDefinition(tenant, refProtocolUri, protocolDefinitionTimestamp);
                 return refDefinition.types;
             }
         }
@@ -185,31 +179,14 @@ export function verifySizeLimit(incomingMessage, ruleSet) {
     }
 }
 /**
- * Verifies record tags against the `$tags` schema in the rule set using JSON Schema (Ajv).
+ * Verifies record tags against the `$tags` schema in the rule set.
  * Checks required tags, additional properties, and schema conformance.
  */
 export function verifyTagsIfNeeded(incomingMessage, ruleSet) {
     if (ruleSet.$tags !== undefined) {
         const { tags = {}, protocol, protocolPath } = incomingMessage.message.descriptor;
-        const { $allowUndefinedTags, $requiredTags, ...properties } = ruleSet.$tags;
-        // if $allowUndefinedTags is set to false and there are properties not defined in the schema, an error is thrown
-        const additionalProperties = $allowUndefinedTags || false;
-        // if $requiredTags is set, all required tags must be present
-        const required = $requiredTags || [];
-        const ajv = new Ajv.default();
-        const compiledTags = ajv.compile({
-            type: 'object',
-            properties,
-            required,
-            additionalProperties,
-        });
-        const validSchema = compiledTags(tags);
-        if (!validSchema) {
-            // the `dataVar` is used to add a qualifier to the error message.
-            // For example. If the error is related to a tag `status` in a protocol `https://example.protocol` with the protocolPath `example/path`
-            // the error would be described as `https://example.protocol/example/path/$tags/status'
-            // without this decorator it would show up as `data/status` which may be confusing.
-            const schemaError = ajv.errorsText(compiledTags.errors, { dataVar: `${protocol}/${protocolPath}/$tags` });
+        const schemaError = validateProtocolTags(ruleSet.$tags, tags, `${protocol}/${protocolPath}/$tags`);
+        if (schemaError !== undefined) {
             throw new DwnError(DwnErrorCode.ProtocolAuthorizationTagsInvalidSchema, `tags schema validation error: ${schemaError}`);
         }
     }
@@ -220,7 +197,7 @@ export function verifyTagsIfNeeded(incomingMessage, ruleSet) {
  * Else it verifies the validity of the given `RecordsWrite` as a role record, including:
  * 1. The same role has not been assigned to the same entity/recipient.
  */
-export async function verifyAsRoleRecordIfNeeded(tenant, incomingMessage, ruleSet, messageStore) {
+export async function verifyAsRoleRecordIfNeeded(tenant, incomingMessage, ruleSet, validationStateReader) {
     if (!ruleSet.$role) {
         return;
     }
@@ -231,72 +208,40 @@ export async function verifyAsRoleRecordIfNeeded(tenant, incomingMessage, ruleSe
         throw new DwnError(DwnErrorCode.ProtocolAuthorizationRoleMissingRecipient, 'Role records must have a recipient');
     }
     const protocolPath = incomingRecordsWrite.message.descriptor.protocolPath;
-    const filter = {
-        interface: DwnInterfaceName.Records,
-        method: DwnMethodName.Write,
-        isLatestBaseState: true,
+    const parentContextId = Records.getParentContextFromOfContextId(incomingRecordsWrite.message.contextId);
+    // if this is not the root record, scope the role-record query to the parent context
+    const matchingRecords = await validationStateReader.queryLatestRoleRecords({
+        tenant,
         protocol: incomingRecordsWrite.message.descriptor.protocol,
         protocolPath,
         recipient,
-    };
-    const parentContextId = Records.getParentContextFromOfContextId(incomingRecordsWrite.message.contextId);
-    // if this is not the root record, add a prefix filter to the query
-    if (parentContextId !== '') {
-        const prefixFilter = FilterUtility.constructPrefixFilterAsRangeFilter(parentContextId);
-        filter.contextId = prefixFilter;
-    }
-    const { messages: matchingMessages } = await messageStore.query(tenant, [filter]);
-    const matchingRecords = matchingMessages;
+        contextIdPrefix: parentContextId === '' ? undefined : parentContextId,
+    });
     const matchingRecordsExceptIncomingRecordId = matchingRecords.filter((recordsWriteMessage) => recordsWriteMessage.recordId !== incomingRecordsWrite.message.recordId);
     if (matchingRecordsExceptIncomingRecordId.length > 0) {
         throw new DwnError(DwnErrorCode.ProtocolAuthorizationDuplicateRoleRecipient, `DID '${recipient}' is already recipient of a role record at protocol path '${protocolPath} under the parent context ${parentContextId}.`);
     }
 }
 /**
- * Verifies that a new record creation does not exceed the `$recordLimit` defined in the rule set.
+ * Verifies that the `$recordLimit` strategy is supported for a new record creation.
  *
- * This check only applies to initial writes (new records). Updates to existing records are not counted.
- * The count is scoped to the same `protocol + protocolPath` within the parent context:
- * - For root-level records: counted across the entire protocol for the tenant.
- * - For nested records: counted within the parent record's context.
+ * This check only applies to initial writes (new records). Updates to existing records do not
+ * affect record-limit occupancy. The supported `reject` strategy admits every candidate and
+ * projects the visible occupant set at read time, so validation stays independent of arrival order.
  *
- * @throws {DwnError} with `ProtocolAuthorizationRecordLimitExceeded` if the limit is reached and strategy is `reject`.
- * @throws {DwnError} with `ProtocolAuthorizationRecordLimitStrategyNotImplemented` if strategy is not yet implemented.
+ * @throws {DwnError} with `ProtocolAuthorizationRecordLimitStrategyNotImplemented` if strategy is not implemented.
  */
-export async function verifyRecordLimit(tenant, incomingMessage, ruleSet, messageStore) {
+export async function verifyRecordLimit(incomingMessage, ruleSet) {
     if (ruleSet.$recordLimit === undefined) {
         return;
     }
-    // Only enforce on initial writes — updates to existing records do not count as new records.
+    // Only initial writes can introduce a new record-limit candidate.
     const isInitialWrite = await incomingMessage.isInitialWrite();
     if (!isInitialWrite) {
         return;
     }
-    const { max, strategy } = ruleSet.$recordLimit;
-    // Build a filter to count existing records at the same protocol path and parent context.
-    const protocolPath = incomingMessage.message.descriptor.protocolPath;
-    const filter = {
-        interface: DwnInterfaceName.Records,
-        method: DwnMethodName.Write,
-        isLatestBaseState: true,
-        protocol: incomingMessage.message.descriptor.protocol,
-        protocolPath,
-    };
-    // Scope by parent context for nested records.
-    const parentContextId = Records.getParentContextFromOfContextId(incomingMessage.message.contextId);
-    if (parentContextId !== '') {
-        const prefixFilter = FilterUtility.constructPrefixFilterAsRangeFilter(parentContextId);
-        filter.contextId = prefixFilter;
-    }
-    const existingCount = await messageStore.count(tenant, [filter]);
-    if (existingCount >= max) {
-        if (strategy === ProtocolRecordLimitStrategy.Reject) {
-            throw new DwnError(DwnErrorCode.ProtocolAuthorizationRecordLimitExceeded, `record limit of ${max} reached at protocol path '${protocolPath}'` +
-                `${parentContextId === '' ? '' : ` under parent context '${parentContextId}'`}` +
-                `: new records are rejected until existing records are deleted.`);
-        }
-        // Future strategies (e.g. purgeOldest) will be implemented here.
-        // For now, any non-reject strategy that somehow passes schema validation is rejected.
+    const { strategy } = ruleSet.$recordLimit;
+    if (strategy !== ProtocolRecordLimitStrategy.Reject) {
         throw new DwnError(DwnErrorCode.ProtocolAuthorizationRecordLimitStrategyNotImplemented, `record limit strategy '${strategy}' is not yet implemented.`);
     }
 }

package/dist/esm/src/core/protocol-authorization-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"protocol-authorization-validation.js","sourceRoot":"","sources":["../../../../src/core/protocol-authorization-validation.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAI1E,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAI3E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAc,EACd,cAA4B,EAC5B,YAA0B,EAC1B,uBAAkD,EAClD,kBAA2B;IAE3B,MAAM,oBAAoB,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IAC5E,MAAM,gBAAgB,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IAC5D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,oBAAoB,KAAK,gBAAgB,EAAE,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,oDAAoD,EACjE,2BAA2B,oBAAoB,6CAA6C,CAC7F,CAAC;QACJ,CAAC;QAED,OAAO;IACT,CAAC;IAED,mFAAmF;IAEnF,mDAAmD;IACnD,+GAA+G;IAC/G,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACjE,MAAM,iBAAiB,GAAG,MAAM,wBAAwB,CACtD,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,CACvG,CAAC;IAEF,2BAA2B;IAC3B,MAAM,KAAK,GAAW;QACpB,iBAAiB,EAAG,IAAI,EAAE,kFAAkF;QAC5G,SAAS,EAAW,gBAAgB,CAAC,OAAO;QAC5C,MAAM,EAAc,aAAa,CAAC,KAAK;QACvC,QAAQ,EAAY,iBAAiB;QACrC,QAAQ,EAAY,QAAQ;KAC7B,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAI,cAAwC,CAAC,CAAC,CAAC,CAAC;IAEnE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,+EAA+E;QAC/E,IAAI,iBAAiB,KAAK,aAAa,EAAE,CAAC;YACxC,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,gDAAgD,EAC7D,iCAAiC,QAAQ,kBAAkB,iBAAiB,IAAI;gBAChF,qCAAqC,oBAAoB,IAAI,CAC9D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,yCAAyC,EACtD,iCAAiC,QAAQ,uCAAuC,oBAAoB,IAAI,CACzG,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,MAAM,kBAAkB,GAAG,aAAa,CAAC,UAAU,CAAC,YAAY,CAAC;IACjE,MAAM,oBAAoB,GAAG,GAAG,kBAAkB,IAAI,gBAAgB,EAAE,CAAC;IACzE,IAAI,oBAAoB,KAAK,oBAAoB,EAAE,CAAC;QAClD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,0CAA0C,EACvD,2EAA2E,oBAAoB,IAAI,CACpG,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,MAAM,iBAAiB,GAAG,GAAG,aAAa,CAAC,SAAS,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC1F,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;IACzD,IAAI,eAAe,KAAK,iBAAiB,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,uCAAuC,EACpD,uBAAuB,eAAe,mCAAmC,iBAAiB,IAAI,CAC/F,CAAC;IACJ,CAAC;AAEH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,gBAAwB,EACxB,iBAAyB,EACzB,YAA0B,EAC1B,uBAAkD,EAClD,kBAA2B;IAE3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE9C,+EAA+E;IAC/E,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,uEAAuE;IACvE,MAAM,mBAAmB,GAAG,MAAM,uBAAuB,CACvD,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB,CAC3D,CAAC;IAEF,uDAAuD;IACvD,gEAAgE;IAChE,gGAAgG;IAChG,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,mBAAmB,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,SAAS,IAAI,mBAAmB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,yFAAyF;gBACzF,6EAA6E;gBAC7E,uHAAuH;gBACvH,sGAAsG;gBACtG,+EAA+E;gBAC/E,4GAA4G;gBAC5G,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1B,uFAAuF;oBACvF,OAAO,WAAW,CAAC;gBACrB,CAAC;gBACD,mEAAmE;gBACnE,OAAO,gBAAgB,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,cAAmC,EACnC,kBAAsC,EACtC,YAA0B,EAC1B,uBAAkD,EAClD,kBAA2B;IAE3B,MAAM,oBAAoB,GAAG,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC;IACpE,MAAM,gBAAgB,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAE3D,2CAA2C;IAC3C,sGAAsG;IACtG,MAAM,aAAa,GAAG,MAAM,2BAA2B,CACrD,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,CAC5G,CAAC;IAEF,UAAU,CAAC,cAAc,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAc,EACd,YAAoB,EACpB,kBAAsC,EACtC,YAA0B,EAC1B,uBAAkD,EAClD,kBAA2B;IAE3B,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEzC,0CAA0C;IAC1C,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,mBAAmB,EAAE,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,uFAAuF;QACvF,MAAM,MAAM,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,SAAS,IAAI,kBAAkB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClE,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,CACzD,CAAC;gBACF,OAAO,aAAa,CAAC,KAAK,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,OAAO,kBAAkB,CAAC,KAAK,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,cAAmC,EACnC,aAA4B,EAC5B,QAAiB;IAEjB,MAAM,gBAAgB,GAAG,QAAQ,IAAI,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE7C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,gCAAgC,EAC9D,oBAAoB,gBAAgB,0BAA0B,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,YAAY,GAAiB,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAEnE,gFAAgF;IAChF,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC;IAC7C,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxE,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,kCAAkC,EAC/C,SAAS,gBAAgB,uBAAuB,YAAY,CAAC,MAAM;qBACpD,MAAM,GAAG,CACzB,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,MAAM,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC;IACjD,IAAI,YAAY,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,wCAAwC,EACrD,SAAS,gBAAgB,+BAA+B,YAAY,CAAC,WAAW;qBACjE,UAAU,GAAG,CAC7B,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,IAAI,YAAY,CAAC,kBAAkB,KAAK,IAAI,IAAI,cAAc,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,uCAAuC,EACpD,SAAS,gBAAgB,8DAA8D,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,eAA6B,EAC7B,OAAwB;IAExB,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAE7C,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IAE7D,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,mCAAmC,EAAE,aAAa,QAAQ,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,mCAAmC,EAAE,aAAa,QAAQ,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAC5H,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,eAA6B,EAC7B,OAAwB;IAExB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC;QAEjF,MAAM,EAAE,mBAAmB,EAAE,aAAa,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAE5E,gHAAgH;QAChH,MAAM,oBAAoB,GAAG,mBAAmB,IAAI,KAAK,CAAC;QAE1D,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,aAAa,IAAI,EAAE,CAAC;QAErC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC;YAC/B,IAAI,EAAE,QAAQ;YACd,UAAU;YACV,QAAQ;YACR,oBAAoB;SACrB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,iEAAiE;YACjE,uIAAuI;YACvI,uFAAuF;YACvF,mFAAmF;YACnF,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,QAAQ,IAAI,YAAY,QAAQ,EAAE,CAAC,CAAC;YAC1G,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,sCAAsC,EAAE,iCAAiC,WAAW,EAAE,CAAC,CAAC;QAC1H,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAc,EACd,eAA6B,EAC7B,OAAwB,EACxB,YAA0B;IAE1B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,6BAA6B;IAE7B,MAAM,oBAAoB,GAAG,eAAe,CAAC;IAC7C,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACpE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,yCAAyC,EACtD,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IAC1E,MAAM,MAAM,GAAW;QACrB,SAAS,EAAW,gBAAgB,CAAC,OAAO;QAC5C,MAAM,EAAc,aAAa,CAAC,KAAK;QACvC,iBAAiB,EAAG,IAAI;QACxB,QAAQ,EAAY,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;QACpE,YAAY;QACZ,SAAS;KACV,CAAC;IAEF,MAAM,eAAe,GAAG,OAAO,CAAC,+BAA+B,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAE,CAAC;IAEzG,mEAAmE;IACnE,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,aAAa,CAAC,kCAAkC,CAAC,eAAe,CAAC,CAAC;QACvF,MAAM,CAAC,SAAS,GAAG,YAAY,CAAC;IAClC,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,MAAM,eAAe,GAAG,gBAAyC,CAAC;IAClE,MAAM,qCAAqC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,mBAAwC,EAAW,EAAE,CACzH,mBAAmB,CAAC,QAAQ,KAAK,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CACvE,CAAC;IACF,IAAI,qCAAqC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,2CAA2C,EACxD,QAAQ,SAAS,6DAA6D,YAAY,6BAA6B,eAAe,GAAG,CAC1I,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,eAA6B,EAC7B,OAAwB,EACxB,YAA0B;IAE1B,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO;IACT,CAAC;IAED,4FAA4F;IAC5F,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,CAAC;IAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAE/C,yFAAyF;IACzF,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IACrE,MAAM,MAAM,GAAW;QACrB,SAAS,EAAW,gBAAgB,CAAC,OAAO;QAC5C,MAAM,EAAc,aAAa,CAAC,KAAK;QACvC,iBAAiB,EAAG,IAAI;QACxB,QAAQ,EAAY,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;QAC/D,YAAY;KACb,CAAC;IAEF,8CAA8C;IAC9C,MAAM,eAAe,GAAG,OAAO,CAAC,+BAA+B,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAE,CAAC;IACpG,IAAI,eAAe,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,aAAa,CAAC,kCAAkC,CAAC,eAAe,CAAC,CAAC;QACvF,MAAM,CAAC,SAAS,GAAG,YAAY,CAAC;IAClC,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAEjE,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC;QACzB,IAAI,QAAQ,KAAK,2BAA2B,CAAC,MAAM,EAAE,CAAC;YACpD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,wCAAwC,EACrD,mBAAmB,GAAG,8BAA8B,YAAY,GAAG;gBACnE,GAAG,eAAe,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,eAAe,GAAG,EAAE;gBAC/E,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,sFAAsF;QACtF,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,sDAAsD,EACnE,0BAA0B,QAAQ,2BAA2B,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,eAA6B,EAC7B,OAAwB;IAExB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;IAEzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,6DAA6D;IAC7D,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,qCAAqC,EAClD,mDAAmD,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,KAAK;YACvG,mCAAmC,CACpC,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,CAAC;IAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,0CAA0C,EACvD,wFAAwF,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,eAA6B,EAC7B,OAAwB;IAExB,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,CAAC;IAC9D,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,oCAAoC,EACjD,4BAA4B,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,0CAA0C,CACtH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"protocol-authorization-validation.js","sourceRoot":"","sources":["../../../../src/core/protocol-authorization-validation.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAE1E,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE3E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAc,EACd,cAA4B,EAC5B,qBAA4C,EAC5C,2BAAoC;IAEpC,MAAM,oBAAoB,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IAC5E,MAAM,gBAAgB,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IAC5D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,oBAAoB,KAAK,gBAAgB,EAAE,CAAC;YAC9C,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,oDAAoD,EACjE,2BAA2B,oBAAoB,6CAA6C,CAC7F,CAAC;QACJ,CAAC;QAED,OAAO;IACT,CAAC;IAED,mFAAmF;IAEnF,mDAAmD;IACnD,+GAA+G;IAC/G,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACjE,MAAM,iBAAiB,GAAG,MAAM,wBAAwB,CACtD,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,2BAA2B,CAChG,CAAC;IAEF,2BAA2B;IAC3B,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,iBAAiB,CAAC;QAClE,MAAM;QACN,iBAAiB;QACjB,QAAQ;KACT,CAAC,CAAC;IAEH,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,+EAA+E;QAC/E,IAAI,iBAAiB,KAAK,aAAa,EAAE,CAAC;YACxC,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,gDAAgD,EAC7D,iCAAiC,QAAQ,kBAAkB,iBAAiB,IAAI;gBAChF,qCAAqC,oBAAoB,IAAI,CAC9D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,yCAAyC,EACtD,iCAAiC,QAAQ,uCAAuC,oBAAoB,IAAI,CACzG,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,MAAM,kBAAkB,GAAG,aAAa,CAAC,UAAU,CAAC,YAAY,CAAC;IACjE,MAAM,oBAAoB,GAAG,GAAG,kBAAkB,IAAI,gBAAgB,EAAE,CAAC;IACzE,IAAI,oBAAoB,KAAK,oBAAoB,EAAE,CAAC;QAClD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,0CAA0C,EACvD,2EAA2E,oBAAoB,IAAI,CACpG,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,MAAM,iBAAiB,GAAG,GAAG,aAAa,CAAC,SAAS,IAAI,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC1F,MAAM,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC;IACzD,IAAI,eAAe,KAAK,iBAAiB,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,uCAAuC,EACpD,uBAAuB,eAAe,mCAAmC,iBAAiB,IAAI,CAC/F,CAAC;IACJ,CAAC;AAEH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,gBAAwB,EACxB,iBAAyB,EACzB,qBAA4C,EAC5C,2BAAoC;IAEpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE9C,+EAA+E;IAC/E,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,8EAA8E;IAC9E,MAAM,mBAAmB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC7E,MAAM,EAAE,gBAAgB,EAAE,2BAA2B,CACtD,CAAC;IAEF,uDAAuD;IACvD,gEAAgE;IAChE,gGAAgG;IAChG,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,mBAAmB,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,SAAS,IAAI,mBAAmB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,yFAAyF;gBACzF,6EAA6E;gBAC7E,uHAAuH;gBACvH,sGAAsG;gBACtG,+EAA+E;gBAC/E,4GAA4G;gBAC5G,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1B,uFAAuF;oBACvF,OAAO,WAAW,CAAC;gBACrB,CAAC;gBACD,mEAAmE;gBACnE,OAAO,gBAAgB,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,cAAmC,EACnC,kBAAsC,EACtC,qBAA4C,EAC5C,2BAAoC;IAEpC,MAAM,oBAAoB,GAAG,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC;IACpE,MAAM,gBAAgB,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAE3D,2CAA2C;IAC3C,sGAAsG;IACtG,MAAM,aAAa,GAAG,MAAM,2BAA2B,CACrD,MAAM,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,2BAA2B,CACrG,CAAC;IAEF,UAAU,CAAC,cAAc,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAc,EACd,YAAoB,EACpB,kBAAsC,EACtC,qBAA4C,EAC5C,2BAAoC;IAEpC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEzC,0CAA0C;IAC1C,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,mBAAmB,EAAE,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,uFAAuF;QACvF,MAAM,MAAM,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,SAAS,IAAI,kBAAkB,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClE,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CACvE,MAAM,EAAE,cAAc,EAAE,2BAA2B,CACpD,CAAC;gBACF,OAAO,aAAa,CAAC,KAAK,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,OAAO,kBAAkB,CAAC,KAAK,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,cAAmC,EACnC,aAA4B,EAC5B,QAAiB;IAEjB,MAAM,gBAAgB,GAAG,QAAQ,IAAI,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAE7C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,gCAAgC,EAC9D,oBAAoB,gBAAgB,0BAA0B,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,YAAY,GAAiB,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAEnE,gFAAgF;IAChF,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC;IAC7C,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxE,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,kCAAkC,EAC/C,SAAS,gBAAgB,uBAAuB,YAAY,CAAC,MAAM;qBACpD,MAAM,GAAG,CACzB,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,MAAM,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC;IACjD,IAAI,YAAY,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,wCAAwC,EACrD,SAAS,gBAAgB,+BAA+B,YAAY,CAAC,WAAW;qBACjE,UAAU,GAAG,CAC7B,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,IAAI,YAAY,CAAC,kBAAkB,KAAK,IAAI,IAAI,cAAc,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,uCAAuC,EACpD,SAAS,gBAAgB,8DAA8D,CACxF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,eAA6B,EAC7B,OAAwB;IAExB,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAE7C,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IAE7D,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,mCAAmC,EAAE,aAAa,QAAQ,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,mCAAmC,EAAE,aAAa,QAAQ,yBAAyB,GAAG,EAAE,CAAC,CAAC;IAC5H,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,eAA6B,EAC7B,OAAwB;IAExB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC;QACjF,MAAM,WAAW,GAAG,oBAAoB,CACtC,OAAO,CAAC,KAAK,EACb,IAAI,EACJ,GAAG,QAAQ,IAAI,YAAY,QAAQ,CACpC,CAAC;QAEF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,sCAAsC,EAAE,iCAAiC,WAAW,EAAE,CAAC,CAAC;QAC1H,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAc,EACd,eAA6B,EAC7B,OAAwB,EACxB,qBAA4C;IAE5C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,6BAA6B;IAE7B,MAAM,oBAAoB,GAAG,eAAe,CAAC;IAC7C,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;IACpE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,yCAAyC,EACtD,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;IAC1E,MAAM,eAAe,GAAG,OAAO,CAAC,+BAA+B,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAE,CAAC;IAEzG,oFAAoF;IACpF,MAAM,eAAe,GAAG,MAAM,qBAAqB,CAAC,sBAAsB,CAAC;QACzE,MAAM;QACN,QAAQ,EAAU,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;QAClE,YAAY;QACZ,SAAS;QACT,eAAe,EAAG,eAAe,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;KACvE,CAAC,CAAC;IAEH,MAAM,qCAAqC,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,mBAAwC,EAAW,EAAE,CACzH,mBAAmB,CAAC,QAAQ,KAAK,oBAAoB,CAAC,OAAO,CAAC,QAAQ,CACvE,CAAC;IACF,IAAI,qCAAqC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,2CAA2C,EACxD,QAAQ,SAAS,6DAA6D,YAAY,6BAA6B,eAAe,GAAG,CAC1I,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,eAA6B,EAC7B,OAAwB;IAExB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO;IACT,CAAC;IAED,kEAAkE;IAClE,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,CAAC;IAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1C,IAAI,QAAQ,KAAK,2BAA2B,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,sDAAsD,EACnE,0BAA0B,QAAQ,2BAA2B,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,eAA6B,EAC7B,OAAwB;IAExB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;IAEzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,6DAA6D;IAC7D,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,qCAAqC,EAClD,mDAAmD,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,KAAK;YACvG,mCAAmC,CACpC,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,CAAC;IAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,0CAA0C,EACvD,wFAAwF,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,eAA6B,EAC7B,OAAwB;IAExB,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,CAAC;IAC9D,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,oCAAoC,EACjD,4BAA4B,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,0CAA0C,CACtH,CAAC;AACJ,CAAC"}

package/dist/esm/src/core/protocol-authorization.js

@@ -1,34 +1,26 @@
 import { getRuleSetAtPath } from '../utils/protocols.js';
-import { SortDirection } from '../types/query-types.js';
 import { DwnError, DwnErrorCode } from './dwn-error.js';
-import { DwnInterfaceName, DwnMethodName } from '../enums/dwn-interface-method.js';
 import { ProtocolAction, ProtocolActor } from '../types/protocols-types.js';
 import { authorizeAgainstAllowedActions, verifyInvokedRole } from './protocol-authorization-action.js';
-import { constructRecordChain, fetchInitialWrite, getGoverningTimestamp } from './record-chain.js';
 import { verifyAsRoleRecordIfNeeded, verifyImmutability, verifyProtocolPathAndContextId, verifyRecordLimit, verifySizeLimit, verifySquashEligibility, verifyTagsIfNeeded, verifyTypeWithComposition, } from './protocol-authorization-validation.js';
 export class ProtocolAuthorization {
     /**
      * Performs validation on the structure of RecordsWrite messages that use a protocol.
      * @throws {Error} if validation fails.
      */
-    static async validateReferentialIntegrity(tenant, incomingMessage, messageStore, coreProtocols) {
-        // Determine the governing timestamp for protocol definition lookup.
-        // For an initial write, this is the message's own timestamp.
-        // For an update, this is the initial write's timestamp (the protocol version is locked at creation time).
-        const governingTimestamp = await getGoverningTimestamp(tenant, incomingMessage, messageStore);
-        // fetch the protocol definition that was active at the governing timestamp
-        const protocolDefinition = await ProtocolAuthorization.fetchProtocolDefinition(tenant, incomingMessage.message.descriptor.protocol, messageStore, governingTimestamp, coreProtocols);
-        // Create a bound fetch function that captures the registry for downstream callbacks.
-        const boundFetchDefinition = ProtocolAuthorization.createBoundFetchDefinition(coreProtocols);
+    static async validateReferentialIntegrity(tenant, incomingMessage, validationStateReader) {
+        const protocolDefinitionTimestamp = incomingMessage.message.descriptor.messageTimestamp;
+        // fetch the protocol definition active at the incoming message timestamp
+        const protocolDefinition = await validationStateReader.fetchProtocolDefinition(tenant, incomingMessage.message.descriptor.protocol, protocolDefinitionTimestamp);
         // verify declared protocol type exists in protocol and that it conforms to type specification.
         // For cross-protocol composition, the type may be defined in a referenced protocol.
-        await verifyTypeWithComposition(tenant, incomingMessage.message, protocolDefinition, messageStore, boundFetchDefinition, governingTimestamp);
+        await verifyTypeWithComposition(tenant, incomingMessage.message, protocolDefinition, validationStateReader, protocolDefinitionTimestamp);
         // validate `protocolPath`
-        await verifyProtocolPathAndContextId(tenant, incomingMessage, messageStore, boundFetchDefinition, governingTimestamp);
+        await verifyProtocolPathAndContextId(tenant, incomingMessage, validationStateReader, protocolDefinitionTimestamp);
         // get the rule set for the inbound message
         const ruleSet = ProtocolAuthorization.getRuleSet(incomingMessage.message.descriptor.protocolPath, protocolDefinition);
         // Validate as a role record if the incoming message is writing a role record
-        await verifyAsRoleRecordIfNeeded(tenant, incomingMessage, ruleSet, messageStore);
+        await verifyAsRoleRecordIfNeeded(tenant, incomingMessage, ruleSet, validationStateReader);
         // Verify size limit
         verifySizeLimit(incomingMessage, ruleSet);
         // Verify protocol tags
@@ -38,7 +30,8 @@ export class ProtocolAuthorization {
         // Verify squash eligibility — ensure squash writes are at $squash: true paths and are initial writes
         await verifySquashEligibility(incomingMessage, ruleSet);
         // Verify record count limit
-        await verifyRecordLimit(tenant, incomingMessage, ruleSet, messageStore);
+        await verifyRecordLimit(incomingMessage, ruleSet);
+        return ruleSet;
     }
     /**
      * Revalidates a stored initial write against the protocol definition that governed its creation timestamp.
@@ -47,161 +40,94 @@ export class ProtocolAuthorization {
      * structure and avoids live dependency checks. Missing grant, role, or parent records must not cause
      * an already-admitted record to be hard-purged.
      */
-    static async validateStoredInitialWrite(tenant, incomingMessage, messageStore, coreProtocols) {
+    static async validateStoredInitialWrite(tenant, incomingMessage, validationStateReader) {
         await ProtocolAuthorization.verifyStoredInitialWrite(incomingMessage);
-        const governingTimestamp = incomingMessage.message.descriptor.messageTimestamp;
-        const protocolDefinition = await ProtocolAuthorization.fetchProtocolDefinition(tenant, incomingMessage.message.descriptor.protocol, messageStore, governingTimestamp, coreProtocols);
-        const boundFetchDefinition = ProtocolAuthorization.createBoundFetchDefinition(coreProtocols);
-        await verifyTypeWithComposition(tenant, incomingMessage.message, protocolDefinition, messageStore, boundFetchDefinition, governingTimestamp);
+        const protocolDefinitionTimestamp = incomingMessage.message.descriptor.messageTimestamp;
+        const protocolDefinition = await validationStateReader.fetchProtocolDefinition(tenant, incomingMessage.message.descriptor.protocol, protocolDefinitionTimestamp);
+        await verifyTypeWithComposition(tenant, incomingMessage.message, protocolDefinition, validationStateReader, protocolDefinitionTimestamp);
         const ruleSet = ProtocolAuthorization.getRuleSet(incomingMessage.message.descriptor.protocolPath, protocolDefinition);
         ProtocolAuthorization.verifyStoredInitialWriteRoleRecipientIfNeeded(incomingMessage, ruleSet);
         verifySizeLimit(incomingMessage, ruleSet);
         verifyTagsIfNeeded(incomingMessage, ruleSet);
         await verifySquashEligibility(incomingMessage, ruleSet);
         ProtocolAuthorization.verifyStoredInitialWriteCreateAction(tenant, incomingMessage, ruleSet);
-        // `verifyRecordLimit()` is not replayed here. It is stateful and counts the present
-        // latest live set, which would incorrectly reject the record being revalidated.
-        // Inbound writes continue to enforce record limits at admission time.
+        // `verifyRecordLimit()` is intentionally not replayed here. It only checks strategy
+        // support for new record candidates; read-time occupancy projection decides visibility.
     }
     /**
      * Performs protocol-based authorization against the incoming RecordsWrite message.
      * @throws {Error} if authorization fails.
      */
-    static async authorizeWrite(tenant, incomingMessage, messageStore, coreProtocols) {
-        const existingInitialWrite = await fetchInitialWrite(tenant, incomingMessage.message.recordId, messageStore);
+    static async authorizeWrite(tenant, incomingMessage, validationStateReader) {
+        const existingInitialWrite = await validationStateReader.fetchInitialWrite(tenant, incomingMessage.message.recordId);
         let recordChain;
         if (existingInitialWrite === undefined) {
             // NOTE: we can assume this message is an initial write because an existing initial write does not exist.
             // Additionally, we check further down in the `RecordsWriteHandler` if the incoming message is an initialWrite,
             // so we don't check explicitly here to avoid an unnecessary duplicate check.
-            recordChain = await constructRecordChain(tenant, incomingMessage.message.descriptor.parentId, messageStore);
+            recordChain = await validationStateReader.constructRecordChain(tenant, incomingMessage.message.descriptor.parentId);
         }
         else {
-            recordChain = await constructRecordChain(tenant, incomingMessage.message.recordId, messageStore);
+            recordChain = await validationStateReader.constructRecordChain(tenant, incomingMessage.message.recordId);
         }
-        // Determine the governing timestamp for protocol definition lookup.
-        const governingTimestamp = await getGoverningTimestamp(tenant, incomingMessage, messageStore);
-        // fetch the protocol definition that was active at the governing timestamp
-        const protocolDefinition = await ProtocolAuthorization.fetchProtocolDefinition(tenant, incomingMessage.message.descriptor.protocol, messageStore, governingTimestamp, coreProtocols);
+        const protocolDefinitionTimestamp = incomingMessage.message.descriptor.messageTimestamp;
+        // fetch the protocol definition active at the incoming message timestamp
+        const protocolDefinition = await validationStateReader.fetchProtocolDefinition(tenant, incomingMessage.message.descriptor.protocol, protocolDefinitionTimestamp);
         // get the rule set for the inbound message
         const ruleSet = ProtocolAuthorization.getRuleSet(incomingMessage.message.descriptor.protocolPath, protocolDefinition);
-        const boundFetchDefinition = ProtocolAuthorization.createBoundFetchDefinition(coreProtocols);
         // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
-        await verifyInvokedRole(tenant, incomingMessage, incomingMessage.message.descriptor.protocol, incomingMessage.message.contextId, protocolDefinition, messageStore, boundFetchDefinition, governingTimestamp);
+        await verifyInvokedRole(tenant, incomingMessage, incomingMessage.message.descriptor.protocol, incomingMessage.message.contextId, protocolDefinition, validationStateReader, protocolDefinitionTimestamp);
         // verify method invoked against the allowed actions in the rule set
-        await authorizeAgainstAllowedActions(tenant, incomingMessage, ruleSet, recordChain, messageStore, protocolDefinition);
+        await authorizeAgainstAllowedActions(tenant, incomingMessage, ruleSet, recordChain, validationStateReader, protocolDefinition);
     }
     /**
      * Performs protocol-based authorization against the incoming `RecordsRead` message.
      * @param newestRecordsWrite The latest RecordsWrite associated with the recordId being read.
      * @throws {Error} if authorization fails.
      */
-    static async authorizeRead(tenant, incomingMessage, newestRecordsWrite, messageStore, coreProtocols) {
+    static async authorizeRead(tenant, incomingMessage, newestRecordsWrite, validationStateReader) {
         // fetch record chain
-        const recordChain = await constructRecordChain(tenant, newestRecordsWrite.message.recordId, messageStore);
-        // Use the initial write's timestamp to determine the governing protocol definition.
-        // The protocol version is locked at the time the record was first created.
-        const initialWrite = await fetchInitialWrite(tenant, newestRecordsWrite.message.recordId, messageStore);
-        const governingTimestamp = initialWrite === undefined
-            ? newestRecordsWrite.message.descriptor.messageTimestamp
-            : initialWrite.descriptor.messageTimestamp;
-        // fetch the protocol definition that was active when the record was created
-        const protocolDefinition = await ProtocolAuthorization.fetchProtocolDefinition(tenant, newestRecordsWrite.message.descriptor.protocol, messageStore, governingTimestamp, coreProtocols);
+        const recordChain = await validationStateReader.constructRecordChain(tenant, newestRecordsWrite.message.recordId);
+        const protocolDefinitionTimestamp = incomingMessage.message.descriptor.messageTimestamp;
+        // fetch the protocol definition active at the incoming message timestamp
+        const protocolDefinition = await validationStateReader.fetchProtocolDefinition(tenant, newestRecordsWrite.message.descriptor.protocol, protocolDefinitionTimestamp);
         // get the rule set for the inbound message
         const ruleSet = ProtocolAuthorization.getRuleSet(newestRecordsWrite.message.descriptor.protocolPath, protocolDefinition);
-        const boundFetchDefinition = ProtocolAuthorization.createBoundFetchDefinition(coreProtocols);
         // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
-        await verifyInvokedRole(tenant, incomingMessage, newestRecordsWrite.message.descriptor.protocol, newestRecordsWrite.message.contextId, protocolDefinition, messageStore, boundFetchDefinition, governingTimestamp);
+        await verifyInvokedRole(tenant, incomingMessage, newestRecordsWrite.message.descriptor.protocol, newestRecordsWrite.message.contextId, protocolDefinition, validationStateReader, protocolDefinitionTimestamp);
         // verify method invoked against the allowed actions in the rule set
-        await authorizeAgainstAllowedActions(tenant, incomingMessage, ruleSet, recordChain, messageStore, protocolDefinition);
+        await authorizeAgainstAllowedActions(tenant, incomingMessage, ruleSet, recordChain, validationStateReader, protocolDefinition);
     }
-    static async authorizeQueryOrSubscribe(tenant, incomingMessage, messageStore, coreProtocols) {
+    static async authorizeQueryOrSubscribe(tenant, incomingMessage, validationStateReader) {
         const { protocol, protocolPath, contextId } = incomingMessage.message.descriptor.filter;
         // fetch the protocol definition
-        const protocolDefinition = await ProtocolAuthorization.fetchProtocolDefinition(tenant, protocol, // `authorizeQueryOrSubscribe` is only called if `protocol` is present
-        messageStore, undefined, coreProtocols);
+        const protocolDefinition = await validationStateReader.fetchProtocolDefinition(tenant, protocol, // `authorizeQueryOrSubscribe` is only called if `protocol` is present
+        incomingMessage.message.descriptor.messageTimestamp);
         // get the rule set for the inbound message
         const ruleSet = ProtocolAuthorization.getRuleSet(protocolPath, // presence of `protocolPath` is verified in `parse()`
         protocolDefinition);
-        const boundFetchDefinition = ProtocolAuthorization.createBoundFetchDefinition(coreProtocols);
         // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
-        await verifyInvokedRole(tenant, incomingMessage, protocol, contextId, protocolDefinition, messageStore, boundFetchDefinition);
+        await verifyInvokedRole(tenant, incomingMessage, protocol, contextId, protocolDefinition, validationStateReader);
         // verify method invoked against the allowed actions in the rule set
         await authorizeAgainstAllowedActions(tenant, incomingMessage, ruleSet, [], // record chain is not relevant to queries or subscriptions
-        messageStore, protocolDefinition);
+        validationStateReader, protocolDefinition);
     }
     /**
      * Performs protocol-based authorization against the incoming `RecordsDelete` message.
      * @param recordsWrite A `RecordsWrite` of the record being deleted.
      */
-    static async authorizeDelete(tenant, incomingMessage, recordsWrite, messageStore, coreProtocols) {
+    static async authorizeDelete(tenant, incomingMessage, recordsWrite, validationStateReader) {
         // fetch record chain
-        const recordChain = await constructRecordChain(tenant, incomingMessage.message.descriptor.recordId, messageStore);
-        // Use the initial write's timestamp to determine the governing protocol definition.
-        const initialWrite = await fetchInitialWrite(tenant, incomingMessage.message.descriptor.recordId, messageStore);
-        const governingTimestamp = initialWrite === undefined
-            ? recordsWrite.message.descriptor.messageTimestamp
-            : initialWrite.descriptor.messageTimestamp;
-        // fetch the protocol definition that was active when the record was created
-        const protocolDefinition = await ProtocolAuthorization.fetchProtocolDefinition(tenant, recordsWrite.message.descriptor.protocol, messageStore, governingTimestamp, coreProtocols);
+        const recordChain = await validationStateReader.constructRecordChain(tenant, incomingMessage.message.descriptor.recordId);
+        const protocolDefinitionTimestamp = incomingMessage.message.descriptor.messageTimestamp;
+        // fetch the protocol definition active at the incoming message timestamp
+        const protocolDefinition = await validationStateReader.fetchProtocolDefinition(tenant, recordsWrite.message.descriptor.protocol, protocolDefinitionTimestamp);
         // get the rule set for the inbound message
         const ruleSet = ProtocolAuthorization.getRuleSet(recordsWrite.message.descriptor.protocolPath, protocolDefinition);
-        const boundFetchDefinition = ProtocolAuthorization.createBoundFetchDefinition(coreProtocols);
         // If the incoming message has `protocolRole` in the descriptor, validate the invoked role
-        await verifyInvokedRole(tenant, incomingMessage, recordsWrite.message.descriptor.protocol, recordsWrite.message.contextId, protocolDefinition, messageStore, boundFetchDefinition, governingTimestamp);
+        await verifyInvokedRole(tenant, incomingMessage, recordsWrite.message.descriptor.protocol, recordsWrite.message.contextId, protocolDefinition, validationStateReader, protocolDefinitionTimestamp);
         // verify method invoked against the allowed actions in the rule set
-        await authorizeAgainstAllowedActions(tenant, incomingMessage, ruleSet, recordChain, messageStore, protocolDefinition);
-    }
-    /**
-     * Fetches the protocol definition based on the protocol specified in the given message.
-     * When `messageTimestamp` is provided, returns the protocol definition that was active at that
-     * point in time — i.e. the ProtocolsConfigure with the greatest `messageTimestamp` that is <= the
-     * given timestamp. When not provided, returns the latest (current) protocol definition.
-     *
-     * When `coreProtocols` is provided, core protocol definitions are returned directly from the
-     * registry without a message store query. The extra parameter does not affect the
-     * `FetchProtocolDefinitionFn` callback type — callers that pass this function as a callback
-     * should bind the registry via a closure (see `createBoundFetchDefinition`).
-     */
-    static async fetchProtocolDefinition(tenant, protocolUri, messageStore, messageTimestamp, coreProtocols) {
-        // if the protocol is a registered core protocol, return the definition directly without a store query
-        if (coreProtocols !== undefined) {
-            const coreDefinition = coreProtocols.getDefinition(protocolUri);
-            if (coreDefinition !== undefined) {
-                return coreDefinition;
-            }
-        }
-        // fetch the corresponding protocol definition
-        const query = {
-            interface: DwnInterfaceName.Protocols,
-            method: DwnMethodName.Configure,
-            protocol: protocolUri,
-        };
-        if (messageTimestamp === undefined) {
-            // default: return only the latest protocol definition
-            query.isLatestBaseState = true;
-        }
-        else {
-            // temporal lookup: find the protocol definition active at the given timestamp
-            query.messageTimestamp = { lte: messageTimestamp };
-        }
-        const { messages: protocols } = await messageStore.query(tenant, [query], { messageTimestamp: SortDirection.Descending }, { limit: 1 });
-        if (protocols.length === 0) {
-            throw new DwnError(DwnErrorCode.ProtocolAuthorizationProtocolNotFound, `unable to find protocol definition for ${protocolUri}`);
-        }
-        const protocolMessage = protocols[0];
-        return protocolMessage.descriptor.definition;
-    }
-    /**
-     * Creates a `FetchProtocolDefinitionFn` closure that binds the given `CoreProtocolRegistry`.
-     * This allows core protocol definitions to be resolved from the registry without changing
-     * the `FetchProtocolDefinitionFn` type signature — zero ripple to downstream consumers
-     * like `protocol-authorization-action.ts` and `protocol-authorization-validation.ts`.
-     */
-    static createBoundFetchDefinition(coreProtocols) {
-        return (tenant, protocolUri, messageStore, messageTimestamp) => {
-            return ProtocolAuthorization.fetchProtocolDefinition(tenant, protocolUri, messageStore, messageTimestamp, coreProtocols);
-        };
+        await authorizeAgainstAllowedActions(tenant, incomingMessage, ruleSet, recordChain, validationStateReader, protocolDefinition);
     }
     /**
      * Gets the rule set corresponding to the given protocolPath.
@@ -256,7 +182,7 @@ export class ProtocolAuthorization {
                 return;
             }
         }
-        throw new DwnError(DwnErrorCode.ProtocolAuthorizationStoredInitialWriteActionNotAllowed, `stored RecordsWrite by author ${incomingMessage.author} is not allowed by the governing protocol config`);
+        throw new DwnError(DwnErrorCode.ProtocolAuthorizationStoredInitialWriteActionNotAllowed, `stored RecordsWrite by author ${incomingMessage.author} is not allowed by the resolved protocol config`);
     }
     static isStoredInitialWriteDirectlyAuthorized(tenant, incomingMessage) {
         return incomingMessage.owner !== undefined ||

package/dist/esm/src/core/protocol-authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"protocol-authorization.js","sourceRoot":"","sources":["../../../../src/core/protocol-authorization.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5E,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACnG,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,8BAA8B,EAC9B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAahD,MAAM,OAAO,qBAAqB;IAEhC;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAC9C,MAAc,EACd,eAA6B,EAC7B,YAA0B,EAC1B,aAAoC;QAEpC,oEAAoE;QACpE,6DAA6D;QAC7D,0GAA0G;QAC1G,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CACpD,MAAM,EAAE,eAAe,EAAE,YAAY,CACtC,CAAC;QAEF,2EAA2E;QAC3E,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAC3C,YAAY,EACZ,kBAAkB,EAClB,aAAa,CACd,CAAC;QAEF,qFAAqF;QACrF,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;QAE7F,+FAA+F;QAC/F,oFAAoF;QACpF,MAAM,yBAAyB,CAC7B,MAAM,EAAE,eAAe,CAAC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EACjE,oBAAoB,EAAE,kBAAkB,CACzC,CAAC;QAEF,0BAA0B;QAC1B,MAAM,8BAA8B,CAClC,MAAM,EAAE,eAAe,EAAE,YAAY,EACrC,oBAAoB,EAAE,kBAAkB,CACzC,CAAC;QAEF,2CAA2C;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,EAC/C,kBAAkB,CACnB,CAAC;QAEF,6EAA6E;QAC7E,MAAM,0BAA0B,CAC9B,MAAM,EACN,eAAe,EACf,OAAO,EACP,YAAY,CACb,CAAC;QAEF,oBAAoB;QACpB,eAAe,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE1C,uBAAuB;QACvB,kBAAkB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE7C,6DAA6D;QAC7D,MAAM,kBAAkB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAEnD,qGAAqG;QACrG,MAAM,uBAAuB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAExD,4BAA4B;QAC5B,MAAM,iBAAiB,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAC5C,MAAc,EACd,eAA6B,EAC7B,YAA0B,EAC1B,aAAoC;QAEpC,MAAM,qBAAqB,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC;QAEtE,MAAM,kBAAkB,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAC/E,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAC3C,YAAY,EACZ,kBAAkB,EAClB,aAAa,CACd,CAAC;QAEF,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;QAE7F,MAAM,yBAAyB,CAC7B,MAAM,EAAE,eAAe,CAAC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,CAC5G,CAAC;QAEF,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,EAC/C,kBAAkB,CACnB,CAAC;QAEF,qBAAqB,CAAC,6CAA6C,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC9F,eAAe,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC1C,kBAAkB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,uBAAuB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACxD,qBAAqB,CAAC,oCAAoC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAE7F,oFAAoF;QACpF,gFAAgF;QAChF,sEAAsE;IACxE,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,cAAc,CAChC,MAAc,EACd,eAA6B,EAC7B,YAA0B,EAC1B,aAAoC;QAEpC,MAAM,oBAAoB,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAE7G,IAAI,WAAW,CAAC;QAChB,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,yGAAyG;YACzG,+GAA+G;YAC/G,6EAA6E;YAC7E,WAAW,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC9G,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACnG,CAAC;QAED,oEAAoE;QACpE,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CACpD,MAAM,EAAE,eAAe,EAAE,YAAY,CACtC,CAAC;QAEF,2EAA2E;QAC3E,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAC3C,YAAY,EACZ,kBAAkB,EAClB,aAAa,CACd,CAAC;QAEF,2CAA2C;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,EAC/C,kBAAkB,CACnB,CAAC;QAEF,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;QAE7F,0FAA0F;QAC1F,MAAM,iBAAiB,CACrB,MAAM,EACN,eAAe,EACf,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAC3C,eAAe,CAAC,OAAO,CAAC,SAAS,EACjC,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,CACnB,CAAC;QAEF,oEAAoE;QACpE,MAAM,8BAA8B,CAClC,MAAM,EACN,eAAe,EACf,OAAO,EACP,WAAW,EACX,YAAY,EACZ,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,KAAK,CAAC,aAAa,CAC/B,MAAc,EACd,eAA4B,EAC5B,kBAAgC,EAChC,YAA0B,EAC1B,aAAoC;QAEpC,qBAAqB;QACrB,MAAM,WAAW,GACf,MAAM,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAExF,oFAAoF;QACpF,2EAA2E;QAC3E,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAC1C,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAC1D,CAAC;QACF,MAAM,kBAAkB,GAAG,YAAY,KAAK,SAAS;YACnD,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB;YACxD,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAE7C,4EAA4E;QAC5E,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAC9C,YAAY,EACZ,kBAAkB,EAClB,aAAa,CACd,CAAC;QAEF,2CAA2C;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,EAClD,kBAAkB,CACnB,CAAC;QAEF,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;QAE7F,0FAA0F;QAC1F,MAAM,iBAAiB,CACrB,MAAM,EACN,eAAe,EACf,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAC9C,kBAAkB,CAAC,OAAO,CAAC,SAAS,EACpC,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,CACnB,CAAC;QAEF,oEAAoE;QACpE,MAAM,8BAA8B,CAClC,MAAM,EACN,eAAe,EACf,OAAO,EACP,WAAW,EACX,YAAY,EACZ,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAC3C,MAAc,EACd,eAA+D,EAC/D,YAA0B,EAC1B,aAAoC;QAEpC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAExF,gCAAgC;QAChC,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,QAAS,EAAE,sEAAsE;QACjF,YAAY,EACZ,SAAS,EACT,aAAa,CACd,CAAC;QAEF,2CAA2C;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,YAAa,EAAE,sDAAsD;QACrE,kBAAkB,CACnB,CAAC;QAEF,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;QAE7F,0FAA0F;QAC1F,MAAM,iBAAiB,CACrB,MAAM,EACN,eAAe,EACf,QAAS,EACT,SAAS,EACT,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,CACrB,CAAC;QAEF,oEAAoE;QACpE,MAAM,8BAA8B,CAClC,MAAM,EACN,eAAe,EACf,OAAO,EACP,EAAE,EAAE,2DAA2D;QAC/D,YAAY,EACZ,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,eAAe,CACjC,MAAc,EACd,eAA8B,EAC9B,YAA0B,EAC1B,YAA0B,EAC1B,aAAoC;QAGpC,qBAAqB;QACrB,MAAM,WAAW,GACf,MAAM,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAEhG,oFAAoF;QACpF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAC1C,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,CAClE,CAAC;QACF,MAAM,kBAAkB,GAAG,YAAY,KAAK,SAAS;YACnD,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB;YAClD,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAE7C,4EAA4E;QAC5E,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EACxC,YAAY,EACZ,kBAAkB,EAClB,aAAa,CACd,CAAC;QAEF,2CAA2C;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,EAC5C,kBAAkB,CACnB,CAAC;QAEF,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;QAE7F,0FAA0F;QAC1F,MAAM,iBAAiB,CACrB,MAAM,EACN,eAAe,EACf,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EACxC,YAAY,CAAC,OAAO,CAAC,SAAS,EAC9B,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,CACnB,CAAC;QAEF,oEAAoE;QACpE,MAAM,8BAA8B,CAClC,MAAM,EACN,eAAe,EACf,OAAO,EACP,WAAW,EACX,YAAY,EACZ,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,MAAM,CAAC,KAAK,CAAC,uBAAuB,CACzC,MAAc,EACd,WAAmB,EACnB,YAA0B,EAC1B,gBAAyB,EACzB,aAAoC;QAEpC,sGAAsG;QACtG,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,cAAc,GAAG,aAAa,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YAChE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,cAAc,CAAC;YACxB,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,MAAM,KAAK,GAAW;YACpB,SAAS,EAAG,gBAAgB,CAAC,SAAS;YACtC,MAAM,EAAM,aAAa,CAAC,SAAS;YACnC,QAAQ,EAAI,WAAW;SACxB,CAAC;QAEF,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,sDAAsD;YACtD,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,8EAA8E;YAC9E,KAAK,CAAC,gBAAgB,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;QACrD,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,YAAY,CAAC,KAAK,CACtD,MAAM,EACN,CAAC,KAAK,CAAC,EACP,EAAE,gBAAgB,EAAE,aAAa,CAAC,UAAU,EAAE,EAC9C,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,qCAAqC,EAAE,0CAA0C,WAAW,EAAE,CAAC,CAAC;QAClI,CAAC;QAED,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,CAA8B,CAAC;QAClE,OAAO,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,0BAA0B,CAAC,aAAoC;QAC5E,OAAO,CACL,MAAc,EACd,WAAmB,EACnB,YAA0B,EAC1B,gBAAyB,EACI,EAAE;YAC/B,OAAO,qBAAqB,CAAC,uBAAuB,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAC3H,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,UAAU,CACvB,YAAoB,EACpB,kBAAsC;QAEtC,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,mCAAmC,EACjE,wCAAwC,YAAY,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,eAA6B;QACzE,IAAI,MAAM,eAAe,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,uDAAuD,EACpE,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,6CAA6C,CAC1D,eAA6B,EAC7B,OAAwB;QAExB,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,2DAA2D,EACxE,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,oCAAoC,CACjD,MAAc,EACd,eAA6B,EAC7B,OAAwB;QAExB,IAAI,qBAAqB,CAAC,sCAAsC,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,IAAI;YAChE,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;YAChD,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;QACrC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,0DAA0D,EACvE,mEAAmE,eAAe,CAAC,MAAM,EAAE,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,gBAAgB,EAAE,YAAY,CAAC;QACnE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAqB,EAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,aAA+B,CAAC,CAAC,EAAE,CAAC;gBAChH,SAAS;YACX,CAAC;YAED,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBACpC,OAAO;gBACT,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,UAAU,CAAC,GAAG,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,mFAAmF;YACnF,0FAA0F;YAC1F,IAAI,UAAU,CAAC,GAAG,KAAK,aAAa,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,KAAK,aAAa,CAAC,SAAS,EAAE,CAAC;gBAC1F,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,uDAAuD,EACpE,iCAAiC,eAAe,CAAC,MAAM,kDAAkD,CAC1G,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,sCAAsC,CAAC,MAAc,EAAE,eAA6B;QACjG,OAAO,eAAe,CAAC,KAAK,KAAK,SAAS;YACxC,eAAe,CAAC,MAAM,KAAK,MAAM;YACjC,eAAe,CAAC,wBAAwB;YACxC,eAAe,CAAC,uBAAuB;YACvC,eAAe,CAAC,gBAAgB,EAAE,iBAAiB,KAAK,SAAS,CAAC;IACtE,CAAC;CAEF"}
+{"version":3,"file":"protocol-authorization.js","sourceRoot":"","sources":["../../../../src/core/protocol-authorization.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5E,OAAO,EAAE,8BAA8B,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvG,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,8BAA8B,EAC9B,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAEhD,MAAM,OAAO,qBAAqB;IAEhC;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAC9C,MAAc,EACd,eAA6B,EAC7B,qBAA4C;QAE5C,MAAM,2BAA2B,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAExF,yEAAyE;QACzE,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAC3C,2BAA2B,CAC5B,CAAC;QAEF,+FAA+F;QAC/F,oFAAoF;QACpF,MAAM,yBAAyB,CAC7B,MAAM,EAAE,eAAe,CAAC,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,2BAA2B,CACxG,CAAC;QAEF,0BAA0B;QAC1B,MAAM,8BAA8B,CAClC,MAAM,EAAE,eAAe,EAAE,qBAAqB,EAAE,2BAA2B,CAC5E,CAAC;QAEF,2CAA2C;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,EAC/C,kBAAkB,CACnB,CAAC;QAEF,6EAA6E;QAC7E,MAAM,0BAA0B,CAC9B,MAAM,EACN,eAAe,EACf,OAAO,EACP,qBAAqB,CACtB,CAAC;QAEF,oBAAoB;QACpB,eAAe,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE1C,uBAAuB;QACvB,kBAAkB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAE7C,6DAA6D;QAC7D,MAAM,kBAAkB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAEnD,qGAAqG;QACrG,MAAM,uBAAuB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAExD,4BAA4B;QAC5B,MAAM,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAElD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAC5C,MAAc,EACd,eAA6B,EAC7B,qBAA4C;QAE5C,MAAM,qBAAqB,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC;QAEtE,MAAM,2BAA2B,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACxF,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAC3C,2BAA2B,CAC5B,CAAC;QAEF,MAAM,yBAAyB,CAC7B,MAAM,EAAE,eAAe,CAAC,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,2BAA2B,CACxG,CAAC;QAEF,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,EAC/C,kBAAkB,CACnB,CAAC;QAEF,qBAAqB,CAAC,6CAA6C,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC9F,eAAe,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC1C,kBAAkB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,uBAAuB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACxD,qBAAqB,CAAC,oCAAoC,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAE7F,oFAAoF;QACpF,wFAAwF;IAC1F,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,cAAc,CAChC,MAAc,EACd,eAA6B,EAC7B,qBAA4C;QAE5C,MAAM,oBAAoB,GAAG,MAAM,qBAAqB,CAAC,iBAAiB,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAErH,IAAI,WAAW,CAAC;QAChB,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,yGAAyG;YACzG,+GAA+G;YAC/G,6EAA6E;YAC7E,WAAW,GAAG,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACtH,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3G,CAAC;QAED,MAAM,2BAA2B,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAExF,yEAAyE;QACzE,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAC3C,2BAA2B,CAC5B,CAAC;QAEF,2CAA2C;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,EAC/C,kBAAkB,CACnB,CAAC;QAEF,0FAA0F;QAC1F,MAAM,iBAAiB,CACrB,MAAM,EACN,eAAe,EACf,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAC3C,eAAe,CAAC,OAAO,CAAC,SAAS,EACjC,kBAAkB,EAClB,qBAAqB,EACrB,2BAA2B,CAC5B,CAAC;QAEF,oEAAoE;QACpE,MAAM,8BAA8B,CAClC,MAAM,EACN,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,KAAK,CAAC,aAAa,CAC/B,MAAc,EACd,eAA4B,EAC5B,kBAAgC,EAChC,qBAA4C;QAE5C,qBAAqB;QACrB,MAAM,WAAW,GACf,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEhG,MAAM,2BAA2B,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAExF,yEAAyE;QACzE,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAC9C,2BAA2B,CAC5B,CAAC;QAEF,2CAA2C;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,EAClD,kBAAkB,CACnB,CAAC;QAEF,0FAA0F;QAC1F,MAAM,iBAAiB,CACrB,MAAM,EACN,eAAe,EACf,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAC9C,kBAAkB,CAAC,OAAO,CAAC,SAAS,EACpC,kBAAkB,EAClB,qBAAqB,EACrB,2BAA2B,CAC5B,CAAC;QAEF,oEAAoE;QACpE,MAAM,8BAA8B,CAClC,MAAM,EACN,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAC3C,MAAc,EACd,eAA+D,EAC/D,qBAA4C;QAE5C,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAExF,gCAAgC;QAChC,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,QAAS,EAAE,sEAAsE;QACjF,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CACpD,CAAC;QAEF,2CAA2C;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,YAAa,EAAE,sDAAsD;QACrE,kBAAkB,CACnB,CAAC;QAEF,0FAA0F;QAC1F,MAAM,iBAAiB,CACrB,MAAM,EACN,eAAe,EACf,QAAS,EACT,SAAS,EACT,kBAAkB,EAClB,qBAAqB,CACtB,CAAC;QAEF,oEAAoE;QACpE,MAAM,8BAA8B,CAClC,MAAM,EACN,eAAe,EACf,OAAO,EACP,EAAE,EAAE,2DAA2D;QAC/D,qBAAqB,EACrB,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,eAAe,CACjC,MAAc,EACd,eAA8B,EAC9B,YAA0B,EAC1B,qBAA4C;QAG5C,qBAAqB;QACrB,MAAM,WAAW,GACf,MAAM,qBAAqB,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAExG,MAAM,2BAA2B,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAExF,yEAAyE;QACzE,MAAM,kBAAkB,GAAG,MAAM,qBAAqB,CAAC,uBAAuB,CAC5E,MAAM,EACN,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EACxC,2BAA2B,CAC5B,CAAC;QAEF,2CAA2C;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAC9C,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,EAC5C,kBAAkB,CACnB,CAAC;QAEF,0FAA0F;QAC1F,MAAM,iBAAiB,CACrB,MAAM,EACN,eAAe,EACf,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EACxC,YAAY,CAAC,OAAO,CAAC,SAAS,EAC9B,kBAAkB,EAClB,qBAAqB,EACrB,2BAA2B,CAC5B,CAAC;QAEF,oEAAoE;QACpE,MAAM,8BAA8B,CAClC,MAAM,EACN,eAAe,EACf,OAAO,EACP,WAAW,EACX,qBAAqB,EACrB,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,UAAU,CACvB,YAAoB,EACpB,kBAAsC;QAEtC,MAAM,OAAO,GAAG,gBAAgB,CAAC,YAAY,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,mCAAmC,EACjE,wCAAwC,YAAY,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,eAA6B;QACzE,IAAI,MAAM,eAAe,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,uDAAuD,EACpE,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,6CAA6C,CAC1D,eAA6B,EAC7B,OAAwB;QAExB,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,2DAA2D,EACxE,oCAAoC,CACrC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,oCAAoC,CACjD,MAAc,EACd,eAA6B,EAC7B,OAAwB;QAExB,IAAI,qBAAqB,CAAC,sCAAsC,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,IAAI;YAChE,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;YAChD,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;QACrC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,0DAA0D,EACvE,mEAAmE,eAAe,CAAC,MAAM,EAAE,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,gBAAgB,EAAE,YAAY,CAAC;QACnE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAqB,EAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,aAA+B,CAAC,CAAC,EAAE,CAAC;gBAChH,SAAS;YACX,CAAC;YAED,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,IAAI,UAAU,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBACpC,OAAO;gBACT,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,UAAU,CAAC,GAAG,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,mFAAmF;YACnF,0FAA0F;YAC1F,IAAI,UAAU,CAAC,GAAG,KAAK,aAAa,CAAC,MAAM,IAAI,UAAU,CAAC,GAAG,KAAK,aAAa,CAAC,SAAS,EAAE,CAAC;gBAC1F,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,IAAI,QAAQ,CAChB,YAAY,CAAC,uDAAuD,EACpE,iCAAiC,eAAe,CAAC,MAAM,iDAAiD,CACzG,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,sCAAsC,CAAC,MAAc,EAAE,eAA6B;QACjG,OAAO,eAAe,CAAC,KAAK,KAAK,SAAS;YACxC,eAAe,CAAC,MAAM,KAAK,MAAM;YACjC,eAAe,CAAC,wBAAwB;YACxC,eAAe,CAAC,uBAAuB;YACvC,eAAe,CAAC,gBAAgB,EAAE,iBAAiB,KAAK,SAAS,CAAC;IACtE,CAAC;CAEF"}

package/dist/esm/src/core/protocols-grant-authorization.js

@@ -5,28 +5,28 @@ export class ProtocolsGrantAuthorization {
      * Authorizes the given ProtocolsConfigure in the scope of the DID given.
      */
     static async authorizeConfigure(input) {
-        const { protocolsConfigureMessage, expectedGrantor, expectedGrantee, permissionGrant, messageStore } = input;
+        const { protocolsConfigureMessage, expectedGrantor, expectedGrantee, permissionGrant, validationStateReader } = input;
         await GrantAuthorization.performBaseValidation({
             incomingMessage: protocolsConfigureMessage,
             expectedGrantor,
             expectedGrantee,
             permissionGrant,
-            messageStore
+            validationStateReader
         });
         ProtocolsGrantAuthorization.verifyScope(protocolsConfigureMessage, permissionGrant.scope);
     }
     /**
      * Authorizes the scope of a permission grant for a ProtocolsQuery message.
-     * @param messageStore Used to check if the grant has been revoked.
+     * @param validationStateReader Used to check if the grant has been revoked.
      */
     static async authorizeQuery(input) {
-        const { expectedGrantee, expectedGrantor, incomingMessage, permissionGrant, messageStore } = input;
+        const { expectedGrantee, expectedGrantor, incomingMessage, permissionGrant, validationStateReader } = input;
         await GrantAuthorization.performBaseValidation({
             incomingMessage: incomingMessage,
             expectedGrantor,
             expectedGrantee,
             permissionGrant,
-            messageStore
+            validationStateReader
         });
         // If the grant specifies a protocol, the query must specify the same protocol.
         const permissionScope = permissionGrant.scope;