@interop/was-client 0.14.5 → 0.16.0

package/dist/edv/WasTransport.d.ts

@@ -32,16 +32,20 @@
  * feature). `updateIndex` throws: in this profile the `indexed` array rides
  * inside the stored document envelope, so `update()` IS the re-index
  * operation and no separate index endpoint exists. Chunked streams
- * (`storeChunk` / `getChunk`) still require the server's `chunked-streams`
- * affordance (the reserved `/{id}/chunks/{n}` sub-segment), which neither
- * reference backend provides, so they throw.
+ * (`storeChunk` / `getChunk`) map each EDV chunk onto the reserved
+ * `/{id}/chunks/{n}` sub-segment (the server's `chunked-streams` affordance),
+ * storing the chunk object as an opaque JSON body -- so `EdvClientCore.insert({
+ * stream })` / `getStream` drive chunked encrypted blobs over a WAS server
+ * unchanged. Both chunk methods are gated on the backend advertising
+ * `chunked-streams` (throwing `NotSupportedError` when it is absent), like
+ * `find` is on `blinded-index-query`.
  * `insert` uses an atomic `If-None-Match: *` create when the backend
  * advertises the optional `conditional-writes` feature; otherwise (and for
  * `update`) writes are advisory -- the EDV `sequence` is not enforced
  * (last-writer-wins on `update`).
  */
 import { Transport } from '@interop/edv-client';
-import type { IEDVQuery, IEncryptedDocument } from '@interop/data-integrity-core';
+import type { IEDVChunk, IEDVQuery, IEncryptedDocument } from '@interop/data-integrity-core';
 import type { WasClient } from '../WasClient.js';
 import { JOSE_CONTENT_TYPE } from './constants.js';
 export { JOSE_CONTENT_TYPE };
@@ -55,7 +59,7 @@ export declare class WasTransport extends Transport {
     readonly collectionId: string;
     readonly contentType: string;
     private readonly _was;
-    private _backendFeaturesPromise?;
+    private readonly _features;
     /**
      * @param options {object}
      * @param options.was {WasClient}          a WAS client holding the signer
@@ -94,42 +98,6 @@ export declare class WasTransport extends Transport {
      * @returns {Promise<HttpResponse>}
      */
     private _put;
-    /**
-     * The feature tokens the collection's backend advertises in its "Collection
-     * Backend Selected" descriptor (e.g. `conditional-writes`,
-     * `blinded-index-query`). Memoized once it produces a definitive answer: a
-     * successful read (including one that lists no features) and a definitive
-     * "endpoint absent" (`404` / `405` / `501`) both resolve to a cached feature
-     * list, so every affordance gate falls closed against a server that has no
-     * backend descriptors.
-     *
-     * A transient/ambiguous failure (network error, timeout, `401`, `429`, other
-     * `5xx`) is NOT cached: the memo is cleared so the next call re-probes, and
-     * the error is rethrown so the caller fails loud rather than silently
-     * degrading atomicity against a server that may well be capable. (A single
-     * transient failure must not poison the transport for its lifetime.)
-     *
-     * @returns {Promise<string[]>}
-     */
-    private _backendFeatures;
-    /**
-     * Reads and parses the backend descriptor once. On a definitive answer
-     * (success, or a `404` / `405` / `501` that means the endpoint is legitimately
-     * absent) resolves the feature list, which `_backendFeatures` then caches. On
-     * a transient failure, clears the memo (so the next call re-probes) and
-     * rethrows.
-     *
-     * @returns {Promise<string[]>}
-     */
-    private _probeBackendFeatures;
-    /**
-     * Whether the collection's backend advertises the optional
-     * `conditional-writes` feature, so `insert` can use an atomic
-     * `If-None-Match: *` create instead of the advisory existence-check path.
-     *
-     * @returns {Promise<boolean>}
-     */
-    private _conditionalWrites;
     /**
      * @inheritdoc
      *
@@ -185,6 +153,16 @@ export declare class WasTransport extends Transport {
     get({ id }?: {
         id?: string;
     }): Promise<IEncryptedDocument>;
+    /**
+     * Throws a `NotSupportedError` (the name `EdvClientCore` dispatches on)
+     * unless the collection's backend advertises the given affordance token --
+     * the shared gate in front of every optional-feature operation.
+     *
+     * @param feature {string}   the affordance token (e.g. `chunked-streams`)
+     * @param what {string}      the operation name, for the message
+     * @returns {Promise<void>}
+     */
+    private _requireFeature;
     /**
      * Resolves to `true` if a resource exists at the document's path, via a
      * bodiless `HEAD` (the stored envelope is not needed, only its existence). A
@@ -230,26 +208,56 @@ export declare class WasTransport extends Transport {
      */
     updateIndex(): Promise<never>;
     /**
-     * @inheritdoc
+     * The WAS path of one chunk of a document, delegating to the internal
+     * `resourceChunkPath` builder (member form, no trailing slash --
+     * put/get/delete one chunk by index).
      *
-     * Chunked streams need the reserved `/{id}/chunks/{n}` sub-segment.
+     * @param docId {string}       the EDV document id (= WAS resource id)
+     * @param chunkIndex {number}   the chunk's non-negative ordinal index
+     * @returns {string}
      */
-    storeChunk(): Promise<never>;
+    private _chunkPath;
     /**
      * @inheritdoc
      *
-     * Chunked streams need the reserved `/{id}/chunks/{n}` sub-segment.
+     * Stores one encrypted chunk of a document's data stream. The EDV chunk
+     * object (`{ sequence, index, jwe, offset }`) is serialized to JSON and
+     * `PUT` as an opaque binary body ({@link CHUNK_CONTENT_TYPE}) to the chunk's
+     * own URL (`.../chunks/{index}`), signed like every other write. The server
+     * stores the bytes verbatim -- it never parses the chunk -- so any
+     * client-side crypto framing is transparent to it. Requires the backend's
+     * `chunked-streams` affordance (throws `NotSupportedError` when it is
+     * absent). The parent Resource must already exist
+     * (`EdvClientCore.insert`/`update` writes the document envelope before
+     * draining the stream), so a 404 here surfaces as a `NotFoundError`.
+     *
+     * @param options {object}
+     * @param options.docId {string}     the owning document id (= WAS resource id)
+     * @param options.chunk {IEDVChunk}   the encrypted chunk to store
+     * @returns {Promise<void>}
      */
-    getChunk(): Promise<never>;
+    storeChunk({ docId, chunk }?: {
+        docId?: string;
+        chunk?: IEDVChunk;
+    }): Promise<void>;
     /**
-     * Throws a uniform "not supported in this profile" error for the chunked-
-     * stream operations, which depend on a server-side affordance (the reserved
-     * `/{id}/chunks/{n}` sub-segment, the `chunked-streams` backend feature)
-     * that neither reference backend provides yet.
+     * @inheritdoc
      *
-     * @param operation {string}
-     * @returns {never}
+     * Reads one encrypted chunk back by index, `GET`ting the chunk's own URL and
+     * parsing the opaque body (stored as raw bytes, so parsed client-side) back
+     * into the EDV chunk object the decrypt stream consumes. Requires the
+     * backend's `chunked-streams` affordance (throws `NotSupportedError` when it
+     * is absent). A missing chunk (404) surfaces as a `NotFoundError` (the name
+     * `EdvClientCore` expects), so a reassembling reader can distinguish it.
+     *
+     * @param options {object}
+     * @param options.docId {string}        the owning document id
+     * @param options.chunkIndex {number}   the chunk's ordinal index
+     * @returns {Promise<IEDVChunk>}
      */
-    private _unsupported;
+    getChunk({ docId, chunkIndex }?: {
+        docId?: string;
+        chunkIndex?: number;
+    }): Promise<IEDVChunk>;
 }
 //# sourceMappingURL=WasTransport.d.ts.map

package/dist/edv/WasTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WasTransport.d.ts","sourceRoot":"","sources":["../../src/edv/WasTransport.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C,OAAO,KAAK,EACV,SAAS,EACT,kBAAkB,EACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAQhD,OAAO,EAGL,iBAAiB,EAClB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAc5B;;;GAGG;AACH,KAAK,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;AA8B9C,qBAAa,YAAa,SAAQ,SAAS;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAE5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;IACnC,OAAO,CAAC,uBAAuB,CAAC,CAAmB;IAEnD;;;;;;;;;OASG;gBACS,EACV,GAAG,EACH,OAAO,EACP,YAAY,EACZ,WAAkC,EACnC,EAAE;QACD,GAAG,EAAE,YAAY,CAAA;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB;IAQD;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAIrB;;;;;;;;;;OAUG;YACW,IAAI;IAclB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,gBAAgB;IAKxB;;;;;;;;OAQG;YACW,qBAAqB;IA0BnC;;;;;;OAMG;YACW,kBAAkB;IAIhC;;;;;;;;;;;;;;;;OAgBG;IACY,MAAM,CAAC,EACpB,SAAS,EACV,GAAE;QAAE,SAAS,CAAC,EAAE,kBAAkB,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD1D;;;;;;;;;;;;;;;;;;OAkBG;IACY,MAAM,CAAC,EACpB,SAAS,EACV,GAAE;QAAE,SAAS,CAAC,EAAE,kBAAkB,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B1D;;;;;;;;;OASG;IACY,GAAG,CAAC,EACjB,EAAE,EACH,GAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAuBrD;;;;;;;OAOG;YACW,OAAO;IAYrB;;;;;;;;;;;;;;;;;;;;OAoBG;IACY,IAAI,CAAC,EAAE,KAAK,EAAE,GAAE;QAAE,KAAK,CAAC,EAAE,SAAS,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAyC3E;;;;;;;;;OASG;IACY,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC;IAU5C;;;;OAIG;IACY,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAI3C;;;;OAIG;IACY,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC;IAIzC;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;CAQrB"}
+{"version":3,"file":"WasTransport.d.ts","sourceRoot":"","sources":["../../src/edv/WasTransport.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C,OAAO,KAAK,EACV,SAAS,EACT,SAAS,EACT,kBAAkB,EACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAUhD,OAAO,EAGL,iBAAiB,EAClB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAsB5B;;;GAGG;AACH,KAAK,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;AAqD9C,qBAAa,YAAa,SAAQ,SAAS;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAE5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAE3C;;;;;;;;;OASG;gBACS,EACV,GAAG,EACH,OAAO,EACP,YAAY,EACZ,WAAkC,EACnC,EAAE;QACD,GAAG,EAAE,YAAY,CAAA;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB;IAkBD;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAIrB;;;;;;;;;;OAUG;YACW,IAAI;IAclB;;;;;;;;;;;;;;;;OAgBG;IACY,MAAM,CAAC,EACpB,SAAS,EACV,GAAE;QAAE,SAAS,CAAC,EAAE,kBAAkB,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAoC1D;;;;;;;;;;;;;;;;;;OAkBG;IACY,MAAM,CAAC,EACpB,SAAS,EACV,GAAE;QAAE,SAAS,CAAC,EAAE,kBAAkB,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAmB1D;;;;;;;;;OASG;IACY,GAAG,CAAC,EACjB,EAAE,EACH,GAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkBrD;;;;;;;;OAQG;YACW,eAAe;IAW7B;;;;;;;OAOG;YACW,OAAO;IAYrB;;;;;;;;;;;;;;;;;;;;OAoBG;IACY,IAAI,CAAC,EAAE,KAAK,EAAE,GAAE;QAAE,KAAK,CAAC,EAAE,SAAS,CAAA;KAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IA6B3E;;;;;;;;;OASG;IACY,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC;IAU5C;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAU;IAIlB;;;;;;;;;;;;;;;;;;OAkBG;IACY,UAAU,CAAC,EACxB,KAAK,EACL,KAAK,EACN,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B7D;;;;;;;;;;;;;;OAcG;IACY,QAAQ,CAAC,EACtB,KAAK,EACL,UAAU,EACX,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,SAAS,CAAC;CA6BrE"}

package/dist/edv/WasTransport.js

@@ -32,9 +32,13 @@
  * feature). `updateIndex` throws: in this profile the `indexed` array rides
  * inside the stored document envelope, so `update()` IS the re-index
  * operation and no separate index endpoint exists. Chunked streams
- * (`storeChunk` / `getChunk`) still require the server's `chunked-streams`
- * affordance (the reserved `/{id}/chunks/{n}` sub-segment), which neither
- * reference backend provides, so they throw.
+ * (`storeChunk` / `getChunk`) map each EDV chunk onto the reserved
+ * `/{id}/chunks/{n}` sub-segment (the server's `chunked-streams` affordance),
+ * storing the chunk object as an opaque JSON body -- so `EdvClientCore.insert({
+ * stream })` / `getStream` drive chunked encrypted blobs over a WAS server
+ * unchanged. Both chunk methods are gated on the backend advertising
+ * `chunked-streams` (throwing `NotSupportedError` when it is absent), like
+ * `find` is on `blinded-index-query`.
  * `insert` uses an atomic `If-None-Match: *` create when the backend
  * advertises the optional `conditional-writes` feature; otherwise (and for
  * `update`) writes are advisory -- the EDV `sequence` is not enforced
@@ -42,21 +46,28 @@
  */
 import { Transport } from '@interop/edv-client';
 import { httpStatus } from '../errors.js';
+import { BackendFeatures } from '../internal/features.js';
 import { readJsonData } from '../internal/content.js';
-import { collectionBackend, collectionQuery, resourcePath } from '../internal/paths.js';
+import { collectionBackend, collectionQuery, resourceChunkPath, resourcePath } from '../internal/paths.js';
 import { DEFAULT_CONTENT_TYPE, envelopeBytes, JOSE_CONTENT_TYPE } from './constants.js';
 export { JOSE_CONTENT_TYPE };
 /**
- * HTTP statuses that mean the backend-descriptor endpoint is legitimately
- * absent (or explicitly unimplemented), as opposed to transiently failing:
- * `404` (no such endpoint), `405` (endpoint does not answer `GET`), `501`
- * (not implemented). These are a definitive "this server advertises no
- * backend features" answer and are safe to cache -- every affordance gate
- * then falls closed against a server that has no backend descriptors. Any
- * other failure (network error, timeout, `401`, `429`, other `5xx`) is
- * transient/ambiguous and is re-probed instead of cached.
+ * The content type a serialized EDV chunk is stored under. Deliberately an
+ * opaque binary type (not `application/json`): the chunk is `PUT` as raw bytes
+ * so the server routes it through its streaming binary write path (bounded by
+ * the backend's `maxUploadBytes`, tens of MiB) rather than the in-memory JSON
+ * body parser (a ~1 MiB cap that a full encrypted chunk would exceed). The
+ * body is still JSON text -- the server stores it verbatim and never parses it,
+ * so `getChunk` decodes and parses it back client-side.
  */
-const DESCRIPTOR_ABSENT_STATUSES = new Set([404, 405, 501]);
+const CHUNK_CONTENT_TYPE = 'application/octet-stream';
+/**
+ * The message for the EDV unique-attribute collision (HTTP 409): a
+ * `unique: true` blinded attribute value already held by another document.
+ * Shared by every write method that can trip it.
+ */
+const DUPLICATE_ATTRIBUTE_MESSAGE = 'A unique indexed attribute value is already held by another document in ' +
+    'this collection.';
 /**
  * Builds an `Error` carrying the `name` that `EdvClientCore` (and the reference
  * `HttpsTransport`) dispatch on -- `DuplicateError`, `InvalidStateError`,
@@ -76,12 +87,31 @@ function namedError({ name, message, cause }) {
     }
     return err;
 }
+/**
+ * Rethrows a caught transport error as the named error `EdvClientCore`
+ * dispatches on, selected by the error's HTTP status from `mapping`; an
+ * unmapped status (or a non-HTTP error) is rethrown verbatim. The single
+ * status-to-named-error funnel every transport method's catch goes through.
+ *
+ * @param err {unknown}   the caught error
+ * @param mapping {object}   HTTP status to `{ name, message }` of the named
+ *   error to throw in its place (the original error becomes its `cause`)
+ * @returns {never}
+ */
+function mapTransportError(err, mapping) {
+    const status = httpStatus(err);
+    const entry = status === undefined ? undefined : mapping[status];
+    if (entry) {
+        throw namedError({ ...entry, cause: err });
+    }
+    throw err;
+}
 export class WasTransport extends Transport {
     spaceId;
     collectionId;
     contentType;
     _was;
-    _backendFeaturesPromise;
+    _features;
     /**
      * @param options {object}
      * @param options.was {WasClient}          a WAS client holding the signer
@@ -98,6 +128,16 @@ export class WasTransport extends Transport {
         this.spaceId = spaceId;
         this.collectionId = collectionId;
         this.contentType = contentType;
+        // The shared memoizing feature probe (see `BackendFeatures` for the
+        // definitive-vs-transient caching rules), reading this collection's
+        // "Collection Backend Selected" descriptor with a signed GET.
+        this._features = new BackendFeatures(async () => {
+            const response = await this._was.request({
+                path: collectionBackend(this.spaceId, this.collectionId),
+                method: 'GET'
+            });
+            return readJsonData(response);
+        });
     }
     /**
      * The WAS resource path for a document id, delegating to was-client's
@@ -131,68 +171,6 @@ export class WasTransport extends Transport {
             headers: { 'content-type': this.contentType, ...headers }
         });
     }
-    /**
-     * The feature tokens the collection's backend advertises in its "Collection
-     * Backend Selected" descriptor (e.g. `conditional-writes`,
-     * `blinded-index-query`). Memoized once it produces a definitive answer: a
-     * successful read (including one that lists no features) and a definitive
-     * "endpoint absent" (`404` / `405` / `501`) both resolve to a cached feature
-     * list, so every affordance gate falls closed against a server that has no
-     * backend descriptors.
-     *
-     * A transient/ambiguous failure (network error, timeout, `401`, `429`, other
-     * `5xx`) is NOT cached: the memo is cleared so the next call re-probes, and
-     * the error is rethrown so the caller fails loud rather than silently
-     * degrading atomicity against a server that may well be capable. (A single
-     * transient failure must not poison the transport for its lifetime.)
-     *
-     * @returns {Promise<string[]>}
-     */
-    _backendFeatures() {
-        this._backendFeaturesPromise ??= this._probeBackendFeatures();
-        return this._backendFeaturesPromise;
-    }
-    /**
-     * Reads and parses the backend descriptor once. On a definitive answer
-     * (success, or a `404` / `405` / `501` that means the endpoint is legitimately
-     * absent) resolves the feature list, which `_backendFeatures` then caches. On
-     * a transient failure, clears the memo (so the next call re-probes) and
-     * rethrows.
-     *
-     * @returns {Promise<string[]>}
-     */
-    async _probeBackendFeatures() {
-        try {
-            const response = await this._was.request({
-                path: collectionBackend(this.spaceId, this.collectionId),
-                method: 'GET'
-            });
-            const descriptor = (await readJsonData(response));
-            return Array.isArray(descriptor?.features)
-                ? descriptor.features.filter((feature) => typeof feature === 'string')
-                : [];
-        }
-        catch (err) {
-            const status = httpStatus(err);
-            if (status !== undefined && DESCRIPTOR_ABSENT_STATUSES.has(status)) {
-                return [];
-            }
-            // Transient/ambiguous: do not cache this failure -- drop the memo so the
-            // next call re-probes -- and rethrow.
-            this._backendFeaturesPromise = undefined;
-            throw err;
-        }
-    }
-    /**
-     * Whether the collection's backend advertises the optional
-     * `conditional-writes` feature, so `insert` can use an atomic
-     * `If-None-Match: *` create instead of the advisory existence-check path.
-     *
-     * @returns {Promise<boolean>}
-     */
-    async _conditionalWrites() {
-        return (await this._backendFeatures()).includes('conditional-writes');
-    }
     /**
      * @inheritdoc
      *
@@ -214,27 +192,21 @@ export class WasTransport extends Transport {
         if (!encrypted) {
             throw new TypeError('"encrypted" is required.');
         }
-        if (await this._conditionalWrites()) {
+        if (await this._features.has('conditional-writes')) {
             try {
                 await this._put(encrypted.id, encrypted, { 'if-none-match': '*' });
             }
             catch (err) {
-                if (httpStatus(err) === 412) {
-                    throw namedError({
+                mapTransportError(err, {
+                    412: {
                         name: 'DuplicateError',
-                        message: `A document with id "${encrypted.id}" already exists.`,
-                        cause: err
-                    });
-                }
-                if (httpStatus(err) === 409) {
-                    throw namedError({
+                        message: `A document with id "${encrypted.id}" already exists.`
+                    },
+                    409: {
                         name: 'DuplicateError',
-                        message: 'A unique indexed attribute value is already held by another ' +
-                            'document in this collection.',
-                        cause: err
-                    });
-                }
-                throw err;
+                        message: DUPLICATE_ATTRIBUTE_MESSAGE
+                    }
+                });
             }
             return;
         }
@@ -248,15 +220,9 @@ export class WasTransport extends Transport {
             await this._put(encrypted.id, encrypted);
         }
         catch (err) {
-            if (httpStatus(err) === 409) {
-                throw namedError({
-                    name: 'DuplicateError',
-                    message: 'A unique indexed attribute value is already held by another ' +
-                        'document in this collection.',
-                    cause: err
-                });
-            }
-            throw err;
+            mapTransportError(err, {
+                409: { name: 'DuplicateError', message: DUPLICATE_ATTRIBUTE_MESSAGE }
+            });
         }
     }
     /**
@@ -286,23 +252,14 @@ export class WasTransport extends Transport {
             await this._put(encrypted.id, encrypted);
         }
         catch (err) {
-            if (httpStatus(err) === 412) {
-                throw namedError({
+            mapTransportError(err, {
+                412: {
                     name: 'InvalidStateError',
                     message: 'Document update conflict: the stored document changed since it ' +
-                        'was read. Re-fetch the current document and retry.',
-                    cause: err
-                });
-            }
-            if (httpStatus(err) === 409) {
-                throw namedError({
-                    name: 'DuplicateError',
-                    message: 'A unique indexed attribute value is already held by another ' +
-                        'document in this collection.',
-                    cause: err
-                });
-            }
-            throw err;
+                        'was read. Re-fetch the current document and retry.'
+                },
+                409: { name: 'DuplicateError', message: DUPLICATE_ATTRIBUTE_MESSAGE }
+            });
         }
     }
     /**
@@ -327,17 +284,30 @@ export class WasTransport extends Transport {
             });
         }
         catch (err) {
-            if (httpStatus(err) === 404) {
-                throw namedError({
-                    name: 'NotFoundError',
-                    message: 'Document not found.',
-                    cause: err
-                });
-            }
-            throw err;
+            mapTransportError(err, {
+                404: { name: 'NotFoundError', message: 'Document not found.' }
+            });
         }
         return (await readJsonData(response));
     }
+    /**
+     * Throws a `NotSupportedError` (the name `EdvClientCore` dispatches on)
+     * unless the collection's backend advertises the given affordance token --
+     * the shared gate in front of every optional-feature operation.
+     *
+     * @param feature {string}   the affordance token (e.g. `chunked-streams`)
+     * @param what {string}      the operation name, for the message
+     * @returns {Promise<void>}
+     */
+    async _requireFeature(feature, what) {
+        if (!(await this._features.has(feature))) {
+            throw namedError({
+                name: 'NotSupportedError',
+                message: `${what} is not supported: the collection's backend ` +
+                    `does not advertise the "${feature}" affordance.`
+            });
+        }
+    }
     /**
      * Resolves to `true` if a resource exists at the document's path, via a
      * bodiless `HEAD` (the stored envelope is not needed, only its existence). A
@@ -383,13 +353,7 @@ export class WasTransport extends Transport {
         if (!query) {
             throw new TypeError('"query" is required.');
         }
-        if (!(await this._backendFeatures()).includes('blinded-index-query')) {
-            throw namedError({
-                name: 'NotSupportedError',
-                message: "Blinded-index query is not supported: the collection's backend " +
-                    'does not advertise the "blinded-index-query" affordance.'
-            });
-        }
+        await this._requireFeature('blinded-index-query', 'Blinded-index query');
         // `returnDocuments` is a first-class `IEDVQuery` field, but the WAS profile
         // has no ids-only mode, so it is dropped (whatever its value) and full
         // documents come back -- the best-effort degradation `EdvClientCore.find`
@@ -404,14 +368,9 @@ export class WasTransport extends Transport {
             });
         }
         catch (err) {
-            if (httpStatus(err) === 404) {
-                throw namedError({
-                    name: 'NotFoundError',
-                    message: 'Collection not found.',
-                    cause: err
-                });
-            }
-            throw err;
+            mapTransportError(err, {
+                404: { name: 'NotFoundError', message: 'Collection not found.' }
+            });
         }
         const result = await readJsonData(response);
         if (result === null || typeof result !== 'object') {
@@ -438,36 +397,109 @@ export class WasTransport extends Transport {
         });
     }
     /**
-     * @inheritdoc
+     * The WAS path of one chunk of a document, delegating to the internal
+     * `resourceChunkPath` builder (member form, no trailing slash --
+     * put/get/delete one chunk by index).
      *
-     * Chunked streams need the reserved `/{id}/chunks/{n}` sub-segment.
+     * @param docId {string}       the EDV document id (= WAS resource id)
+     * @param chunkIndex {number}   the chunk's non-negative ordinal index
+     * @returns {string}
      */
-    async storeChunk() {
-        return this._unsupported('storeChunk (chunked streams)');
+    _chunkPath(docId, chunkIndex) {
+        return resourceChunkPath(this.spaceId, this.collectionId, docId, chunkIndex);
     }
     /**
      * @inheritdoc
      *
-     * Chunked streams need the reserved `/{id}/chunks/{n}` sub-segment.
+     * Stores one encrypted chunk of a document's data stream. The EDV chunk
+     * object (`{ sequence, index, jwe, offset }`) is serialized to JSON and
+     * `PUT` as an opaque binary body ({@link CHUNK_CONTENT_TYPE}) to the chunk's
+     * own URL (`.../chunks/{index}`), signed like every other write. The server
+     * stores the bytes verbatim -- it never parses the chunk -- so any
+     * client-side crypto framing is transparent to it. Requires the backend's
+     * `chunked-streams` affordance (throws `NotSupportedError` when it is
+     * absent). The parent Resource must already exist
+     * (`EdvClientCore.insert`/`update` writes the document envelope before
+     * draining the stream), so a 404 here surfaces as a `NotFoundError`.
+     *
+     * @param options {object}
+     * @param options.docId {string}     the owning document id (= WAS resource id)
+     * @param options.chunk {IEDVChunk}   the encrypted chunk to store
+     * @returns {Promise<void>}
      */
-    async getChunk() {
-        return this._unsupported('getChunk (chunked streams)');
+    async storeChunk({ docId, chunk } = {}) {
+        if (!docId) {
+            throw new TypeError('"docId" is required.');
+        }
+        if (!chunk) {
+            throw new TypeError('"chunk" is required.');
+        }
+        // Gate on the affordance before diagnosing a 404: against a server with no
+        // `/chunks/{n}` route at all, the 404 would otherwise be misreported as a
+        // missing parent document.
+        await this._requireFeature('chunked-streams', 'Chunked encrypted storage');
+        try {
+            await this._was.request({
+                path: this._chunkPath(docId, chunk.index),
+                method: 'PUT',
+                body: envelopeBytes(chunk),
+                headers: { 'content-type': CHUNK_CONTENT_TYPE }
+            });
+        }
+        catch (err) {
+            mapTransportError(err, {
+                404: {
+                    name: 'NotFoundError',
+                    message: `Cannot store chunk ${chunk.index}: the parent document ` +
+                        `"${docId}" does not exist. Write the document before its chunks.`
+                }
+            });
+        }
     }
     /**
-     * Throws a uniform "not supported in this profile" error for the chunked-
-     * stream operations, which depend on a server-side affordance (the reserved
-     * `/{id}/chunks/{n}` sub-segment, the `chunked-streams` backend feature)
-     * that neither reference backend provides yet.
+     * @inheritdoc
      *
-     * @param operation {string}
-     * @returns {never}
+     * Reads one encrypted chunk back by index, `GET`ting the chunk's own URL and
+     * parsing the opaque body (stored as raw bytes, so parsed client-side) back
+     * into the EDV chunk object the decrypt stream consumes. Requires the
+     * backend's `chunked-streams` affordance (throws `NotSupportedError` when it
+     * is absent). A missing chunk (404) surfaces as a `NotFoundError` (the name
+     * `EdvClientCore` expects), so a reassembling reader can distinguish it.
+     *
+     * @param options {object}
+     * @param options.docId {string}        the owning document id
+     * @param options.chunkIndex {number}   the chunk's ordinal index
+     * @returns {Promise<IEDVChunk>}
      */
-    _unsupported(operation) {
-        throw namedError({
-            name: 'NotSupportedError',
-            message: `"${operation}" is not supported by the EDV-over-WAS profile ` +
-                '(requires the server\'s "chunked-streams" affordance).'
-        });
+    async getChunk({ docId, chunkIndex } = {}) {
+        if (!docId) {
+            throw new TypeError('"docId" is required.');
+        }
+        if (chunkIndex === undefined) {
+            throw new TypeError('"chunkIndex" is required.');
+        }
+        // Gate on the affordance before diagnosing a 404: against a server with no
+        // `/chunks/{n}` route at all, the 404 would otherwise surface as a spurious
+        // missing-chunk (data corruption) report.
+        await this._requireFeature('chunked-streams', 'Chunked encrypted storage');
+        let response;
+        try {
+            response = await this._was.request({
+                path: this._chunkPath(docId, chunkIndex),
+                method: 'GET'
+            });
+        }
+        catch (err) {
+            mapTransportError(err, {
+                404: {
+                    name: 'NotFoundError',
+                    message: `Chunk ${chunkIndex} of document "${docId}" not found.`
+                }
+            });
+        }
+        // The chunk was stored as opaque bytes, so the http-client did not
+        // pre-parse it: decode the body text and parse the EDV chunk object back.
+        return JSON.parse(await response.text());
     }
 }
 //# sourceMappingURL=WasTransport.js.map