@interop/was-client 0.61.0 → 0.62.1

package/README.md

@@ -13,6 +13,7 @@
 - [Usage](#usage)
   - [Creating a client (signer + zcapClient)](#creating-a-client-signer--zcapclient)
     - [Deriving a client from a secret or seed (`./identity`)](#deriving-a-client-from-a-secret-or-seed-identity)
+  - [Service discovery](#service-discovery)
   - [The handle model](#the-handle-model)
   - [Spaces](#spaces)
   - [Collections](#collections)
@@ -187,6 +188,50 @@ accepted. A server that verifies both it and the older `Ed25519Signature2020`
 accepts chains whose links mix the two, which is what a fleet upgrading at its
 own pace produces.
 
+### Service discovery
+
+Before its first signed request, the client reads the server's service
+description. It sends an unsigned `HEAD` to `serverUrl` and follows the
+`Link: <...>; rel="service"` header on the response, whatever its status. Then
+it reads the linked document with an unsigned `GET`. The spec fixes no path for
+the document, so the client assumes none.
+
+From the document the client selects the WAS specification version it speaks.
+This client speaks only v0.5. It ignores `specs` keys other than
+`https://w3id.org/pws` and entries without a `version`. If no entry names v0.5,
+or the document is malformed, every signed request rejects with
+`IncompatibleServerError` before anything is signed. A server whose responses
+carry no `service` link predates v0.5 and is refused the same way. The client
+does not fall back to the v0.4 layout.
+
+Discovery runs once per client and is shared by every handle. A failure is not
+memoized, so the next request retries. Unsigned public reads (`publicRead`,
+`publicListCollection`, ...) take absolute URLs that may point at another
+server, and do not wait on discovery.
+
+`was.service()` returns what discovery found:
+
+```ts
+const info = await was.service()
+info.version // '0.5'
+info.entry // the chosen `PwsVersionEntry`
+info.description // the whole `ServiceDescription`
+info.spacesUrl // the Spaces Repository URL, or undefined
+info.features // e.g. ['listing', 'collection-management', ...]
+info.hasFeature('quotas') // false when the token is absent
+
+// Discover again, e.g. before relying on an affordance a host may have dropped.
+await was.service({ refresh: true })
+```
+
+`features` is an open token list. A token this client does not know is carried
+along and otherwise ignored, and an absent token means unsupported. The client
+gates no behavior on the document's `instance` member.
+
+A caller that already holds the document (from a cache, say) can pass it as the
+`serviceDescription` constructor option. The client then selects a version from
+that copy without fetching, and `service({ refresh: true })` discovers afresh.
+
 ### The handle model
 
 The client exposes the WAS containment model
@@ -220,10 +265,13 @@ one item" footgun. The next sections cover each level in turn.
 
 A Space is the top-level container, created from the spaces repository. The
 server requires a `name`; `controller` defaults to the client's own DID, and the
-server generates the id unless you pass one.
+server generates the id unless you pass one. `createSpace()` and `listSpaces()`
+address the Spaces Repository URL the service description names (see
+[Service discovery](#service-discovery)). Against a server whose description has
+no `spaces` URL, they throw `NotSupportedError` without sending anything.
 
 ```ts
-const space = await was.createSpace({ name: 'Home' }) // POST /spaces/
+const space = await was.createSpace({ name: 'Home' }) // POST {spacesUrl}
 
 // Lazy handle to an existing space by id -- no I/O until a verb runs.
 const same = was.space(space.id)
@@ -1134,7 +1182,8 @@ large Blobs to disk.)
 `was.request(...)` mirrors ezcap's generic `request()` for hand-built calls. As
 a deliberate escape hatch it returns the raw `HttpResponse` and throws raw
 ezcap/ky errors -- it does not apply the null-on-404 or typed-error
-conveniences.
+conveniences. It still waits on service discovery, so against an incompatible
+server it rejects with `IncompatibleServerError`.
 
 ```ts
 const response = await was.request({ path: `/space/${spaceId}`, method: 'GET' })
@@ -1171,6 +1220,12 @@ instead, as `{ outcome: 'not-found' }`, rather than swallowing it.
 Spec endpoints a given server has not yet implemented surface as
 `NotImplementedError` (the server's 501).
 
+`IncompatibleServerError` comes from service discovery, not from a response
+status. Any signed method, read methods included, throws it when the server
+speaks no WAS version this client understands (see
+[Service discovery](#service-discovery)). It carries no `status`, so a read
+method does not mistake it for a 404.
+
 ## Contribute
 
 PRs accepted. See [CONTRIBUTING.md](CONTRIBUTING.md) for editor setup (Prettier,

package/dist/WasClient.d.ts

@@ -6,16 +6,18 @@
  * signer) and exposes the WAS containment model
  * (`SpacesRepository > Space > Collection > Resource`) through lazy
  * navigational handles. Also hosts the general delegation primitive
- * (`grant`), capability-rebuilding (`fromCapability`), and the signed
- * escape-hatch (`request`).
+ * (`grant`), capability-rebuilding (`fromCapability`), the signed
+ * escape-hatch (`request`), and service discovery (`service`), which every
+ * signed request waits on.
  */
 import type { ZcapClient } from '@interop/ezcap';
 import type { HttpResponse } from '@interop/http-client';
+import type { ServiceDescription } from '@interop/storage-core';
 import type { EncryptionProvider } from './codec.js';
 import { Space } from './Space.js';
 import { Collection } from './Collection.js';
 import { Resource } from './Resource.js';
-import type { GrantOptions, HandleOptions, IDelegatedZcap, ISigner, IZcap, Json, RequestInput, CollectionResourcesList, ResourceSummary, SpaceListing } from './types.js';
+import type { GrantOptions, HandleOptions, IDelegatedZcap, ISigner, IZcap, Json, RequestInput, CollectionResourcesList, ResourceSummary, ServiceInfo, SpaceListing } from './types.js';
 export declare class WasClient {
     #private;
     readonly serverUrl: string;
@@ -33,11 +35,18 @@ export declare class WasClient {
      *   does not decide *which* collections are encrypted -- that is the
      *   descriptor/override -- so a missing key for an encrypted collection fails
      *   closed rather than silently downgrading to plaintext.
+     * @param [options.serviceDescription] {ServiceDescription}   a service
+     *   description the caller already holds (from a cache, say). The client
+     *   selects its version from this copy instead of discovering the document
+     *   from `serverUrl`, and still refuses it with `IncompatibleServerError` if
+     *   it names no version this client speaks. `service({ refresh: true })`
+     *   discards it and discovers afresh.
      */
-    constructor({ serverUrl, zcapClient, encryption }: {
+    constructor({ serverUrl, zcapClient, encryption, serviceDescription }: {
         serverUrl: string;
         zcapClient: ZcapClient;
         encryption?: EncryptionProvider;
+        serviceDescription?: ServiceDescription;
     });
     /**
      * Convenience constructor that builds the ezcap `ZcapClient` internally from
@@ -52,12 +61,15 @@ export declare class WasClient {
      * @param options.serverUrl {string}
      * @param options.signer {ISigner}
      * @param [options.encryption] {EncryptionProvider}   see the constructor
+     * @param [options.serviceDescription] {ServiceDescription}   see the
+     *   constructor
      * @returns {WasClient}
      */
-    static fromSigner({ serverUrl, signer, encryption }: {
+    static fromSigner({ serverUrl, signer, encryption, serviceDescription }: {
         serverUrl: string;
         signer: ISigner;
         encryption?: EncryptionProvider;
+        serviceDescription?: ServiceDescription;
     }): WasClient;
     /**
      * The DID controlling the wrapped signer (`signer.id` without the key
@@ -66,6 +78,34 @@ export declare class WasClient {
      * @returns {string}
      */
     get controllerDid(): string;
+    /**
+     * Discovers the server's service description and the WAS version this
+     * client speaks with it. Follows the `rel="service"` link on the response to
+     * an unsigned `HEAD` of `serverUrl`, then reads the linked document with an
+     * unsigned `GET`. No capability is invoked. The result is memoized for the
+     * life of the client and shared by every handle; concurrent callers share
+     * one discovery, and a failure is not memoized, so the next call retries.
+     *
+     * Every signed request waits on this discovery, so a caller rarely needs to
+     * call it first. It is the way to read the server-wide affordances:
+     * `features` (an open token list, where an absent token means unsupported)
+     * and `spacesUrl` (absent when the server has no Spaces Repository).
+     * Unsigned public reads (`publicRead`, `publicListCollection`, ...) address
+     * an absolute URL that may be on another server, and do not wait on it.
+     *
+     * @param [options] {object}
+     * @param [options.refresh] {boolean}   discard the memoized result (and any
+     *   constructor-supplied `serviceDescription`) and discover again, for a
+     *   caller about to rely on an affordance the server may have stopped
+     *   advertising
+     * @returns {Promise<ServiceInfo>}
+     * @throws {IncompatibleServerError}   when the server's responses carry no
+     *   `service` link (it predates v0.5), the document is malformed, or it
+     *   lists no version this client speaks
+     */
+    service(options?: {
+        refresh?: boolean;
+    }): Promise<ServiceInfo>;
     /**
      * Returns a lazy handle to a space by id. No I/O.
      *
@@ -78,13 +118,15 @@ export declare class WasClient {
     /**
      * Creates a space (server-generated id unless `id` is given). `name` is
      * optional (both in the spec and on the reference server); `controller` must
-     * match the wrapped signer's DID (which is the default).
+     * match the wrapped signer's DID (which is the default). The request goes
+     * to the Spaces Repository URL the service description names.
      *
      * @param desc {object}
      * @param [desc.id] {string}
      * @param [desc.name] {string}
      * @param [desc.controller] {string}
      * @returns {Promise<Space>}
+     * @throws {NotSupportedError}   when the server has no Spaces Repository
      */
     createSpace(desc?: {
         id?: string;
@@ -106,6 +148,7 @@ export declare class WasClient {
      * the walk has gathered the complete listing.
      *
      * @returns {Promise<SpaceListing>}
+     * @throws {NotSupportedError}   when the server has no Spaces Repository
      */
     listSpaces(): Promise<SpaceListing>;
     /**
@@ -205,6 +248,8 @@ export declare class WasClient {
      * `path` against `serverUrl`, defaults `action` to `method`, and signs via the
      * wrapped client. Returns the raw `HttpResponse` and throws raw ky/ezcap
      * errors -- it does not apply the null-on-404 or typed-error conveniences.
+     * Like every signed request it waits on {@link service} first, and rejects
+     * with its `IncompatibleServerError` before signing anything.
      *
      * @param options {RequestInput}
      * @returns {Promise<HttpResponse>}

package/dist/WasClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WasClient.d.ts","sourceRoot":"","sources":["../src/WasClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAuBxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EACd,OAAO,EACP,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,uBAAuB,EACvB,eAAe,EACf,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,qBAAa,SAAS;;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAExC;;;;;;;;;;;;OAYG;gBACS,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACX,EAAE;QACD,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,UAAU,CAAA;QACtB,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC;IAMD;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,SAAS,EACT,MAAM,EACN,UAAU,EACX,EAAE;QACD,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,OAAO,CAAA;QACf,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC,GAAG,SAAS;IAQb;;;;;OAKG;IACH,IAAI,aAAa,IAAI,MAAM,CAQ1B;IAoBD;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,KAAK;IAQ1D;;;;;;;;;;OAUG;IACG,WAAW,CACf,IAAI,GAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7D,OAAO,CAAC,KAAK,CAAC;IAejB;;;;;;;;;;;;;;;OAeG;IACG,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC;IAsBzC;;;;;;;;;OASG;IACG,UAAU,CAAC,EACf,WAAW,EACZ,EAAE;QACD,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAqC/B;;;;;;;;;;;;;OAaG;IACG,oBAAoB,CAAC,EACzB,aAAa,EACd,EAAE;QACD,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAI3C;;;;;;;;;;OAUG;IACI,yBAAyB,CAAC,EAC/B,aAAa,EACd,EAAE;QACD,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,cAAc,CAAC,uBAAuB,CAAC;IAI3C;;;;;;;;;;OAUG;IACI,yBAAyB,CAAC,EAC/B,aAAa,EACd,EAAE;QACD,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,cAAc,CAAC,eAAe,CAAC;IAInC;;;;;;;OAOG;IACH,cAAc,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ;IAuD1D;;;;;;;;OAQG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAI3D;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD;;;;;;;;OAQG;IACG,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;CAG5D"}
+{"version":3,"file":"WasClient.d.ts","sourceRoot":"","sources":["../src/WasClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAoB/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EACd,OAAO,EACP,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,uBAAuB,EACvB,eAAe,EACf,WAAW,EACX,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,qBAAa,SAAS;;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAExC;;;;;;;;;;;;;;;;;;OAkBG;gBACS,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,kBAAkB,EACnB,EAAE;QACD,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,UAAU,CAAA;QACtB,UAAU,CAAC,EAAE,kBAAkB,CAAA;QAC/B,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;KACxC;IAOD;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,SAAS,EACT,MAAM,EACN,UAAU,EACV,kBAAkB,EACnB,EAAE;QACD,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,OAAO,CAAA;QACf,UAAU,CAAC,EAAE,kBAAkB,CAAA;QAC/B,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;KACxC,GAAG,SAAS;IASb;;;;;OAKG;IACH,IAAI,aAAa,IAAI,MAAM,CAQ1B;IAUD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,OAAO,CAAC,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IA8CxE;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,KAAK;IAQ1D;;;;;;;;;;;;OAYG;IACG,WAAW,CACf,IAAI,GAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7D,OAAO,CAAC,KAAK,CAAC;IAejB;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC;IAsBzC;;;;;;;;;OASG;IACG,UAAU,CAAC,EACf,WAAW,EACZ,EAAE;QACD,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAqC/B;;;;;;;;;;;;;OAaG;IACG,oBAAoB,CAAC,EACzB,aAAa,EACd,EAAE;QACD,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAI3C;;;;;;;;;;OAUG;IACI,yBAAyB,CAAC,EAC/B,aAAa,EACd,EAAE;QACD,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,cAAc,CAAC,uBAAuB,CAAC;IAI3C;;;;;;;;;;OAUG;IACI,yBAAyB,CAAC,EAC/B,aAAa,EACd,EAAE;QACD,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,cAAc,CAAC,eAAe,CAAC;IAInC;;;;;;;OAOG;IACH,cAAc,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ;IAuD1D;;;;;;;;OAQG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAI3D;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD;;;;;;;;;;OAUG;IACG,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;CAG5D"}

package/dist/WasClient.js

@@ -1,10 +1,12 @@
-import { collectionItemsUrl, parseSpaceTarget, spacesRoot, toUrl } from './internal/paths.js';
+import { collectionItemsUrl, parseSpaceTarget } from './internal/paths.js';
 import { send, rawRequest, unsignedRequest } from './internal/request.js';
 import { createdId, parseResource, readJsonData } from './internal/content.js';
 import { buildPageWalk, collectPages, collectWalk, signedPageWalk, walkItems, walkPagesOrEmpty } from './internal/pagination.js';
 import { delegateGrant } from './internal/grant.js';
 import { spaceIdOf, submitRevocation } from './internal/revoke.js';
-import { ValidationError, WasServerError } from './errors.js';
+import { Memo } from './internal/memo.js';
+import { discoverService, selectServiceVersion } from './internal/service.js';
+import { NotSupportedError, ValidationError, WasServerError } from './errors.js';
 import { zcapClientForSigner } from './zcapClient.js';
 import { Space } from './Space.js';
 import { Collection } from './Collection.js';
@@ -25,11 +27,18 @@ export class WasClient {
      *   does not decide *which* collections are encrypted -- that is the
      *   descriptor/override -- so a missing key for an encrypted collection fails
      *   closed rather than silently downgrading to plaintext.
+     * @param [options.serviceDescription] {ServiceDescription}   a service
+     *   description the caller already holds (from a cache, say). The client
+     *   selects its version from this copy instead of discovering the document
+     *   from `serverUrl`, and still refuses it with `IncompatibleServerError` if
+     *   it names no version this client speaks. `service({ refresh: true })`
+     *   discards it and discovers afresh.
      */
-    constructor({ serverUrl, zcapClient, encryption }) {
+    constructor({ serverUrl, zcapClient, encryption, serviceDescription }) {
         this.serverUrl = serverUrl;
         this.zcapClient = zcapClient;
         this.encryption = encryption;
+        this.#serviceDescription = serviceDescription;
     }
     /**
      * Convenience constructor that builds the ezcap `ZcapClient` internally from
@@ -44,13 +53,16 @@ export class WasClient {
      * @param options.serverUrl {string}
      * @param options.signer {ISigner}
      * @param [options.encryption] {EncryptionProvider}   see the constructor
+     * @param [options.serviceDescription] {ServiceDescription}   see the
+     *   constructor
      * @returns {WasClient}
      */
-    static fromSigner({ serverUrl, signer, encryption }) {
+    static fromSigner({ serverUrl, signer, encryption, serviceDescription }) {
         return new WasClient({
             serverUrl,
             zcapClient: zcapClientForSigner({ signer }),
-            encryption
+            encryption,
+            serviceDescription
         });
     }
     /**
@@ -66,6 +78,58 @@ export class WasClient {
         }
         return signer.id.split('#')[0];
     }
+    #serviceDescription;
+    #service = new Memo(async () => this.#serviceDescription === undefined
+        ? discoverService({ url: this.serverUrl })
+        : selectServiceVersion(this.#serviceDescription));
+    /**
+     * Discovers the server's service description and the WAS version this
+     * client speaks with it. Follows the `rel="service"` link on the response to
+     * an unsigned `HEAD` of `serverUrl`, then reads the linked document with an
+     * unsigned `GET`. No capability is invoked. The result is memoized for the
+     * life of the client and shared by every handle; concurrent callers share
+     * one discovery, and a failure is not memoized, so the next call retries.
+     *
+     * Every signed request waits on this discovery, so a caller rarely needs to
+     * call it first. It is the way to read the server-wide affordances:
+     * `features` (an open token list, where an absent token means unsupported)
+     * and `spacesUrl` (absent when the server has no Spaces Repository).
+     * Unsigned public reads (`publicRead`, `publicListCollection`, ...) address
+     * an absolute URL that may be on another server, and do not wait on it.
+     *
+     * @param [options] {object}
+     * @param [options.refresh] {boolean}   discard the memoized result (and any
+     *   constructor-supplied `serviceDescription`) and discover again, for a
+     *   caller about to rely on an affordance the server may have stopped
+     *   advertising
+     * @returns {Promise<ServiceInfo>}
+     * @throws {IncompatibleServerError}   when the server's responses carry no
+     *   `service` link (it predates v0.5), the document is malformed, or it
+     *   lists no version this client speaks
+     */
+    async service(options = {}) {
+        if (options.refresh) {
+            this.#serviceDescription = undefined;
+            this.#service.reset();
+        }
+        return this.#service.get();
+    }
+    /**
+     * The Spaces Repository URL from the service description.
+     *
+     * @returns {Promise<string>}
+     * @throws {NotSupportedError}   when the server does not implement the
+     *   Spaces Repository
+     */
+    async #spacesUrl() {
+        const { spacesUrl, version } = await this.service();
+        if (spacesUrl === undefined) {
+            throw new NotSupportedError(`The server at "${this.serverUrl}" does not implement the Spaces ` +
+                `Repository: its WAS ${version} service description entry has no ` +
+                '`spaces` URL.');
+        }
+        return spacesUrl;
+    }
     #cachedContext;
     get #context() {
         // `serverUrl`, `zcapClient` (and thus `controllerDid`), and `encryption`
@@ -77,7 +141,8 @@ export class WasClient {
                 serverUrl: this.serverUrl,
                 zcapClient: this.zcapClient,
                 controllerDid: this.controllerDid,
-                encryption: this.encryption
+                encryption: this.encryption,
+                service: () => this.service()
             };
         }
         return this.#cachedContext;
@@ -100,13 +165,15 @@ export class WasClient {
     /**
      * Creates a space (server-generated id unless `id` is given). `name` is
      * optional (both in the spec and on the reference server); `controller` must
-     * match the wrapped signer's DID (which is the default).
+     * match the wrapped signer's DID (which is the default). The request goes
+     * to the Spaces Repository URL the service description names.
      *
      * @param desc {object}
      * @param [desc.id] {string}
      * @param [desc.name] {string}
      * @param [desc.controller] {string}
      * @returns {Promise<Space>}
+     * @throws {NotSupportedError}   when the server has no Spaces Repository
      */
     async createSpace(desc = {}) {
         const controller = desc.controller ?? this.controllerDid;
@@ -116,7 +183,7 @@ export class WasClient {
             ...(desc.name !== undefined && { name: desc.name })
         };
         const response = await send(this.#context, {
-            path: spacesRoot(),
+            url: await this.#spacesUrl(),
             method: 'POST',
             json: body
         });
@@ -137,19 +204,20 @@ export class WasClient {
      * the walk has gathered the complete listing.
      *
      * @returns {Promise<SpaceListing>}
+     * @throws {NotSupportedError}   when the server has no Spaces Repository
      */
     async listSpaces() {
+        const spacesUrl = await this.#spacesUrl();
         const walk = await signedPageWalk(this.#context, {
-            firstUrl: toUrl({ serverUrl: this.serverUrl, path: spacesRoot() })
+            firstUrl: spacesUrl
         });
         // The first page always carries the listing body (an unauthorized caller
         // still gets an empty `items` list, not an error), so a `null` walk is a
-        // server fault -- a 404 from a `serverUrl` whose base path does not reach
-        // the repository, or a 2xx whose body did not parse as JSON. Report it as
-        // one, rather than as a `TypeError` from destructuring `null`.
+        // server fault -- a 404 at the advertised repository URL, or a 2xx whose
+        // body did not parse as JSON. Report it as one, rather than as a
+        // `TypeError` from destructuring `null`.
         if (walk === null) {
-            throw new WasServerError(`The space listing at "${this.serverUrl}" answered with no JSON ` +
-                'body. Check that `serverUrl` names the WAS repository root.');
+            throw new WasServerError(`The space listing at "${spacesUrl}" answered with no JSON body.`);
         }
         const listing = await collectPages(walk);
         // A paginating server omits `totalItems` on truncated pages; the walk has
@@ -341,6 +409,8 @@ export class WasClient {
      * `path` against `serverUrl`, defaults `action` to `method`, and signs via the
      * wrapped client. Returns the raw `HttpResponse` and throws raw ky/ezcap
      * errors -- it does not apply the null-on-404 or typed-error conveniences.
+     * Like every signed request it waits on {@link service} first, and rejects
+     * with its `IncompatibleServerError` before signing anything.
      *
      * @param options {RequestInput}
      * @returns {Promise<HttpResponse>}

package/dist/WasClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"WasClient.js","sourceRoot":"","sources":["../src/WasClient.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,KAAK,EACN,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,WAAW,EACX,cAAc,EACd,SAAS,EACT,gBAAgB,EACjB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAcxC,MAAM,OAAO,SAAS;IACX,SAAS,CAAQ;IACjB,UAAU,CAAY;IACtB,UAAU,CAAqB;IAExC;;;;;;;;;;;;OAYG;IACH,YAAY,EACV,SAAS,EACT,UAAU,EACV,UAAU,EAKX;QACC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,SAAS,EACT,MAAM,EACN,UAAU,EAKX;QACC,OAAO,IAAI,SAAS,CAAC;YACnB,SAAS;YACT,UAAU,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3C,UAAU;SACX,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,IAAI,aAAa;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CACvB,oDAAoD,CACrD,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAA;IAC1C,CAAC;IAED,cAAc,CAAgB;IAE9B,IAAI,QAAQ;QACV,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,uBAAuB;QACvB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,cAAc,GAAG;gBACpB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAe,EAAE,UAAyB,EAAE;QAChD,OAAO,IAAI,KAAK,CAAC;YACf,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW,CACf,OAA4D,EAAE;QAE9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAA;QACxD,MAAM,IAAI,GAAG;YACX,UAAU;YACV,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SACpD,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,UAAU,EAAE;YAClB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxC,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,GAAG,MAAM,cAAc,CAAe,IAAI,CAAC,QAAQ,EAAE;YAC7D,QAAQ,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC;SACnE,CAAC,CAAA;QACF,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CACtB,yBAAyB,IAAI,CAAC,SAAS,0BAA0B;gBAC/D,6DAA6D,CAChE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QACxC,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAA;QACzC,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,EACf,WAAW,EAGZ;QACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;YACrC,GAAG,EAAE,WAAW;YAChB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,OAAO,aAAa,CAAC;YACnB,mEAAmE;YACnE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,CAAC;YAC3C,SAAS,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;gBACzB,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC;oBACzC,GAAG,EAAE,OAAO;oBACZ,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,IAAI;iBACX,CAAC,CAAA;gBACF,kEAAkE;gBAClE,wDAAwD;gBACxD,OAAO,YAAY,KAAK,IAAI;oBAC1B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAE,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAA6B,CAAA;YACrE,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,oBAAoB,CAAC,EACzB,aAAa,EAGd;QACC,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAC/B,aAAa,EAGd;QACC,KAAK,CAAC,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAA;IACpE,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAC/B,aAAa,EAGd;QACC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;IACrE,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,IAAW;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAA;QACpC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,gCAAgC,EAC3D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;QACtE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,iDAAiD,MAAM,aAAa;gBAClE,8BAA8B,IAAI,CAAC,SAAS,IAAI,CACnD,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,yBAAyB;gBAClD,oEAAoE;gBACpE,oDAAoD;gBACpD,8DAA8D,CACjE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,QAAQ,CAAC;gBAClB,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,IAAI,UAAU,CAAC;gBACpB,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,MAAM,CAAC,IAAoB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,OAAO,gBAAgB,CAAC,OAAO,EAAE;YAC/B,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;YACjC,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;CACF"}
+{"version":3,"file":"WasClient.js","sourceRoot":"","sources":["../src/WasClient.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAE1E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,WAAW,EACX,cAAc,EACd,SAAS,EACT,gBAAgB,EACjB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAexC,MAAM,OAAO,SAAS;IACX,SAAS,CAAQ;IACjB,UAAU,CAAY;IACtB,UAAU,CAAqB;IAExC;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,kBAAkB,EAMnB;QACC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,mBAAmB,GAAG,kBAAkB,CAAA;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,SAAS,EACT,MAAM,EACN,UAAU,EACV,kBAAkB,EAMnB;QACC,OAAO,IAAI,SAAS,CAAC;YACnB,SAAS;YACT,UAAU,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3C,UAAU;YACV,kBAAkB;SACnB,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,IAAI,aAAa;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CACvB,oDAAoD,CACrD,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAA;IAC1C,CAAC;IAED,mBAAmB,CAAqB;IAE/B,QAAQ,GAAG,IAAI,IAAI,CAAc,KAAK,IAAI,EAAE,CACnD,IAAI,CAAC,mBAAmB,KAAK,SAAS;QACpC,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1C,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CACnD,CAAA;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,CAAC,OAAO,CAAC,UAAiC,EAAE;QAC/C,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAA;YACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;QACvB,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAA;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,IAAI,CAAC,SAAS,kCAAkC;gBAChE,uBAAuB,OAAO,oCAAoC;gBAClE,eAAe,CAClB,CAAA;QACH,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,cAAc,CAAgB;IAE9B,IAAI,QAAQ;QACV,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,uBAAuB;QACvB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,cAAc,GAAG;gBACpB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;aAC9B,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAe,EAAE,UAAyB,EAAE;QAChD,OAAO,IAAI,KAAK,CAAC;YACf,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,WAAW,CACf,OAA4D,EAAE;QAE9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAA;QACxD,MAAM,IAAI,GAAG;YACX,UAAU;YACV,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SACpD,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,GAAG,EAAE,MAAM,IAAI,CAAC,UAAU,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAA;QACzC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAe,IAAI,CAAC,QAAQ,EAAE;YAC7D,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAA;QACF,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,iEAAiE;QACjE,yCAAyC;QACzC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CACtB,yBAAyB,SAAS,+BAA+B,CAClE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QACxC,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAA;QACzC,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,EACf,WAAW,EAGZ;QACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;YACrC,GAAG,EAAE,WAAW;YAChB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,OAAO,aAAa,CAAC;YACnB,mEAAmE;YACnE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,CAAC;YAC3C,SAAS,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;gBACzB,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC;oBACzC,GAAG,EAAE,OAAO;oBACZ,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,IAAI;iBACX,CAAC,CAAA;gBACF,kEAAkE;gBAClE,wDAAwD;gBACxD,OAAO,YAAY,KAAK,IAAI;oBAC1B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAE,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAA6B,CAAA;YACrE,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,oBAAoB,CAAC,EACzB,aAAa,EAGd;QACC,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAC/B,aAAa,EAGd;QACC,KAAK,CAAC,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAA;IACpE,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAC/B,aAAa,EAGd;QACC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;IACrE,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,IAAW;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAA;QACpC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,gCAAgC,EAC3D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;QACtE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,iDAAiD,MAAM,aAAa;gBAClE,8BAA8B,IAAI,CAAC,SAAS,IAAI,CACnD,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,yBAAyB;gBAClD,oEAAoE;gBACpE,oDAAoD;gBACpD,8DAA8D,CACjE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,QAAQ,CAAC;gBAClB,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,IAAI,UAAU,CAAC;gBACpB,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,MAAM,CAAC,IAAoB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,OAAO,gBAAgB,CAAC,OAAO,EAAE;YAC/B,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;YACjC,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;CACF"}

package/dist/edv/EdvCodec.d.ts

@@ -275,11 +275,10 @@ export declare function buildEdvCodec({ collectionId, label, transportFactory, e
  *
  * Applies the same fail-closed guards as `codecFor`: a future-scheme
  * descriptor and a descriptor without epochs are refused. The write epoch is
- * the descriptor's `currentEpoch`; a descriptor that omits it seals to the
- * last listed epoch (the roster is append-only, so that is the newest). A
- * `currentEpoch` the roster does not list violates the descriptor invariant
- * and is refused fail-closed -- silently re-routing it could seal new
- * plaintext to a rotated-out epoch whose removed recipients still hold keys.
+ * the descriptor's `currentEpoch`. A descriptor that omits it, or names an
+ * epoch the roster does not list, violates the descriptor invariant and is
+ * refused fail-closed -- guessing another entry could seal new plaintext to a
+ * rotated-out epoch whose removed recipients still hold keys.
  *
  * @param options {object}
  * @param options.collectionId {string}   labels errors; and on a slot-bound

package/dist/edv/EdvCodec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EdvCodec.d.ts","sourceRoot":"","sources":["../../src/edv/EdvCodec.ts"],"names":[],"mappings":"AAwEA,OAAO,EAAE,aAAa,EAAe,MAAM,qBAAqB,CAAA;AAChE,OAAO,KAAK,EAGV,gBAAgB,EAChB,YAAY,EAEb,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAGV,aAAa,EACb,mBAAmB,EACnB,UAAU,EACV,kBAAkB,EAElB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,EACb,MAAM,aAAa,CAAA;AAepB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAMhD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAQ/C,OAAO,KAAK,EACV,oBAAoB,EACpB,IAAI,EACJ,YAAY,EACZ,sBAAsB,EACtB,2BAA2B,EAC5B,MAAM,aAAa,CAAA;AA8BpB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,mBAAmB,CAAA;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACzC,KAAK,YAAY,CAAA;AAElB;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,YAAY,EACZ,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;CACpB,GAAG,qBAAqB,CAUxB;AA4GD;;;;GAIG;AACH,qBAAa,QAAS,YAAW,aAAa;;IAC5C,QAAQ,CAAC,iBAAiB,QAAO;IAqFjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;gBACS,EACV,GAAG,EACH,eAAe,EACf,QAAQ,EACR,UAAU,EACV,WAAW,EACX,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,OAAO,EACP,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,IAAI,EACL,EAAE;QACD,GAAG,EAAE,aAAa,CAAA;QAClB,eAAe,EAAE,gBAAgB,CAAA;QACjC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;QAC5B,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,YAAY,EAAE,QAAQ,GAAG,SAAS,CAAA;QAClC,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;QACxC,YAAY,EAAE,MAAM,CAAA;QACpB,QAAQ,EAAE,MAAM,EAAE,CAAA;QAClB,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;KAC1B;IA2BD;;;;OAIG;IACH,IAAI,WAAW,IAAI,WAAW,GAAG,IAAI,CAEpC;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,aAAa,GAAG,SAAS,CAExC;IAgED;;OAEG;IACG,MAAM,CAAC,EACX,EAAE,EACF,IAAI,EACJ,WAAW,EACX,OAAO,EACP,YAAY,EACb,EAAE;QACD,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,YAAY,CAAA;QAClB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,CAAA;QAC7B,YAAY,CAAC,EAAE,iBAAiB,CAAA;KACjC,GAAG,OAAO,CAAC,UAAU,CAAC;IAuZvB;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,YAAY,EACtB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAkdvB;;;;;;;;OAQG;IACG,UAAU,CAAC,EACf,MAAM,EACN,IAAI,EACL,EAAE;QACD,MAAM,EAAE,2BAA2B,CAAA;QACnC,IAAI,EAAE,aAAa,CAAA;KACpB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAwC9C;;;;;;;;;;;;;OAaG;IACG,UAAU,CACd,EACE,MAAM,EACP,EAAE;QACD,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,EACD,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,sBAAsB,CAAC;CAyOnC;AAqGD;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,WAAW,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,WAAW,EACX,WAAkC,EAClC,YAAqC,EACrC,SAAS,EACT,YAAuB,EACxB,EAAE;IACD,WAAW,EAAE,CAAC,GAAG,EAAE;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;KACrB,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;CACpC,GAAG,kBAAkB,CA2CrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,aAAa,CAAC,EAClC,YAAY,EACZ,KAA2B,EAC3B,gBAAgB,EAChB,UAAU,EACV,IAAI,EACJ,YAAY,EACZ,WAAkC,EAClC,YAAqC,EACrC,SAAS,EACV,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;IACxC,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC,IAAI,EAAE,OAAO,CAAA;IACb,YAAY,EAAE,QAAQ,GAAG,SAAS,CAAA;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwDpB;AAuED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,YAAY,EACZ,YAAY,EACZ,UAAU,EACX,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,SAAS,GAAG,QAAQ,CAAA;IAClC,UAAU,EAAE,oBAAoB,CAAA;CACjC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4BpB"}
+{"version":3,"file":"EdvCodec.d.ts","sourceRoot":"","sources":["../../src/edv/EdvCodec.ts"],"names":[],"mappings":"AAwEA,OAAO,EAAE,aAAa,EAAe,MAAM,qBAAqB,CAAA;AAChE,OAAO,KAAK,EAGV,gBAAgB,EAChB,YAAY,EAEb,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAGV,aAAa,EACb,mBAAmB,EACnB,UAAU,EACV,kBAAkB,EAElB,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,EACb,MAAM,aAAa,CAAA;AAepB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAMhD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAQ/C,OAAO,KAAK,EACV,oBAAoB,EACpB,IAAI,EACJ,YAAY,EACZ,sBAAsB,EACtB,2BAA2B,EAC5B,MAAM,aAAa,CAAA;AA8BpB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,mBAAmB,CAAA;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACzC,KAAK,YAAY,CAAA;AAElB;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,OAAO,EACP,YAAY,EACZ,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;CACpB,GAAG,qBAAqB,CAUxB;AA4GD;;;;GAIG;AACH,qBAAa,QAAS,YAAW,aAAa;;IAC5C,QAAQ,CAAC,iBAAiB,QAAO;IAqFjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;gBACS,EACV,GAAG,EACH,eAAe,EACf,QAAQ,EACR,UAAU,EACV,WAAW,EACX,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,OAAO,EACP,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,IAAI,EACL,EAAE;QACD,GAAG,EAAE,aAAa,CAAA;QAClB,eAAe,EAAE,gBAAgB,CAAA;QACjC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;QAC5B,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,YAAY,EAAE,QAAQ,GAAG,SAAS,CAAA;QAClC,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;QACxC,YAAY,EAAE,MAAM,CAAA;QACpB,QAAQ,EAAE,MAAM,EAAE,CAAA;QAClB,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;KAC1B;IA2BD;;;;OAIG;IACH,IAAI,WAAW,IAAI,WAAW,GAAG,IAAI,CAEpC;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,aAAa,GAAG,SAAS,CAExC;IAgED;;OAEG;IACG,MAAM,CAAC,EACX,EAAE,EACF,IAAI,EACJ,WAAW,EACX,OAAO,EACP,YAAY,EACb,EAAE;QACD,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,YAAY,CAAA;QAClB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,CAAA;QAC7B,YAAY,CAAC,EAAE,iBAAiB,CAAA;KACjC,GAAG,OAAO,CAAC,UAAU,CAAC;IAuZvB;;OAEG;IACG,MAAM,CACV,QAAQ,EAAE,YAAY,EACtB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAkdvB;;;;;;;;OAQG;IACG,UAAU,CAAC,EACf,MAAM,EACN,IAAI,EACL,EAAE;QACD,MAAM,EAAE,2BAA2B,CAAA;QACnC,IAAI,EAAE,aAAa,CAAA;KACpB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAwC9C;;;;;;;;;;;;;OAaG;IACG,UAAU,CACd,EACE,MAAM,EACP,EAAE;QACD,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,EACD,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,sBAAsB,CAAC;CAyOnC;AAqGD;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,WAAW,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,WAAW,EACX,WAAkC,EAClC,YAAqC,EACrC,SAAS,EACT,YAAuB,EACxB,EAAE;IACD,WAAW,EAAE,CAAC,GAAG,EAAE;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;KACrB,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;CACpC,GAAG,kBAAkB,CA2CrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,aAAa,CAAC,EAClC,YAAY,EACZ,KAA2B,EAC3B,gBAAgB,EAChB,UAAU,EACV,IAAI,EACJ,YAAY,EACZ,WAAkC,EAClC,YAAqC,EACrC,SAAS,EACV,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;IACxC,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC,IAAI,EAAE,OAAO,CAAA;IACb,YAAY,EAAE,QAAQ,GAAG,SAAS,CAAA;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwDpB;AAgFD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,YAAY,EACZ,YAAY,EACZ,UAAU,EACX,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,SAAS,GAAG,QAAQ,CAAA;IAClC,UAAU,EAAE,oBAAoB,CAAA;CACjC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2BpB"}

package/dist/edv/EdvCodec.js

@@ -79,7 +79,7 @@ import { WasTransport } from './WasTransport.js';
 import { isEncryptedEnvelope } from '../sync/envelope.js';
 import { epochWriteStandIn, resolveEpochKeys } from './epochKeys.js';
 import { didKeyResolver } from './epochCrypto.js';
-import { currentEpochOf } from './epochRoster.js';
+import { currentEpochOf, hasKeyEpochs } from './epochRoster.js';
 import { resolveHmacKey } from './hmacKey.js';
 import { DECODER, isBlob, isTextContentType, readJsonData, resolvePayload } from '../internal/content.js';
 import { DEFAULT_CONTENT_TYPE, EDV_SCHEME_VERSION, envelopeBytes } from './constants.js';
@@ -1692,7 +1692,7 @@ export async function buildEdvCodec({ collectionId, label = `"${collectionId}"`,
  * @param options.label {string}   names the collection in error messages
  * @param [options.encryption] {CollectionEncryption}   the descriptor
  * @returns {CollectionEncryption}   the descriptor, with `epochs` narrowed
- *   non-empty
+ *   non-empty and `currentEpoch` narrowed to a string
  */
 function guardEncryptionDescriptor({ label, encryption }) {
     const defect = descriptorDefect(encryption);
@@ -1705,8 +1705,9 @@ function guardEncryptionDescriptor({ label, encryption }) {
  * The one routability rule for an `edv` descriptor, shared by the throwing
  * guard and the provider's `canRoute`: names why this client cannot route the
  * descriptor as it stands (a scheme version newer than this client
- * implements, or no key epochs), or `null` when it can. The reason reads as
- * the predicate of a sentence whose subject is the collection.
+ * implements, no key epochs, or no `currentEpoch`), or `null` when it can.
+ * The reason reads as the predicate of a sentence whose subject is the
+ * collection.
  *
  * @param [encryption] {CollectionEncryption}
  * @returns {string | null}
@@ -1726,6 +1727,10 @@ function descriptorDefect(encryption) {
             'a descriptor without one is refused rather than encrypted straight ' +
             'to a key-agreement key.');
     }
+    if (!hasKeyEpochs(encryption)) {
+        return ('declares key epochs but no currentEpoch, so the epoch to seal under ' +
+            'cannot be identified. Re-read the descriptor.');
+    }
     return null;
 }
 /**
@@ -1741,11 +1746,10 @@ function descriptorDefect(encryption) {
  *
  * Applies the same fail-closed guards as `codecFor`: a future-scheme
  * descriptor and a descriptor without epochs are refused. The write epoch is
- * the descriptor's `currentEpoch`; a descriptor that omits it seals to the
- * last listed epoch (the roster is append-only, so that is the newest). A
- * `currentEpoch` the roster does not list violates the descriptor invariant
- * and is refused fail-closed -- silently re-routing it could seal new
- * plaintext to a rotated-out epoch whose removed recipients still hold keys.
+ * the descriptor's `currentEpoch`. A descriptor that omits it, or names an
+ * epoch the roster does not list, violates the descriptor invariant and is
+ * refused fail-closed -- guessing another entry could seal new plaintext to a
+ * rotated-out epoch whose removed recipients still hold keys.
  *
  * @param options {object}
  * @param options.collectionId {string}   labels errors; and on a slot-bound
@@ -1759,8 +1763,7 @@ export async function encryptOnlyEdvCodec({ collectionId, idDerivation, encrypti
     const label = `"${collectionId}"`;
     const descriptor = guardEncryptionDescriptor({ label, encryption });
     // `currentEpoch` MUST name a listed epoch (storage-core's descriptor
-    // invariant); with none declared, the last listed epoch is the newest,
-    // since the roster is append-only and the current epoch never moves back.
+    // invariant); the list order is not trusted to put the newest epoch last.
     const writeEpoch = currentEpochOf({
         epochs: descriptor.epochs,
         currentEpoch: descriptor.currentEpoch,