@interop/was-client 0.100.0 → 0.101.0

package/README.md

@@ -48,16 +48,16 @@ through cheap, lazy navigational handles modeled on a document store's DX
 (`add`/`get`/`put`/`list`/`delete`) rather than `insertOne`/`findOne` (PWS has
 no query-by-filter yet).
 
-| Document db driver                  | PWS client                                  |
-| ----------------------------------- | ------------------------------------------- |
-| `new Client(url)`                   | `new WasClient({ serviceUrl, zcapClient })` |
-| `client.db('app')`                  | `was.spaceAt(spaceUrl)`                     |
-| `db.collection('users')`            | `space.collection(collectionId)`            |
-| `collection.insertOne(doc)`         | `collection.add(doc)`                       |
-| `collection.findOne({ _id })`       | `collection.get(resourceId)`                |
-| `collection.replaceOne({ _id }, d)` | `collection.put(resourceId, data)`          |
-| `collection.find().toArray()`       | `collection.list()`                         |
-| `collection.deleteOne({ _id })`     | `collection.resource(resourceId).delete()`  |
+| Document db driver                  | PWS client                                     |
+| ----------------------------------- | ---------------------------------------------- |
+| `new Client(url)`                   | `new WasClient({ baseServerUrl, zcapClient })` |
+| `client.db('app')`                  | `was.spaceAt(spaceUrl)`                        |
+| `db.collection('users')`            | `space.collection(collectionId)`               |
+| `collection.insertOne(doc)`         | `collection.add(doc)`                          |
+| `collection.findOne({ _id })`       | `collection.get(resourceId)`                   |
+| `collection.replaceOne({ _id }, d)` | `collection.put(resourceId, data)`             |
+| `collection.find().toArray()`       | `collection.list()`                            |
+| `collection.deleteOne({ _id })`     | `collection.resource(resourceId).delete()`     |
 
 See also:
 
@@ -110,7 +110,7 @@ const zcapClient = new ZcapClient({
 
 // 3. Wrap it.
 const was = new WasClient({
-  serviceUrl: 'https://was.example/service',
+  baseServerUrl: 'https://was.example/',
   zcapClient
 })
 ```
@@ -130,7 +130,7 @@ keyPair.controller = `did:key:${keyPair.fingerprint()}`
 keyPair.id = `${keyPair.controller}#${keyPair.fingerprint()}`
 
 const was = WasClient.fromSigner({
-  serviceUrl: 'https://was.example/service',
+  baseServerUrl: 'https://was.example/',
   signer: keyPair.signer()
 })
 ```
@@ -139,20 +139,56 @@ The `seed` is where a passphrase-, stored-secret-, or KMS-derived key plugs in:
 deriving the same 32-byte seed yields the same DID, and therefore access to the
 same spaces.
 
-A client is built from exactly one of two URLs. `serviceUrl` is the URL of the
-server's service description, read with an unsigned `GET`. `spacesUrl` is the
-Spaces Repository URL (`https://host/spaces/`), which the client probes with an
-unsigned `HEAD` for the `Link: <...>; rel="service"` header. Giving both or
-neither, or a URL that is not absolute `http(s)`, is refused with
-`ValidationError`. The one given is exposed as `was.serviceUrl` or
-`was.spacesUrl` (the latter with its trailing slash supplied), and the other is
-`undefined`.
-
-A Space URL is received. It is not assembled from a server root. It arrives as
-the `Location` of a create response, a listing item's `url`, a linkset entry, a
-stored pointer, or a self-locating DID. The client holds no base URL, and no
-function in the `./paths` entry takes one. `was.spaceAt(spaceUrl)` opens a
-handle on a Space URL you hold.
+A client is built from the server's base server URL. The spec's Server Layout
+places the server-level endpoints under it: `{base}service` is the service
+description, `{base}spaces/` is the Spaces Repository, and
+`{base}space/{space_id}/` is a Space. The base must be an absolute `http(s)` URL
+with no query or fragment. A missing trailing slash is supplied. Anything else
+is refused with `ValidationError`. The result is exposed as `was.baseServerUrl`.
+
+`was.space(spaceId)` opens a handle on `{base}space/{spaceId}/`, with no I/O.
+`was.spaceAt(spaceUrl)` opens a handle on a Space URL you hold, such as the
+`Location` of a create response, a listing item's `url`, a linkset entry, a
+stored pointer, a capability's target, or a self-locating DID. A received Space
+URL is used as given. It is never checked against the base, because a grant or a
+DID may name a Space on another server.
+
+The `./paths` entry exports the matching builders: `canonicalBaseServerUrl`,
+`serviceDescriptionUrl({ baseServerUrl })`,
+`spacesRepositoryUrl({ baseServerUrl })` and
+`spaceUrlById({ baseServerUrl, spaceId })`. `baseServerUrlOf(url)` is their
+inverse. It accepts the service, Spaces Repository or Space URL and rejects
+anything else. `splitCollectionUrl(url)` splits a Collection URL into its Space
+URL and id.
+
+#### Single fixed Space
+
+Some servers are one Space with no id and no base server URL, such as a personal
+site whose Collections are `https://alice.example/posts/` and
+`https://alice.example/images/`. Open one with `WasClient.forSpace()` and reach
+a Collection directly with `collectionAt()`:
+
+```ts
+const was = WasClient.forSpace({
+  spaceUrl: 'https://alice.example/',
+  signer: keyPair.didKeySigner()
+})
+
+const posts = was.collectionAt('https://alice.example/posts/')
+const post = await posts.get('hello')
+```
+
+`forSpace` takes
+`{ spaceUrl, zcapClient | signer, encryption?, serviceDescription? }`. The
+client exposes `was.spaceUrl`, and `was.baseServerUrl` is `undefined`. It finds
+the service description with an unsigned `HEAD` of the Space URL and the
+`Link: <...>; rel="service"` header. `space(id)`, `createSpace()` and
+`listSpaces()` throw `NotSupportedError`.
+
+`collectionAt(collectionUrl)` works on any client. The parent of the URL is the
+Space URL and the last segment is the Collection id. A Space URL may be an
+origin root, in which case `Space.id` is `undefined`. At an origin-root Space
+the Collection ids `service`, `spaces` and `space` are reserved.
 
 #### Deriving a client from a secret or seed (`./identity`)
 
@@ -167,7 +203,7 @@ import { WasClient } from '@interop/was-client'
 const agents = await agentsFromSecret({ secret: 'the account secret' })
 
 const was = WasClient.fromSigner({
-  serviceUrl: 'https://was.example/service',
+  baseServerUrl: 'https://was.example/',
   signer: agents.keyAgent.getSigner()
 })
 ```
@@ -208,17 +244,19 @@ own pace produces.
 ### Service discovery
 
 Before its first signed request, the client reads the server's service
-description. A client built from `serviceUrl` reads that document with an
-unsigned `GET`. A client built from `spacesUrl` first sends an unsigned `HEAD`
-to it and follows the `Link: <...>; rel="service"` header on the response,
-whatever its status, then reads the linked document with an unsigned `GET`. The
-PWS server itself answers the Spaces Repository URL. The server root is often a
-landing page served by something else, with no `service` link. The spec fixes no
-path for the document, so the client assumes none.
-
-The client does not compare the document's `spaces` member against any URL it
-was given. `createSpace()` and `listSpaces()` address the `spaces` URL the
-document names.
+description. A client built from `baseServerUrl` reads `{base}service` with an
+unsigned `GET`. A client built by `forSpace` first sends an unsigned `HEAD` to
+the Space URL and follows the `Link: <...>; rel="service"` header on the
+response, whatever its status, then reads the linked document with an unsigned
+`GET`. The spec fixes no path for the document on a fixed-Space server, so that
+client assumes none.
+
+A client with a base checks that the document describes that base. Its `url`
+must equal `{base}service`, and its `spaces` member, when present, must equal
+`{base}spaces/`. Otherwise every signed request rejects with
+`IncompatibleServerError` naming both values. The check also applies to a
+caller-supplied `serviceDescription`. A client built by `forSpace` has no base
+and is not checked. `createSpace()` and `listSpaces()` address `{base}spaces/`.
 
 From the document the client selects the PWS specification version it speaks.
 This client speaks only v0.5. It ignores `specs` keys other than
@@ -294,13 +332,12 @@ server requires a `name`; `controller` defaults to the client's own DID, and the
 server generates the id unless you pass one. `createSpace()` reads the
 `Location` header of the response and returns a handle on that Space URL. A
 response without `Location` throws `WasServerError`. `createSpace()` and
-`listSpaces()` address the Spaces Repository URL the service description names
-(see [Service discovery](#service-discovery)). Against a server whose
-description has no `spaces` URL, they throw `NotSupportedError` without sending
-anything.
+`listSpaces()` address the Spaces Repository, `{base}spaces/` (see
+[Service discovery](#service-discovery)). Against a server whose description has
+no `spaces` URL, they throw `NotSupportedError` without sending anything.
 
 ```ts
-const space = await was.createSpace({ name: 'Home' }) // POST {spacesUrl}
+const space = await was.createSpace({ name: 'Home' }) // POST {base}spaces/
 // A typed Space, e.g. an auxiliary one; `type` defaults to ['Space'].
 const aux = await was.createSpace({
   name: 'Clients',
@@ -309,6 +346,7 @@ const aux = await was.createSpace({
 
 // Lazy handle to an existing space by its URL -- no I/O until a verb runs.
 const same = was.spaceAt(space.url)
+const byId = was.space('abc') // {base}space/abc/, no I/O
 
 // Read the Space Metadata object (null if missing or not visible to you).
 const desc = await space.describe() // { id, type: ['Space'], name, controller } | null
@@ -953,18 +991,40 @@ const listing = await space.replicas() // { url, totalItems, items } | null
 const one = await space.replica('peer-1') // ReplicaRegistration | null
 
 const status = await space.replicaStatus('peer-1') // ReplicaStatus | null
-// status.state: 'idle' | 'pulling' | 'backing-off' | 'stalled'
+// status.state: 'idle' | 'pulling' | 'paused' | 'backing-off' | 'stalled'
 for (const entry of status?.collections ?? []) {
   if (entry.state === 'stalled') {
     // entry.stall: { reason, since, detail? }
   }
 }
 
+// Stop and restart the pull loop. The registration keeps its id and its
+// checkpoint, and the data already pulled stays.
+await space.pauseReplica('peer-1') // status.state reads 'paused'
+await space.resumeReplica('peer-1')
+
+// Swap the pull capability in place, before the signer that delegated the
+// old one is withdrawn. Same id, same checkpoint.
+await space.replaceReplicaCapability('peer-1', renewedCapability)
+
 // The data already pulled under the registration stays. 'not-found' is the
-// server's masked 404: absent, or the caller is not the controller.
+// server's masked 404: absent, or the caller holds no authority on the route.
 const { outcome } = await space.deregisterReplica('peer-1') // 'deleted' | 'not-found'
 ```
 
+`pauseReplica()`, `resumeReplica()` and `replaceReplicaCapability()` are each
+one `PUT` of the registration at its URL, run as a compare-and-swap: the client
+reads the stored record with its `ETag`, writes it back under `If-Match`, and
+re-reads and re-applies the change on a 412, so a write that lands in between is
+rebased on rather than clobbered. `PreconditionFailedError` (412) surfaces only
+after the attempt limit. A pause sets `pausedAt`, which the server fills with
+its own time and keeps while the registration stays paused, and a resume omits
+it. Only `capability` and `pausedAt` may change on a stored registration. All
+three throw `NotFoundError` on the masked 404, since a `PUT` at an absent
+registration would register a new replica. A replacement capability is checked
+against the peer the way `registerReplica()` checks one, so it can throw the
+same `ConflictError` (`replica-refused`) and `ValidationError`.
+
 `replicaStatus()` reports the pull loop's runtime state. The response is
 uncacheable and is not part of the registration record. Each Collection entry
 has its own `state` (`synced`, `syncing`, `stalled`, or `skipped`). A stalled
@@ -980,13 +1040,23 @@ Collections continue. Its `stall.reason` is one of:
   registration for.
 - `container-refused` -- the local Space or Collection refused the write.
 
-Every replica method is controller-only on the server, the reads included, since
-a registration holds the pull capability. A delegated capability gets the
-masked 404. `replicas()`, `replica()`, and `replicaStatus()` then return `null`,
-and `registerReplica()` throws `NotFoundError`. `deregisterReplica()` reports it
-as `{ outcome: 'not-found' }` rather than swallowing it, so a delegated caller
-can tell that nothing was removed. The three reads reserve `null` for that 404.
-A 2xx with no JSON body is a server fault and throws `WasServerError`.
+Every replica method takes the controller's capability or a delegated one whose
+chain roots in the Space's root capability, for `GET`, `POST`, `PUT` and
+`DELETE` alike. A delegated `POST` may only name a `fromSpace` the Space already
+has a registration for. Any other caller gets the masked 404, as does every
+delegated caller on a server that still treats the route as controller-only.
+`replicas()`, `replica()`, and `replicaStatus()` then return `null`, and
+`registerReplica()` throws `NotFoundError`. `deregisterReplica()` reports it as
+`{ outcome: 'not-found' }` rather than swallowing it, so such a caller can tell
+that nothing was removed. The three reads reserve `null` for that 404. A 2xx
+with no JSON body is a server fault and throws `WasServerError`.
+
+A grant on the route targets `{spaceUrl}replicas`, the bare URL with no trailing
+slash. `spaceReplicasUrl({ spaceUrl })` on the `./paths` entry forms it, and
+`replicaRegistrationUrl({ spaceUrl, replicaId })` forms one registration beneath
+it. `fromCapability` refuses that target as a reserved sub-resource, so the
+holder opens the Space handle with `was.space(id, { capability })` (or
+`was.spaceAt(url, { capability })`) and calls the replica methods on it.
 
 `registerReplica()` throws `ValidationError` (400 `invalid-request-body`) for a
 malformed body. Each entry of the error's `problems` carries a `pointer` naming
@@ -1063,7 +1133,7 @@ const encryption = createEdvEncryption({
     return { keyAgreementKey, keyResolver }
   }
 })
-const was = WasClient.fromSigner({ serviceUrl, signer, encryption })
+const was = WasClient.fromSigner({ baseServerUrl, signer, encryption })
 
 // Declare the collection encrypted (writes the descriptor). The returned handle is
 // pre-seeded, so the first write encrypts with no extra round-trip.

package/dist/Collection.d.ts

@@ -10,10 +10,6 @@ export declare class Collection {
      * The URL of the Space this Collection lives in, in canonical form.
      */
     readonly spaceUrl: string;
-    /**
-     * The id of that Space: the last path segment of {@link spaceUrl}.
-     */
-    readonly spaceId: string;
     readonly id: string;
     /**
      * The Collection container in canonical (trailing-slash) form: the URL whose
@@ -194,6 +190,10 @@ export declare class Collection {
      * Deletes the whole collection. Idempotent. To delete a single resource, use
      * `collection.resource(id).delete()`.
      *
+     * Drops the memoized codec as well: a collection re-created at this URL
+     * under another encryption scheme must not be written through the codec
+     * the deleted one resolved (see `CodecHolder.reset`).
+     *
      * @returns {Promise<void>}
      */
     delete(): Promise<void>;
@@ -385,6 +385,10 @@ export declare class Collection {
      * attribute was declared carry no token for it, so they do not match a search
      * on it until they are rewritten.
      *
+     * The result is a copy: mutating it (a compound entry's `attribute` array
+     * included) does not touch the schema installed on this handle's codec.
+     * Declare through {@link declareIndex}.
+     *
      * @returns {Promise<IndexDeclaration[]>}
      */
     indexes(): Promise<IndexDeclaration[]>;
@@ -414,7 +418,8 @@ export declare class Collection {
      *   for a compound index
      * @param [options.unique] {boolean}   reject a second document that carries
      *   the same value (the server answers a colliding write with `409`)
-     * @returns {Promise<IndexSchema>}   the schema now in force
+     * @returns {Promise<IndexSchema>}   the schema now in force, as a copy (see
+     *   {@link indexes})
      */
     declareIndex({ attribute, unique }: {
         attribute: string | string[];
@@ -437,7 +442,8 @@ export declare class Collection {
      * @param options {object}
      * @param options.indexes {Array<{ attribute: string | string[]; unique?: boolean }>}
      *   the attributes to declare, in `declareIndex`'s own terms
-     * @returns {Promise<IndexSchema>}   the schema now in force
+     * @returns {Promise<IndexSchema>}   the schema now in force, as a copy (see
+     *   {@link indexes})
      */
     declareIndexes({ indexes }: {
         indexes: Array<{
@@ -676,20 +682,25 @@ export declare class Collection {
      * checkpoint); a short page is not the end (see `changes()`). Checkpoints
      * are opaque strings compared by equality only. A server that hands back a
      * checkpoint this walk already resumed from (the starting one included)
-     * fails the walk with a `WasServerError` rather than looping. Every fault
-     * `changes()` rejects on fails the walk the same way.
+     * fails the walk with a `WasServerError` rather than looping, as does one
+     * that keeps advancing the checkpoint without ending the feed within
+     * `maxPages` pages. Every fault `changes()` rejects on fails the walk the
+     * same way.
      *
      * @param [options] {object}
      * @param [options.checkpoint] {ChangesCheckpoint}   resume strictly after it
      * @param [options.limit] {number}   max entries per request, every kind counted
      * @param [options.method] {'POST' | 'GET'}   the request form of each page,
      *   as for {@link changes}
+     * @param [options.maxPages] {number}   the most pages one walk reads before
+     *   it fails (default 10,000, the same bound as a listing walk)
      * @returns {AsyncGenerator<{ documents: ResourceChangeDocument[], checkpoint: ChangesCheckpoint | null }>}
      */
     resourceChanges(options?: {
         checkpoint?: ChangesCheckpoint;
         limit?: number;
         method?: 'POST' | 'GET';
+        maxPages?: number;
     }): AsyncGenerator<{
         documents: ResourceChangeDocument[];
         checkpoint: ChangesCheckpoint | null;
@@ -721,7 +732,8 @@ export declare class Collection {
      * `changes()` rejects on (a bodiless 2xx, a live JSON entry with no `data`,
      * or a `501` from a server that does not advertise the `changes-query`
      * feature) fail the walk with the same `WasServerError`, as does a server
-     * that repeats a checkpoint instead of advancing.
+     * that repeats a checkpoint instead of advancing, or one that keeps advancing
+     * it without ever ending the feed (the page bound of `resourceChanges()`).
      *
      * @param [options] {object}
      * @param [options.limit] {number}   max documents per request (default 1000, the teaching server's maximum); the server reduces it to its own maximum

package/dist/Collection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Collection.d.ts","sourceRoot":"","sources":["../src/Collection.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAgC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AA+BlE,OAAO,KAAK,EAEV,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,WAAW,EAEZ,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,KAAK,EACV,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EACV,SAAS,EACT,iBAAiB,EACjB,YAAY,EAEZ,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,cAAc,EACd,uBAAuB,EAEvB,2BAA2B,EAC3B,eAAe,EAChB,MAAM,YAAY,CAAA;AA8FnB,qBAAa,UAAU;;IACrB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IAYpB;;;;;;;;;;OAUG;gBACS,EACV,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,UAAU,EACX,EAAE;QACD,OAAO,EAAE,aAAa,CAAA;QACtB,QAAQ,EAAE,MAAM,CAAA;QAChB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,KAAK,CAAA;QAClB,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC;IAqDD;;;;;;;;;OASG;IACH,YAAY,IAAI,mBAAmB;IAuBnC;;;;;;;;;;;;OAYG;IACG,QAAQ,IAAI,OAAO,CAAC,CAAC,kBAAkB,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAW1E;;;;;;;;;;OAUG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAChC,WAAW,EAAE,kBAAkB,CAAA;QAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,IAAI,CAAC;IAsPT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwDG;IACG,SAAS,CACb,IAAI,EAAE,wBAAwB,GAAG;QAC/B,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,OAAO,CAAC,EAAE,CAAC,kBAAkB,GAAG;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,GAAG,IAAI,CAAA;QACzD,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,GACA,OAAO,CAAC;QAAE,WAAW,EAAE,kBAAkB,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA6F9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACG,kBAAkB,CACtB,WAAW,EAAE,wBAAwB,EACrC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC;QAAE,WAAW,EAAE,kBAAkB,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqI9D;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAS7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,IAAI,IAAI,OAAO,CAAC,CAAC,kBAAkB,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IA2BtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuDG;IACG,OAAO,CACX,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,2BAA2B,CAAA;KAAO,EACnD,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA8D7B;;;;;;;;;;;;;;;;;OAiBG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1C;;;;;;;OAOG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAE9B;;;;;;;;;;;;;;;;;OAiBG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAqBtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,aAAa,CACjB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA8E7B;;;;;;;;;;;;;OAaG;IACG,OAAO,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAK5C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,YAAY,CAAC,EACjB,SAAS,EACT,MAAM,EACP,EAAE;QACD,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QAC5B,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,GAAG,OAAO,CAAC,WAAW,CAAC;IAIxB;;;;;;;;;;;;;;;;;;OAkBG;IACG,cAAc,CAAC,EACnB,OAAO,EACR,EAAE;QACD,OAAO,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KACnE,GAAG,OAAO,CAAC,WAAW,CAAC;IA8CxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,IAAI,CAAC,OAAO,EAAE;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QACjE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QACvB,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC,QAAQ,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAiEzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,QAAQ;IAkBnE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,GAAG,CACP,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC;IA8DrB;;;;;;;OAOG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAM1D;;;;;;;;;OASG;IACG,SAAS,CACb,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAItD;;;;;;;;;;;;;;OAcG;IACG,GAAG,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACjB,GACL,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAkB7B;;;;;;;;;OASG;IACG,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAIrD;;;;;;;;;OASG;IACI,SAAS,IAAI,cAAc,CAAC,uBAAuB,CAAC;IAI3D;;;;;;;OAOG;IACI,SAAS,IAAI,cAAc,CAAC,eAAe,CAAC;IAInD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4DG;IACG,OAAO,CACX,OAAO,GAAE;QACP,UAAU,CAAC,EAAE,iBAAiB,CAAA;QAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;KACnB,GACL,OAAO,CAAC,WAAW,CAAC;IAqEvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACI,eAAe,CACpB,OAAO,GAAE;QACP,UAAU,CAAC,EAAE,iBAAiB,CAAA;QAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;KACnB,GACL,cAAc,CAAC;QAChB,SAAS,EAAE,sBAAsB,EAAE,CAAA;QACnC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAA;KACrC,CAAC;IAwBF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACG,SAAS,CACb,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC/B,OAAO,CAAC,sBAAsB,EAAE,GAAG,IAAI,CAAC;IAwB3C;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAS3D;;;;;;;;;;;OAWG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAOjD;;;;;;;;;OASG;IACG,iBAAiB,IAAI,OAAO,CAAC;QACjC,MAAM,EAAE,cAAc,CAAA;QACtB,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,IAAI,CAAC;IAOT;;;;;;;;;;;;;;OAcG;IACG,SAAS,CACb,MAAM,EAAE,cAAc,EACtB,EAAE,OAAO,EAAE,WAAW,EAAE,GAAE,iBAAsB,GAC/C,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAU7B;;;;;;OAMG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAOlC;;;;;;;;;;OAUG;IACG,SAAS,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,GAAE,iBAAsB,GAAG,OAAO,CAAC;QACzE,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAC;IASF;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,EAAE,OAAO,EAAE,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC;QACjE,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAC;IAQF;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAUxC;;;;;;;;;;;;;OAaG;IACG,OAAO,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAUlD;;;;;;;OAOG;IACG,KAAK,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAS5C"}
+{"version":3,"file":"Collection.d.ts","sourceRoot":"","sources":["../src/Collection.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAiC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAgClE,OAAO,KAAK,EAEV,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,WAAW,EAEZ,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,KAAK,EACV,iBAAiB,EACjB,WAAW,EACX,sBAAsB,EACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EACV,SAAS,EACT,iBAAiB,EACjB,YAAY,EAEZ,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,cAAc,EACd,uBAAuB,EAEvB,2BAA2B,EAC3B,eAAe,EAChB,MAAM,YAAY,CAAA;AA8FnB,qBAAa,UAAU;;IACrB;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IAYpB;;;;;;;;;;OAUG;gBACS,EACV,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,UAAU,EACX,EAAE;QACD,OAAO,EAAE,aAAa,CAAA;QACtB,QAAQ,EAAE,MAAM,CAAA;QAChB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,KAAK,CAAA;QAClB,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC;IAoDD;;;;;;;;;OASG;IACH,YAAY,IAAI,mBAAmB;IAuBnC;;;;;;;;;;;;OAYG;IACG,QAAQ,IAAI,OAAO,CAAC,CAAC,kBAAkB,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAW1E;;;;;;;;;;OAUG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAChC,WAAW,EAAE,kBAAkB,CAAA;QAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,IAAI,CAAC;IAsPT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwDG;IACG,SAAS,CACb,IAAI,EAAE,wBAAwB,GAAG;QAC/B,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,OAAO,CAAC,EAAE,CAAC,kBAAkB,GAAG;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,GAAG,IAAI,CAAA;QACzD,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,GACA,OAAO,CAAC;QAAE,WAAW,EAAE,kBAAkB,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA+F9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACG,kBAAkB,CACtB,WAAW,EAAE,wBAAwB,EACrC,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC;QAAE,WAAW,EAAE,kBAAkB,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAiH9D;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAU7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,IAAI,IAAI,OAAO,CAAC,CAAC,kBAAkB,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IA2BtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuDG;IACG,OAAO,CACX,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,2BAA2B,CAAA;KAAO,EACnD,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA8D7B;;;;;;;;;;;;;;;;;OAiBG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1C;;;;;;;OAOG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAE9B;;;;;;;;;;;;;;;;;OAiBG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAqBtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,aAAa,CACjB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA8E7B;;;;;;;;;;;;;;;;;OAiBG;IACG,OAAO,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAK5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,YAAY,CAAC,EACjB,SAAS,EACT,MAAM,EACP,EAAE;QACD,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QAC5B,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,GAAG,OAAO,CAAC,WAAW,CAAC;IAIxB;;;;;;;;;;;;;;;;;;;OAmBG;IACG,cAAc,CAAC,EACnB,OAAO,EACR,EAAE;QACD,OAAO,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KACnE,GAAG,OAAO,CAAC,WAAW,CAAC;IA8CxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,IAAI,CAAC,OAAO,EAAE;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QACjE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QACvB,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC,QAAQ,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAiEzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,QAAQ;IAkBnE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,GAAG,CACP,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC;IA8DrB;;;;;;;OAOG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAM1D;;;;;;;;;OASG;IACG,SAAS,CACb,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,aAAa,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAItD;;;;;;;;;;;;;;OAcG;IACG,GAAG,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACjB,GACL,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAkB7B;;;;;;;;;OASG;IACG,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAIrD;;;;;;;;;OASG;IACI,SAAS,IAAI,cAAc,CAAC,uBAAuB,CAAC;IAI3D;;;;;;;OAOG;IACI,SAAS,IAAI,cAAc,CAAC,eAAe,CAAC;IAInD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4DG;IACG,OAAO,CACX,OAAO,GAAE;QACP,UAAU,CAAC,EAAE,iBAAiB,CAAA;QAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;KACnB,GACL,OAAO,CAAC,WAAW,CAAC;IAqEvB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACI,eAAe,CACpB,OAAO,GAAE;QACP,UAAU,CAAC,EAAE,iBAAiB,CAAA;QAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;KACb,GACL,cAAc,CAAC;QAChB,SAAS,EAAE,sBAAsB,EAAE,CAAA;QACnC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAA;KACrC,CAAC;IAkCF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACG,SAAS,CACb,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC/B,OAAO,CAAC,sBAAsB,EAAE,GAAG,IAAI,CAAC;IAwB3C;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAS3D;;;;;;;;;;;OAWG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAOjD;;;;;;;;;OASG;IACG,iBAAiB,IAAI,OAAO,CAAC;QACjC,MAAM,EAAE,cAAc,CAAA;QACtB,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,IAAI,CAAC;IAOT;;;;;;;;;;;;;;OAcG;IACG,SAAS,CACb,MAAM,EAAE,cAAc,EACtB,EAAE,OAAO,EAAE,WAAW,EAAE,GAAE,iBAAsB,GAC/C,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAU7B;;;;;;OAMG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAOlC;;;;;;;;;;OAUG;IACG,SAAS,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,GAAE,iBAAsB,GAAG,OAAO,CAAC;QACzE,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAC;IASF;;;;;;;;;;;;OAYG;IACG,WAAW,CAAC,EAAE,OAAO,EAAE,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC;QACjE,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAC;IAQF;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAUxC;;;;;;;;;;;;;OAaG;IACG,OAAO,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAUlD;;;;;;;OAOG;IACG,KAAK,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAS5C"}

package/dist/Collection.js

@@ -15,13 +15,13 @@
  * Collection URL is the container: it lists and adds Resources, and `delete()`
  * removes the Collection.
  */
-import { canonicalSpaceUrl, spaceIdOfCanonicalUrl, collectionUrl, collectionPolicyUrl, collectionLinksetUrl, collectionBackendUrl, collectionQuotaUrl, collectionQueryUrl, collectionMetaUrl, collectionLogUrl, resourceUrl } from './internal/paths.js';
+import { canonicalSpaceUrl, collectionUrl, collectionPolicyUrl, collectionLinksetUrl, collectionBackendUrl, collectionQuotaUrl, collectionQueryUrl, collectionMetaUrl, collectionLogUrl, resourceUrl } from './internal/paths.js';
 import { assertNotReserved } from './internal/reserved.js';
 import { NotFoundError, ValidationError, WasServerError, httpStatus } from './errors.js';
 import { allowsAction, delegateGrantAt } from './internal/grant.js';
 import { send, readData } from './internal/request.js';
 import { codecForDescriptor, collectionCodecHolder, identityCodec, openStoredCustom } from './internal/codec.js';
-import { collectWalk, signedPageWalk, walkItems, walkPagesOrEmpty } from './internal/pagination.js';
+import { DEFAULT_MAX_PAGES, collectWalk, signedPageWalk, walkItems, walkPagesOrEmpty } from './internal/pagination.js';
 import { ANNOTATION_MEMBERS, CONFIGURATION_MEMBERS, asCollectionMetadata, carriedForward, collectionWritableFields, isGovernedDescriptor, storedEncryption, unreadableDescriptionError } from './internal/describe.js';
 import { assertSinglePrecondition, readEtag, writeHeaders } from './internal/conditional.js';
 import { compareAndSwap, composeAndSwap } from './internal/cas.js';
@@ -29,7 +29,7 @@ import { readCollectionMetadata, readMeta, patchCustom } from './internal/meta.j
 import { codecRequestContext, insertResource } from './internal/write.js';
 import { readPolicy, readPolicyWithEtag, writePolicy, deletePolicy, isPublicPolicy, setPublicPolicy } from './internal/policy.js';
 import { ENCODER, LOG_CONTENT_TYPE, createdResource, dataOrNull, storedResponse } from './internal/content.js';
-import { INDEX_SCHEMA_PROPERTY, mergeIndexDeclarations, normalizeIndexRequests, readIndexSchema, withStoredIndexSchema } from './internal/indexSchema.js';
+import { INDEX_SCHEMA_PROPERTY, cloneIndexSchema, mergeIndexDeclarations, normalizeIndexRequests, readIndexSchema, withStoredIndexSchema } from './internal/indexSchema.js';
 import { Resource } from './Resource.js';
 import { isJsonResourceChange, isResourceChange } from '@interop/storage-core';
 /**
@@ -113,10 +113,6 @@ export class Collection {
      * The URL of the Space this Collection lives in, in canonical form.
      */
     spaceUrl;
-    /**
-     * The id of that Space: the last path segment of {@link spaceUrl}.
-     */
-    spaceId;
     id;
     /**
      * The Collection container in canonical (trailing-slash) form: the URL whose
@@ -158,7 +154,6 @@ export class Collection {
         assertNotReserved({ id: collectionId, kind: 'collection' });
         this.#context = context;
         this.spaceUrl = canonicalSpaceUrl(spaceUrl);
-        this.spaceId = spaceIdOfCanonicalUrl(this.spaceUrl);
         this.url = collectionUrl({ spaceUrl: this.spaceUrl, collectionId });
         this.id = collectionId;
         // Every URL this handle addresses is derived once: `spaceUrl` is
@@ -563,7 +558,9 @@ export class Collection {
             },
             operation: 'Collection configuration'
         });
-        this.#resetCodecIfDeclared(desc.encryption);
+        // Any successful configuration write drops the memoized codec (see
+        // `CodecHolder.reset`).
+        this.#codecHolder.reset();
         return {
             description: metadata ?? {
                 id: this.id,
@@ -649,7 +646,7 @@ export class Collection {
             ifMatch: options.ifMatch,
             ifNoneMatch: options.ifNoneMatch
         });
-        this.#resetCodecIfDeclared(description.encryption);
+        this.#codecHolder.reset();
         return {
             description: metadata ?? {
                 id: this.id,
@@ -741,29 +738,14 @@ export class Collection {
             return {};
         }
     }
-    /**
-     * Drops any memoized codec when a write declared an `encryption` descriptor.
-     * Writing it can rotate the key epoch (the recipient operations CAS this
-     * member) or flip the collection from plaintext to encrypted, and a codec
-     * memoized from the prior descriptor would keep encrypting under the stale
-     * epoch -- whose key a just-removed reader still holds -- or write
-     * server-visible plaintext into a now-encrypted collection. Child resource
-     * handles share this codec via their thunk, so resetting here propagates to
-     * them too.
-     *
-     * @param [encryption] {CollectionEncryption}   the descriptor the write
-     *   declared, if any
-     * @returns {void}
-     */
-    #resetCodecIfDeclared(encryption) {
-        if (encryption !== undefined) {
-            this.#codecHolder.reset();
-        }
-    }
     /**
      * Deletes the whole collection. Idempotent. To delete a single resource, use
      * `collection.resource(id).delete()`.
      *
+     * Drops the memoized codec as well: a collection re-created at this URL
+     * under another encryption scheme must not be written through the codec
+     * the deleted one resolved (see `CodecHolder.reset`).
+     *
      * @returns {Promise<void>}
      */
     async delete() {
@@ -773,6 +755,7 @@ export class Collection {
             capability: this.#capability,
             idempotent: true
         });
+        this.#codecHolder.reset();
     }
     /**
      * Reads the Collection Metadata object with its user-writable `custom`
@@ -1122,11 +1105,15 @@ export class Collection {
      * attribute was declared carry no token for it, so they do not match a search
      * on it until they are rewritten.
      *
+     * The result is a copy: mutating it (a compound entry's `attribute` array
+     * included) does not touch the schema installed on this handle's codec.
+     * Declare through {@link declareIndex}.
+     *
      * @returns {Promise<IndexDeclaration[]>}
      */
     async indexes() {
         const indexing = await this.#indexing('read the index schema');
-        return indexing.schema().indexes;
+        return cloneIndexSchema(indexing.schema()).indexes;
     }
     /**
      * Declares an attribute searchable, persisting it in the Collection's
@@ -1154,7 +1141,8 @@ export class Collection {
      *   for a compound index
      * @param [options.unique] {boolean}   reject a second document that carries
      *   the same value (the server answers a colliding write with `409`)
-     * @returns {Promise<IndexSchema>}   the schema now in force
+     * @returns {Promise<IndexSchema>}   the schema now in force, as a copy (see
+     *   {@link indexes})
      */
     async declareIndex({ attribute, unique }) {
         return this.declareIndexes({ indexes: [{ attribute, unique }] });
@@ -1176,7 +1164,8 @@ export class Collection {
      * @param options {object}
      * @param options.indexes {Array<{ attribute: string | string[]; unique?: boolean }>}
      *   the attributes to declare, in `declareIndex`'s own terms
-     * @returns {Promise<IndexSchema>}   the schema now in force
+     * @returns {Promise<IndexSchema>}   the schema now in force, as a copy (see
+     *   {@link indexes})
      */
     async declareIndexes({ indexes }) {
         const { indexing, meta: snapshot } = await this.#resolveIndexing('declare indexes');
@@ -1220,7 +1209,7 @@ export class Collection {
         });
         const schema = readIndexSchema(custom);
         indexing.applySchema(schema);
-        return schema;
+        return cloneIndexSchema(schema);
     }
     /**
      * Searches the collection's encrypted documents by indexed attribute. The
@@ -1633,22 +1622,28 @@ export class Collection {
      * checkpoint); a short page is not the end (see `changes()`). Checkpoints
      * are opaque strings compared by equality only. A server that hands back a
      * checkpoint this walk already resumed from (the starting one included)
-     * fails the walk with a `WasServerError` rather than looping. Every fault
-     * `changes()` rejects on fails the walk the same way.
+     * fails the walk with a `WasServerError` rather than looping, as does one
+     * that keeps advancing the checkpoint without ending the feed within
+     * `maxPages` pages. Every fault `changes()` rejects on fails the walk the
+     * same way.
      *
      * @param [options] {object}
      * @param [options.checkpoint] {ChangesCheckpoint}   resume strictly after it
      * @param [options.limit] {number}   max entries per request, every kind counted
      * @param [options.method] {'POST' | 'GET'}   the request form of each page,
      *   as for {@link changes}
+     * @param [options.maxPages] {number}   the most pages one walk reads before
+     *   it fails (default 10,000, the same bound as a listing walk)
      * @returns {AsyncGenerator<{ documents: ResourceChangeDocument[], checkpoint: ChangesCheckpoint | null }>}
      */
     async *resourceChanges(options = {}) {
-        const { limit, method } = options;
+        const { limit, method, maxPages = DEFAULT_MAX_PAGES } = options;
         let checkpoint = options.checkpoint;
         const seen = new Set(checkpoint === undefined ? [] : [checkpoint]);
+        let pagesRead = 0;
         for (;;) {
             const page = await this.changes({ checkpoint, limit, method });
+            pagesRead += 1;
             yield {
                 documents: page.documents.filter(isResourceChange),
                 checkpoint: page.checkpoint ?? null
@@ -1660,6 +1655,12 @@ export class Collection {
                 throw new WasServerError(`The changes feed of collection "${this.id}" repeated checkpoint ` +
                     `${JSON.stringify(page.checkpoint)} instead of advancing.`);
             }
+            // The page already says the feed continues, so the refusal costs no
+            // further request.
+            if (pagesRead >= maxPages) {
+                throw new WasServerError(`The changes feed of collection "${this.id}" did not end within ` +
+                    `${maxPages} pages.`);
+            }
             seen.add(page.checkpoint);
             checkpoint = page.checkpoint;
         }
@@ -1691,7 +1692,8 @@ export class Collection {
      * `changes()` rejects on (a bodiless 2xx, a live JSON entry with no `data`,
      * or a `501` from a server that does not advertise the `changes-query`
      * feature) fail the walk with the same `WasServerError`, as does a server
-     * that repeats a checkpoint instead of advancing.
+     * that repeats a checkpoint instead of advancing, or one that keeps advancing
+     * it without ever ending the feed (the page bound of `resourceChanges()`).
      *
      * @param [options] {object}
      * @param [options.limit] {number}   max documents per request (default 1000, the teaching server's maximum); the server reduces it to its own maximum