@interop/was-client 0.33.0 → 0.35.0

package/dist/paths.js

@@ -0,0 +1,29 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/was-client/paths` subpath entry: the WAS URL grammar as
+ * standalone functions, for a consumer that has to form a WAS path or a zcap
+ * `invocationTarget` without going through a navigational handle.
+ *
+ * The path builders own the trailing-slash canonicalization (item-create and
+ * listing endpoints carry a trailing slash; get/put/delete-by-id endpoints do
+ * not) and the per-segment percent-encoding, and the zcap `invocationTarget` is
+ * derived from the request URL -- so a caller that hand-assembles a path is
+ * re-deriving rules that must match the server's `allowedTarget` byte for byte.
+ * Exporting the builders instead is what keeps that from happening.
+ *
+ * `parseSpacePath` / `parseSpaceTarget` are the inverse grammar (a pathname or
+ * an absolute URL back to the containment depth it addresses), and
+ * `rootCapabilityId` / `rootCapability` mint the `urn:zcap:root:` capability a
+ * target's own root invocation names -- the id form for parenting an unparented
+ * grant, the object form for invoking it (`@interop/ezcap` accepts a bare root
+ * capability id only for an `https:` target, which would break against an
+ * `http://localhost` server).
+ *
+ * Kept off the core entry so a consumer opts in; every export here is a pure
+ * function with no I/O and no client state.
+ */
+export { spacePath, collectionPath, collectionItems, collectionMeta, collectionQuery, resourcePath, resourceMeta, toUrl, parseSpacePath, parseSpaceTarget } from './internal/paths.js';
+export { rootCapabilityId, rootCapability } from './internal/revoke.js';
+//# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EACL,SAAS,EACT,cAAc,EACd,eAAe,EACf,cAAc,EACd,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,cAAc,EACd,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAG5B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/sync/index.d.ts

@@ -16,16 +16,18 @@
  * - `ensureSpaceAndCollection` -- idempotent Space + Collection provisioning.
  *
  * The 412 conflict / 404 not-found port signals (`WasSyncConflictError` /
- * `WasSyncNotFoundError`) live in the client's typed error hierarchy and are
- * re-exported here for convenience -- as is the stale-descriptor decrypt
+ * `WasSyncNotFoundError`), and the opt-in revoked-access signal
+ * (`WasSyncAuthError`, raised only under `mapAuthErrors`), live in the client's
+ * typed error hierarchy and are re-exported here for convenience -- as is the
+ * stale-descriptor decrypt
  * signal (`UnknownEpochError`), so a crypto-free sync consumer can
  * `instanceof`-match it without importing the `/edv` entry that throws it.
  */
-export { createWasSyncPort, KEY_EPOCH_HEADER, formatEtag, parseEtag, errorStatus } from './port.js';
+export { createWasSyncPort, KEY_EPOCH_HEADER, formatEtag, parseEtag, errorStatus, errorMessage } from './port.js';
 export { contentCid, cidFrom, deriveSpaceId } from './cid.js';
 export { isEncryptedEnvelope } from './envelope.js';
 export { createPlaintextDocCipher } from './plaintextCipher.js';
 export { ensureSpaceAndCollection } from './provisioning.js';
-export { UnknownEpochError, WasSyncConflictError, WasSyncNotFoundError } from '../errors.js';
+export { UnknownEpochError, WasSyncAuthError, WasSyncConflictError, WasSyncNotFoundError } from '../errors.js';
 export type { Json, SyncCheckpoint, WireDoc, SyncPage, MasterState, WasSyncPort, DocCipher } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/sync/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,WAAW,EACZ,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,cAAc,CAAA;AAErB,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,QAAQ,EACR,WAAW,EACX,WAAW,EACX,SAAS,EACV,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACb,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,cAAc,CAAA;AAErB,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,QAAQ,EACR,WAAW,EACX,WAAW,EACX,SAAS,EACV,MAAM,YAAY,CAAA"}

package/dist/sync/index.js

@@ -16,15 +16,17 @@
  * - `ensureSpaceAndCollection` -- idempotent Space + Collection provisioning.
  *
  * The 412 conflict / 404 not-found port signals (`WasSyncConflictError` /
- * `WasSyncNotFoundError`) live in the client's typed error hierarchy and are
- * re-exported here for convenience -- as is the stale-descriptor decrypt
+ * `WasSyncNotFoundError`), and the opt-in revoked-access signal
+ * (`WasSyncAuthError`, raised only under `mapAuthErrors`), live in the client's
+ * typed error hierarchy and are re-exported here for convenience -- as is the
+ * stale-descriptor decrypt
  * signal (`UnknownEpochError`), so a crypto-free sync consumer can
  * `instanceof`-match it without importing the `/edv` entry that throws it.
  */
-export { createWasSyncPort, KEY_EPOCH_HEADER, formatEtag, parseEtag, errorStatus } from './port.js';
+export { createWasSyncPort, KEY_EPOCH_HEADER, formatEtag, parseEtag, errorStatus, errorMessage } from './port.js';
 export { contentCid, cidFrom, deriveSpaceId } from './cid.js';
 export { isEncryptedEnvelope } from './envelope.js';
 export { createPlaintextDocCipher } from './plaintextCipher.js';
 export { ensureSpaceAndCollection } from './provisioning.js';
-export { UnknownEpochError, WasSyncConflictError, WasSyncNotFoundError } from '../errors.js';
+export { UnknownEpochError, WasSyncAuthError, WasSyncConflictError, WasSyncNotFoundError } from '../errors.js';
 //# sourceMappingURL=index.js.map

package/dist/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,WAAW,EACZ,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACb,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,cAAc,CAAA"}

package/dist/sync/port.d.ts

@@ -27,7 +27,8 @@
  */
 import type { WasClient } from '../WasClient.js';
 import { KEY_EPOCH_HEADER } from '../internal/conditional.js';
-import { httpStatus } from '../errors.js';
+import { errorMessage, httpStatus } from '../errors.js';
+import type { IZcap } from '../types.js';
 import type { WasSyncPort } from './types.js';
 /**
  * The request header the server reads a content write's key-epoch id from,
@@ -43,6 +44,12 @@ export { KEY_EPOCH_HEADER };
  * for the client's own {@link httpStatus}.
  */
 export declare const errorStatus: typeof httpStatus;
+/**
+ * Normalizes an unknown caught error into a display string. The sync subpath's
+ * name for the client's own {@link errorMessage}, the companion to
+ * {@link errorStatus}.
+ */
+export { errorMessage };
 /**
  * Formats a numeric content `version` as the quoted strong `ETag` an
  * update-if-unchanged write passes as its `ifMatch` precondition (e.g. `3` to
@@ -62,18 +69,41 @@ export declare function formatEtag(version: number): string;
 export declare function parseEtag(etag: string | null): number | undefined;
 /**
  * Builds a {@link WasSyncPort} bound to one Space + Collection, backed by the
- * caller's signed {@link WasClient}. Requests invoke the client's own root
- * capability (no delegated `capability` is attached).
+ * caller's signed {@link WasClient}. With no `capability`, requests invoke the
+ * client's own root capability.
+ *
+ * `mapAuthErrors` exists because a WAS server MASKS an authorization failure as
+ * `404` ("not found or invalid authorization") rather than `403`, so an
+ * unauthorized caller cannot probe which resources exist. A replica that
+ * already synced its Space and Collection knows they exist, so on its sync
+ * paths a `404` can only mean the invocation itself was rejected -- the
+ * expired- or revoked-grant signal it needs in order to stop retrying and
+ * prompt for a reconnect. The reading is only safe with that knowledge, so it
+ * is opt-in: off (the default), every status behaves exactly as before.
+ *
+ * Two paths keep their own `404` semantics even when it is on, because there a
+ * `404` is a modeled outcome rather than an anomaly: `deleteContent` resolves
+ * (the tombstone's goal state already holds -- an idempotent delete), and `get`
+ * resolves `null` (absent or tombstoned -- the deletion-wins input its callers
+ * depend on). Revoked access still surfaces within one poll on `query` and on
+ * the content/metadata writes.
  *
  * @param options {object}
  * @param options.was {WasClient}       the session client (holds the signer)
  * @param options.spaceId {string}      the WAS Space id
  * @param options.collectionId {string}   the WAS collection id
+ * @param [options.capability] {IZcap}   a delegated capability to invoke on
+ *   every request this port makes (pull, writes, and reads alike); omit to
+ *   invoke the client's own root capability
+ * @param [options.mapAuthErrors] {boolean}   map `401` / `403` / the masked
+ *   `404` to {@link WasSyncAuthError} (default `false`)
  * @returns {WasSyncPort}
  */
-export declare function createWasSyncPort({ was, spaceId, collectionId }: {
+export declare function createWasSyncPort({ was, spaceId, collectionId, capability, mapAuthErrors }: {
     was: WasClient;
     spaceId: string;
     collectionId: string;
+    capability?: IZcap;
+    mapAuthErrors?: boolean;
 }): WasSyncPort;
 //# sourceMappingURL=port.d.ts.map

package/dist/sync/port.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"port.d.ts","sourceRoot":"","sources":["../../src/sync/port.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,OAAO,EACL,gBAAgB,EAGjB,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EACL,UAAU,EAGX,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAqB,WAAW,EAAE,MAAM,YAAY,CAAA;AAEhE;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAW3B;;;;;GAKG;AACH,eAAO,MAAM,WAAW,mBAAa,CAAA;AA4BrC;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAMjE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACb,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,WAAW,CAgJd"}
+{"version":3,"file":"port.d.ts","sourceRoot":"","sources":["../../src/sync/port.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhD,OAAO,EACL,gBAAgB,EAGjB,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EACL,YAAY,EACZ,UAAU,EAIX,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,EAAqB,WAAW,EAAE,MAAM,YAAY,CAAA;AAEhE;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAW3B;;;;;GAKG;AACH,eAAO,MAAM,WAAW,mBAAa,CAAA;AAErC;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,CAAA;AAmDvB;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAMjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,aAAqB,EACtB,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB,GAAG,WAAW,CAwMd"}

package/dist/sync/port.js

@@ -1,6 +1,6 @@
 import { KEY_EPOCH_HEADER, readEtag, writeHeaders } from '../internal/conditional.js';
 import { resourceMeta, resourcePath } from '../internal/paths.js';
-import { httpStatus, WasSyncConflictError, WasSyncNotFoundError } from '../errors.js';
+import { errorMessage, httpStatus, WasSyncAuthError, WasSyncConflictError, WasSyncNotFoundError } from '../errors.js';
 /**
  * The request header the server reads a content write's key-epoch id from,
  * stamping it onto the Resource's metadata. Defined next to the header
@@ -23,19 +23,41 @@ const UNKNOWN_UPDATED_AT = new Date(0).toISOString();
  * for the client's own {@link httpStatus}.
  */
 export const errorStatus = httpStatus;
+/**
+ * Normalizes an unknown caught error into a display string. The sync subpath's
+ * name for the client's own {@link errorMessage}, the companion to
+ * {@link errorStatus}.
+ */
+export { errorMessage };
+/**
+ * The statuses a WAS server can return for an authorization failure: `401` (no
+ * verifiable invocation), `403` (not permitted), and the `404` it returns when
+ * it masks an authorization failure as "not found".
+ *
+ * @param status {number | undefined}
+ * @returns {boolean}
+ */
+function isAuthStatus(status) {
+    return status === 401 || status === 403 || status === 404;
+}
 /**
  * Maps a raw write error onto the port's typed signals, rethrowing anything
  * else unchanged: `412` becomes a {@link WasSyncConflictError} for every write.
  * `notFound` opts in to the `404` mapping, which only `deleteContent` performs
  * (an already-gone target is a settled outcome for a delete, but a hard error
- * for a content or metadata write).
+ * for a content or metadata write). `authErrors` is the port's `mapAuthErrors`
+ * option: it maps `401` / `403` / the masked `404` to a
+ * {@link WasSyncAuthError}. `notFound` is checked first, so a port that asked
+ * for both still gets the delete-specific signal.
  *
  * @param err {unknown}   the caught error
  * @param [options] {object}
  * @param [options.notFound] {boolean}   map `404` to {@link WasSyncNotFoundError}
+ * @param [options.authErrors] {boolean}   map `401`/`403`/`404` to
+ *   {@link WasSyncAuthError}
  * @returns {never}   always throws
  */
-function mapWriteError(err, { notFound = false } = {}) {
+function mapWriteError(err, { notFound = false, authErrors = false } = {}) {
     const status = errorStatus(err);
     if (notFound && status === 404) {
         throw new WasSyncNotFoundError();
@@ -43,6 +65,9 @@ function mapWriteError(err, { notFound = false } = {}) {
     if (status === 412) {
         throw new WasSyncConflictError();
     }
+    if (authErrors && isAuthStatus(status)) {
+        throw new WasSyncAuthError(status);
+    }
     throw err;
 }
 /**
@@ -72,16 +97,37 @@ export function parseEtag(etag) {
 }
 /**
  * Builds a {@link WasSyncPort} bound to one Space + Collection, backed by the
- * caller's signed {@link WasClient}. Requests invoke the client's own root
- * capability (no delegated `capability` is attached).
+ * caller's signed {@link WasClient}. With no `capability`, requests invoke the
+ * client's own root capability.
+ *
+ * `mapAuthErrors` exists because a WAS server MASKS an authorization failure as
+ * `404` ("not found or invalid authorization") rather than `403`, so an
+ * unauthorized caller cannot probe which resources exist. A replica that
+ * already synced its Space and Collection knows they exist, so on its sync
+ * paths a `404` can only mean the invocation itself was rejected -- the
+ * expired- or revoked-grant signal it needs in order to stop retrying and
+ * prompt for a reconnect. The reading is only safe with that knowledge, so it
+ * is opt-in: off (the default), every status behaves exactly as before.
+ *
+ * Two paths keep their own `404` semantics even when it is on, because there a
+ * `404` is a modeled outcome rather than an anomaly: `deleteContent` resolves
+ * (the tombstone's goal state already holds -- an idempotent delete), and `get`
+ * resolves `null` (absent or tombstoned -- the deletion-wins input its callers
+ * depend on). Revoked access still surfaces within one poll on `query` and on
+ * the content/metadata writes.
  *
  * @param options {object}
  * @param options.was {WasClient}       the session client (holds the signer)
  * @param options.spaceId {string}      the WAS Space id
  * @param options.collectionId {string}   the WAS collection id
+ * @param [options.capability] {IZcap}   a delegated capability to invoke on
+ *   every request this port makes (pull, writes, and reads alike); omit to
+ *   invoke the client's own root capability
+ * @param [options.mapAuthErrors] {boolean}   map `401` / `403` / the masked
+ *   `404` to {@link WasSyncAuthError} (default `false`)
  * @returns {WasSyncPort}
  */
-export function createWasSyncPort({ was, spaceId, collectionId }) {
+export function createWasSyncPort({ was, spaceId, collectionId, capability, mapAuthErrors = false }) {
     // Paths come from the internal builders, so this port inherits the same
     // percent-encoding and reserved/dot-segment guards as the handle API.
     const contentPath = (id) => resourcePath(spaceId, collectionId, id);
@@ -89,16 +135,29 @@ export function createWasSyncPort({ was, spaceId, collectionId }) {
     // Construction is I/O-free (the codec/feature probes are lazy thunks) and
     // `changes()` never resolves the codec, so it ships the stored bodies
     // verbatim -- what this codec-bypassing port requires.
-    const changesCollection = was.space(spaceId).collection(collectionId);
+    const changesCollection = was
+        .space(spaceId)
+        .collection(collectionId, { capability });
     /** Re-reads a resource's raw content body + version (no decrypt, no `/meta`). */
     const readContent = async (id) => {
         let response;
         try {
-            response = await was.request({ path: contentPath(id), method: 'GET' });
+            response = await was.request({
+                capability,
+                path: contentPath(id),
+                method: 'GET'
+            });
         }
         catch (err) {
-            if (errorStatus(err) === 404) {
-                return null; // absent or tombstoned -- caller treats as deletion-wins
+            const status = errorStatus(err);
+            // A read's `404` stays "absent or tombstoned" even under
+            // `mapAuthErrors`: it is a modeled outcome here, and the callers read it
+            // as deletion-wins.
+            if (status === 404) {
+                return null;
+            }
+            if (mapAuthErrors && isAuthStatus(status)) {
+                throw new WasSyncAuthError(status);
             }
             throw err;
         }
@@ -118,11 +177,24 @@ export function createWasSyncPort({ was, spaceId, collectionId }) {
     };
     return {
         async query({ checkpoint, limit }) {
-            return changesCollection.changes({ checkpoint, limit });
+            try {
+                return await changesCollection.changes({ checkpoint, limit });
+            }
+            catch (err) {
+                // The pull path is where revoked access surfaces reliably: unlike a
+                // read or a delete, a `404` on the collection's own query endpoint has
+                // no benign reading once the collection is known to exist.
+                const status = errorStatus(err);
+                if (mapAuthErrors && isAuthStatus(status)) {
+                    throw new WasSyncAuthError(status);
+                }
+                throw err;
+            }
         },
         async putContent({ id, data, ifMatch, ifNoneMatch, epoch }) {
             try {
                 const response = await was.request({
+                    capability,
                     path: contentPath(id),
                     method: 'PUT',
                     json: data,
@@ -134,12 +206,13 @@ export function createWasSyncPort({ was, spaceId, collectionId }) {
                 return await ackedVersion(response, id);
             }
             catch (err) {
-                mapWriteError(err);
+                mapWriteError(err, { authErrors: mapAuthErrors });
             }
         },
         async deleteContent({ id, ifMatch }) {
             try {
                 const response = await was.request({
+                    capability,
                     path: contentPath(id),
                     method: 'DELETE',
                     headers: writeHeaders({ precondition: { ifMatch } })
@@ -147,20 +220,41 @@ export function createWasSyncPort({ was, spaceId, collectionId }) {
                 return await ackedVersion(response, id);
             }
             catch (err) {
-                mapWriteError(err, { notFound: true });
+                // Under `mapAuthErrors` a delete's `404` is an idempotent success: the
+                // resource is already gone (deleted locally before it was ever pushed,
+                // or deleted first by another replica), so the tombstone's goal state
+                // holds and the batch must not be retried forever. A masked
+                // authorization `404` is swallowed with it -- indistinguishable by
+                // design -- but revoked access still surfaces on the next `query`.
+                if (mapAuthErrors && errorStatus(err) === 404) {
+                    return undefined;
+                }
+                mapWriteError(err, {
+                    notFound: !mapAuthErrors,
+                    authErrors: mapAuthErrors
+                });
             }
         },
         async putMeta({ id, custom, ifMatch, ifNoneMatch }) {
             try {
-                await was.request({
+                const response = await was.request({
+                    capability,
                     path: metaPath(id),
                     method: 'PUT',
-                    json: { custom },
+                    // The `/meta` PUT fully replaces `custom`: a body omitting it writes
+                    // the CLEARED state (the server clears every property the body
+                    // leaves out), which is how a metadata clear replicates. Byte-
+                    // identical on the wire to the `{ custom: undefined }` this used to
+                    // send, since `JSON.stringify` drops an `undefined` member.
+                    json: custom === undefined ? {} : { custom },
                     headers: writeHeaders({ precondition: { ifMatch, ifNoneMatch } })
                 });
+                // `readEtag` reports an absent header as `undefined`; `parseEtag` reads
+                // the `null` spelling of the same thing.
+                return parseEtag(readEtag(response) ?? null);
             }
             catch (err) {
-                mapWriteError(err);
+                mapWriteError(err, { authErrors: mapAuthErrors });
             }
         },
         async get({ id }) {
@@ -168,7 +262,9 @@ export function createWasSyncPort({ was, spaceId, collectionId }) {
             // together. The metadata read settles into a value (its rejection handler
             // is attached before any `await` that can throw, so an abandoned read can
             // never surface as an unhandled rejection).
-            const metaRead = was.request({ path: metaPath(id), method: 'GET' }).then(response => ({ ok: true, response }), (err) => ({ ok: false, err }));
+            const metaRead = was
+                .request({ capability, path: metaPath(id), method: 'GET' })
+                .then(response => ({ ok: true, response }), (err) => ({ ok: false, err }));
             const master = await readContent(id);
             if (master === null) {
                 return null; // absent or tombstoned; the metadata read is discarded
@@ -179,10 +275,17 @@ export function createWasSyncPort({ was, spaceId, collectionId }) {
             // yet 404s here; only a hard error propagates.
             const meta = await metaRead;
             if (!meta.ok) {
-                if (errorStatus(meta.err) !== 404) {
-                    throw meta.err;
+                const status = errorStatus(meta.err);
+                // A `/meta` `404` is routine (the resource has no metadata document
+                // yet), so it stays benign under `mapAuthErrors` -- only `401`/`403`
+                // map there.
+                if (status === 404) {
+                    return master;
+                }
+                if (mapAuthErrors && isAuthStatus(status)) {
+                    throw new WasSyncAuthError(status);
                 }
-                return master;
+                throw meta.err;
             }
             const metaBody = meta.response.data;
             if (metaBody?.updatedAt) {

package/dist/sync/port.js.map

@@ -1 +1 @@
-{"version":3,"file":"port.js","sourceRoot":"","sources":["../../src/sync/port.ts"],"names":[],"mappings":"AA6BA,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACb,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,cAAc,CAAA;AAGrB;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAE3B;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAA;AAErC;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CACpB,GAAY,EACZ,EAAE,QAAQ,GAAG,KAAK,KAA6B,EAAE;IAEjD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,QAAQ,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAoB,EAAE,CAAA;IAClC,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,oBAAoB,EAAE,CAAA;IAClC,CAAC;IACD,MAAM,GAAG,CAAA;AACX,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,IAAI,OAAO,GAAG,CAAA;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,IAAmB;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;IAC/C,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AACzD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EAKb;IACC,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;IAC3E,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;IAExE,0EAA0E;IAC1E,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;IAErE,iFAAiF;IACjF,MAAM,WAAW,GAAG,KAAK,EAAE,EAAU,EAA+B,EAAE;QACpE,IAAI,QAAsB,CAAA;QAC1B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAA,CAAC,yDAAyD;YACvE,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO;YACL,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC;YACnD,SAAS,EAAE,kBAAkB;YAC7B,IAAI,EAAE,QAAQ,CAAC,IAAY;SAC5B,CAAA;IACH,CAAC,CAAA;IAED,kFAAkF;IAClF,MAAM,YAAY,GAAG,KAAK,EACxB,QAAsB,EACtB,EAAU,EACO,EAAE;QACnB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,CAAC,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAA;IAC9C,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE;YAC/B,OAAO,iBAAiB,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;QACzD,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE;YACxD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;oBACjC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;oBACrB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,IAAc;oBACpB,OAAO,EAAE,YAAY,CAAC;wBACpB,YAAY,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;wBACtC,KAAK;qBACN,CAAC;iBACH,CAAC,CAAA;gBACF,OAAO,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,aAAa,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE;YACjC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;oBACjC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;oBACrB,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;iBACrD,CAAC,CAAA;gBACF,OAAO,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,aAAa,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE;YAChD,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,OAAO,CAAC;oBAChB,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAClB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,EAAE,MAAM,EAAE;oBAChB,OAAO,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;iBAClE,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,aAAa,CAAC,GAAG,CAAC,CAAA;YACpB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE;YACd,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CACtE,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,QAAQ,EAAE,CAAC,EAC7C,CAAC,GAAY,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,GAAG,EAAE,CAAC,CAChD,CAAA;YAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAA;YACpC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA,CAAC,uDAAuD;YACrE,CAAC;YAED,sEAAsE;YACtE,wEAAwE;YACxE,yEAAyE;YACzE,+CAA+C;YAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAA;YAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,GAAG,CAAA;gBAChB,CAAC;gBACD,OAAO,MAAM,CAAA;YACf,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAOlB,CAAA;YACb,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACxB,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;YACvC,CAAC;YACD,IAAI,QAAQ,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;YACvC,CAAC;YACD,IAAI,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;YAC/B,CAAC;YACD,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;YACjC,CAAC;YACD,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;YAC9D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,WAAW,GAAG,WAAW,CAAA;YAClC,CAAC;YAED,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"port.js","sourceRoot":"","sources":["../../src/sync/port.ts"],"names":[],"mappings":"AA6BA,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,YAAY,EACb,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,cAAc,CAAA;AAIrB;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAE3B;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAA;AAErC;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,CAAA;AAEvB;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,MAA0B;IAC9C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,aAAa,CACpB,GAAY,EACZ,EACE,QAAQ,GAAG,KAAK,EAChB,UAAU,GAAG,KAAK,KAC8B,EAAE;IAEpD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,QAAQ,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAC/B,MAAM,IAAI,oBAAoB,EAAE,CAAA;IAClC,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,oBAAoB,EAAE,CAAA;IAClC,CAAC;IACD,IAAI,UAAU,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACpC,CAAC;IACD,MAAM,GAAG,CAAA;AACX,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,IAAI,OAAO,GAAG,CAAA;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,IAAmB;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;IAC/C,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AACzD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACV,aAAa,GAAG,KAAK,EAOtB;IACC,wEAAwE;IACxE,sEAAsE;IACtE,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;IAC3E,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;IAExE,0EAA0E;IAC1E,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,iBAAiB,GAAG,GAAG;SAC1B,KAAK,CAAC,OAAO,CAAC;SACd,UAAU,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAE3C,iFAAiF;IACjF,MAAM,WAAW,GAAG,KAAK,EAAE,EAAU,EAA+B,EAAE;QACpE,IAAI,QAAsB,CAAA;QAC1B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;gBAC3B,UAAU;gBACV,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;gBACrB,MAAM,EAAE,KAAK;aACd,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;YAC/B,yDAAyD;YACzD,yEAAyE;YACzE,oBAAoB;YACpB,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,aAAa,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAA;YACpC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO;YACL,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC;YACnD,SAAS,EAAE,kBAAkB;YAC7B,IAAI,EAAE,QAAQ,CAAC,IAAY;SAC5B,CAAA;IACH,CAAC,CAAA;IAED,kFAAkF;IAClF,MAAM,YAAY,GAAG,KAAK,EACxB,QAAsB,EACtB,EAAU,EACO,EAAE;QACnB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;QACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,OAAO,CAAC,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAA;IAC9C,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE;YAC/B,IAAI,CAAC;gBACH,OAAO,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oEAAoE;gBACpE,uEAAuE;gBACvE,2DAA2D;gBAC3D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;gBAC/B,IAAI,aAAa,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAA;gBACpC,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE;YACxD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;oBACjC,UAAU;oBACV,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;oBACrB,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,IAAc;oBACpB,OAAO,EAAE,YAAY,CAAC;wBACpB,YAAY,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;wBACtC,KAAK;qBACN,CAAC;iBACH,CAAC,CAAA;gBACF,OAAO,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,aAAa,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE;YACjC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;oBACjC,UAAU;oBACV,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;oBACrB,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;iBACrD,CAAC,CAAA;gBACF,OAAO,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,uEAAuE;gBACvE,sEAAsE;gBACtE,4DAA4D;gBAC5D,mEAAmE;gBACnE,mEAAmE;gBACnE,IAAI,aAAa,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC9C,OAAO,SAAS,CAAA;gBAClB,CAAC;gBACD,aAAa,CAAC,GAAG,EAAE;oBACjB,QAAQ,EAAE,CAAC,aAAa;oBACxB,UAAU,EAAE,aAAa;iBAC1B,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE;YAChD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;oBACjC,UAAU;oBACV,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAClB,MAAM,EAAE,KAAK;oBACb,qEAAqE;oBACrE,+DAA+D;oBAC/D,+DAA+D;oBAC/D,oEAAoE;oBACpE,4DAA4D;oBAC5D,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE;oBAC5C,OAAO,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;iBAClE,CAAC,CAAA;gBACF,wEAAwE;gBACxE,yCAAyC;gBACzC,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;YAC9C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,aAAa,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE;YACd,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,4CAA4C;YAC5C,MAAM,QAAQ,GAAG,GAAG;iBACjB,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;iBAC1D,IAAI,CACH,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,QAAQ,EAAE,CAAC,EAC7C,CAAC,GAAY,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,GAAG,EAAE,CAAC,CAChD,CAAA;YAEH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAA;YACpC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAA,CAAC,uDAAuD;YACrE,CAAC;YAED,sEAAsE;YACtE,wEAAwE;YACxE,yEAAyE;YACzE,+CAA+C;YAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAA;YAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACpC,oEAAoE;gBACpE,qEAAqE;gBACrE,aAAa;gBACb,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;oBACnB,OAAO,MAAM,CAAA;gBACf,CAAC;gBACD,IAAI,aAAa,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAA;gBACpC,CAAC;gBACD,MAAM,IAAI,CAAC,GAAG,CAAA;YAChB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAOlB,CAAA;YACb,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACxB,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;YACvC,CAAC;YACD,IAAI,QAAQ,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;YACvC,CAAC;YACD,IAAI,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;YAC/B,CAAC;YACD,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;YACjC,CAAC;YACD,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAA;YAC9D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,WAAW,GAAG,WAAW,CAAA;YAClC,CAAC;YAED,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/sync/types.d.ts

@@ -96,22 +96,30 @@ export interface WasSyncPort {
      * unchanged. Returns the tombstone's new server `version`. Throws
      * {@link WasSyncConflictError} on `412`, {@link WasSyncNotFoundError} on `404`
      * (already gone -- a settled outcome for a delete).
+     *
+     * Resolves `undefined` instead when the port was built with
+     * `mapAuthErrors: true` and the target was already absent: there the delete
+     * is idempotent, so there is no acked revision to report.
      */
     deleteContent(options: {
         id: string;
         ifMatch?: string;
-    }): Promise<number>;
+    }): Promise<number | undefined>;
     /**
      * Conditionally writes the user-writable metadata `custom` (`PUT /:id/meta`).
-     * Optional -- present only on a port that syncs metadata. Throws
+     * Optional -- present only on a port that syncs metadata. The write fully
+     * replaces `custom`, so omitting it writes the CLEARED state (the server
+     * clears every property the body leaves out) -- that is how a metadata clear
+     * replicates. Returns the new `metaVersion` (parsed from the write's `ETag`),
+     * or `undefined` when the response carried none. Throws
      * {@link WasSyncConflictError} on `412`.
      */
     putMeta?(options: {
         id: string;
-        custom: Json;
+        custom?: Json;
         ifMatch?: string;
         ifNoneMatch?: boolean;
-    }): Promise<void>;
+    }): Promise<number | undefined>;
     /**
      * Re-reads a single resource's current master state for the 412-conflict
      * assembler. Returns `null` when the resource is genuinely absent OR a

package/dist/sync/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,WAAW,EACZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAEvC,YAAY,EAAE,IAAI,EAAE,CAAA;AAEpB;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAE9C;;;;;;;;GAQG;AACH,MAAM,MAAM,OAAO,GAAG,cAAc,CAAA;AAEpC;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAA;AAElC;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE;QACb,UAAU,CAAC,EAAE,cAAc,CAAA;QAC3B,KAAK,EAAE,MAAM,CAAA;KACd,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAErB;;;;;;;OAOG;IACH,UAAU,CAAC,OAAO,EAAE;QAClB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,IAAI,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;QACrB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAEnB;;;;;;OAMG;IACH,aAAa,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAEzE;;;;OAIG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE;QAChB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,IAAI,CAAA;QACZ,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;;;OAKG;IACH,GAAG,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,IAAI,CAAA;KACX,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3D,aAAa,CAAC,CAAC,OAAO,EAAE;QACtB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,IAAI,CAAA;QACV,OAAO,EAAE,IAAI,CAAA;KACd,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3D,OAAO,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,WAAW,EACZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAEvC,YAAY,EAAE,IAAI,EAAE,CAAA;AAEpB;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAA;AAE9C;;;;;;;;GAQG;AACH,MAAM,MAAM,OAAO,GAAG,cAAc,CAAA;AAEpC;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAA;AAElC;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,KAAK,CAAC,OAAO,EAAE;QACb,UAAU,CAAC,EAAE,cAAc,CAAA;QAC3B,KAAK,EAAE,MAAM,CAAA;KACd,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAErB;;;;;;;OAOG;IACH,UAAU,CAAC,OAAO,EAAE;QAClB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,IAAI,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;QACrB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAEnB;;;;;;;;;;OAUG;IACH,aAAa,CAAC,OAAO,EAAE;QACrB,EAAE,EAAE,MAAM,CAAA;QACV,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAE/B;;;;;;;;OAQG;IACH,OAAO,CAAC,CAAC,OAAO,EAAE;QAChB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,CAAC,EAAE,IAAI,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IAE/B;;;;;OAKG;IACH,GAAG,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;CAC1D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,IAAI,CAAA;KACX,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3D,aAAa,CAAC,CAAC,OAAO,EAAE;QACtB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,IAAI,CAAA;QACV,OAAO,EAAE,IAAI,CAAA;KACd,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3D,OAAO,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD"}

package/dist/types.d.ts

@@ -22,8 +22,32 @@ export type { IZcap, IDelegatedZcap, IRootZcap, IDID, ISigner };
  * `ResourceListing`) and the collections-in-a-space listing is `CollectionsList`
  * (formerly `CollectionListing`).
  */
-export type { Action, ActionInput, SpaceDescription, CollectionDescription, CollectionEncryption, CollectionEncryptionEpoch, CollectionEncryptionRecipient, PolicyDocument, LinkSet, LinkSetEntry, CollectionSummary, CollectionsList, SpaceSummary, SpaceListing, ResourceSummary, CollectionResourcesList, ResourceMetadata, ResourceMetadataCustom, ImportStats, BackendReference, BackendDescriptor, BackendRegistration, BackendConnectionInput, BackendConnectionPublic, StorageLimit, CollectionUsage, BackendUsage, SpaceQuotaReport } from '@interop/storage-core';
+export type { Action, ActionInput, SpaceDescription, CollectionDescription, CollectionEncryption, CollectionEncryptionEpoch, CollectionEncryptionRecipient, PolicyDocument, LinkSet, LinkSetEntry, CollectionSummary, CollectionsList, SpaceSummary, SpaceListing, ResourceSummary, CollectionResourcesList, ResourceMetadata, ResourceMetadataCustom, CollectionMetadata, ImportStats, BackendReference, BackendDescriptor, BackendRegistration, BackendConnectionInput, BackendConnectionPublic, StorageLimit, CollectionUsage, BackendUsage, SpaceQuotaReport } from '@interop/storage-core';
 import type { BackendReference, CollectionEncryption } from '@interop/storage-core';
+/**
+ * The Collection's blinded-index HMAC key, as it appears on the `encryption`
+ * descriptor: the key `id` (the value an envelope's `indexed[].hmac.id` and a
+ * blinded query's `index` name), its `type` (`'Sha256HmacKey2019'`), and the
+ * 32-byte HMAC secret wrapped once per recipient -- the same JWE `recipients`
+ * entry shape and `ECDH-ES+A256KW` wrap the epoch secrets use, so a recipient
+ * receives the blinding key exactly the way it receives epoch keys.
+ *
+ * The key is installed at Collection provisioning or never, and never rotates:
+ * blinded tokens must compare across the Collection's whole history. Removing a
+ * recipient drops its wrap entry as housekeeping only -- the key is unchanged,
+ * so a removed recipient keeps it (a documented revocation asymmetry).
+ *
+ * A named alias for the descriptor's own `hmac` member, so the blinding-key
+ * code can refer to the shape by name.
+ */
+export type CollectionEncryptionHmac = NonNullable<CollectionEncryption['hmac']>;
+/**
+ * A `CollectionEncryption` descriptor known to carry the blinded-index `hmac`
+ * member. `CollectionEncryption` declares `hmac` natively, so this is now an
+ * alias; the name is kept because the blinding-key code reads better naming the
+ * member it works with.
+ */
+export type EncryptionWithHmac = CollectionEncryption;
 /**
  * The client-writable fields of a Collection Description -- the shape shared
  * by `Collection.configure` and `Collection.replaceDescription` and the single
@@ -76,6 +100,21 @@ export interface AddResult {
      */
     etag?: string;
 }
+/**
+ * One page of `collection.find()` results: the matching resources, decoded
+ * (decrypted) the way `get()` decodes them, plus the means to ask for more.
+ * `cursor` is present exactly when `hasMore` is `true`; pass it back as
+ * `find({ ..., cursor })` to continue. It is an opaque server token, not an
+ * offset.
+ */
+export interface FindPage {
+    items: Array<{
+        id: string;
+        data: Json | Blob;
+    }>;
+    hasMore: boolean;
+    cursor?: string;
+}
 /**
  * A per-handle client-side encryption override -- the escape hatch / bootstrap
  * path that takes precedence over the Collection's declared `encryption`

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,KAAK,EACL,cAAc,EACd,SAAS,EACV,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAE/D;;;;;GAKG;AACH,YAAY,EACV,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,cAAc,EACd,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,uBAAuB,CAAA;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;AAC5D,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AACD,MAAM,MAAM,SAAS,GAAG,IAAI,EAAE,CAAA;AAC9B,MAAM,MAAM,IAAI,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAA;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,IAAI,GAAG,UAAU,CAAA;AAErE;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,kBAAkB,GAC5B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,WAAW,CAAA;AAElD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,IAAI,GAAG,UAAU,CAAA;IACxB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,KAAK,EACL,cAAc,EACd,SAAS,EACV,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAEjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAE/D;;;;;GAKG;AACH,YAAY,EACV,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,cAAc,EACd,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EACV,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,uBAAuB,CAAA;AAE9B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,wBAAwB,GAAG,WAAW,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAA;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AAErD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,IAAI,CAAA;IAChB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;AAC5D,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AACD,MAAM,MAAM,SAAS,GAAG,IAAI,EAAE,CAAA;AAC9B,MAAM,MAAM,IAAI,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAA;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,IAAI,GAAG,UAAU,CAAA;AAErE;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAA;IAC/C,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,kBAAkB,GAC5B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,WAAW,CAAA;AAElD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,IAAI,GAAG,UAAU,CAAA;IACxB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/was-client",
   "description": "A developer-friendly client for Wallet Attached Storage (WAS) servers.",
-  "version": "0.33.0",
+  "version": "0.35.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -36,6 +36,12 @@
       "import": "./dist/edv/index.js",
       "default": "./dist/edv/index.js"
     },
+    "./paths": {
+      "types": "./dist/paths.d.ts",
+      "react-native": "./dist/paths.js",
+      "import": "./dist/paths.js",
+      "default": "./dist/paths.js"
+    },
     "./log": {
       "types": "./dist/log/index.d.ts",
       "react-native": "./dist/log/index.js",
@@ -60,7 +66,7 @@
     "@interop/ezcap": "^7.4.1",
     "@interop/http-client": "^1.0.5",
     "@interop/minimal-cipher": "^7.8.1",
-    "@interop/storage-core": "^0.6.0",
+    "@interop/storage-core": "^0.8.0",
     "@interop/x25519-key-agreement-key": "^5.2.1",
     "@noble/hashes": "^2.3.0",
     "@scure/base": "^2.3.0",