@interop/was-client 0.5.0 → 0.7.0

package/dist/edv/EdvCodec.d.ts

@@ -0,0 +1,148 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The EDV (Encrypted Data Vault) resource codec and its `EncryptionProvider`
+ * factory -- the encrypting half of the codec seam. Bound to an
+ * encrypted collection, it encrypts a caller's value into an EDV envelope
+ * (`{ id, sequence, indexed, jwe }`) on write and decrypts it on read, so
+ * `collection.put(id, obj)` / `collection.get(id)` transparently round-trip
+ * ciphertext. Keys live in the wallet and are supplied per-collection by the
+ * app's `resolveKeys`; they never reach the server, which stores only opaque
+ * JWE envelopes.
+ *
+ * This reuses `EdvClientCore`'s encrypt/decrypt primitives (the same JWE
+ * machinery as the standalone `WasTransport`), but here the WAS Resource CRUD --
+ * the transport role -- is played by core was-client's `Collection`/`Resource`
+ * I/O, so the codec is a pure encode/decode transform and needs no transport of
+ * its own.
+ *
+ * Scope (documents-only):
+ *
+ * - **Restrict-mode ids.** `add()` mints a 128-bit multibase EDV id; the WAS
+ *   resource id IS that EDV id. `put(id, ...)` accepts only an EDV-format id --
+ *   a human-readable id is rejected (it would leak onto the URL). Carry a
+ *   human-readable label inside the encrypted content instead. (Blind-derived
+ *   ids are a deferred future item.)
+ * - **Small binary as a single JWE.** A `Blob`/`Uint8Array` under the size cap
+ *   is wrapped and encrypted as one document; an oversized one is rejected
+ *   (chunked encrypted blobs need the server's `chunked-streams` affordance).
+ * - **Enforced sequence (conditional writes).** The codec sets
+ *   `conditionalWrites`, so the write path pre-reads the current envelope and
+ *   hands it to `encode`: an update advances `sequence` from its prior value and
+ *   pins the write to the server's current ETag via `If-Match`, while a fresh
+ *   insert (`sequence: 0`) is guarded by `If-None-Match: *`. A stale write
+ *   surfaces as a `PreconditionFailedError` (412) -- the lost-update guard --
+ *   rather than the old advisory last-writer-wins. Against a backend that does
+ *   not advertise `conditional-writes` (no ETag) it degrades to advisory.
+ * - **No server-visible metadata.** `allowsServerMetadata` is `false`, so
+ *   `setName`/`setTags` throw on an encrypted collection (the core seam enforces
+ *   this).
+ */
+import { EdvClientCore } from '@interop/edv-client';
+import type { HttpResponse } from '@interop/http-client';
+import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
+import type { EncodedWrite, EncryptionProvider, ResourceCodec } from '../codec.js';
+import type { Json } from '../types.js';
+import { EDV_CONTENT_TYPE } from './WasTransport.js';
+/**
+ * A {@link ResourceCodec} that encrypts on write and decrypts on read using an
+ * `EdvClientCore`'s JWE primitives. One instance is bound per encrypted
+ * collection handle.
+ */
+export declare class EdvCodec implements ResourceCodec {
+    readonly allowsServerMetadata = false;
+    readonly conditionalWrites = true;
+    private readonly _edv;
+    private readonly _keyAgreementKey;
+    private readonly _contentType;
+    private readonly _maxBlobBytes;
+    /**
+     * @param options {object}
+     * @param options.edv {EdvClientCore}             holds the cipher + key resolver
+     * @param options.keyAgreementKey {IKeyAgreementKey}   the recipient/decrypt key
+     * @param options.contentType {string}            stored envelope content type
+     * @param options.maxBlobBytes {number}           single-document binary cap
+     */
+    constructor({ edv, keyAgreementKey, contentType, maxBlobBytes }: {
+        edv: EdvClientCore;
+        keyAgreementKey: IKeyAgreementKey;
+        contentType: string;
+        maxBlobBytes: number;
+    });
+    /**
+     * @inheritdoc
+     */
+    encode({ id, data, contentType, current }: {
+        id?: string;
+        data: Json | Blob | Uint8Array;
+        contentType?: string;
+        current?: HttpResponse | null;
+    }): Promise<EncodedWrite>;
+    /**
+     * @inheritdoc
+     */
+    decode(response: {
+        data?: unknown;
+        json(): Promise<unknown>;
+    }): Promise<Json | Blob>;
+    /**
+     * Resolves a caller value to the EDV document `content`: a JSON object/array
+     * passes through; a `Blob`/`Uint8Array` (under the cap) is wrapped as a
+     * base64 blob record; a bare primitive is rejected (mirroring the plaintext
+     * `prepareBody` contract).
+     *
+     * @param data {Json | Blob | Uint8Array}
+     * @param [contentType] {string}
+     * @returns {Promise<object>}
+     */
+    private _toContent;
+    /**
+     * Wraps binary bytes as an EDV document content record, enforcing the
+     * single-document size cap.
+     *
+     * @param bytes {Uint8Array}
+     * @param contentType {string}
+     * @returns {object}
+     */
+    private _blobContent;
+    /**
+     * Reconstructs a caller value from decrypted EDV document content: a `Blob`
+     * for a wrapped blob record, otherwise the JSON content verbatim.
+     *
+     * @param content {unknown}
+     * @returns {Json | Blob}
+     */
+    private _fromContent;
+}
+/**
+ * Builds an {@link EncryptionProvider} that encrypts the collections the client
+ * holds keys for, wiring the per-collection keys (from `resolveKeys`) into an
+ * {@link EdvCodec}. Pass the result as `WasClient`'s `encryption` option; core
+ * resolves a codec for a collection exactly when `resolveKeys` returns keys for
+ * it (the switch is keys alone -- encryption is not a backend feature).
+ *
+ * @param options {object}
+ * @param options.resolveKeys {function}   returns the collection's
+ *   `{ keyAgreementKey, keyResolver }`, or `null` to read/write it as plaintext
+ * @param [options.contentType] {string}   stored envelope content type;
+ *   defaults to `application/json`. Pass `EDV_CONTENT_TYPE`
+ *   (`application/edv+json`) against a server that registers an
+ *   `application/*+json` parser.
+ * @param [options.maxBlobBytes] {number}   single-document binary cap (default
+ *   1 MiB)
+ * @returns {EncryptionProvider}
+ */
+export declare function createEdvEncryption({ resolveKeys, contentType, maxBlobBytes }: {
+    resolveKeys: (ref: {
+        spaceId: string;
+        collectionId: string;
+    }) => Promise<{
+        keyAgreementKey: IKeyAgreementKey;
+        keyResolver: IKeyResolver;
+    } | null>;
+    contentType?: string;
+    maxBlobBytes?: number;
+}): EncryptionProvider;
+export { EDV_CONTENT_TYPE };
+//# sourceMappingURL=EdvCodec.d.ts.map

package/dist/edv/EdvCodec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EdvCodec.d.ts","sourceRoot":"","sources":["../../src/edv/EdvCodec.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAEV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACd,MAAM,aAAa,CAAA;AAGpB,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAsEpD;;;;GAIG;AACH,qBAAa,QAAS,YAAW,aAAa;IAC5C,QAAQ,CAAC,oBAAoB,SAAQ;IACrC,QAAQ,CAAC,iBAAiB,QAAO;IAEjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAkB;IACnD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;IAEtC;;;;;;OAMG;gBACS,EACV,GAAG,EACH,eAAe,EACf,WAAW,EACX,YAAY,EACb,EAAE;QACD,GAAG,EAAE,aAAa,CAAA;QAClB,eAAe,EAAE,gBAAgB,CAAA;QACjC,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;KACrB;IAOD;;OAEG;IACG,MAAM,CAAC,EACX,EAAE,EACF,IAAI,EACJ,WAAW,EACX,OAAO,EACR,EAAE;QACD,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,UAAU,CAAA;QAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,CAAA;KAC9B,GAAG,OAAO,CAAC,YAAY,CAAC;IA+CzB;;OAEG;IACG,MAAM,CAAC,QAAQ,EAAE;QACrB,IAAI,CAAC,EAAE,OAAO,CAAA;QACd,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;KACzB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAWxB;;;;;;;;;OASG;YACW,UAAU;IAuBxB;;;;;;;OAOG;IACH,OAAO,CAAC,YAAY;IAYpB;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;CAarB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,WAAW,EACX,WAAkC,EAClC,YAAqC,EACtC,EAAE;IACD,WAAW,EAAE,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QACvE,eAAe,EAAE,gBAAgB,CAAA;QACjC,WAAW,EAAE,YAAY,CAAA;KAC1B,GAAG,IAAI,CAAC,CAAA;IACT,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,kBAAkB,CAmBrB;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAA"}

package/dist/edv/EdvCodec.js

@@ -0,0 +1,284 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The EDV (Encrypted Data Vault) resource codec and its `EncryptionProvider`
+ * factory -- the encrypting half of the codec seam. Bound to an
+ * encrypted collection, it encrypts a caller's value into an EDV envelope
+ * (`{ id, sequence, indexed, jwe }`) on write and decrypts it on read, so
+ * `collection.put(id, obj)` / `collection.get(id)` transparently round-trip
+ * ciphertext. Keys live in the wallet and are supplied per-collection by the
+ * app's `resolveKeys`; they never reach the server, which stores only opaque
+ * JWE envelopes.
+ *
+ * This reuses `EdvClientCore`'s encrypt/decrypt primitives (the same JWE
+ * machinery as the standalone `WasTransport`), but here the WAS Resource CRUD --
+ * the transport role -- is played by core was-client's `Collection`/`Resource`
+ * I/O, so the codec is a pure encode/decode transform and needs no transport of
+ * its own.
+ *
+ * Scope (documents-only):
+ *
+ * - **Restrict-mode ids.** `add()` mints a 128-bit multibase EDV id; the WAS
+ *   resource id IS that EDV id. `put(id, ...)` accepts only an EDV-format id --
+ *   a human-readable id is rejected (it would leak onto the URL). Carry a
+ *   human-readable label inside the encrypted content instead. (Blind-derived
+ *   ids are a deferred future item.)
+ * - **Small binary as a single JWE.** A `Blob`/`Uint8Array` under the size cap
+ *   is wrapped and encrypted as one document; an oversized one is rejected
+ *   (chunked encrypted blobs need the server's `chunked-streams` affordance).
+ * - **Enforced sequence (conditional writes).** The codec sets
+ *   `conditionalWrites`, so the write path pre-reads the current envelope and
+ *   hands it to `encode`: an update advances `sequence` from its prior value and
+ *   pins the write to the server's current ETag via `If-Match`, while a fresh
+ *   insert (`sequence: 0`) is guarded by `If-None-Match: *`. A stale write
+ *   surfaces as a `PreconditionFailedError` (412) -- the lost-update guard --
+ *   rather than the old advisory last-writer-wins. Against a backend that does
+ *   not advertise `conditional-writes` (no ETag) it degrades to advisory.
+ * - **No server-visible metadata.** `allowsServerMetadata` is `false`, so
+ *   `setName`/`setTags` throw on an encrypted collection (the core seam enforces
+ *   this).
+ */
+import { EdvClientCore } from '@interop/edv-client';
+import { ValidationError } from '../errors.js';
+import { readJsonData } from '../internal/content.js';
+import { EDV_CONTENT_TYPE } from './WasTransport.js';
+/**
+ * Default ceiling for a single-document (unchunked) encrypted binary write.
+ * Past this a `Blob`/`Uint8Array` is rejected until chunked encrypted blobs are
+ * supported. 1 MiB before the ~33% base64 inflation.
+ */
+const DEFAULT_MAX_BLOB_BYTES = 1024 * 1024;
+/**
+ * The default stored content type. Plain JSON keeps the codec portable across
+ * any document-capable server (the envelope is still self-identifying by its
+ * `jwe` field). Pass `contentType: EDV_CONTENT_TYPE`
+ * (`application/edv+json`) against a server that registers an
+ * `application/*+json` parser to mark envelopes distinctly in listings.
+ */
+const DEFAULT_CONTENT_TYPE = 'application/json';
+/**
+ * Marker property tagging an encrypted document whose decrypted content is a
+ * binary blob (rather than a JSON value), so `decode` can reconstruct a `Blob`.
+ * Namespaced to avoid colliding with caller JSON.
+ */
+const BLOB_MARKER = '@interop/was-client:edvBlob';
+/**
+ * Heuristic for an EDV document id: multibase base58btc (leading `z`) of a
+ * 128-bit value. Used to reject human-readable ids on `put()`. Deliberately a
+ * loose, dependency-free check (base58 charset, leading `z`, minimum length) --
+ * it rejects ids with human separators (`.`/`-`/`_`/spaces) and is not a full
+ * decode-and-length verification.
+ */
+const EDV_DOC_ID = /^z[1-9A-HJ-NP-Za-km-z]{21,}$/;
+const ENCODER = new TextEncoder();
+function isBlob(value) {
+    return typeof Blob !== 'undefined' && value instanceof Blob;
+}
+/**
+ * Encodes bytes to standard base64 using the platform `btoa` (present in modern
+ * Node and browsers), via a binary string.
+ *
+ * @param bytes {Uint8Array}
+ * @returns {string}
+ */
+function bytesToBase64(bytes) {
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary);
+}
+/**
+ * Decodes standard base64 to bytes using the platform `atob`.
+ *
+ * @param base64 {string}
+ * @returns {Uint8Array}
+ */
+function base64ToBytes(base64) {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index++) {
+        bytes[index] = binary.charCodeAt(index);
+    }
+    return bytes;
+}
+/**
+ * A {@link ResourceCodec} that encrypts on write and decrypts on read using an
+ * `EdvClientCore`'s JWE primitives. One instance is bound per encrypted
+ * collection handle.
+ */
+export class EdvCodec {
+    allowsServerMetadata = false;
+    conditionalWrites = true;
+    _edv;
+    _keyAgreementKey;
+    _contentType;
+    _maxBlobBytes;
+    /**
+     * @param options {object}
+     * @param options.edv {EdvClientCore}             holds the cipher + key resolver
+     * @param options.keyAgreementKey {IKeyAgreementKey}   the recipient/decrypt key
+     * @param options.contentType {string}            stored envelope content type
+     * @param options.maxBlobBytes {number}           single-document binary cap
+     */
+    constructor({ edv, keyAgreementKey, contentType, maxBlobBytes }) {
+        this._edv = edv;
+        this._keyAgreementKey = keyAgreementKey;
+        this._contentType = contentType;
+        this._maxBlobBytes = maxBlobBytes;
+    }
+    /**
+     * @inheritdoc
+     */
+    async encode({ id, data, contentType, current }) {
+        if (id !== undefined && !EDV_DOC_ID.test(id)) {
+            throw new ValidationError(`Cannot write a human-readable id "${id}" to an encrypted collection ` +
+                '-- it would leak onto the URL. Use add() to mint an EDV document ' +
+                'id, or carry the human-readable label inside the encrypted content.');
+        }
+        const docId = id ?? (await this._edv.generateId());
+        const content = await this._toContent(data, contentType);
+        // When the write path pre-read a current envelope, advance `sequence` from
+        // its prior value (`_encrypt({ update: true })` increments it) and pin the
+        // write to the server's current ETag with `If-Match`. With no prior envelope
+        // this is a fresh insert (`sequence: 0`) guarded by `If-None-Match: *`
+        // (create-if-absent), so a concurrent first writer cannot be clobbered.
+        const priorDoc = current
+            ? (await readJsonData(current))
+            : null;
+        const recipients = this._edv._createDefaultRecipients(this._keyAgreementKey);
+        const encrypted = await this._edv._encrypt({
+            doc: {
+                id: docId,
+                content,
+                ...(priorDoc && { sequence: priorDoc.sequence })
+            },
+            recipients,
+            keyResolver: this._edv.keyResolver,
+            hmac: undefined,
+            update: priorDoc !== null
+        });
+        return {
+            id: docId,
+            body: ENCODER.encode(JSON.stringify(encrypted)),
+            contentType: this._contentType,
+            // Pin an update to the server's current ETag; guard a fresh insert with
+            // create-if-absent. (An ETag is absent only against a backend without the
+            // conditional-writes feature, where this degrades to an advisory write.)
+            ...(priorDoc
+                ? { ifMatch: current.headers.get('etag') ?? undefined }
+                : { ifNoneMatch: true })
+        };
+    }
+    /**
+     * @inheritdoc
+     */
+    async decode(response) {
+        const encryptedDoc = (await readJsonData(response));
+        const decrypted = await this._edv._decrypt({
+            encryptedDoc,
+            keyAgreementKey: this._keyAgreementKey
+        });
+        return this._fromContent(decrypted.content);
+    }
+    /**
+     * Resolves a caller value to the EDV document `content`: a JSON object/array
+     * passes through; a `Blob`/`Uint8Array` (under the cap) is wrapped as a
+     * base64 blob record; a bare primitive is rejected (mirroring the plaintext
+     * `prepareBody` contract).
+     *
+     * @param data {Json | Blob | Uint8Array}
+     * @param [contentType] {string}
+     * @returns {Promise<object>}
+     */
+    async _toContent(data, contentType) {
+        if (isBlob(data)) {
+            const bytes = new Uint8Array(await data.arrayBuffer());
+            return this._blobContent(bytes, contentType || data.type || 'application/octet-stream');
+        }
+        if (data instanceof Uint8Array) {
+            return this._blobContent(data, contentType || 'application/octet-stream');
+        }
+        if (data !== null && typeof data === 'object') {
+            return data;
+        }
+        throw new ValidationError('Encrypted resource data must be a plain object/array (JSON) or a ' +
+            'Blob/Uint8Array (binary).');
+    }
+    /**
+     * Wraps binary bytes as an EDV document content record, enforcing the
+     * single-document size cap.
+     *
+     * @param bytes {Uint8Array}
+     * @param contentType {string}
+     * @returns {object}
+     */
+    _blobContent(bytes, contentType) {
+        if (bytes.length > this._maxBlobBytes) {
+            throw new ValidationError(`Encrypted binary write of ${bytes.length} bytes exceeds the ` +
+                `single-document limit of ${this._maxBlobBytes} bytes. Chunked ` +
+                "encrypted blobs need the server's chunked-streams affordance " +
+                '(not yet available).');
+        }
+        return { [BLOB_MARKER]: true, contentType, base64: bytesToBase64(bytes) };
+    }
+    /**
+     * Reconstructs a caller value from decrypted EDV document content: a `Blob`
+     * for a wrapped blob record, otherwise the JSON content verbatim.
+     *
+     * @param content {unknown}
+     * @returns {Json | Blob}
+     */
+    _fromContent(content) {
+        if (content !== null &&
+            typeof content === 'object' &&
+            content[BLOB_MARKER] === true) {
+            const record = content;
+            return new Blob([base64ToBytes(record.base64)], {
+                type: record.contentType
+            });
+        }
+        return content;
+    }
+}
+/**
+ * Builds an {@link EncryptionProvider} that encrypts the collections the client
+ * holds keys for, wiring the per-collection keys (from `resolveKeys`) into an
+ * {@link EdvCodec}. Pass the result as `WasClient`'s `encryption` option; core
+ * resolves a codec for a collection exactly when `resolveKeys` returns keys for
+ * it (the switch is keys alone -- encryption is not a backend feature).
+ *
+ * @param options {object}
+ * @param options.resolveKeys {function}   returns the collection's
+ *   `{ keyAgreementKey, keyResolver }`, or `null` to read/write it as plaintext
+ * @param [options.contentType] {string}   stored envelope content type;
+ *   defaults to `application/json`. Pass `EDV_CONTENT_TYPE`
+ *   (`application/edv+json`) against a server that registers an
+ *   `application/*+json` parser.
+ * @param [options.maxBlobBytes] {number}   single-document binary cap (default
+ *   1 MiB)
+ * @returns {EncryptionProvider}
+ */
+export function createEdvEncryption({ resolveKeys, contentType = DEFAULT_CONTENT_TYPE, maxBlobBytes = DEFAULT_MAX_BLOB_BYTES }) {
+    return {
+        async resolveCodec({ spaceId, collectionId }) {
+            const keys = await resolveKeys({ spaceId, collectionId });
+            if (!keys) {
+                return null;
+            }
+            const edv = new EdvClientCore({
+                keyAgreementKey: keys.keyAgreementKey,
+                keyResolver: keys.keyResolver
+            });
+            return new EdvCodec({
+                edv,
+                keyAgreementKey: keys.keyAgreementKey,
+                contentType,
+                maxBlobBytes
+            });
+        }
+    };
+}
+export { EDV_CONTENT_TYPE };
+//# sourceMappingURL=EdvCodec.js.map

package/dist/edv/EdvCodec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EdvCodec.js","sourceRoot":"","sources":["../../src/edv/EdvCodec.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAYnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAA;AAE1C;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,kBAAkB,CAAA;AAE/C;;;;GAIG;AACH,MAAM,WAAW,GAAG,6BAA6B,CAAA;AAEjD;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,8BAA8B,CAAA;AAEjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,IAAI,KAAK,WAAW,IAAI,KAAK,YAAY,IAAI,CAAA;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IACV,oBAAoB,GAAG,KAAK,CAAA;IAC5B,iBAAiB,GAAG,IAAI,CAAA;IAEhB,IAAI,CAAe;IACnB,gBAAgB,CAAkB;IAClC,YAAY,CAAQ;IACpB,aAAa,CAAQ;IAEtC;;;;;;OAMG;IACH,YAAY,EACV,GAAG,EACH,eAAe,EACf,WAAW,EACX,YAAY,EAMb;QACC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;QACf,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAA;QACvC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAA;QAC/B,IAAI,CAAC,aAAa,GAAG,YAAY,CAAA;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,EACX,EAAE,EACF,IAAI,EACJ,WAAW,EACX,OAAO,EAMR;QACC,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,eAAe,CACvB,qCAAqC,EAAE,+BAA+B;gBACpE,mEAAmE;gBACnE,qEAAqE,CACxE,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,IAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAY,CAAA;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAExD,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,QAAQ,GAAG,OAAO;YACtB,CAAC,CAAE,CAAC,MAAM,YAAY,CAClB,OAA6C,CAC9C,CAAwB;YAC3B,CAAC,CAAC,IAAI,CAAA;QAER,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC5E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzC,GAAG,EAAE;gBACH,EAAE,EAAE,KAAK;gBACT,OAAO;gBACP,GAAG,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;aACjD;YACD,UAAU;YACV,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,QAAQ,KAAK,IAAI;SAC1B,CAAC,CAAA;QACF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC/C,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,GAAG,CAAC,QAAQ;gBACV,CAAC,CAAC,EAAE,OAAO,EAAE,OAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,EAAE;gBACxD,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;SAC3B,CAAA;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,QAGZ;QACC,MAAM,YAAY,GAAG,CAAC,MAAM,YAAY,CACtC,QAA8C,CAC/C,CAAuB,CAAA;QACxB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzC,YAAY;YACZ,eAAe,EAAE,IAAI,CAAC,gBAAgB;SACvC,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IAC7C,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,UAAU,CACtB,IAA8B,EAC9B,WAAoB;QAEpB,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;YACtD,OAAO,IAAI,CAAC,YAAY,CACtB,KAAK,EACL,WAAW,IAAI,IAAI,CAAC,IAAI,IAAI,0BAA0B,CACvD,CAAA;QACH,CAAC;QACD,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,WAAW,IAAI,0BAA0B,CAAC,CAAA;QAC3E,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,mEAAmE;YACjE,2BAA2B,CAC9B,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACK,YAAY,CAAC,KAAiB,EAAE,WAAmB;QACzD,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACtC,MAAM,IAAI,eAAe,CACvB,6BAA6B,KAAK,CAAC,MAAM,qBAAqB;gBAC5D,4BAA4B,IAAI,CAAC,aAAa,kBAAkB;gBAChE,+DAA+D;gBAC/D,sBAAsB,CACzB,CAAA;QACH,CAAC;QACD,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAA;IAC3E,CAAC;IAED;;;;;;OAMG;IACK,YAAY,CAAC,OAAgB;QACnC,IACE,OAAO,KAAK,IAAI;YAChB,OAAO,OAAO,KAAK,QAAQ;YAC1B,OAAmC,CAAC,WAAW,CAAC,KAAK,IAAI,EAC1D,CAAC;YACD,MAAM,MAAM,GAAG,OAAmD,CAAA;YAClE,OAAO,IAAI,IAAI,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAa,CAAC,EAAE;gBAC1D,IAAI,EAAE,MAAM,CAAC,WAAW;aACzB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,OAAe,CAAA;IACxB,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,WAAW,EACX,WAAW,GAAG,oBAAoB,EAClC,YAAY,GAAG,sBAAsB,EAQtC;IACC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE;YAC1C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;YACzD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAA;YACb,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC;gBAC5B,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAA;YACF,OAAO,IAAI,QAAQ,CAAC;gBAClB,GAAG;gBACH,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,WAAW;gBACX,YAAY;aACb,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAA"}

package/dist/edv/WasTransport.d.ts

@@ -0,0 +1,178 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * An `@interop/edv-client` `Transport` that maps Encrypted Data Vault (EDV)
+ * document operations onto ordinary WAS Resource CRUD -- the "EDV-over-WAS"
+ * layout profile (Layer 1). It is paired with `EdvClientCore`, which does all
+ * encryption, decryption, and index blinding client-side; this transport only
+ * moves opaque JWE documents to and from a WAS server, reusing the client's
+ * zcap-signed request layer (`WasClient.request()`). Keys never reach the
+ * server.
+ *
+ * Profile decisions encoded here:
+ *
+ * - **Vault per Collection.** The WAS Collection is the EDV vault; each
+ *   encrypted document is one WAS Resource.
+ * - **Restrict-mode ids.** The WAS resource id IS the EDV document id (the
+ *   128-bit multibase value `EdvClientCore.generateId()` produces), which is
+ *   URL-safe and never a reserved segment.
+ * - **Encrypted content type.** Documents are stored as `application/json` by
+ *   default, so the profile works against an unmodified WAS server. The
+ *   preferred marker is `application/edv+json` (exported as `EDV_CONTENT_TYPE`),
+ *   which distinguishes EDV envelopes from plaintext application JSON in
+ *   listings and metadata -- but the server must register an `application/*+json`
+ *   content-type parser to accept it (the reference was-teaching-server does; a
+ *   server that does not will reject it with 415). Pass `contentType:
+ *   EDV_CONTENT_TYPE` to opt into it where the server supports it.
+ *
+ * Scope: documents only (`insert` / `update` / `get`). Blinded `find` / `count`
+ * / `updateIndex` and chunked streams (`storeChunk` / `getChunk`) require
+ * server-side EDV affordances (blinded `/query`, the `/{id}/chunks/{n}`
+ * sub-segment, conditional writes) that a plaintext WAS server does not yet
+ * provide, so they throw here. Because there are no conditional writes, the EDV
+ * `sequence` is advisory (last-writer-wins on `update`).
+ */
+import { Transport } from '@interop/edv-client';
+import type { IEncryptedDocument } from '@interop/data-integrity-core';
+import type { WasClient } from '../WasClient.js';
+/**
+ * The preferred content type marking a stored EDV-encrypted document (a JSON
+ * envelope whose `jwe` property carries the ciphertext). Requires the server to
+ * register an `application/*+json` content-type parser; otherwise use the
+ * default `application/json` (see `WasTransport`'s `contentType` option).
+ */
+export declare const EDV_CONTENT_TYPE = "application/edv+json";
+/**
+ * The subset of `WasClient` this transport depends on: the signed-request
+ * escape hatch. Declared structurally so tests can supply a lightweight stub.
+ */
+type WasRequester = Pick<WasClient, 'request'>;
+export declare class WasTransport extends Transport {
+    readonly spaceId: string;
+    readonly collectionId: string;
+    readonly contentType: string;
+    private readonly _was;
+    /**
+     * @param options {object}
+     * @param options.was {WasClient}          a WAS client holding the signer
+     * @param options.spaceId {string}         the vault's Space id
+     * @param options.collectionId {string}    the vault Collection id
+     * @param [options.contentType] {string}   content type for stored envelopes;
+     *   defaults to `application/json` (accepted by an unmodified server). Pass
+     *   `EDV_CONTENT_TYPE` against a server that registers an `application/*+json`
+     *   parser.
+     */
+    constructor({ was, spaceId, collectionId, contentType }: {
+        was: WasRequester;
+        spaceId: string;
+        collectionId: string;
+        contentType?: string;
+    });
+    /**
+     * The WAS resource path for a document id, delegating to was-client's
+     * internal `resourcePath` builder so the percent-encoding and trailing-slash
+     * rules stay defined in one place (no trailing slash -- get/put/delete by
+     * id).
+     *
+     * @param id {string}   the EDV document id (= WAS resource id)
+     * @returns {string}
+     */
+    private _resourcePath;
+    /**
+     * Writes an encrypted document to its WAS resource path as
+     * `application/edv+json` (the envelope serialized to bytes so the stored
+     * content type is exact).
+     *
+     * @param id {string}
+     * @param encrypted {IEncryptedDocument}
+     * @returns {Promise<HttpResponse>}
+     */
+    private _put;
+    /**
+     * @inheritdoc
+     *
+     * Inserts a new encrypted document. WAS `PUT` is an upsert, so to preserve
+     * EDV insert semantics (`DuplicateError` if the id already exists) this first
+     * checks for an existing resource. The check + write is not atomic -- with no
+     * server-side conditional writes yet, this is an advisory, single-writer
+     * guard.
+     *
+     * @param options {object}
+     * @param options.encrypted {IEncryptedDocument}   the document to insert
+     * @returns {Promise<void>}
+     */
+    insert({ encrypted }?: {
+        encrypted?: IEncryptedDocument;
+    }): Promise<void>;
+    /**
+     * @inheritdoc
+     *
+     * Updates (upserts) an encrypted document. The EDV `sequence` is advisory
+     * here -- without server-side conditional writes, a stale write is not
+     * rejected (last-writer-wins).
+     *
+     * @param options {object}
+     * @param options.encrypted {IEncryptedDocument}   the document to update
+     * @returns {Promise<void>}
+     */
+    update({ encrypted }?: {
+        encrypted?: IEncryptedDocument;
+    }): Promise<void>;
+    /**
+     * @inheritdoc
+     *
+     * Reads an encrypted document by id. Throws a `NotFoundError` (the name
+     * `EdvClientCore` expects) when the resource is missing or not visible.
+     *
+     * @param options {object}
+     * @param options.id {string}   the document id to read
+     * @returns {Promise<IEncryptedDocument>}
+     */
+    get({ id }?: {
+        id?: string;
+    }): Promise<IEncryptedDocument>;
+    /**
+     * Resolves to `true` if a resource exists at the document's path. A 404
+     * resolves to `false`; any other error propagates.
+     *
+     * @param id {string}
+     * @returns {Promise<boolean>}
+     */
+    private _exists;
+    /**
+     * @inheritdoc
+     *
+     * Blinded-index query is not part of the documents-only EDV-over-WAS profile;
+     * it needs the server's `/query` affordance.
+     */
+    find(): Promise<never>;
+    /**
+     * @inheritdoc
+     *
+     * Index updates need the server's `/{id}/index` affordance.
+     */
+    updateIndex(): Promise<never>;
+    /**
+     * @inheritdoc
+     *
+     * Chunked streams need the reserved `/{id}/chunks/{n}` sub-segment.
+     */
+    storeChunk(): Promise<never>;
+    /**
+     * @inheritdoc
+     *
+     * Chunked streams need the reserved `/{id}/chunks/{n}` sub-segment.
+     */
+    getChunk(): Promise<never>;
+    /**
+     * Throws a uniform "not supported in this profile" error for EDV operations
+     * that depend on server-side affordances absent from a plaintext WAS server.
+     *
+     * @param operation {string}
+     * @returns {never}
+     */
+    private _unsupported;
+}
+export {};
+//# sourceMappingURL=WasTransport.d.ts.map

package/dist/edv/WasTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WasTransport.d.ts","sourceRoot":"","sources":["../../src/edv/WasTransport.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAKhD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,yBAAyB,CAAA;AAQtD;;;GAGG;AACH,KAAK,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;AAoC9C,qBAAa,YAAa,SAAQ,SAAS;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAE5B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;IAEnC;;;;;;;;;OASG;gBACS,EACV,GAAG,EACH,OAAO,EACP,YAAY,EACZ,WAAkC,EACnC,EAAE;QACD,GAAG,EAAE,YAAY,CAAA;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB;IAQD;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAIrB;;;;;;;;OAQG;YACW,IAAI;IAalB;;;;;;;;;;;;OAYG;IACY,MAAM,CAAC,EACpB,SAAS,EACV,GAAE;QAAE,SAAS,CAAC,EAAE,kBAAkB,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAa1D;;;;;;;;;;OAUG;IACY,MAAM,CAAC,EACpB,SAAS,EACV,GAAE;QAAE,SAAS,CAAC,EAAE,kBAAkB,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB1D;;;;;;;;;OASG;IACY,GAAG,CAAC,EACjB,EAAE,EACH,GAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAuBrD;;;;;;OAMG;YACW,OAAO;IAYrB;;;;;OAKG;IACY,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;IAIrC;;;;OAIG;IACY,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC;IAI5C;;;;OAIG;IACY,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC;IAI3C;;;;OAIG;IACY,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC;IAIzC;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;CAQrB"}