@interop/was-client 0.65.0 → 0.67.0

package/README.md

@@ -217,7 +217,7 @@ info.version // '0.5'
 info.entry // the chosen `PwsVersionEntry`
 info.description // the whole `ServiceDescription`
 info.spacesUrl // the Spaces Repository URL, or undefined
-info.features // e.g. ['listing', 'collection-management', ...]
+info.features // e.g. ['listing', 'collection-management', 'changes-query', ...]
 info.hasFeature('quotas') // false when the token is absent
 
 // Discover again, e.g. before relying on an affordance a host may have dropped.
@@ -611,7 +611,7 @@ await collection.setMeta({ custom: { name: 'Vault', tags: { app: 'wallet' } } })
 await collection.setName('Renamed vault') // keeps existing tags
 await collection.setTags({ app: 'wallet' }) // keeps existing name
 
-// Conditional metadata write, against a `conditional-writes` backend.
+// Conditional metadata write.
 await collection.setMeta({ custom: { name: 'Vault' } }, { ifMatch: meta?.etag })
 // ...or create the Collection only if it does not exist yet:
 await collection.setMeta({ custom: { name: 'Vault' } }, { ifNoneMatch: true })
@@ -690,10 +690,10 @@ const { descriptor } = await store.read() // verified head state, `history` kept
 
 ### Conditional writes (optimistic concurrency)
 
-Against a backend that advertises the `conditional-writes` feature (see below),
-a Resource carries a strong **`ETag`** validator that changes on every write.
-Use it to prevent the lost-update problem -- two clients that both read version
-_N_ and each write _N+1_, the second silently clobbering the first.
+Every Resource carries a strong **`ETag`** validator that changes on every write
+(conditional writes are a baseline WAS server requirement). Use it to prevent
+the lost-update problem -- two clients that both read version _N_ and each write
+_N+1_, the second silently clobbering the first.
 
 ```ts
 const { etag } = await collection.put('doc', { v: 1 }) // writes return the ETag
@@ -740,20 +740,21 @@ const usage = await collection.quota() // BackendUsage | null
 // usage: { id, state, usageBytes, limit, restrictedActions, measuredAt, ... }
 ```
 
-A `BackendDescriptor`'s optional `features` array advertises optional **server
-affordances** -- things the backend actively does beyond the baseline read/write
-API (e.g. `conditional-writes`, `blinded-index-query`, `chunked-streams`). An
-absent token means the backend makes no claim to it, so treat it as unsupported
-rather than assuming a default. (Client-side encryption is _not_ a backend
-feature -- see below.)
+A `BackendDescriptor` says where a Collection's data lives; it advertises no
+optional affordances. Server-wide affordances are read from the service
+description instead:
 
 ```ts
-const backend = await collection.backend()
-if (backend?.features?.includes('conditional-writes')) {
-  // backend enforces If-Match / If-None-Match write preconditions
+const info = await was.service()
+if (info.hasFeature('changes-query')) {
+  // the server serves the replication change feed
 }
 ```
 
+An absent token means the server makes no claim to it, so treat it as
+unsupported rather than assuming a default. (Client-side encryption is _not_ a
+server affordance -- see below.)
+
 ### Registering a Bring-Your-Own-Storage backend
 
 Beyond the server's built-in `default` backend, the Space controller can
@@ -768,7 +769,6 @@ const descriptor = await space.registerBackend({
   id: 'gdrive-personal', // unique within the Space
   name: 'My Google Drive',
   provider: 'google-drive', // selects the server-side adapter
-  storageMode: ['document', 'blob'],
   connection: {
     kind: 'oauth2-google',
     authorizationCode: '4/0Ab...', // one-time PKCE code (or a refreshToken)
@@ -918,12 +918,13 @@ scope for now):
 - **Binary.** A `Blob`/`Uint8Array` up to `maxBlobBytes` (512 KiB by default) is
   encrypted as a single document. A larger one is routed automatically by
   `add()` to the chunked-stream path: one document plus its chunk resources,
-  read back transparently by `get()`. That needs the backend's `chunked-streams`
-  feature, checked before anything is written (`NotSupportedError` otherwise).
-  Two limits apply. Auto-routing is an `add()` affordance -- `put(id, bigBlob)`
-  is refused, since replacing an existing document's chunks is not automated.
-  And a content-addressed collection (`idDerivation: 'content'`) is refused too:
-  a chunked write stores the document twice, so no single ciphertext derives its
+  read back transparently by `get()`. Serving the chunk endpoints is a
+  conformance requirement of a server that offers encrypted collections, so
+  there is no client-side gate -- one that does not answers `501`. Two limits
+  apply. Auto-routing is an `add()` affordance -- `put(id, bigBlob)` is refused,
+  since replacing an existing document's chunks is not automated. And a
+  content-addressed collection (`idDerivation: 'content'`) is refused too: a
+  chunked write stores the document twice, so no single ciphertext derives its
   id. Tune the threshold and the chunk size with
   `createEdvEncryption({ maxBlobBytes, chunkSize })`.
 - **Raw reads.** `get()` decrypts; the `getText()` / `getBytes()` escape hatches
@@ -989,9 +990,10 @@ Two properties are worth planning around:
   an attribute the schema does not declare throws `ValidationError` rather than
   silently matching nothing.
 
-Requires the collection's backend to advertise `blinded-index-query`; a backend
-without it answers `501` (`NotImplementedError`). `find()` / `declareIndex()` on
-a plaintext collection throw -- there is no client-side index there.
+Serving the blinded-index query profile is a conformance requirement of a server
+that offers encrypted collections; one that does not answers `501`
+(`NotImplementedError`). `find()` / `declareIndex()` on a plaintext collection
+throw -- there is no client-side index there.
 
 Note that `collection.setMeta({ custom })` replaces the whole `custom` object,
 schema included; the `setName()` / `setTags()` sugar merges instead and leaves
@@ -1017,31 +1019,38 @@ plugs into:
   failure arrives as the typed `WasError` subclass for its status, carrying the
   server's `problem+json` fields.
 - **`isSyncConflictError` / `isSyncNotFoundError` / `isSyncAuthError` /
-  `isUnknownEpochError` / `isKeyUnwrapError`** classify those signals by
-  `err.name`. Use them rather than `instanceof`: the port and the `DocCipher`
-  are seams your app injects, and a tree that resolves two copies of this
-  package makes an `instanceof` check quietly false. Read what you need off the
-  matched value, such as `err.status` on an auth error to tell a 401 from the
-  masked 404. The last two tell a decrypt's two no-key outcomes apart: an epoch
-  the reader's descriptor does not list (a re-read may fix it) and an epoch it
-  lists but this reader holds no key for (real data, permanently unreadable
-  here, never garbage).
+  `isUnknownEpochError` / `isKeyUnwrapError` / `isIntegrityError`** classify
+  those signals by `err.name`. Use them rather than `instanceof`: the port and
+  the `DocCipher` are seams your app injects, and a tree that resolves two
+  copies of this package makes an `instanceof` check quietly false. Read what
+  you need off the matched value, such as `err.status` on an auth error to tell
+  a 401 from the masked 404. The last two tell a decrypt's two no-key outcomes
+  apart: an epoch the reader's descriptor does not list (a re-read may fix it)
+  and an epoch it lists but this reader holds no key for (real data, permanently
+  unreadable here, never garbage). `isIntegrityError` matches a stored body that
+  does not verify against the resource id it was read under. Do not apply that
+  row.
 - **`SyncStatus`** (`'idle' | 'syncing' | 'synced' | 'error'`) is the closed
   vocabulary a replication driver reports one feed's state through.
 - **`DocCipher`** is the per-collection encrypt/decrypt seam sitting above the
   port: it turns a JSON document into its stored body (minting the resource id)
-  and back. `createPlaintextDocCipher(...)` is the crypto-free identity
-  implementation for a plaintext content-addressed collection;
-  `createEdvDocCipher(...)` (from `@interop/was-client/edv`) is the encrypting
-  one, built from the collection's key-epoch descriptor (every encrypted
-  collection carries one from birth; install epoch[0] at provision time with
-  `ensureFirstEpoch`). On a searchable collection, also hand it the stored
-  Collection `/meta` value (the `meta` input, or `applyMeta` when the replica's
-  copy changes) so pushed documents carry blinded index entries and stay visible
-  to `find()`. `createEdvEncryptOnlyDocCipher(...)` is the write-only
-  counterpart, built from the descriptor alone with no key-agreement secret
-  (writes seal to the current epoch's public key, reconstructed from the epoch
-  id); `decrypt` on it refuses with the typed `EncryptOnlyCipherError`.
+  and back. `decrypt({ id, envelope, context? })` takes the resource id the
+  replica read the body under (the feed row's `id`, not the envelope's own) and
+  throws `IntegrityError` when the body was written for a different id. Pass
+  `collection.codecContext()` as `context` to read a chunked encrypted blob,
+  which then decrypts to a `Blob`. `createPlaintextDocCipher(...)` is the
+  crypto-free identity implementation for a plaintext content-addressed
+  collection; `createEdvDocCipher(...)` (from `@interop/was-client/edv`) is the
+  encrypting one, built from the collection's key-epoch descriptor (every
+  encrypted collection carries one from birth; install epoch[0] at provision
+  time with `ensureFirstEpoch`). Build it with the collection's `spaceId` to let
+  `decrypt` fetch a chunked blob's chunks. On a searchable collection, also hand
+  it the stored Collection `/meta` value (the `meta` input, or `applyMeta` when
+  the replica's copy changes) so pushed documents carry blinded index entries
+  and stay visible to `find()`. `createEdvEncryptOnlyDocCipher(...)` is the
+  write-only counterpart, built from the descriptor alone with no key-agreement
+  secret (writes seal to the current epoch's public key, reconstructed from the
+  epoch id); `decrypt` on it refuses with the typed `EncryptOnlyCipherError`.
 - **`createRefreshingEdvDocCipher(...)`** (from `@interop/was-client/edv`) is
   `createEdvDocCipher` bound to descriptor acquisition and the unknown-epoch
   refresh rule: it acquires the collection's descriptor through the
@@ -1108,7 +1117,7 @@ do {
   const page = await port.query({ checkpoint, limit: 100 })
   for (const doc of page.documents) {
     if (doc._deleted) continue // tombstone
-    const data = await cipher.decrypt({ envelope: doc.data })
+    const data = await cipher.decrypt({ id: doc.id, envelope: doc.data })
     // apply to the local replica, recording doc.version for later pushes
   }
   checkpoint = page.checkpoint // null when the page was empty (caught up)
@@ -1144,9 +1153,9 @@ re-exports none of them.
   governing history log" above). The store does read-with-etag of the full log,
   compare-and-swap append conditioned on that etag, and the guarded create of a
   genesis entry. Appends carry the prior lines' bytes forward verbatim. Both
-  writes ride the backend's `conditional-writes` feature, which the profile
-  requires; a lost race rethrows the library's `ResourceLogConflictError` with
-  the transport's `PreconditionFailedError` as `cause`.
+  writes ride the server's conditional writes, which the profile requires; a
+  lost race rethrows the library's `ResourceLogConflictError` with the
+  transport's `PreconditionFailedError` as `cause`.
 
 ### Export and import
 

package/dist/Collection.d.ts

@@ -1,5 +1,5 @@
 import type { ClientContext } from './internal/request.js';
-import type { IndexDeclaration, IndexSchema } from './codec.js';
+import type { CodecRequestContext, IndexDeclaration, IndexSchema } from './codec.js';
 import { Resource } from './Resource.js';
 import type { ChangeDocument, ChangesCheckpoint, ChangesPage } from '@interop/storage-core';
 import type { AddResult, BackendDescriptor, BackendUsage, CollectionMetadata, CollectionWritableFields, EncryptionOverride, FindPage, GrantOptions, HandleOptions, IDelegatedZcap, IZcap, Json, ResourceData, LinkSet, PolicyDocument, CollectionResourcesList, ResourceMetadataCustomInput, ResourceSummary } from './types.js';
@@ -25,6 +25,17 @@ export declare class Collection {
         capability?: IZcap;
         encryption?: EncryptionOverride;
     });
+    /**
+     * The signed-request context handed to a codec that drives its own I/O (the
+     * EDV codec reading a chunked blob back), bound to this handle's capability.
+     *
+     * Public so a sync replica can pass it to `DocCipher.decrypt`, which then
+     * reassembles a chunked envelope from its chunk resources on this
+     * collection. Building it performs no I/O.
+     *
+     * @returns {CodecRequestContext}
+     */
+    codecContext(): CodecRequestContext;
     /**
      * Reads the Collection Metadata object -- the Collection's configuration
      * (`name`, `backend`, `encryption`, `generator`) beside the server-managed
@@ -169,7 +180,7 @@ export declare class Collection {
      * no keys for, which is why {@link describe} -- the configuration read -- goes
      * without it.
      *
-     * Against a backend with the `conditional-writes` feature the result also
+     * The result also
      * carries the object's current `etag` (its `metaVersion` validator) -- pass it
      * as `setMeta(meta, { ifMatch })` for a lost-update-safe update. One
      * validator covers the whole object: a configuration write and an annotation
@@ -195,8 +206,8 @@ export declare class Collection {
      * and encrypted collections alike. The key epoch the codec stamps the
      * envelope with travels as a top-level `epoch` member of the same body.
      *
-     * Conditional writes (the backend's `conditional-writes` feature): pass
-     * `ifMatch` (the `etag` from a prior {@link meta} or {@link describe}) for an
+     * Conditional writes: pass `ifMatch` (the `etag` from a prior {@link meta}
+     * or {@link describe}) for an
      * update-if-unchanged, and a failed precondition throws
      * `PreconditionFailedError` (412). Without one the write is pinned to the
      * version it composed the configuration from and rebases on a lost race.
@@ -232,11 +243,10 @@ export declare class Collection {
     /**
      * Sets the Collection's annotation-level human-readable `name`, preserving
      * any existing `tags`. Convenience over `setMeta()`. The write is pinned to
-     * the `etag` the `meta()` read returned (when the backend supports
-     * `conditional-writes`) and rebases on a lost race, so a concurrent write --
-     * an annotation write or a configuration change, which share the one
-     * validator -- is re-read and re-applied rather than silently erased by this
-     * full-replacement write.
+     * the `etag` the `meta()` read returned and rebases on a lost race, so a
+     * concurrent write -- an annotation write or a configuration change, which
+     * share the one validator -- is re-read and re-applied rather than silently
+     * erased by this full-replacement write.
      *
      * On an encrypted collection this is the collection's client-encrypted name
      * surface: the codec seals it into the `custom` envelope, and by convention
@@ -268,8 +278,8 @@ export declare class Collection {
      */
     get historyLogUrl(): string;
     /**
-     * Reads the Collection's governing history log (the backend's
-     * `governed-history-logs` feature): the JSON Lines body served at the
+     * Reads the Collection's governing history log (the encrypted-collections
+     * profile's `governed-history-logs` feature): the JSON Lines body served at the
      * `/meta/log` sub-resource, verbatim, together with its `ETag`. The log is
      * not a Resource of the Collection (absent from listings and the `changes`
      * feed) and not part of the `/meta` object; it is versioned by its own
@@ -412,8 +422,10 @@ export declare class Collection {
      * one page: `limit` caps its size (the server clamps its own maximum), and a
      * `hasMore` page carries the `cursor` to pass back for the next one.
      *
-     * Requires the collection's backend to advertise the `blinded-index-query`
-     * feature; a backend without it answers `501` (`NotImplementedError`).
+     * Serving the blinded-index query profile is a conformance requirement of a
+     * server that offers encrypted collections, so there is no client-side
+     * probe; a server that does not implement it answers `501`
+     * (`NotImplementedError`).
      *
      * @param options {object}
      * @param [options.equals] {object | object[]}   attribute/value pairs to match
@@ -451,8 +463,7 @@ export declare class Collection {
      *
      * On an encrypted collection a binary payload above the codec's
      * single-document threshold is auto-routed to the chunked-stream path, which
-     * needs the backend's `chunked-streams` feature (`NotSupportedError` without
-     * it, raised before anything is written).
+     * a server that does not serve the chunk endpoints answers with `501`.
      *
      * @param data {ResourceData}
      * @param options {object}
@@ -474,7 +485,7 @@ export declare class Collection {
     /**
      * Creates or replaces a resource by id (upsert). Forwards the
      * conditional-write options (`ifMatch` / `ifNoneMatch`) to `Resource.put`;
-     * see it for the `conditional-writes` semantics. Returns the stored
+     * see it for the conditional-write semantics. Returns the stored
      * resource's new `etag`.
      *
      * @param resourceId {string}
@@ -537,11 +548,11 @@ export declare class Collection {
      * `limit` to its own maximum, so a short page can still be a full server
      * page.
      *
-     * Requires the collection's backend to advertise the `changes-query` feature
-     * (see `backend()`); a backend without it answers `501`. On an encrypted
-     * collection the documents' `data` / `custom` are the scheme's opaque
-     * envelopes (an EDV encrypted document under the v1 `edv` scheme) -- this
-     * method does not decrypt them, unlike `get()`.
+     * Requires the server to advertise the `changes-query` feature server-wide
+     * (`client.service().features`); a server without it answers `501`. On an
+     * encrypted collection the documents' `data` / `custom` are the scheme's
+     * opaque envelopes (an EDV encrypted document under the v1 `edv` scheme) --
+     * this method does not decrypt them, unlike `get()`.
      *
      * Malformed responses fail the call with a `WasServerError` instead of
      * passing through as a page: a 2xx response with no JSON body
@@ -578,9 +589,10 @@ export declare class Collection {
      * `list()`. Unlike `list()`, a 404 on a later page throws: the collection
      * vanished mid-walk, and the pages already read are not a snapshot of
      * anything. The server faults `changes()` rejects on (a bodiless 2xx, a
-     * live entry with no `data`, or a `501` from a backend without the
-     * `changes-query` feature) fail the walk with the same `WasServerError`, as
-     * does a server that repeats a checkpoint instead of advancing.
+     * live entry with no `data`, or a `501` from a server that does not
+     * advertise the `changes-query` feature) fail the walk with the same
+     * `WasServerError`, as does a server that repeats a checkpoint instead of
+     * advancing.
      *
      * @param [options] {object}
      * @param [options.limit] {number}   max documents per request (default 1000, the teaching server's maximum); the server reduces it to its own maximum
@@ -649,12 +661,11 @@ export declare class Collection {
      * you (404 conflation caveat). A server without backend support surfaces its
      * 501 as `NotImplementedError`.
      *
-     * The descriptor's optional `features` array advertises optional server
-     * affordances (e.g. `conditional-writes`, `blinded-index-query`,
-     * `chunked-streams`); an absent token means the backend makes no claim to it,
-     * so treat it as unsupported rather than assuming a default. (Client-side
-     * encryption is not a backend feature -- it is a per-collection client concern
-     * gated on the client's keys.)
+     * The descriptor names where the collection is stored; it advertises no
+     * optional affordances. Server-wide affordance tokens live in the service
+     * description (`client.service().features`). (Client-side encryption is
+     * neither -- it is a per-collection client concern gated on the client's
+     * keys.)
      *
      * @returns {Promise<BackendDescriptor | null>}
      */

package/dist/Collection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Collection.d.ts","sourceRoot":"","sources":["../src/Collection.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AA0D1D,OAAO,KAAK,EAGV,gBAAgB,EAChB,WAAW,EAEZ,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,WAAW,EACZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EACV,SAAS,EACT,iBAAiB,EACjB,YAAY,EAEZ,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,cAAc,EACd,uBAAuB,EACvB,2BAA2B,EAC3B,eAAe,EAChB,MAAM,YAAY,CAAA;AA8CnB,qBAAa,UAAU;;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IAkBnB;;;;;;;;;;OAUG;gBACS,EACV,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EACX,EAAE;QACD,OAAO,EAAE,aAAa,CAAA;QACtB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,KAAK,CAAA;QAClB,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC;IA4ED;;;;;;;;;;;;OAYG;IACG,QAAQ,IAAI,OAAO,CAAC,CAAC,kBAAkB,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAW1E;;;;;;;;;;OAUG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAChC,WAAW,EAAE,kBAAkB,CAAA;QAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,IAAI,CAAC;IAiOT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACG,SAAS,CACb,IAAI,EAAE,wBAAwB,GAAG;QAC/B,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,OAAO,CAAC,EAAE,CAAC,kBAAkB,GAAG;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,GAAG,IAAI,CAAA;KAC1D,GACA,OAAO,CAAC,kBAAkB,CAAC;IAyF9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACG,kBAAkB,CACtB,WAAW,EAAE,wBAAwB,EACrC,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GACxD,OAAO,CAAC;QAAE,WAAW,EAAE,kBAAkB,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAgI9D;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAa7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,IAAI,IAAI,OAAO,CAAC,CAAC,kBAAkB,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IA0BtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACG,OAAO,CACX,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,2BAA2B,CAAA;KAAO,EACnD,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GACxD,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAiD7B;;;;;;;;;;;;;;;;;;OAkBG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1C;;;;;;;OAOG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ1D;;;;;;;OAOG;IACH,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAqBtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,aAAa,CACjB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GACnD,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA8E7B;;;;;;;;;;;;;OAaG;IACG,OAAO,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAK5C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,YAAY,CAAC,EACjB,SAAS,EACT,MAAM,EACP,EAAE;QACD,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QAC5B,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,GAAG,OAAO,CAAC,WAAW,CAAC;IAIxB;;;;;;;;;;;;;;;;;;OAkBG;IACG,cAAc,CAAC,EACnB,OAAO,EACR,EAAE;QACD,OAAO,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KACnE,GAAG,OAAO,CAAC,WAAW,CAAC;IA8CxB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,IAAI,CAAC,OAAO,EAAE;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QACjE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QACvB,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC,QAAQ,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAkEzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,QAAQ;IAqBnE;;;;;;;;;;;;;;OAcG;IACG,GAAG,CACP,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC;IAsErB;;;;;;;OAOG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAM1D;;;;;;;;;;;;;OAaG;IACG,GAAG,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACjB,GACL,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqB7B;;;;;;;;;OASG;IACG,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAIrD;;;;;;;;;OASG;IACI,SAAS,IAAI,cAAc,CAAC,uBAAuB,CAAC;IAI3D;;;;;;;OAOG;IACI,SAAS,IAAI,cAAc,CAAC,eAAe,CAAC;IAInD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACG,OAAO,CACX,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,iBAAiB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC/D,OAAO,CAAC,WAAW,CAAC;IAsDvB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,SAAS,CACb,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC/B,OAAO,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC;IAyCnC;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAQ3D;;;;;;;OAOG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAOjD;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtD;;;;;;OAMG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAOlC;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAOhC;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAOlC;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAOxC;;;;;;;;;;;;;;OAcG;IACG,OAAO,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAOlD;;;;;;;OAOG;IACG,KAAK,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAM5C"}
+{"version":3,"file":"Collection.d.ts","sourceRoot":"","sources":["../src/Collection.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAwD1D,OAAO,KAAK,EAEV,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EAEZ,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,WAAW,EACZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EACV,SAAS,EACT,iBAAiB,EACjB,YAAY,EAEZ,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,OAAO,EACP,cAAc,EACd,uBAAuB,EACvB,2BAA2B,EAC3B,eAAe,EAChB,MAAM,YAAY,CAAA;AA8CnB,qBAAa,UAAU;;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IAYnB;;;;;;;;;;OAUG;gBACS,EACV,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EACX,EAAE;QACD,OAAO,EAAE,aAAa,CAAA;QACtB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,KAAK,CAAA;QAClB,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC;IAsCD;;;;;;;;;OASG;IACH,YAAY,IAAI,mBAAmB;IAuBnC;;;;;;;;;;;;OAYG;IACG,QAAQ,IAAI,OAAO,CAAC,CAAC,kBAAkB,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAW1E;;;;;;;;;;OAUG;IACG,gBAAgB,IAAI,OAAO,CAAC;QAChC,WAAW,EAAE,kBAAkB,CAAA;QAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,GAAG,IAAI,CAAC;IAsNT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACG,SAAS,CACb,IAAI,EAAE,wBAAwB,GAAG;QAC/B,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,OAAO,CAAC,EAAE,CAAC,kBAAkB,GAAG;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,GAAG,IAAI,CAAA;KAC1D,GACA,OAAO,CAAC,kBAAkB,CAAC;IAyF9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACG,kBAAkB,CACtB,WAAW,EAAE,wBAAwB,EACrC,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GACxD,OAAO,CAAC;QAAE,WAAW,EAAE,kBAAkB,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAgI9D;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAa7B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,IAAI,IAAI,OAAO,CAAC,CAAC,kBAAkB,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IA0BtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACG,OAAO,CACX,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,2BAA2B,CAAA;KAAO,EACnD,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GACxD,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAiD7B;;;;;;;;;;;;;;;;;OAiBG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1C;;;;;;;OAOG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ1D;;;;;;;OAOG;IACH,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAqBtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,aAAa,CACjB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GACnD,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA8E7B;;;;;;;;;;;;;OAaG;IACG,OAAO,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAK5C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,YAAY,CAAC,EACjB,SAAS,EACT,MAAM,EACP,EAAE;QACD,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QAC5B,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,GAAG,OAAO,CAAC,WAAW,CAAC;IAIxB;;;;;;;;;;;;;;;;;;OAkBG;IACG,cAAc,CAAC,EACnB,OAAO,EACR,EAAE;QACD,OAAO,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;YAAC,MAAM,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KACnE,GAAG,OAAO,CAAC,WAAW,CAAC;IA8CxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,IAAI,CAAC,OAAO,EAAE;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QACjE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;QACvB,KAAK,CAAC,EAAE,OAAO,CAAA;QACf,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC,QAAQ,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAiEzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,QAAQ;IAkBnE;;;;;;;;;;;;;OAaG;IACG,GAAG,CACP,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC;IAqErB;;;;;;;OAOG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAM1D;;;;;;;;;;;;;OAaG;IACG,GAAG,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACjB,GACL,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqB7B;;;;;;;;;OASG;IACG,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAIrD;;;;;;;;;OASG;IACI,SAAS,IAAI,cAAc,CAAC,uBAAuB,CAAC;IAI3D;;;;;;;OAOG;IACI,SAAS,IAAI,cAAc,CAAC,eAAe,CAAC;IAInD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACG,OAAO,CACX,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,iBAAiB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC/D,OAAO,CAAC,WAAW,CAAC;IAsDvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,SAAS,CACb,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAC/B,OAAO,CAAC,cAAc,EAAE,GAAG,IAAI,CAAC;IAyCnC;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAQ3D;;;;;;;OAOG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAOjD;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtD;;;;;;OAMG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAOlC;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAOhC;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAOlC;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAOxC;;;;;;;;;;;;;OAaG;IACG,OAAO,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAOlD;;;;;;;OAOG;IACG,KAAK,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAM5C"}

package/dist/Collection.js

@@ -21,7 +21,6 @@ import { NotFoundError, ValidationError, WasServerError, httpStatus } from './er
 import { delegateGrantAt } from './internal/grant.js';
 import { send, readData } from './internal/request.js';
 import { codecForDescriptor, collectionCodecHolder, identityCodec } from './internal/codec.js';
-import { collectionBackendFeatures } from './internal/features.js';
 import { collectWalk, signedPageWalk, walkItems, walkPagesOrEmpty } from './internal/pagination.js';
 import { ANNOTATION_MEMBERS, CONFIGURATION_MEMBERS, asCollectionMetadata, carriedForward, collectionWritableFields, isGovernedDescriptor, readCollectionMetadata, storedEncryption, unreadableDescriptionError } from './internal/describe.js';
 import { assertSinglePrecondition, readEtag, writeHeaders } from './internal/conditional.js';
@@ -84,12 +83,6 @@ export class Collection {
      * without discovering a descriptor from stored state.
      */
     #encryptionOverride;
-    /**
-     * The shared backend-feature probe for this collection (memoized on a
-     * definitive answer), consulted by the conditional-codec write path and
-     * shared with child resource handles the way the codec is.
-     */
-    #features;
     /**
      * @param options {object}
      * @param options.context {ClientContext} - Shared context (serverUrl, ezcap
@@ -123,11 +116,6 @@ export class Collection {
             override: encryption,
             capability
         });
-        this.#features = collectionBackendFeatures(context, {
-            spaceId,
-            collectionId,
-            capability
-        });
     }
     /**
      * The Collection container in canonical (trailing-slash) form: the URL whose
@@ -143,16 +131,16 @@ export class Collection {
     }
     /**
      * The signed-request context handed to a codec that drives its own I/O (the
-     * EDV codec reading a chunked blob back), bound to this handle's capability
-     * and sharing its memoized feature probe.
+     * EDV codec reading a chunked blob back), bound to this handle's capability.
+     *
+     * Public so a sync replica can pass it to `DocCipher.decrypt`, which then
+     * reassembles a chunked envelope from its chunk resources on this
+     * collection. Building it performs no I/O.
      *
      * @returns {CodecRequestContext}
      */
-    #codecContext() {
-        return codecRequestContext(this.#context, {
-            features: this.#features,
-            capability: this.#capability
-        });
+    codecContext() {
+        return codecRequestContext(this.#context, { capability: this.#capability });
     }
     /**
      * Resolves (once, then caches) the codec for this collection's reads and
@@ -294,17 +282,7 @@ export class Collection {
      *   compare-and-swap attempt limit. One validator covers configuration and
      *   annotations alike, so a configuration change now legitimately invalidates
      *   an in-flight annotation write; rebasing is the normal outcome, not an
-     *   error. A backend without `conditional-writes` serves no validator, and
-     *   the write stays the unconditional upsert it has always been.
-     *
-     * Limitation, on a backend without `conditional-writes` only: the body
-     * re-sends the stored `encryption` descriptor, and with no validator to pin
-     * the `PUT` to, a descriptor rotation landing between the compose read and
-     * the write is re-sent as the older roster -- refused as a spurious
-     * `invalid-request-body` ("epochs is append-only") by a server enforcing the
-     * descriptor invariants, and rolled back by one that does not. There is no
-     * client-side remedy without a validator or a partial-update form, neither of
-     * which WAS v0.5 offers (WCL-99).
+     *   error.
      *
      * The absent-object rule is the masked-404 fail-closed policy at write level:
      * a `null` read means "missing OR not visible to you", and composing against
@@ -322,8 +300,7 @@ export class Collection {
      * @param [options.current] {object}   an object the caller has already read,
      *   used as the first attempt's baseline instead of re-reading it: the write
      *   composes against it and pins to its validator, and a rebase re-reads. A
-     *   baseline carrying no validator makes the first attempt unconditional,
-     *   which is what a backend without `conditional-writes` offers anyway
+     *   baseline carrying no validator is refused by the compare-and-swap loop
      * @param [options.allowAbsent] {boolean}   compose against nothing (an
      *   upsert) instead of throwing `NotFoundError` when the object cannot be
      *   read
@@ -699,7 +676,7 @@ export class Collection {
      * no keys for, which is why {@link describe} -- the configuration read -- goes
      * without it.
      *
-     * Against a backend with the `conditional-writes` feature the result also
+     * The result also
      * carries the object's current `etag` (its `metaVersion` validator) -- pass it
      * as `setMeta(meta, { ifMatch })` for a lost-update-safe update. One
      * validator covers the whole object: a configuration write and an annotation
@@ -747,8 +724,8 @@ export class Collection {
      * and encrypted collections alike. The key epoch the codec stamps the
      * envelope with travels as a top-level `epoch` member of the same body.
      *
-     * Conditional writes (the backend's `conditional-writes` feature): pass
-     * `ifMatch` (the `etag` from a prior {@link meta} or {@link describe}) for an
+     * Conditional writes: pass `ifMatch` (the `etag` from a prior {@link meta}
+     * or {@link describe}) for an
      * update-if-unchanged, and a failed precondition throws
      * `PreconditionFailedError` (412). Without one the write is pinned to the
      * version it composed the configuration from and rebases on a lost race.
@@ -823,11 +800,10 @@ export class Collection {
     /**
      * Sets the Collection's annotation-level human-readable `name`, preserving
      * any existing `tags`. Convenience over `setMeta()`. The write is pinned to
-     * the `etag` the `meta()` read returned (when the backend supports
-     * `conditional-writes`) and rebases on a lost race, so a concurrent write --
-     * an annotation write or a configuration change, which share the one
-     * validator -- is re-read and re-applied rather than silently erased by this
-     * full-replacement write.
+     * the `etag` the `meta()` read returned and rebases on a lost race, so a
+     * concurrent write -- an annotation write or a configuration change, which
+     * share the one validator -- is re-read and re-applied rather than silently
+     * erased by this full-replacement write.
      *
      * On an encrypted collection this is the collection's client-encrypted name
      * surface: the codec seals it into the `custom` envelope, and by convention
@@ -868,8 +844,8 @@ export class Collection {
         return toUrl({ serverUrl: this.#context.serverUrl, path: this.#logPath });
     }
     /**
-     * Reads the Collection's governing history log (the backend's
-     * `governed-history-logs` feature): the JSON Lines body served at the
+     * Reads the Collection's governing history log (the encrypted-collections
+     * profile's `governed-history-logs` feature): the JSON Lines body served at the
      * `/meta/log` sub-resource, verbatim, together with its `ETag`. The log is
      * not a Resource of the Collection (absent from listings and the `changes`
      * feed) and not part of the `/meta` object; it is versioned by its own
@@ -1128,8 +1104,10 @@ export class Collection {
      * one page: `limit` caps its size (the server clamps its own maximum), and a
      * `hasMore` page carries the `cursor` to pass back for the next one.
      *
-     * Requires the collection's backend to advertise the `blinded-index-query`
-     * feature; a backend without it answers `501` (`NotImplementedError`).
+     * Serving the blinded-index query profile is a conformance requirement of a
+     * server that offers encrypted collections, so there is no client-side
+     * probe; a server that does not implement it answers `501`
+     * (`NotImplementedError`).
      *
      * @param options {object}
      * @param [options.equals] {object | object[]}   attribute/value pairs to match
@@ -1149,9 +1127,8 @@ export class Collection {
             method: 'POST',
             capability: this.#capability,
             // The profile is bound here the way `changes()` binds its own: same
-            // endpoint, no client-side feature probe -- a backend that does not
-            // implement the profile answers 501, which is a clearer signal than a
-            // guess made from the backend descriptor.
+            // endpoint, no client-side gate -- a server that does not implement the
+            // profile answers 501.
             json: {
                 profile: 'blinded-index',
                 ...query,
@@ -1171,7 +1148,7 @@ export class Collection {
         // Each envelope is an independent JWE open with nothing carried between
         // them, so the page decrypts concurrently. `Promise.all` preserves order,
         // so `items` still matches the server's ranking.
-        const codecContext = this.#codecContext();
+        const codecContext = this.codecContext();
         const items = await Promise.all(documents.map(async (envelope) => {
             // Restrict-mode ids make the stored document's own id the WAS resource
             // id, so it is also the id the codec verifies the envelope's
@@ -1211,9 +1188,6 @@ export class Collection {
             collectionId: this.id,
             resourceId,
             capability: options.capability ?? this.#capability,
-            // Share this collection's memoized feature probe so per-resource handles
-            // do not each repeat the backend-descriptor round-trip.
-            features: this.#features,
             // A per-resource encryption override resolves its own codec (honoring the
             // override); without one, share this collection's resolved codec so the
             // resource handle does not repeat the descriptor-discovery round-trip.
@@ -1231,8 +1205,7 @@ export class Collection {
      *
      * On an encrypted collection a binary payload above the codec's
      * single-document threshold is auto-routed to the chunked-stream path, which
-     * needs the backend's `chunked-streams` feature (`NotSupportedError` without
-     * it, raised before anything is written).
+     * a server that does not serve the chunk endpoints answers with `501`.
      *
      * @param data {ResourceData}
      * @param options {object}
@@ -1247,7 +1220,6 @@ export class Collection {
             pathForId: mintedId => resourcePath(this.spaceId, this.id, mintedId),
             codec,
             data,
-            features: this.#features,
             contentType: options.contentType,
             capability: this.#capability
         });
@@ -1315,7 +1287,7 @@ export class Collection {
     /**
      * Creates or replaces a resource by id (upsert). Forwards the
      * conditional-write options (`ifMatch` / `ifNoneMatch`) to `Resource.put`;
-     * see it for the `conditional-writes` semantics. Returns the stored
+     * see it for the conditional-write semantics. Returns the stored
      * resource's new `etag`.
      *
      * @param resourceId {string}
@@ -1396,11 +1368,11 @@ export class Collection {
      * `limit` to its own maximum, so a short page can still be a full server
      * page.
      *
-     * Requires the collection's backend to advertise the `changes-query` feature
-     * (see `backend()`); a backend without it answers `501`. On an encrypted
-     * collection the documents' `data` / `custom` are the scheme's opaque
-     * envelopes (an EDV encrypted document under the v1 `edv` scheme) -- this
-     * method does not decrypt them, unlike `get()`.
+     * Requires the server to advertise the `changes-query` feature server-wide
+     * (`client.service().features`); a server without it answers `501`. On an
+     * encrypted collection the documents' `data` / `custom` are the scheme's
+     * opaque envelopes (an EDV encrypted document under the v1 `edv` scheme) --
+     * this method does not decrypt them, unlike `get()`.
      *
      * Malformed responses fail the call with a `WasServerError` instead of
      * passing through as a page: a 2xx response with no JSON body
@@ -1478,9 +1450,10 @@ export class Collection {
      * `list()`. Unlike `list()`, a 404 on a later page throws: the collection
      * vanished mid-walk, and the pages already read are not a snapshot of
      * anything. The server faults `changes()` rejects on (a bodiless 2xx, a
-     * live entry with no `data`, or a `501` from a backend without the
-     * `changes-query` feature) fail the walk with the same `WasServerError`, as
-     * does a server that repeats a checkpoint instead of advancing.
+     * live entry with no `data`, or a `501` from a server that does not
+     * advertise the `changes-query` feature) fail the walk with the same
+     * `WasServerError`, as does a server that repeats a checkpoint instead of
+     * advancing.
      *
      * @param [options] {object}
      * @param [options.limit] {number}   max documents per request (default 1000, the teaching server's maximum); the server reduces it to its own maximum
@@ -1622,12 +1595,11 @@ export class Collection {
      * you (404 conflation caveat). A server without backend support surfaces its
      * 501 as `NotImplementedError`.
      *
-     * The descriptor's optional `features` array advertises optional server
-     * affordances (e.g. `conditional-writes`, `blinded-index-query`,
-     * `chunked-streams`); an absent token means the backend makes no claim to it,
-     * so treat it as unsupported rather than assuming a default. (Client-side
-     * encryption is not a backend feature -- it is a per-collection client concern
-     * gated on the client's keys.)
+     * The descriptor names where the collection is stored; it advertises no
+     * optional affordances. Server-wide affordance tokens live in the service
+     * description (`client.service().features`). (Client-side encryption is
+     * neither -- it is a per-collection client concern gated on the client's
+     * keys.)
      *
      * @returns {Promise<BackendDescriptor | null>}
      */