@interop/was-client 0.13.3 → 0.14.1

package/dist/edv/recipients.js

@@ -0,0 +1,265 @@
+import { PreconditionFailedError, ValidationError } from '../errors.js';
+import { didKeyResolver, mintEpoch, unwrapEpochSecret, wrapEpochSecret } from './epochCrypto.js';
+/**
+ * How many times a recipient CAS write retries a stale (`412`) description
+ * before surfacing {@link PreconditionFailedError}.
+ */
+const MAX_CAS_ATTEMPTS = 3;
+/**
+ * Initializes the first key epoch on a Collection that is declared encrypted
+ * but has no epochs yet: mints a fresh epoch key, wraps it to each initial
+ * recipient, and writes `epochs: [epoch]` / `currentEpoch` back with a
+ * compare-and-swap. After this, resources written by any recipient are encrypted
+ * under the epoch, and readers unwrap it with their own key-agreement key.
+ *
+ * @param options {object}
+ * @param options.collection {Collection}   the (already encrypted) collection
+ * @param options.recipients {RecipientPublicKey[]}   the initial readers' public
+ *   key-agreement keys (each `id` is the reader's `kid`)
+ * @returns {Promise<CollectionEncryption>}   the new marker
+ */
+export async function initRecipients({ collection, recipients }) {
+    if (recipients.length === 0) {
+        throw new ValidationError('initRecipients needs at least one recipient to wrap the epoch key to.');
+    }
+    const { epochId, secret } = await mintEpoch();
+    const epoch = {
+        id: epochId,
+        recipients: await Promise.all(recipients.map(recipient => wrapEpochSecret({ epochSecret: secret, recipient })))
+    };
+    return casUpdateMarker({
+        collection,
+        mutate: marker => {
+            if (marker.epochs && marker.epochs.length > 0) {
+                throw new ValidationError('This collection already has key epochs; use addRecipient to add a ' +
+                    'reader instead of initRecipients.');
+            }
+            return { ...marker, epochs: [epoch], currentEpoch: epochId };
+        }
+    });
+}
+/**
+ * Adds a reader to a multi-recipient encrypted Collection. Escrow semantics: the
+ * new reader receives EVERY epoch's key (the current one and all prior), because
+ * "add a reader to a collection" means it can read the Collection, history
+ * included. No rotation happens -- **adds are cheap, removals rotate.**
+ *
+ * The caller must itself be a recipient of every epoch (its `owner` key unwraps
+ * each epoch key, which is then re-wrapped to the new reader). Written back with
+ * a compare-and-swap, retried on a concurrent change.
+ *
+ * @param options {object}
+ * @param options.collection {Collection}   the collection
+ * @param options.recipient {RecipientPublicKey}   the new reader's public KAK
+ * @param options.owner {OwnerKey}   the caller's own key-agreement key, to
+ *   unwrap each epoch key for re-wrapping to the new reader
+ * @returns {Promise<CollectionEncryption>}   the new marker
+ */
+export async function addRecipient({ collection, recipient, owner }) {
+    return casUpdateMarker({
+        collection,
+        mutate: async (marker) => {
+            const epochs = marker.epochs;
+            if (!epochs || epochs.length === 0) {
+                throw new ValidationError('Cannot addRecipient: this collection has no key epochs. Call ' +
+                    'initRecipients first.');
+            }
+            const nextEpochs = [];
+            for (const epoch of epochs) {
+                // Already a recipient of this epoch? Leave it untouched (idempotent).
+                if (epoch.recipients.some(entry => entry.header.kid === recipient.id)) {
+                    nextEpochs.push(epoch);
+                    continue;
+                }
+                const ownEntry = epoch.recipients.find(entry => entry.header.kid === owner.keyAgreementKey.id);
+                if (!ownEntry) {
+                    throw new ValidationError(`Cannot addRecipient: the caller is not a recipient of epoch ` +
+                        `"${epoch.id}", so it cannot unwrap that epoch key to escrow it ` +
+                        'to the new reader.');
+                }
+                const secret = await unwrapEpochSecret({
+                    entry: ownEntry,
+                    keyAgreementKey: owner.keyAgreementKey
+                });
+                if (!secret) {
+                    throw new ValidationError(`Cannot addRecipient: unwrapping epoch "${epoch.id}" with the ` +
+                        "caller's key-agreement key failed.");
+                }
+                const wrapped = await wrapEpochSecret({
+                    epochSecret: secret,
+                    recipient
+                });
+                nextEpochs.push({
+                    ...epoch,
+                    recipients: [...epoch.recipients, wrapped]
+                });
+            }
+            return { ...marker, epochs: nextEpochs };
+        }
+    });
+}
+/**
+ * Removes a reader from a multi-recipient encrypted Collection -- one
+ * indivisible operation doing BOTH halves of a removal:
+ *
+ * 1. **Rotate the epoch**: mint a fresh epoch key, wrap it to each REMAINING
+ *    recipient (the current epoch's roster minus the removed reader), append it
+ *    as a new epoch, and repoint `currentEpoch`, with a compare-and-swap.
+ *    Resources written afterward are unreadable to the removed reader (the read
+ *    axis; prospective).
+ * 2. **Revoke the reader's zcap(s)** via `space.revoke()`, so the server stops
+ *    serving it ciphertext (the pull axis; immediate).
+ *
+ * The rotation runs first so it is durable before the irreversible revocation:
+ * a rotation that keeps losing the compare-and-swap throws with nothing revoked,
+ * leaving the operation safely retryable rather than half-applied. The revoke
+ * step tolerates an already-revoked capability (a retry re-revokes) so the
+ * operation converges.
+ *
+ * Important: this does not re-encrypt existing resources, so the removed
+ * reader keeps every earlier epoch's key and can still decrypt any pre-rotation
+ * resource whose ciphertext it gets. Neither half alone removes a reader.
+ *
+ * @param options {object}
+ * @param options.collection {Collection}   the collection
+ * @param options.space {Space}   the collection's Space, for the zcap revocation
+ * @param options.recipientId {string}   the removed reader's key-agreement key
+ *   id (`kid`), dropped from the new epoch's recipients
+ * @param options.revoke {IDelegatedZcap | IDelegatedZcap[]}   the reader's
+ *   delegated capability/capabilities to revoke (the pull axis)
+ * @param [options.resolveRecipientKey] {function}   resolves a remaining
+ *   recipient's `kid` to its public key-agreement key, so the fresh epoch key
+ *   can be wrapped to it. Defaults to a `did:key` resolver (the `kid` fragment
+ *   is the X25519 public key); override for recipients whose `kid` is not a
+ *   self-describing `did:key`.
+ * @returns {Promise<CollectionEncryption>}   the new marker
+ */
+export async function removeRecipient({ collection, space, recipientId, revoke, resolveRecipientKey = defaultResolveRecipientKey }) {
+    // 1. Read axis: mint a fresh epoch, wrap it to every remaining recipient,
+    // append it, and repoint `currentEpoch` (compare-and-swap, retried on race).
+    // Rotate FIRST so the rotation is durable before any irreversible revocation:
+    // if the CAS keeps losing the race and throws, the reader is neither revoked
+    // nor rotated, so `removeRecipient` is safely retryable to convergence.
+    const { epochId, secret } = await mintEpoch();
+    const rotatedMarker = await casUpdateMarker({
+        collection,
+        mutate: async (marker) => {
+            const epochs = marker.epochs;
+            if (!epochs || epochs.length === 0) {
+                throw new ValidationError('Cannot removeRecipient: this collection has no key epochs.');
+            }
+            // Remaining recipients: the CURRENT epoch's recipients (the authoritative
+            // roster by construction), minus the removed reader. Deliberately NOT the
+            // union across all epochs -- a reader dropped in an earlier rotation is
+            // still present in that older epoch, so unioning would silently re-escrow
+            // it into the fresh epoch and hand it back read access. Older epochs exist
+            // only so existing readers can decrypt history.
+            const currentEpoch = epochs.find(epoch => epoch.id === marker.currentEpoch) ??
+                epochs[epochs.length - 1];
+            const remaining = new Set();
+            for (const entry of currentEpoch.recipients) {
+                if (entry.header.kid !== recipientId) {
+                    remaining.add(entry.header.kid);
+                }
+            }
+            if (remaining.size === 0) {
+                throw new ValidationError('Cannot removeRecipient: no recipients would remain after the ' +
+                    'removal (a collection with no readers cannot be rotated to).');
+            }
+            const newRecipients = await Promise.all([...remaining].map(async (kid) => wrapEpochSecret({
+                epochSecret: secret,
+                recipient: await resolveRecipientKey(kid)
+            })));
+            const newEpoch = {
+                id: epochId,
+                recipients: newRecipients
+            };
+            return {
+                ...marker,
+                epochs: [...epochs, newEpoch],
+                currentEpoch: epochId
+            };
+        }
+    });
+    // 2. Pull axis: revoke the reader's capability/capabilities AFTER the rotation
+    // is durable. Tolerate an already-revoked capability so a retry (after a
+    // transient revoke failure) converges rather than throwing in the loop:
+    // `space.revoke` is not idempotent and reports an already-revoked capability
+    // as ValidationError. That same status also covers tampered/expired/foreign
+    // capabilities, which the client cannot distinguish here, so this swallows
+    // only ValidationError and re-throws anything else.
+    const toRevoke = Array.isArray(revoke) ? revoke : [revoke];
+    for (const zcap of toRevoke) {
+        try {
+            await space.revoke(zcap);
+        }
+        catch (err) {
+            if (err instanceof ValidationError) {
+                continue;
+            }
+            throw err;
+        }
+    }
+    return rotatedMarker;
+}
+/**
+ * The default recipient-key resolver: treats a `kid` as a self-describing
+ * `did:key` X25519 key-agreement key (`did:key:z...#z...`), so the public key is
+ * the fragment.
+ *
+ * @param kid {string}
+ * @returns {Promise<RecipientPublicKey>}
+ */
+async function defaultResolveRecipientKey(kid) {
+    const resolved = await didKeyResolver({ id: kid });
+    return { id: resolved.id, publicKeyMultibase: resolved.publicKeyMultibase };
+}
+/**
+ * Reads the Collection Description, applies `mutate` to its `encryption` marker,
+ * and writes it back with a compare-and-swap (`If-Match`). Retries on a stale
+ * (`412`) validator, re-reading the fresh marker each time, up to
+ * {@link MAX_CAS_ATTEMPTS}; surfaces {@link PreconditionFailedError} if it keeps
+ * losing the race.
+ *
+ * @param options {object}
+ * @param options.collection {Collection}
+ * @param options.mutate {function}   marker to the next marker (may be async)
+ * @returns {Promise<CollectionEncryption>}   the written marker
+ */
+async function casUpdateMarker({ collection, mutate }) {
+    let lastError;
+    for (let attempt = 0; attempt < MAX_CAS_ATTEMPTS; attempt++) {
+        const current = await collection.describeWithEtag();
+        if (current === null) {
+            throw new ValidationError('Cannot manage recipients: the Collection Description is not readable ' +
+                'with this capability (WAS returns 404 for both not-found and ' +
+                'unauthorized).');
+        }
+        const marker = current.description.encryption;
+        if (!marker || marker.scheme !== 'edv') {
+            throw new ValidationError('Cannot manage recipients: this collection is not declared encrypted ' +
+                "with the 'edv' scheme.");
+        }
+        const next = await mutate(marker);
+        try {
+            await collection.replaceDescription({
+                name: current.description.name,
+                backend: current.description.backend,
+                encryption: next
+            }, { ifMatch: current.etag });
+            return next;
+        }
+        catch (err) {
+            if (err instanceof PreconditionFailedError) {
+                // A concurrent recipient change landed first: re-read and re-apply.
+                lastError = err;
+                continue;
+            }
+            throw err;
+        }
+    }
+    throw new PreconditionFailedError(`Recipient change lost the compare-and-swap race after ${MAX_CAS_ATTEMPTS} ` +
+        'attempts (another writer kept updating the Collection Description). ' +
+        'Retry the operation.', { cause: lastError });
+}
+//# sourceMappingURL=recipients.js.map

package/dist/edv/recipients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipients.js","sourceRoot":"","sources":["../../src/edv/recipients.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAMvE,OAAO,EACL,cAAc,EACd,SAAS,EACT,iBAAiB,EACjB,eAAe,EAChB,MAAM,kBAAkB,CAAA;AAazB;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAE1B;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,UAAU,EACV,UAAU,EAIX;IACC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,eAAe,CACvB,uEAAuE,CACxE,CAAA;IACH,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAA;IAC7C,MAAM,KAAK,GAA8B;QACvC,EAAE,EAAE,OAAO;QACX,UAAU,EAAE,MAAM,OAAO,CAAC,GAAG,CAC3B,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CACzB,eAAe,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CACpD,CACF;KACF,CAAA;IACD,OAAO,eAAe,CAAC;QACrB,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,EAAE;YACf,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,MAAM,IAAI,eAAe,CACvB,oEAAoE;oBAClE,mCAAmC,CACtC,CAAA;YACH,CAAC;YACD,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAA;QAC9D,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,UAAU,EACV,SAAS,EACT,KAAK,EAKN;IACC,OAAO,eAAe,CAAC;QACrB,UAAU;QACV,MAAM,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;YACrB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YAC5B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,eAAe,CACvB,+DAA+D;oBAC7D,uBAAuB,CAC1B,CAAA;YACH,CAAC;YACD,MAAM,UAAU,GAAgC,EAAE,CAAA;YAClD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,sEAAsE;gBACtE,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;oBACtE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;oBACtB,SAAQ;gBACV,CAAC;gBACD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CACpC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,eAAe,CAAC,EAAE,CACvD,CAAA;gBACD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,eAAe,CACvB,8DAA8D;wBAC5D,IAAI,KAAK,CAAC,EAAE,qDAAqD;wBACjE,oBAAoB,CACvB,CAAA;gBACH,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;oBACrC,KAAK,EAAE,QAAQ;oBACf,eAAe,EAAE,KAAK,CAAC,eAAe;iBACvC,CAAC,CAAA;gBACF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,eAAe,CACvB,0CAA0C,KAAK,CAAC,EAAE,aAAa;wBAC7D,oCAAoC,CACvC,CAAA;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;oBACpC,WAAW,EAAE,MAAM;oBACnB,SAAS;iBACV,CAAC,CAAA;gBACF,UAAU,CAAC,IAAI,CAAC;oBACd,GAAG,KAAK;oBACR,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;iBAC3C,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;QAC1C,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,UAAU,EACV,KAAK,EACL,WAAW,EACX,MAAM,EACN,mBAAmB,GAAG,0BAA0B,EAOjD;IACC,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAA;IAC7C,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC;QAC1C,UAAU;QACV,MAAM,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;YACrB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;YAC5B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,eAAe,CACvB,4DAA4D,CAC7D,CAAA;YACH,CAAC;YACD,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,2EAA2E;YAC3E,gDAAgD;YAChD,MAAM,YAAY,GAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,YAAY,CAAC;gBACtD,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;YAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;YACnC,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC;gBAC5C,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;oBACrC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBACjC,CAAC;YACH,CAAC;YACD,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,eAAe,CACvB,+DAA+D;oBAC7D,8DAA8D,CACjE,CAAA;YACH,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CACrC,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,GAAG,EAAC,EAAE,CAC7B,eAAe,CAAC;gBACd,WAAW,EAAE,MAAM;gBACnB,SAAS,EAAE,MAAM,mBAAmB,CAAC,GAAG,CAAC;aAC1C,CAAC,CACH,CACF,CAAA;YACD,MAAM,QAAQ,GAA8B;gBAC1C,EAAE,EAAE,OAAO;gBACX,UAAU,EAAE,aAAa;aAC1B,CAAA;YACD,OAAO;gBACL,GAAG,MAAM;gBACT,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,QAAQ,CAAC;gBAC7B,YAAY,EAAE,OAAO;aACtB,CAAA;QACH,CAAC;KACF,CAAC,CAAA;IAEF,+EAA+E;IAC/E,yEAAyE;IACzE,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1D,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,eAAe,EAAE,CAAC;gBACnC,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAA;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,0BAA0B,CACvC,GAAW;IAEX,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;IAClD,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,eAAe,CAAC,EAC7B,UAAU,EACV,MAAM,EAMP;IACC,IAAI,SAAkB,CAAA;IACtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,gBAAgB,EAAE,CAAA;QACnD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,eAAe,CACvB,uEAAuE;gBACrE,+DAA+D;gBAC/D,gBAAgB,CACnB,CAAA;QACH,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,UAAU,CAAA;QAC7C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACvC,MAAM,IAAI,eAAe,CACvB,sEAAsE;gBACpE,wBAAwB,CAC3B,CAAA;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;QACjC,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,kBAAkB,CACjC;gBACE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;gBAC9B,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO;gBACpC,UAAU,EAAE,IAAI;aACjB,EACD,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAC1B,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,oEAAoE;gBACpE,SAAS,GAAG,GAAG,CAAA;gBACf,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IACD,MAAM,IAAI,uBAAuB,CAC/B,yDAAyD,gBAAgB,GAAG;QAC1E,sEAAsE;QACtE,sBAAsB,EACxB,EAAE,KAAK,EAAE,SAAkB,EAAE,CAC9B,CAAA;AACH,CAAC"}

package/dist/errors.d.ts

@@ -102,6 +102,37 @@ export declare class QuotaExceededError extends WasError {
 export declare class EncryptionError extends WasError {
     constructor(message: string, options?: WasErrorOptions);
 }
+/**
+ * A fail-closed key-epoch error: a reader could not unwrap any epoch key it
+ * needs to decrypt a resource on a multi-recipient encrypted Collection -- none
+ * of the marker's `recipients` entries yielded a key for this reader's
+ * key-agreement key (it was never a recipient, or has been removed and the
+ * epoch rotated). A subtype of {@link EncryptionError}, so existing
+ * `catch (EncryptionError)` fail-closed handling still catches it.
+ *
+ * This is the **read** axis only. It says nothing about **pull**: the reader may
+ * still be served the ciphertext by the server (a separate zcap decision) and
+ * may still hold earlier epochs' keys for resources written before it was
+ * removed -- rotation is prospective and never claws back what a reader can
+ * already decrypt.
+ */
+export declare class KeyUnwrapError extends EncryptionError {
+    constructor(message: string, options?: WasErrorOptions);
+}
+/**
+ * A fail-closed integrity error: a stored EDV envelope this reader DOES hold a
+ * key for failed to authenticate on decrypt -- its AEAD tag did not verify, so
+ * the ciphertext is corrupt or has been tampered with. Distinct from
+ * {@link KeyUnwrapError}: that is the read/membership axis ("no key for this
+ * epoch"), whereas this is a data-integrity failure by a legitimate recipient.
+ * A subtype of {@link EncryptionError}, so existing `catch (EncryptionError)`
+ * fail-closed handling still catches it, but a security-conscious caller can
+ * `instanceof IntegrityError` to tell tampering apart from an authorization
+ * problem. Raised client-side before/independent of any HTTP status.
+ */
+export declare class IntegrityError extends EncryptionError {
+    constructor(message: string, options?: WasErrorOptions);
+}
 /**
  * The server encountered an internal fault (HTTP 5xx).
  */

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAWA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;GAEG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;gBAEP,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAU3D;AAED;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,QAAQ;gBAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;gBAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,QAAQ;gBAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;gBACvC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ;gBACpC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;gBAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,QAAQ;gBAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAoFD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CAyD/C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAWA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;GAEG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;gBAEP,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAU3D;AAED;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,QAAQ;gBAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;gBAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,QAAQ;gBAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,QAAQ;gBACvC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;GAIG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ;gBACpC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;;;;;GAQG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;gBAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,cAAe,SAAQ,eAAe;gBACrC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;;;;;;;;;GAUG;AACH,qBAAa,cAAe,SAAQ,eAAe;gBACrC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,QAAQ;gBAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB;CAI3D;AAoFD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CAyD/C"}

package/dist/errors.js

@@ -132,6 +132,43 @@ export class EncryptionError extends WasError {
         this.name = 'EncryptionError';
     }
 }
+/**
+ * A fail-closed key-epoch error: a reader could not unwrap any epoch key it
+ * needs to decrypt a resource on a multi-recipient encrypted Collection -- none
+ * of the marker's `recipients` entries yielded a key for this reader's
+ * key-agreement key (it was never a recipient, or has been removed and the
+ * epoch rotated). A subtype of {@link EncryptionError}, so existing
+ * `catch (EncryptionError)` fail-closed handling still catches it.
+ *
+ * This is the **read** axis only. It says nothing about **pull**: the reader may
+ * still be served the ciphertext by the server (a separate zcap decision) and
+ * may still hold earlier epochs' keys for resources written before it was
+ * removed -- rotation is prospective and never claws back what a reader can
+ * already decrypt.
+ */
+export class KeyUnwrapError extends EncryptionError {
+    constructor(message, options = {}) {
+        super(message, options);
+        this.name = 'KeyUnwrapError';
+    }
+}
+/**
+ * A fail-closed integrity error: a stored EDV envelope this reader DOES hold a
+ * key for failed to authenticate on decrypt -- its AEAD tag did not verify, so
+ * the ciphertext is corrupt or has been tampered with. Distinct from
+ * {@link KeyUnwrapError}: that is the read/membership axis ("no key for this
+ * epoch"), whereas this is a data-integrity failure by a legitimate recipient.
+ * A subtype of {@link EncryptionError}, so existing `catch (EncryptionError)`
+ * fail-closed handling still catches it, but a security-conscious caller can
+ * `instanceof IntegrityError` to tell tampering apart from an authorization
+ * problem. Raised client-side before/independent of any HTTP status.
+ */
+export class IntegrityError extends EncryptionError {
+    constructor(message, options = {}) {
+        super(message, options);
+        this.name = 'IntegrityError';
+    }
+}
 /**
  * The server encountered an internal fault (HTTP 5xx).
  */

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAmBpD;;GAEG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,IAAI,CAAS;IACb,KAAK,CAAS;IACd,OAAO,CAAW;IAClB,UAAU,CAAS;IAEnB,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;QACnE,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,QAAQ;IACzC,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;IAC7B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,aAAc,SAAQ,QAAQ;IACzC,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;IAC7B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,QAAQ;IAC9C,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,QAAQ;IAC1C,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;IAC9B,CAAC;CACF;AAuBD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,WAAmB;IAC1C,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,mBAAmB,GAAkC;IACzD,CAAC,eAAe,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa;IACxD,CAAC,eAAe,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,eAAe;IAC3D,CAAC,eAAe,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,EAAE,eAAe;IACrE,CAAC,eAAe,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,EAAE,eAAe;IACrE,CAAC,eAAe,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC,EAAE,eAAe;IAC7E,CAAC,eAAe,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,eAAe;IACpE,CAAC,eAAe,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAAE,eAAe;IAC/D,CAAC,eAAe,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,EAAE,iBAAiB;IACxE,CAAC,eAAe,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa;IAC1D,CAAC,eAAe,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa;IAC1D,CAAC,eAAe,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,aAAa;IAClE,CAAC,eAAe,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,EAAE,aAAa;IACnE,CAAC,eAAe,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,uBAAuB;IAC5E,CAAC,eAAe,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,EAAE,oBAAoB;IACvE,CAAC,eAAe,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAAE,kBAAkB;IAClE,CAAC,eAAe,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,EAAE,mBAAmB;IAC1E,CAAC,eAAe,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,EAAE,cAAc;IAC7D,CAAC,eAAe,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAAE,cAAc;CAC/D,CAAA;AAED;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,EACpB,IAAI,EACJ,OAAO,EACP,OAAO,EAKR;IACC,MAAM,UAAU,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAC7E,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,GAAG,GAAG,GAA0D,CAAA;IACtE,OAAO,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAA;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,CAAoB,CAAA;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAA;IAC3B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAA;IACvB,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAA;IACzB,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,KAAK,CAAC,EAAE,CAAE,KAAoC,EAAE,MAAM,CAAC;aAC3D,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAA;IACvC,MAAM,OAAO,GAAG,KAAK,IAAI,SAAS,CAAC,OAAO,IAAI,oBAAoB,CAAA;IAClE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;IAExE,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;IACvD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC9C,KAAK,GAAG,CAAC;QACT,KAAK,GAAG;YACN,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAChD,KAAK,GAAG;YACN,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC5C,KAAK,GAAG;YACN,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC5C,KAAK,GAAG;YACN,OAAO,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACtD,KAAK,GAAG;YACN,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACnD,KAAK,GAAG;YACN,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAClD,KAAK,GAAG;YACN,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAChD,OAAO,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AACvC,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAmBpD;;GAEG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,IAAI,CAAS;IACb,KAAK,CAAS;IACd,OAAO,CAAW;IAClB,UAAU,CAAS;IAEnB,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;QACnE,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,QAAQ;IACzC,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;IAC7B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IAC/C,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,aAAc,SAAQ,QAAQ;IACzC,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;IAC7B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,QAAQ;IAC9C,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,cAAe,SAAQ,eAAe;IACjD,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;IAC9B,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAe,SAAQ,eAAe;IACjD,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;IAC9B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,QAAQ;IAC1C,YAAY,OAAe,EAAE,UAA2B,EAAE;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;IAC9B,CAAC;CACF;AAuBD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,WAAmB;IAC1C,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,mBAAmB,GAAkC;IACzD,CAAC,eAAe,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa;IACxD,CAAC,eAAe,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,eAAe;IAC3D,CAAC,eAAe,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,EAAE,eAAe;IACrE,CAAC,eAAe,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,EAAE,eAAe;IACrE,CAAC,eAAe,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC,EAAE,eAAe;IAC7E,CAAC,eAAe,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,eAAe;IACpE,CAAC,eAAe,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAAE,eAAe;IAC/D,CAAC,eAAe,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,EAAE,iBAAiB;IACxE,CAAC,eAAe,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa;IAC1D,CAAC,eAAe,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa;IAC1D,CAAC,eAAe,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,aAAa;IAClE,CAAC,eAAe,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,EAAE,aAAa;IACnE,CAAC,eAAe,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC,EAAE,uBAAuB;IAC5E,CAAC,eAAe,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,EAAE,oBAAoB;IACvE,CAAC,eAAe,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAAE,kBAAkB;IAClE,CAAC,eAAe,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,EAAE,mBAAmB;IAC1E,CAAC,eAAe,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,EAAE,cAAc;IAC7D,CAAC,eAAe,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAAE,cAAc;CAC/D,CAAA;AAED;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CAAC,EACpB,IAAI,EACJ,OAAO,EACP,OAAO,EAKR;IACC,MAAM,UAAU,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAC7E,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,GAAG,GAAG,GAA0D,CAAA;IACtE,OAAO,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAA;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,CAAoB,CAAA;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAA;IAC3B,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAA;IACvB,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAA;IACzB,2EAA2E;IAC3E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,KAAK,CAAC,EAAE,CAAE,KAAoC,EAAE,MAAM,CAAC;aAC3D,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAA;IACvC,MAAM,OAAO,GAAG,KAAK,IAAI,SAAS,CAAC,OAAO,IAAI,oBAAoB,CAAA;IAClE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;IAExE,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;IACvD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,MAAM,CAAA;IACf,CAAC;IAED,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC9C,KAAK,GAAG,CAAC;QACT,KAAK,GAAG;YACN,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAChD,KAAK,GAAG;YACN,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC5C,KAAK,GAAG;YACN,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC9C,KAAK,GAAG;YACN,OAAO,IAAI,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC5C,KAAK,GAAG;YACN,OAAO,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACtD,KAAK,GAAG;YACN,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACnD,KAAK,GAAG;YACN,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAClD,KAAK,GAAG;YACN,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAChD,OAAO,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AACvC,CAAC"}

package/dist/index.d.ts

@@ -9,7 +9,7 @@ export { WasClient } from './WasClient.js';
 export { Space } from './Space.js';
 export { Collection } from './Collection.js';
 export { Resource } from './Resource.js';
-export { WasError, NotFoundError, ValidationError, AuthRequiredError, NotImplementedError, ConflictError, PreconditionFailedError, PayloadTooLargeError, QuotaExceededError, EncryptionError, WasServerError, mapError } from './errors.js';
+export { WasError, NotFoundError, ValidationError, AuthRequiredError, NotImplementedError, ConflictError, PreconditionFailedError, PayloadTooLargeError, QuotaExceededError, EncryptionError, KeyUnwrapError, IntegrityError, WasServerError, mapError } from './errors.js';
 export type { ResourceCodec, EncryptionProvider, EncodedWrite } from './codec.js';
-export type { Json, JsonPrimitive, JsonObject, JsonArray, ResourceData, Action, ActionInput, SpaceDescription, CollectionDescription, CollectionEncryption, CollectionSummary, CollectionsList, SpaceSummary, SpaceListing, ResourceSummary, CollectionResourcesList, ResourceMetadata, ResourceMetadataCustom, AddResult, ImportStats, PolicyDocument, LinkSet, LinkSetEntry, HandleOptions, EncryptionOverride, BackendReference, BackendDescriptor, BackendRegistration, BackendConnectionInput, BackendConnectionPublic, StorageLimit, CollectionUsage, BackendUsage, SpaceQuotaReport, GrantOptions, RequestInput, IZcap, IDelegatedZcap, ISigner } from './types.js';
+export type { Json, JsonPrimitive, JsonObject, JsonArray, ResourceData, Action, ActionInput, SpaceDescription, CollectionDescription, CollectionEncryption, CollectionEncryptionEpoch, CollectionEncryptionRecipient, CollectionSummary, CollectionsList, SpaceSummary, SpaceListing, ResourceSummary, CollectionResourcesList, ResourceMetadata, ResourceMetadataCustom, AddResult, ImportStats, PolicyDocument, LinkSet, LinkSetEntry, HandleOptions, EncryptionOverride, BackendReference, BackendDescriptor, BackendRegistration, BackendConnectionInput, BackendConnectionPublic, StorageLimit, CollectionUsage, BackendUsage, SpaceQuotaReport, GrantOptions, RequestInput, IZcap, IDelegatedZcap, ISigner } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,QAAQ,EACT,MAAM,aAAa,CAAA;AAEpB,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,YAAY,EACV,IAAI,EACJ,aAAa,EACb,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,SAAS,EACT,WAAW,EACX,cAAc,EACd,OAAO,EACP,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,cAAc,EACd,OAAO,EACR,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,cAAc,EACd,QAAQ,EACT,MAAM,aAAa,CAAA;AAEpB,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,YAAY,EACV,IAAI,EACJ,aAAa,EACb,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,SAAS,EACT,WAAW,EACX,cAAc,EACd,OAAO,EACP,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,cAAc,EACd,OAAO,EACR,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -9,5 +9,5 @@ export { WasClient } from './WasClient.js';
 export { Space } from './Space.js';
 export { Collection } from './Collection.js';
 export { Resource } from './Resource.js';
-export { WasError, NotFoundError, ValidationError, AuthRequiredError, NotImplementedError, ConflictError, PreconditionFailedError, PayloadTooLargeError, QuotaExceededError, EncryptionError, WasServerError, mapError } from './errors.js';
+export { WasError, NotFoundError, ValidationError, AuthRequiredError, NotImplementedError, ConflictError, PreconditionFailedError, PayloadTooLargeError, QuotaExceededError, EncryptionError, KeyUnwrapError, IntegrityError, WasServerError, mapError } from './errors.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,QAAQ,EACT,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,cAAc,EACd,cAAc,EACd,QAAQ,EACT,MAAM,aAAa,CAAA"}

package/dist/internal/codec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../../src/internal/codec.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAgB,aAAa,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAIjD,OAAO,KAAK,EACV,kBAAkB,EAClB,KAAK,EAIN,MAAM,aAAa,CAAA;AAEpB;;;;;;GAMG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,CAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;IAEvD;;;OAGG;gBACS,OAAO,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC;IAIjD;;;;OAIG;IACH,GAAG,IAAI,OAAO,CAAC,aAAa,CAAC;IAiB7B;;;;OAIG;IACH,KAAK,IAAI,IAAI;CAGd;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,aAsC3B,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,aAAa,EACtB,EACE,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,UAAU,EACX,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,kBAAkB,CAAA;IAC7B,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GACA,OAAO,CAAC,aAAa,CAAC,CAgDxB"}
+{"version":3,"file":"codec.d.ts","sourceRoot":"","sources":["../../src/internal/codec.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAgB,aAAa,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAIjD,OAAO,KAAK,EAEV,kBAAkB,EAClB,KAAK,EAIN,MAAM,aAAa,CAAA;AAEpB;;;;;;GAMG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,CAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;IAEvD;;;OAGG;gBACS,OAAO,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC;IAIjD;;;;OAIG;IACH,GAAG,IAAI,OAAO,CAAC,aAAa,CAAC;IAiB7B;;;;OAIG;IACH,KAAK,IAAI,IAAI;CAGd;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,aAoC3B,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,aAAa,EACtB,EACE,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,UAAU,EACX,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,kBAAkB,CAAA;IAC7B,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GACA,OAAO,CAAC,aAAa,CAAC,CAwDxB"}

package/dist/internal/codec.js

@@ -57,7 +57,6 @@ export class CodecHolder {
  * metadata round-trips as server-visible plaintext byte-for-byte.
  */
 export const identityCodec = {
-    metadataMode: 'plaintext',
     async encode({ id, data, contentType }) {
         const prepared = prepareBody(data, { contentType, filename: id });
         return {
@@ -105,7 +104,14 @@ export async function resolveCodec(context, { spaceId, collectionId, override, c
             spaceId,
             collectionId,
             scheme: override.scheme,
-            keys: override.keys
+            keys: override.keys,
+            // A full `CollectionEncryption` marker is itself a valid override
+            // (Space.createCollection pre-seeds exactly this). Forward the whole
+            // override as the `encryption` marker so an epoch-bearing override
+            // resolves the epoch codec -- the provider's `codecFor` selects the epoch
+            // path solely on `encryption?.epochs?.length > 0`, so dropping it here
+            // would force the single-key path and break epoch reads/writes.
+            encryption: override
         });
     }
     // 2. A plaintext-only client (no keystore) never encrypts; no round-trip.
@@ -139,7 +145,8 @@ export async function resolveCodec(context, { spaceId, collectionId, override, c
     return buildEncryptingCodec(context, {
         spaceId,
         collectionId,
-        scheme: description.encryption.scheme
+        scheme: description.encryption.scheme,
+        encryption: description.encryption
     });
 }
 /**
@@ -156,7 +163,7 @@ export async function resolveCodec(context, { spaceId, collectionId, override, c
  * @param [options.keys] {unknown}   override-supplied key material
  * @returns {Promise<ResourceCodec>}
  */
-async function buildEncryptingCodec(context, { spaceId, collectionId, scheme, keys }) {
+async function buildEncryptingCodec(context, { spaceId, collectionId, scheme, encryption, keys }) {
     const where = `${spaceId}/${collectionId}`;
     if (!context.encryption) {
         throw new EncryptionError(`Collection ${where} is encrypted (scheme "${scheme}") but this client ` +
@@ -167,6 +174,7 @@ async function buildEncryptingCodec(context, { spaceId, collectionId, scheme, ke
         spaceId,
         collectionId,
         scheme,
+        encryption,
         keys
     });
     if (!codec) {

package/dist/internal/codec.js.map

@@ -1 +1 @@
-{"version":3,"file":"codec.js","sourceRoot":"","sources":["../../src/internal/codec.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAS9C;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACd,QAAQ,CAAyB;IACxB,QAAQ,CAA8B;IAEvD;;;OAGG;IACH,YAAY,OAAqC;QAC/C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;IACzB,CAAC;IAED;;;;OAIG;IACH,GAAG;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,QAAQ,CAAA;QACtB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC/B,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,OAAO,CAAC,KAAK,CAAC,GAAS,EAAE;YACvB,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAA;YAC3B,CAAC;QACH,CAAC,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAA;IAC3B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAkB;IAC1C,YAAY,EAAE,WAAW;IAEzB,KAAK,CAAC,MAAM,CAAC,EACX,EAAE,EACF,IAAI,EACJ,WAAW,EAKZ;QACC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAA;QACjE,OAAO;YACL,EAAE;YACF,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAsB;QACjC,OAAO,CAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAgB,CAAA;IACvD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EACf,MAAM,EAGP;QACC,OAAO,EAAE,MAAM,EAAE,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAEhB;QACC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAA2B,CAAA;IACxD,CAAC;CACF,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAsB,EACtB,EACE,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,UAAU,EAMX;IAED,2DAA2D;IAC3D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,aAAa,CAAA;QACtB,CAAC;QACD,OAAO,oBAAoB,CAAC,OAAO,EAAE;YACnC,OAAO;YACP,YAAY;YACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAA;IACJ,CAAC;IACD,0EAA0E;IAC1E,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE;QACpD,OAAO;QACP,YAAY;QACZ,UAAU;KACX,CAAC,CAAA;IACF,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,eAAe,CACvB,uCAAuC,OAAO,IAAI,YAAY,MAAM;YAClE,gEAAgE;YAChE,qEAAqE;YACrE,qEAAqE;YACrE,gEAAgE;YAChE,qEAAqE;YACrE,sBAAsB,CACzB,CAAA;IACH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,OAAO,oBAAoB,CAAC,OAAO,EAAE;QACnC,OAAO;QACP,YAAY;QACZ,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,MAAM;KACtC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAsB,EACtB,EACE,OAAO,EACP,YAAY,EACZ,MAAM,EACN,IAAI,EACsE;IAE5E,MAAM,KAAK,GAAG,GAAG,OAAO,IAAI,YAAY,EAAE,CAAA;IAC1C,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,0BAA0B,MAAM,qBAAqB;YACtE,8DAA8D;YAC9D,sDAAsD,CACzD,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC9C,OAAO;QACP,YAAY;QACZ,MAAM;QACN,IAAI;KACL,CAAC,CAAA;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,0BAA0B,MAAM,qBAAqB;YACtE,wEAAwE;YACxE,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"codec.js","sourceRoot":"","sources":["../../src/internal/codec.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAU9C;;;;;;GAMG;AACH,MAAM,OAAO,WAAW;IACd,QAAQ,CAAyB;IACxB,QAAQ,CAA8B;IAEvD;;;OAGG;IACH,YAAY,OAAqC;QAC/C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;IACzB,CAAC;IAED;;;;OAIG;IACH,GAAG;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,QAAQ,CAAA;QACtB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC/B,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,OAAO,CAAC,KAAK,CAAC,GAAS,EAAE;YACvB,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAA;YAC3B,CAAC;QACH,CAAC,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAA;IAC3B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAkB;IAC1C,KAAK,CAAC,MAAM,CAAC,EACX,EAAE,EACF,IAAI,EACJ,WAAW,EAKZ;QACC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAA;QACjE,OAAO;YACL,EAAE;YACF,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAsB;QACjC,OAAO,CAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAgB,CAAA;IACvD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EACf,MAAM,EAGP;QACC,OAAO,EAAE,MAAM,EAAE,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAEhB;QACC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAA2B,CAAA;IACxD,CAAC;CACF,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAsB,EACtB,EACE,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,UAAU,EAMX;IAED,2DAA2D;IAC3D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,aAAa,CAAA;QACtB,CAAC;QACD,OAAO,oBAAoB,CAAC,OAAO,EAAE;YACnC,OAAO;YACP,YAAY;YACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,kEAAkE;YAClE,qEAAqE;YACrE,mEAAmE;YACnE,0EAA0E;YAC1E,uEAAuE;YACvE,gEAAgE;YAChE,UAAU,EAAE,QAAgC;SAC7C,CAAC,CAAA;IACJ,CAAC;IACD,0EAA0E;IAC1E,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE;QACpD,OAAO;QACP,YAAY;QACZ,UAAU;KACX,CAAC,CAAA;IACF,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,eAAe,CACvB,uCAAuC,OAAO,IAAI,YAAY,MAAM;YAClE,gEAAgE;YAChE,qEAAqE;YACrE,qEAAqE;YACrE,gEAAgE;YAChE,qEAAqE;YACrE,sBAAsB,CACzB,CAAA;IACH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,OAAO,oBAAoB,CAAC,OAAO,EAAE;QACnC,OAAO;QACP,YAAY;QACZ,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,MAAM;QACrC,UAAU,EAAE,WAAW,CAAC,UAAU;KACnC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAsB,EACtB,EACE,OAAO,EACP,YAAY,EACZ,MAAM,EACN,UAAU,EACV,IAAI,EAOL;IAED,MAAM,KAAK,GAAG,GAAG,OAAO,IAAI,YAAY,EAAE,CAAA;IAC1C,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,0BAA0B,MAAM,qBAAqB;YACtE,8DAA8D;YAC9D,sDAAsD,CACzD,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC9C,OAAO;QACP,YAAY;QACZ,MAAM;QACN,UAAU;QACV,IAAI;KACL,CAAC,CAAA;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,0BAA0B,MAAM,qBAAqB;YACtE,wEAAwE;YACxE,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/internal/conditional.d.ts

@@ -27,11 +27,16 @@ export interface WritePrecondition {
  * @param [options.contentType] {string}          the body content-type, if any
  * @param [options.precondition] {WritePrecondition}   the conditional-write
  *   precondition
+ * @param [options.epoch] {string}   the key-epoch id an encrypting codec
+ *   encrypted this write under; emitted as the `WAS-Key-Epoch` header so the
+ *   server stamps the Resource's epoch. Omitted when absent (which clears any
+ *   prior stamp on the server).
  * @returns {Record<string, string> | undefined}
  */
-export declare function writeHeaders({ contentType, precondition }: {
+export declare function writeHeaders({ contentType, precondition, epoch }: {
     contentType?: string;
     precondition?: WritePrecondition;
+    epoch?: string;
 }): Record<string, string> | undefined;
 /**
  * Reads the strong `ETag` validator a write/read response returned, or

package/dist/internal/conditional.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conditional.d.ts","sourceRoot":"","sources":["../../src/internal/conditional.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,WAAW,EACX,YAAiB,EAClB,EAAE;IACD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,iBAAiB,CAAA;CACjC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAYrC;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAE1E"}
+{"version":3,"file":"conditional.d.ts","sourceRoot":"","sources":["../../src/internal/conditional.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,OAAO,CAAA;CACtB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,EAC3B,WAAW,EACX,YAAiB,EACjB,KAAK,EACN,EAAE;IACD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,iBAAiB,CAAA;IAChC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAerC;AAED;;;;;;;GAOG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAE1E"}

package/dist/internal/conditional.js

@@ -8,9 +8,13 @@
  * @param [options.contentType] {string}          the body content-type, if any
  * @param [options.precondition] {WritePrecondition}   the conditional-write
  *   precondition
+ * @param [options.epoch] {string}   the key-epoch id an encrypting codec
+ *   encrypted this write under; emitted as the `WAS-Key-Epoch` header so the
+ *   server stamps the Resource's epoch. Omitted when absent (which clears any
+ *   prior stamp on the server).
  * @returns {Record<string, string> | undefined}
  */
-export function writeHeaders({ contentType, precondition = {} }) {
+export function writeHeaders({ contentType, precondition = {}, epoch }) {
     const headers = {};
     if (contentType) {
         headers['content-type'] = contentType;
@@ -21,6 +25,9 @@ export function writeHeaders({ contentType, precondition = {} }) {
     if (precondition.ifNoneMatch) {
         headers['if-none-match'] = '*';
     }
+    if (epoch !== undefined) {
+        headers['was-key-epoch'] = epoch;
+    }
     return Object.keys(headers).length > 0 ? headers : undefined;
 }
 /**

package/dist/internal/conditional.js.map

@@ -1 +1 @@
-{"version":3,"file":"conditional.js","sourceRoot":"","sources":["../../src/internal/conditional.ts"],"names":[],"mappings":"AAqBA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,WAAW,EACX,YAAY,GAAG,EAAE,EAIlB;IACC,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,cAAc,CAAC,GAAG,WAAW,CAAA;IACvC,CAAC;IACD,IAAI,YAAY,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,OAAO,CAAA;IAC5C,CAAC;IACD,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;QAC7B,OAAO,CAAC,eAAe,CAAC,GAAG,GAAG,CAAA;IAChC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,QAA6B;IACpD,OAAO,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAA;AACnD,CAAC"}
+{"version":3,"file":"conditional.js","sourceRoot":"","sources":["../../src/internal/conditional.ts"],"names":[],"mappings":"AAqBA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,WAAW,EACX,YAAY,GAAG,EAAE,EACjB,KAAK,EAKN;IACC,MAAM,OAAO,GAA2B,EAAE,CAAA;IAC1C,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,cAAc,CAAC,GAAG,WAAW,CAAA;IACvC,CAAC;IACD,IAAI,YAAY,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,OAAO,CAAA;IAC5C,CAAC;IACD,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;QAC7B,OAAO,CAAC,eAAe,CAAC,GAAG,GAAG,CAAA;IAChC,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,CAAC,eAAe,CAAC,GAAG,KAAK,CAAA;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,QAA6B;IACpD,OAAO,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAA;AACnD,CAAC"}

package/dist/internal/content.d.ts

@@ -33,7 +33,7 @@ export declare function isJsonContentType(contentType: string): boolean;
  * suffix such as `image/svg+xml` / `application/atom+xml`). Kept deliberately
  * narrow: an unlisted type is treated as binary (base64), which is always
  * byte-safe, and the caller additionally gates on valid UTF-8 before choosing
- * text. Any `; charset=…` parameter is ignored.
+ * text. Any `; charset=...` parameter is ignored.
  *
  * @param contentType {string}
  * @returns {boolean}
@@ -145,7 +145,7 @@ export declare function createdId(response: HttpResponse | null): string;
  * Unwraps a read response's pre-parsed JSON `data` as `T`, mapping a `null`
  * response (a 404 that a `read` request resolved to `null`) to `null`. The
  * http-client leaves `data` undefined for a non-JSON content-type or a 204;
- * that is also mapped to `null`, so the declared `T | null` is honest and a
+ * that is also mapped to `null`, so the declared `T | null` is correct and a
  * caller never dereferences `undefined` cast as `T`.
  *
  * @param response {HttpResponse | null}

package/dist/internal/content.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/internal/content.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAUrD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAO9D;AA6BD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAEpD;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAK1D;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,IAAI,GAAG,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAEvB;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,IAAI,EACJ,WAAW,EACX,EAAE,EACH,EAAE;IACD,IAAI,EAAE,YAAY,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ,GAAG,eAAe,CAoBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACxD,YAAY,CAiCd;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,GAAG,MAAM,CAqB/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAIrE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,YAAY,GAAG,IAAI,GAC5B,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAS7B"}
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/internal/content.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAUrD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAO9D;AA6BD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAEpD;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAK1D;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,IAAI,GAAG,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAEvB;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,IAAI,EACJ,WAAW,EACX,EAAE,EACH,EAAE;IACD,IAAI,EAAE,YAAY,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ,GAAG,eAAe,CAwBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACxD,YAAY,CAiCd;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,GAAG,MAAM,CA4B/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAIrE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,YAAY,GAAG,IAAI,GAC5B,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAS7B"}