@interop/was-client 0.27.0 → 0.28.0

package/dist/sync/provisioning.js

@@ -1,41 +1,74 @@
+// A direct module import (not the `./edv` subpath entry), so the crypto-free
+// sync module does not pull the EDV crypto graph for one number.
+import { EDV_SCHEME_VERSION } from '../edv/constants.js';
 /**
  * Ensures the controller's Space exists and one synced collection is
- * configured. An `'edv'` collection declares the encryption descriptor `{
- * scheme: 'edv' }` (so the server stores only ciphertext it can never decrypt);
- * a `'plaintext'` collection is configured without one, with `force` so the
- * descriptor-less upsert can create a fresh collection (running with the root
- * capability, a 404 from the pre-merge describe really means absent). A public
- * collection additionally gets a collection-level world-read grant
- * (`setPublic`), which is what makes a resource URL in it resolve for anyone.
- * Runs full-tier -- the client invokes its own root capability.
+ * configured, without overwriting anything already there. The Space is
+ * described first and configured only when absent -- an existing Space keeps
+ * its name AND its controller, so `controllerDid` is used only at creation
+ * (a joined client re-running this never rewrites the description). The
+ * collection likewise: when absent, an `'edv'` collection is created with the
+ * encryption descriptor `{ scheme: 'edv', version: EDV_SCHEME_VERSION }`, so
+ * the server stores only ciphertext it can never decrypt and validates every
+ * write against the declared envelope wire format -- the same version the
+ * cipher binds into each envelope's AEAD-protected header, so descriptor and
+ * envelopes cannot drift; a `'plaintext'` collection is created without one,
+ * with `force` so the descriptor-less upsert can create a fresh collection
+ * (running full-tier, a 404 from the pre-merge describe really means absent).
+ * An existing collection that lacks a descriptor an `'edv'` spec calls for
+ * gets the late in-place declaration (set-once on the server); one that
+ * already carries a descriptor -- possibly with appended key epochs -- is
+ * left untouched, epochs and display name included. A public collection gets
+ * the collection-level world-read grant (`setPublic`, what makes a resource
+ * URL in it resolve for anyone) only when its policy does not already say so.
+ * Runs full-tier -- the client invokes its own root authority.
  *
  * @param options {object}
  * @param options.was {WasClient}
  * @param options.spaceId {string}
- * @param options.controllerDid {string}   the Space controller (e.g. `did:key`)
+ * @param options.controllerDid {string}   the Space controller (e.g. `did:key`);
+ *   used only when the Space does not exist yet
  * @param options.collectionId {string}    the WAS collection id
  * @param [options.encryption] {'edv' | 'plaintext'}   defaults to `'edv'`
  * @param [options.isPublic] {boolean}   grant collection-level world read
- * @param [options.spaceName] {string}   the Space display name; defaults to
- *   `'WAS Space'`
- * @param [options.collectionName] {string}   the collection display name;
- *   defaults to the collection id
+ * @param [options.spaceName] {string}   the Space display name, applied only at
+ *   Space creation; defaults to `'WAS Space'`
+ * @param [options.collectionName] {string}   the collection display name,
+ *   applied only at collection creation; defaults to the collection id
  * @returns {Promise<void>}
  */
 export async function ensureSpaceAndCollection({ was, spaceId, controllerDid, collectionId, encryption = 'edv', isPublic = false, spaceName = 'WAS Space', collectionName = collectionId }) {
     const space = was.space(spaceId);
     try {
-        await space.configure({ name: spaceName, controller: controllerDid });
+        if ((await space.describe()) === null) {
+            await space.configure({ name: spaceName, controller: controllerDid });
+        }
     }
     catch (err) {
         throw new Error(`Failed to configure WAS space "${spaceId}" for "${controllerDid}".`, { cause: err });
     }
     try {
         const collection = space.collection(collectionId);
-        await collection.configure(encryption === 'edv'
-            ? { name: collectionName, encryption: { scheme: 'edv' } }
-            : { name: collectionName, force: true });
-        if (isPublic) {
+        const current = await collection.describe();
+        if (current === null) {
+            await collection.configure(encryption === 'edv'
+                ? {
+                    name: collectionName,
+                    encryption: { scheme: 'edv', version: EDV_SCHEME_VERSION }
+                }
+                : { name: collectionName, force: true });
+        }
+        else if (encryption === 'edv' && current.encryption === undefined) {
+            // The late in-place declaration: adding a descriptor to a collection
+            // that lacks one is allowed (set-once), while re-sending one over an
+            // existing descriptor would drop its appended key epochs -- which is
+            // exactly why an existing descriptor is never touched.
+            await collection.configure({
+                name: current.name ?? collectionName,
+                encryption: { scheme: 'edv', version: EDV_SCHEME_VERSION }
+            });
+        }
+        if (isPublic && !(await collection.isPublic())) {
             await collection.setPublic();
         }
     }

package/dist/sync/provisioning.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../../src/sync/provisioning.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,GAAG,EACH,OAAO,EACP,aAAa,EACb,YAAY,EACZ,UAAU,GAAG,KAAK,EAClB,QAAQ,GAAG,KAAK,EAChB,SAAS,GAAG,WAAW,EACvB,cAAc,GAAG,YAAY,EAU9B;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEhC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,kCAAkC,OAAO,UAAU,aAAa,IAAI,EACpE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;QACjD,MAAM,UAAU,CAAC,SAAS,CACxB,UAAU,KAAK,KAAK;YAClB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;YACzD,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAC1C,CAAA;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,UAAU,CAAC,SAAS,EAAE,CAAA;QAC9B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mCAAmC,YAAY,eAAe,OAAO,IAAI,EACzE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../../src/sync/provisioning.ts"],"names":[],"mappings":"AAaA,6EAA6E;AAC7E,iEAAiE;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,GAAG,EACH,OAAO,EACP,aAAa,EACb,YAAY,EACZ,UAAU,GAAG,KAAK,EAClB,QAAQ,GAAG,KAAK,EAChB,SAAS,GAAG,WAAW,EACvB,cAAc,GAAG,YAAY,EAU9B;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEhC,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,kCAAkC,OAAO,UAAU,aAAa,IAAI,EACpE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAA;QAC3C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,UAAU,CAAC,SAAS,CACxB,UAAU,KAAK,KAAK;gBAClB,CAAC,CAAC;oBACE,IAAI,EAAE,cAAc;oBACpB,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE;iBAC3D;gBACH,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAC1C,CAAA;QACH,CAAC;aAAM,IAAI,UAAU,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,qEAAqE;YACrE,uDAAuD;YACvD,MAAM,UAAU,CAAC,SAAS,CAAC;gBACzB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,cAAc;gBACpC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE;aAC3D,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC/C,MAAM,UAAU,CAAC,SAAS,EAAE,CAAA;QAC9B,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mCAAmC,YAAY,eAAe,OAAO,IAAI,EACzE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/sync/types.d.ts

@@ -40,16 +40,16 @@ export type WireDoc = ChangeDocument;
 export type SyncPage = ChangesPage;
 /**
  * The current master state of a single resource, read back for the 412-conflict
- * path ({@link WasSyncPort.get}). `deleted` distinguishes a tombstone from a
- * live resource. `updatedAt`, `metaVersion`, `custom`, `createdBy`, and `epoch`
- * are populated from the resource's `/meta` document when it exists; a resource
- * with no metadata yet reports an epoch-zero `updatedAt` placeholder (a valid,
- * sortable timestamp -- the change feed remains the authority on ordering).
+ * path ({@link WasSyncPort.get}). An absent or tombstoned resource surfaces as
+ * `get` resolving `null`, never as a `MasterState`. `updatedAt`, `metaVersion`,
+ * `custom`, `createdBy`, and `epoch` are populated from the resource's `/meta`
+ * document when it exists; a resource with no metadata yet reports an
+ * epoch-zero `updatedAt` placeholder (a valid, sortable timestamp -- the
+ * change feed remains the authority on ordering).
  */
 export interface MasterState {
     version: number;
     updatedAt: string;
-    deleted: boolean;
     metaVersion?: number;
     data?: Json;
     custom?: Json;
@@ -74,10 +74,7 @@ export interface WasSyncPort {
     query(options: {
         checkpoint?: SyncCheckpoint;
         limit: number;
-    }): Promise<{
-        documents: WireDoc[];
-        checkpoint: SyncCheckpoint | null;
-    }>;
+    }): Promise<SyncPage>;
     /**
      * Conditionally writes the content body verbatim (`PUT /:id`). Pass
      * `ifNoneMatch: true` for create-if-absent, or `ifMatch` (a quoted ETag over

package/dist/sync/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,WAAW,EACZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAEvC,YAAY,EAAE,IAAI,EAAE,CAAA;AAEpB;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAE9C;;;;;;;;GAQG;AACH,MAAM,MAAM,OAAO,GAAG,cAAc,CAAA;AAEpC;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAA;AAElC;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE;QAAE,UAAU,CAAC,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QACtE,SAAS,EAAE,OAAO,EAAE,CAAA;QACpB,UAAU,EAAE,cAAc,GAAG,IAAI,CAAA;KAClC,CAAC,CAAA;IAEF;;;;;;;OAOG;IACH,UAAU,CAAC,OAAO,EAAE;QAClB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,IAAI,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;QACrB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAEnB;;;;;;OAMG;IACH,aAAa,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAEzE;;;;OAIG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE;QAChB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,IAAI,CAAA;QACZ,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;OAKG;IACH,GAAG,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,IAAI,CAAA;KACX,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3D,aAAa,CAAC,CAAC,OAAO,EAAE;QACtB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,IAAI,CAAA;QACV,OAAO,EAAE,IAAI,CAAA;KACd,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3D,OAAO,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,WAAW,EACZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAEvC,YAAY,EAAE,IAAI,EAAE,CAAA;AAEpB;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAE9C;;;;;;;;GAQG;AACH,MAAM,MAAM,OAAO,GAAG,cAAc,CAAA;AAEpC;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAA;AAElC;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE;QACb,UAAU,CAAC,EAAE,cAAc,CAAA;QAC3B,KAAK,EAAE,MAAM,CAAA;KACd,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAErB;;;;;;;OAOG;IACH,UAAU,CAAC,OAAO,EAAE;QAClB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,IAAI,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;QACrB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAEnB;;;;;;OAMG;IACH,aAAa,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAEzE;;;;OAIG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE;QAChB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,IAAI,CAAA;QACZ,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;OAKG;IACH,GAAG,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,IAAI,CAAA;KACX,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3D,aAAa,CAAC,CAAC,OAAO,EAAE;QACtB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,IAAI,CAAA;QACV,OAAO,EAAE,IAAI,CAAA;KACd,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3D,OAAO,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/was-client",
   "description": "A developer-friendly client for Wallet Attached Storage (WAS) servers.",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -56,25 +56,25 @@
     "@interop/minimal-cipher": "^7.8.1",
     "@interop/storage-core": "^0.3.13",
     "@interop/x25519-key-agreement-key": "^5.2.1",
-    "@noble/hashes": "^2.2.0",
+    "@noble/hashes": "^2.3.0",
     "@scure/base": "^2.2.0",
     "json-canonicalize": "^2.0.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@interop/ed25519-verification-key": "^8.0.3",
-    "@playwright/test": "^1.60.0",
-    "@types/node": "^25.9.1",
-    "@vitest/coverage-v8": "^4.1.7",
-    "eslint": "^10.4.0",
+    "@playwright/test": "^1.62.1",
+    "@types/node": "^26.1.2",
+    "@vitest/coverage-v8": "^4.1.10",
+    "eslint": "^10.8.0",
     "eslint-config-prettier": "^10.1.8",
-    "globals": "^17.6.0",
-    "prettier": "^3.8.3",
+    "globals": "^17.9.0",
+    "prettier": "^3.9.6",
     "rimraf": "^6.1.3",
-    "typescript": "^5.9.3",
-    "typescript-eslint": "^8.59.4",
-    "vite": "^8.0.14",
-    "vitest": "^4.1.7"
+    "typescript": "~6.0.3",
+    "typescript-eslint": "^8.66.0",
+    "vite": "^8.2.1",
+    "vitest": "^4.1.10"
   },
   "publishConfig": {
     "access": "public",
@@ -86,7 +86,7 @@
     "zcap",
     "ezcap"
   ],
-  "packageManager": "pnpm@11.5.0",
+  "packageManager": "pnpm@11.20.0",
   "engines": {
     "node": ">=24.0"
   },