@interop/was-client 0.8.0 → 0.9.0

package/README.md

@@ -22,7 +22,7 @@
   - [Conditional writes (optimistic concurrency)](#conditional-writes-optimistic-concurrency)
   - [Storage introspection: backends and quotas](#storage-introspection-backends-and-quotas)
   - [Registering a Bring-Your-Own-Storage backend](#registering-a-bring-your-own-storage-backend)
-  - [Encrypted collections (EDV-over-WAS)](#encrypted-collections-edv-over-was)
+  - [Encrypted collections (EDV-over-WAS): pass-through encryption via the WAS client (recommended)](#encrypted-collections-edv-over-was-pass-through-encryption-via-the-was-client-recommended)
   - [Export and import](#export-and-import)
   - [The manual-request escape hatch](#the-manual-request-escape-hatch)
 - [Errors and the 404/null caveat](#errors-and-the-404null-caveat)
@@ -498,38 +498,80 @@ sends no body on an in-place replace).
 > can actually serve bytes depends on the server having a live provider adapter
 > for it. Until then it is registered but inert (`status: 'registered'`).
 
-### Encrypted collections (EDV-over-WAS)
+### Encrypted collections (EDV-over-WAS): pass-through encryption via the WAS client (recommended)
 
-Client-side end-to-end encryption is a per-collection concern, gated on whether
-your client holds keys for the collection -- **not** a backend feature (an
-encrypted document is opaque JSON any document backend stores faithfully).
-Construct a `WasClient` with an `encryption` provider (built from the opt-in
-`@interop/was-client/edv` subpath, so plaintext consumers never pull the crypto
-graph), and the ordinary `Collection`/`Resource` handles transparently encrypt
-on write and decrypt on read -- for any collection your `resolveKeys` returns
-keys for. Keys live in your wallet; the server only ever stores opaque JWE
-envelopes.
+This is the recommended way to use encrypted collections. For the low-level
+alternative -- driving an `EdvClientCore` directly via `WasTransport` -- see
+[docs/edv-client-core-usage.md](docs/edv-client-core-usage.md).
+
+Client-side end-to-end encryption is a per-collection concern -- **not** a
+backend feature (an encrypted document is opaque JSON any document backend
+stores faithfully). Two things drive it, kept separate:
+
+- **Policy** (is this collection encrypted?) is declared on the collection
+  itself: `createCollection({ encryption: { scheme: 'edv' } })` writes a
+  non-secret `encryption` marker to the Collection Description. Any authorized
+  reader -- including a delegated consumer that did **not** create the
+  collection -- discovers it by reading the Description, so it knows to decrypt.
+- **Keys** come from an `encryption` provider you pass to `WasClient` (built
+  from the opt-in `@interop/was-client/edv` subpath, so plaintext consumers
+  never pull the crypto graph). It is a pure **keystore**: `resolveKeys` returns
+  the collection's keys, which live in your wallet. The server only ever stores
+  opaque JWE envelopes.
+
+The ordinary `Collection`/`Resource` handles then transparently encrypt on write
+and decrypt on read for any collection the marker (or an override) declares
+encrypted.
 
 ```ts
 import { WasClient } from '@interop/was-client'
 import { createEdvEncryption } from '@interop/was-client/edv'
 
 const encryption = createEdvEncryption({
-  // Return the collection's keys to encrypt it, or null to use it in plaintext.
+  // The keystore: return the collection's keys (from your wallet).
   async resolveKeys({ spaceId, collectionId }) {
-    return { keyAgreementKey, keyResolver } // from your wallet
+    return { keyAgreementKey, keyResolver }
   }
 })
 const was = WasClient.fromSigner({ serverUrl, signer, encryption })
 
-const vault = was.space(spaceId).collection('vault')
+// Declare the collection encrypted (writes the marker). The returned handle is
+// pre-seeded, so the first write encrypts with no extra round-trip.
+const vault = await was
+  .space(spaceId)
+  .createCollection({ id: 'vault', encryption: { scheme: 'edv' } })
 const { id } = await vault.add({ secret: 'hello' }) // encrypted; id is an EDV id
 const back = await vault.get(id) // { secret: 'hello' } -- decrypted
+
+// A consumer that did not create it discovers the marker and decrypts with its
+// own keys -- no override needed; one cached read of the Description:
+const same = was.space(spaceId).collection('vault')
+await same.get(id) // reads the marker, then decrypts
 ```
 
-The switch is **keys**: a handle encrypts a collection exactly when
-`resolveKeys` returns keys for it (else it stays plaintext). Resolution happens
-once per collection handle and is cached -- no backend round-trip.
+The switch is the **marker**: a handle encrypts a collection when its
+Description declares `encryption` (resolution reads the Description once, then
+caches -- no round-trip for plaintext-only clients or when an override is set).
+Keys are then **required**: if the collection is declared encrypted but your
+keystore returns no keys, reads/writes throw `EncryptionError` (fail-closed) --
+they never silently fall back to plaintext.
+
+**Per-handle override (escape hatch).** Pass `encryption` in the handle options
+to force the decision and skip the Description read -- `{ scheme: 'edv' }` (keys
+from the keystore), `{ scheme: 'edv', keys }` (keys inline), or `'plaintext'`:
+
+```ts
+const vault = was.space(spaceId).collection('vault', {
+  encryption: { scheme: 'edv' }
+})
+```
+
+**Migrating a pre-marker vault** (created before the marker existed, keys-only):
+re-declare it once with
+`collection.configure({ encryption: { scheme: 'edv' } })` (the marker is
+set-once: declaring it on a collection that lacks one is allowed, changing or
+clearing an existing one is rejected). Until then, a per-handle override reads
+it correctly.
 
 Encrypted collections are a **stricter contract**, not a drop-in (documents-only
 scope for now):
@@ -555,77 +597,6 @@ const stats = await otherSpace.import(archive)
 //   policiesCreated, policiesSkipped }
 ```
 
-### Encrypted collections (EDV-over-WAS)
-
-Client-side end-to-end encryption, where the server stores only opaque
-ciphertext and the keys never leave the client. This is the "EDV-over-WAS"
-layout profile (Layer 1): it maps
-[Encrypted Data Vault](https://digitalbazaar.github.io/encrypted-data-vaults/)
-documents onto ordinary WAS resources, so it works against **any** WAS server
-with no server changes. It is shipped on the opt-in `@interop/was-client/edv`
-subpath so plaintext consumers do not pull the crypto dependencies.
-
-`WasTransport` is an `@interop/edv-client` `Transport`: pair it with
-`EdvClientCore`, which does all encryption, decryption, and key handling
-client-side. The WAS Collection is the vault; each encrypted document is one WAS
-resource (its EDV id is used verbatim as the resource id).
-
-This example assumes a WAS server is already running and you have created (or
-have access to) a collection to use as the vault:
-
-```ts
-import { WasClient } from '@interop/was-client'
-import { WasTransport } from '@interop/was-client/edv'
-import { EdvClientCore } from '@interop/edv-client'
-import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key'
-
-const was = WasClient.fromSigner({ serverUrl, signer })
-const space = await was.createSpace({ name: 'My Wallet' })
-const collection = await space.createCollection({ id: 'vault', name: 'Vault' })
-
-// Client-side key material (never sent to the server). In a real app these come
-// from the wallet's key store; here we generate a key-agreement key.
-const kak = await X25519KeyAgreementKey2020.generate({
-  controller: was.controllerDid
-})
-const keyResolver = async ({ id }: { id: string }) => {
-  if (id !== kak.id) throw new Error(`Unknown key id "${id}".`)
-  return {
-    id: kak.id,
-    type: kak.type,
-    publicKeyMultibase: kak.publicKeyMultibase
-  }
-}
-
-const edv = new EdvClientCore({ keyAgreementKey: kak, keyResolver })
-const transport = new WasTransport({
-  was,
-  spaceId: space.id,
-  collectionId: collection.id
-})
-
-// Encrypt + write: the server stores a JWE envelope, not the cleartext.
-const doc = await edv.insert({ doc: { content: { secret: 42 } }, transport })
-
-// Read + decrypt:
-const decrypted = await edv.get({ id: doc.id, transport })
-console.log(decrypted.content) // { secret: 42 }
-```
-
-Scope and caveats (this is the first, documents-only increment):
-
-- **Documents only.** `insert` / `update` / `get` are supported. Blinded `find`
-  / `count` / index updates and chunked blob streams throw -- they need
-  server-side EDV affordances (a blinded `/query` endpoint, the
-  `/{id}/chunks/{n}` sub-segment) a plaintext WAS server does not provide.
-- **Advisory `sequence`.** Without server-side conditional writes, a stale
-  `update` is not rejected (last-writer-wins). Safe for single-writer use.
-- **Content type.** Envelopes are stored as `application/json` by default so any
-  WAS server accepts them. The preferred marker `application/edv+json` (exported
-  as `EDV_CONTENT_TYPE`) needs the server to register an `application/*+json`
-  content-type parser -- the reference was-teaching-server does; pass
-  `contentType: EDV_CONTENT_TYPE` to opt in.
-
 ### The manual-request escape hatch
 
 `was.request(...)` mirrors ezcap's generic `request()` for hand-built calls. As

package/dist/Collection.d.ts

@@ -1,11 +1,12 @@
 import type { ClientContext } from './internal/request.js';
 import { Resource } from './Resource.js';
-import type { AddResult, BackendDescriptor, BackendReference, BackendUsage, CollectionDescription, GrantOptions, HandleOptions, IDelegatedZcap, IZcap, Json, LinkSet, PolicyDocument, CollectionResourcesList } from './types.js';
+import type { AddResult, BackendDescriptor, BackendReference, BackendUsage, CollectionDescription, CollectionEncryption, EncryptionOverride, GrantOptions, HandleOptions, IDelegatedZcap, IZcap, Json, LinkSet, PolicyDocument, CollectionResourcesList } from './types.js';
 export declare class Collection {
     readonly spaceId: string;
     readonly id: string;
     private readonly _context;
     private readonly _capability?;
+    private readonly _encryptionOverride?;
     private _codecPromise?;
     /**
      * @param options {object}
@@ -14,20 +15,27 @@ export declare class Collection {
      * @param options.spaceId {string}
      * @param options.collectionId {string}
      * @param [options.capability] {IZcap} - capability attached to every request
+     * @param [options.encryption] {EncryptionOverride} - per-handle encryption
+     *   override; wins over the Collection's declared marker and skips the
+     *   marker-discovery round-trip
      */
-    constructor({ context, spaceId, collectionId, capability }: {
+    constructor({ context, spaceId, collectionId, capability, encryption }: {
         context: ClientContext;
         spaceId: string;
         collectionId: string;
         capability?: IZcap;
+        encryption?: EncryptionOverride;
     });
     private get _path();
     private get _itemsPath();
     /**
      * Resolves (once, then caches) the codec for this collection's reads and
      * writes: the identity codec for a plaintext collection, or the encrypting
-     * codec when an `EncryptionProvider` is injected and supplies one for this
-     * collection (i.e. the client holds keys for it).
+     * codec when this collection is declared encrypted -- by a per-handle override
+     * or its `encryption` marker -- and the client's keystore supplies its keys.
+     * An encrypted collection the client cannot key for fails closed (throws), and
+     * the marker read happens at most once per handle (memoized here) -- a fresh
+     * handle to the same collection re-reads it, so retain the handle to reuse it.
      *
      * @returns {Promise<ResourceCodec>}
      */
@@ -47,11 +55,16 @@ export declare class Collection {
      * @param desc {object}
      * @param [desc.name] {string}
      * @param [desc.backend] {BackendReference}
+     * @param [desc.encryption] {CollectionEncryption}   declare the client-side
+     *   encryption marker. Set-once on the server: it may be added to a Collection
+     *   that lacks one, but changing/clearing an existing marker is rejected
+     *   (`ConflictError`, `encryption-immutable`).
      * @returns {Promise<CollectionDescription>}
      */
     configure(desc: {
         name?: string;
         backend?: BackendReference;
+        encryption?: CollectionEncryption;
     }): Promise<CollectionDescription>;
     /**
      * Deletes the whole collection. Idempotent. To delete a single resource, use

package/dist/Collection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Collection.d.ts","sourceRoot":"","sources":["../src/Collection.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAK1D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EACV,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,EACL,IAAI,EACJ,OAAO,EACP,cAAc,EACd,uBAAuB,EACxB,MAAM,YAAY,CAAA;AAEnB,qBAAa,UAAU;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IAEnB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAO;IACpC,OAAO,CAAC,aAAa,CAAC,CAAwB;IAE9C;;;;;;;OAOG;gBACS,EACV,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACX,EAAE;QACD,OAAO,EAAE,aAAa,CAAA;QACtB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,KAAK,CAAA;KACnB;IAOD,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,KAAK,UAAU,GAErB;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM;IAOd;;;;;;OAMG;IACG,QAAQ,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAUvD;;;;;;;;OAQG;IACG,SAAS,CAAC,IAAI,EAAE;QACpB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,gBAAgB,CAAA;KAC3B,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAqBlC;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAS7B;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,QAAQ;IAanE;;;;;;;;;OASG;IACG,GAAG,CACP,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,UAAU,EAC9B,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC;IAgErB;;;;;;;OAOG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAW1D;;;;;;;;;;;;OAYG;IACG,GAAG,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,UAAU,EAC9B,OAAO,GAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACjB,GACL,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAI7B;;;;;OAKG;IACG,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAUrD;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAU3D;;;;;;;OAOG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAUjD;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAStD;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAKlC;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IASlC;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAUxC;;;;;;;;;;;;;;OAcG;IACG,OAAO,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAUlD;;;;;;;OAOG;IACG,KAAK,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAS5C"}
+{"version":3,"file":"Collection.d.ts","sourceRoot":"","sources":["../src/Collection.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAM1D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EACV,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,EACL,IAAI,EACJ,OAAO,EACP,cAAc,EACd,uBAAuB,EACxB,MAAM,YAAY,CAAA;AAEnB,qBAAa,UAAU;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IAEnB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAO;IACpC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAoB;IACzD,OAAO,CAAC,aAAa,CAAC,CAAwB;IAE9C;;;;;;;;;;OAUG;gBACS,EACV,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EACX,EAAE;QACD,OAAO,EAAE,aAAa,CAAA;QACtB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,KAAK,CAAA;QAClB,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC;IAQD,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,KAAK,UAAU,GAErB;IAED;;;;;;;;;;OAUG;IACH,OAAO,CAAC,MAAM;IAUd;;;;;;OAMG;IACG,QAAQ,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAQvD;;;;;;;;;;;;OAYG;IACG,SAAS,CAAC,IAAI,EAAE;QACpB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,gBAAgB,CAAA;QAC1B,UAAU,CAAC,EAAE,oBAAoB,CAAA;KAClC,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAwBlC;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAS7B;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,QAAQ;IAanE;;;;;;;;;OASG;IACG,GAAG,CACP,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,UAAU,EAC9B,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GACrC,OAAO,CAAC,SAAS,CAAC;IAgErB;;;;;;;OAOG;IACG,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAW1D;;;;;;;;;;;;OAYG;IACG,GAAG,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,UAAU,EAC9B,OAAO,GAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACjB,GACL,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAI7B;;;;;OAKG;IACG,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAUrD;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAU3D;;;;;;;OAOG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAUjD;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAStD;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAKlC;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IASlC;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAUxC;;;;;;;;;;;;;;OAcG;IACG,OAAO,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAUlD;;;;;;;OAOG;IACG,KAAK,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAS5C"}

package/dist/Collection.js

@@ -11,6 +11,7 @@ import { assertNotReserved } from './internal/reserved.js';
 import { delegateGrant } from './internal/grant.js';
 import { send } from './internal/request.js';
 import { resolveCodec } from './internal/codec.js';
+import { describeCollection } from './internal/describe.js';
 import { writeHeaders, readEtag } from './internal/conditional.js';
 import { Resource } from './Resource.js';
 export class Collection {
@@ -18,6 +19,7 @@ export class Collection {
     id;
     _context;
     _capability;
+    _encryptionOverride;
     _codecPromise;
     /**
      * @param options {object}
@@ -26,12 +28,16 @@ export class Collection {
      * @param options.spaceId {string}
      * @param options.collectionId {string}
      * @param [options.capability] {IZcap} - capability attached to every request
+     * @param [options.encryption] {EncryptionOverride} - per-handle encryption
+     *   override; wins over the Collection's declared marker and skips the
+     *   marker-discovery round-trip
      */
-    constructor({ context, spaceId, collectionId, capability }) {
+    constructor({ context, spaceId, collectionId, capability, encryption }) {
         this._context = context;
         this.spaceId = spaceId;
         this.id = collectionId;
         this._capability = capability;
+        this._encryptionOverride = encryption;
     }
     get _path() {
         return collectionPath(this.spaceId, this.id);
@@ -42,15 +48,20 @@ export class Collection {
     /**
      * Resolves (once, then caches) the codec for this collection's reads and
      * writes: the identity codec for a plaintext collection, or the encrypting
-     * codec when an `EncryptionProvider` is injected and supplies one for this
-     * collection (i.e. the client holds keys for it).
+     * codec when this collection is declared encrypted -- by a per-handle override
+     * or its `encryption` marker -- and the client's keystore supplies its keys.
+     * An encrypted collection the client cannot key for fails closed (throws), and
+     * the marker read happens at most once per handle (memoized here) -- a fresh
+     * handle to the same collection re-reads it, so retain the handle to reuse it.
      *
      * @returns {Promise<ResourceCodec>}
      */
     _codec() {
         return (this._codecPromise ??= resolveCodec(this._context, {
             spaceId: this.spaceId,
-            collectionId: this.id
+            collectionId: this.id,
+            override: this._encryptionOverride,
+            readMarker: async () => (await this.describe())?.encryption
         }));
     }
     /**
@@ -61,13 +72,11 @@ export class Collection {
      * @returns {Promise<CollectionDescription | null>}
      */
     async describe() {
-        const response = await send(this._context, {
-            path: this._path,
-            method: 'GET',
-            capability: this._capability,
-            read: true
+        return describeCollection(this._context, {
+            spaceId: this.spaceId,
+            collectionId: this.id,
+            capability: this._capability
         });
-        return response === null ? null : response.data;
     }
     /**
      * Creates or updates the collection by id (upsert). Merges the given fields
@@ -76,6 +85,10 @@ export class Collection {
      * @param desc {object}
      * @param [desc.name] {string}
      * @param [desc.backend] {BackendReference}
+     * @param [desc.encryption] {CollectionEncryption}   declare the client-side
+     *   encryption marker. Set-once on the server: it may be added to a Collection
+     *   that lacks one, but changing/clearing an existing marker is rejected
+     *   (`ConflictError`, `encryption-immutable`).
      * @returns {Promise<CollectionDescription>}
      */
     async configure(desc) {
@@ -86,6 +99,9 @@ export class Collection {
         if (desc.backend) {
             body.backend = desc.backend;
         }
+        if (desc.encryption) {
+            body.encryption = desc.encryption;
+        }
         await send(this._context, {
             path: this._path,
             method: 'PUT',

package/dist/Collection.js.map

@@ -1 +1 @@
-{"version":3,"file":"Collection.js","sourceRoot":"","sources":["../src/Collection.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;GAIG;AACH,OAAO,EACL,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,EACN,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAElE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAiBxC,MAAM,OAAO,UAAU;IACZ,OAAO,CAAQ;IACf,EAAE,CAAQ;IAEF,QAAQ,CAAe;IACvB,WAAW,CAAQ;IAC5B,aAAa,CAAyB;IAE9C;;;;;;;OAOG;IACH,YAAY,EACV,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EAMX;QACC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,EAAE,GAAG,YAAY,CAAA;QACtB,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED,IAAY,KAAK;QACf,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED;;;;;;;OAOG;IACK,MAAM;QACZ,OAAO,CAAC,IAAI,CAAC,aAAa,KAAK,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,EAAE;SACtB,CAAC,CAAC,CAAA;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAA8B,CAAA;IAC5E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,IAGf;QACC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAA;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,IAAI,CAAA;QACvC,MAAM,IAAI,GAA4B,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAA;QAC3D,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC7B,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC;YACrC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAkB,EAAE,UAAyB,EAAE;QACtD,OAAO,IAAI,QAAQ,CAAC;YAClB,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,UAAU;YACV,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW;YAClD,uEAAuE;YACvE,mCAAmC;YACnC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,CACP,IAA8B,EAC9B,UAAoC,EAAE;QAEtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;YACjC,IAAI;YACJ,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAA;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,gBAAgB;QAChB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAA;QAEF,4EAA4E;QAC5E,0EAA0E;QAC1E,cAAc;QACd,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;YAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACzC,IAAI;gBACJ,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,IAAI,CAAC,WAAW;gBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO;aACR,CAAC,CAAA;YACF,OAAO;gBACL,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,GAAG,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;gBACxD,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC;aACzB,CAAA;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO;SACR,CAAC,CAAA;QACF,gEAAgE;QAChE,MAAM,OAAO,GAAI,QAA+B,CAAC,IAIhD,CAAA;QACD,MAAM,QAAQ,GACX,QAAiC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAA;QACzE,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,GAAG,EACD,QAAQ;gBACR,KAAK,CAAC;oBACJ,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;oBAClC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;iBACtD,CAAC;YACJ,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC;YACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC;SACzB,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAC,UAAkB;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;YACrD,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC1D,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,GAAG,CACP,UAAkB,EAClB,IAA8B,EAC9B,UAII,EAAE;QAEN,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAgC,CAAA;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE;YAClC,GAAG,OAAO;YACV,MAAM,EACJ,OAAO,CAAC,MAAM;gBACd,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YACjE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW;SACnD,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAuB,CAAA;IACrE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,MAAsB;QACpC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,MAAM;SACb,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACrC,OAAO,MAAM,EAAE,IAAI,KAAK,eAAe,CAAA;IACzC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAA;IACjD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAgB,CAAA;IAC9D,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAA0B,CAAA;IACxE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAqB,CAAA;IACnE,CAAC;CACF"}
+{"version":3,"file":"Collection.js","sourceRoot":"","sources":["../src/Collection.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;GAIG;AACH,OAAO,EACL,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,EACN,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAElE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAmBxC,MAAM,OAAO,UAAU;IACZ,OAAO,CAAQ;IACf,EAAE,CAAQ;IAEF,QAAQ,CAAe;IACvB,WAAW,CAAQ;IACnB,mBAAmB,CAAqB;IACjD,aAAa,CAAyB;IAE9C;;;;;;;;;;OAUG;IACH,YAAY,EACV,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EAOX;QACC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,EAAE,GAAG,YAAY,CAAA;QACtB,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;QAC7B,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAA;IACvC,CAAC;IAED,IAAY,KAAK;QACf,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAC9C,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED;;;;;;;;;;OAUG;IACK,MAAM;QACZ,OAAO,CAAC,IAAI,CAAC,aAAa,KAAK,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,QAAQ,EAAE,IAAI,CAAC,mBAAmB;YAClC,UAAU,EAAE,KAAK,IAA+C,EAAE,CAChE,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,UAAU;SACtC,CAAC,CAAC,CAAA;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ;QACZ,OAAO,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE;YACvC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,UAAU,EAAE,IAAI,CAAC,WAAW;SAC7B,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,SAAS,CAAC,IAIf;QACC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAA;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,IAAI,CAAA;QACvC,MAAM,IAAI,GAA4B,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAA;QAC3D,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC7B,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACnC,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC;YACrC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAkB,EAAE,UAAyB,EAAE;QACtD,OAAO,IAAI,QAAQ,CAAC;YAClB,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,UAAU;YACV,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW;YAClD,uEAAuE;YACvE,mCAAmC;YACnC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE;SAC3B,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,CACP,IAA8B,EAC9B,UAAoC,EAAE;QAEtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;YACjC,IAAI;YACJ,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAA;QACF,4EAA4E;QAC5E,0EAA0E;QAC1E,gBAAgB;QAChB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAA;QAEF,4EAA4E;QAC5E,0EAA0E;QAC1E,cAAc;QACd,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;YAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACzC,IAAI;gBACJ,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,IAAI,CAAC,WAAW;gBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO;aACR,CAAC,CAAA;YACF,OAAO;gBACL,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,GAAG,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;gBACxD,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC;aACzB,CAAA;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO;SACR,CAAC,CAAA;QACF,gEAAgE;QAChE,MAAM,OAAO,GAAI,QAA+B,CAAC,IAIhD,CAAA;QACD,MAAM,QAAQ,GACX,QAAiC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAA;QACzE,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,GAAG,EACD,QAAQ;gBACR,KAAK,CAAC;oBACJ,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;oBAClC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;iBACtD,CAAC;YACJ,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC;YACpC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC;SACzB,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,CAAC,UAAkB;QAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC;YACrD,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC1D,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,GAAG,CACP,UAAkB,EAClB,IAA8B,EAC9B,UAII,EAAE;QAEN,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAgC,CAAA;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE;YAClC,GAAG,OAAO;YACV,MAAM,EACJ,OAAO,CAAC,MAAM;gBACd,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YACjE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,WAAW;SACnD,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAuB,CAAA;IACrE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,MAAsB;QACpC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,MAAM;SACb,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACrC,OAAO,MAAM,EAAE,IAAI,KAAK,eAAe,CAAA;IACzC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAA;IACjD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAgB,CAAA;IAC9D,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAA0B,CAAA;IACxE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAqB,CAAA;IACnE,CAAC;CACF"}

package/dist/Resource.d.ts

@@ -1,6 +1,6 @@
 import type { ClientContext } from './internal/request.js';
 import type { ResourceCodec } from './codec.js';
-import type { IZcap, Json, PolicyDocument, ResourceMetadata, ResourceMetadataCustom } from './types.js';
+import type { EncryptionOverride, IZcap, Json, PolicyDocument, ResourceMetadata, ResourceMetadataCustom } from './types.js';
 export declare class Resource {
     readonly spaceId: string;
     readonly collectionId: string;
@@ -8,6 +8,7 @@ export declare class Resource {
     private readonly _context;
     private readonly _capability?;
     private readonly _codecThunk?;
+    private readonly _encryptionOverride?;
     private _codecPromise?;
     /**
      * @param options {object}
@@ -20,20 +21,28 @@ export declare class Resource {
      *   codec, so a resource handle obtained via `collection.resource(id)` does
      *   not repeat the backend() round-trip. A standalone resource resolves its
      *   own.
+     * @param [options.encryption] {EncryptionOverride}   per-handle encryption
+     *   override for a standalone resource (ignored when `codec` is supplied --
+     *   the shared parent codec wins)
      */
-    constructor({ context, spaceId, collectionId, resourceId, capability, codec }: {
+    constructor({ context, spaceId, collectionId, resourceId, capability, codec, encryption }: {
         context: ClientContext;
         spaceId: string;
         collectionId: string;
         resourceId: string;
         capability?: IZcap;
         codec?: () => Promise<ResourceCodec>;
+        encryption?: EncryptionOverride;
     });
     private get _path();
     /**
      * Resolves (once, then caches) the codec for this resource: the parent
      * collection's shared codec when this handle came from
-     * `collection.resource(id)`, otherwise one resolved for its own collection.
+     * `collection.resource(id)`, otherwise one resolved for its own collection. A
+     * standalone resource discovers its collection's `encryption` marker (one GET
+     * on the collection, cached per handle) unless a per-handle override is set,
+     * and fails closed if it cannot key an encrypted collection. A fresh
+     * standalone handle re-reads the marker, so retain the handle to reuse it.
      *
      * @returns {Promise<ResourceCodec>}
      */

package/dist/Resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Resource.d.ts","sourceRoot":"","sources":["../src/Resource.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAI1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,KAAK,EACV,KAAK,EACL,IAAI,EACJ,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,YAAY,CAAA;AAEnB,qBAAa,QAAQ;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IAEnB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAO;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAA8B;IAC3D,OAAO,CAAC,aAAa,CAAC,CAAwB;IAE9C;;;;;;;;;;;OAWG;gBACS,EACV,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EACV,KAAK,EACN,EAAE;QACD,OAAO,EAAE,aAAa,CAAA;QACtB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,KAAK,CAAA;QAClB,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;KACrC;IASD,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IASd;;;;;;OAMG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAWxC;;;;;;;OAOG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUvC;;;;;;;OAOG;IACG,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAa5C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,GAAG,CACP,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,UAAU,EAC9B,OAAO,GAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACjB,GACL,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqC7B;;;;;;;;OAQG;IACG,MAAM,CAAC,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/D,OAAO,KAAK,SAAS,GAEpB;IAED;;;;;;;;;;;OAWG;IACG,IAAI,IAAI,OAAO,CAAC,CAAC,gBAAgB,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAepE;;;;;;;;;;;;;;OAcG;IACG,OAAO,CAAC,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,sBAAsB,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB5E;;;;;;OAMG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1C;;;;;;OAMG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1D,OAAO,KAAK,WAAW,GAEtB;IAED;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAUjD;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAStD;;;;;OAKG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAKlC;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;CAQnC"}
+{"version":3,"file":"Resource.d.ts","sourceRoot":"","sources":["../src/Resource.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAK1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,KAAK,EAEV,kBAAkB,EAClB,KAAK,EACL,IAAI,EACJ,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,YAAY,CAAA;AAEnB,qBAAa,QAAQ;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IAEnB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAO;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAA8B;IAC3D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAoB;IACzD,OAAO,CAAC,aAAa,CAAC,CAAwB;IAE9C;;;;;;;;;;;;;;OAcG;gBACS,EACV,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EACV,KAAK,EACL,UAAU,EACX,EAAE;QACD,OAAO,EAAE,aAAa,CAAA;QACtB,OAAO,EAAE,MAAM,CAAA;QACf,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,KAAK,CAAA;QAClB,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAA;QACpC,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC;IAUD,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;;;;;;OAUG;IACH,OAAO,CAAC,MAAM;IAkBd;;;;;;OAMG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAWxC;;;;;;;OAOG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUvC;;;;;;;OAOG;IACG,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAa5C;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,GAAG,CACP,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,UAAU,EAC9B,OAAO,GAAE;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,WAAW,CAAC,EAAE,OAAO,CAAA;KACjB,GACL,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAqC7B;;;;;;;;OAQG;IACG,MAAM,CAAC,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAY/D,OAAO,KAAK,SAAS,GAEpB;IAED;;;;;;;;;;;OAWG;IACG,IAAI,IAAI,OAAO,CAAC,CAAC,gBAAgB,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAepE;;;;;;;;;;;;;;OAcG;IACG,OAAO,CAAC,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,sBAAsB,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB5E;;;;;;OAMG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1C;;;;;;OAMG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1D,OAAO,KAAK,WAAW,GAEtB;IAED;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAUjD;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAStD;;;;;OAKG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAKlC;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;CAQnC"}

package/dist/Resource.js

@@ -2,6 +2,7 @@ import { resourcePath, resourcePolicy, resourceMeta } from './internal/paths.js'
 import { assertNotReserved } from './internal/reserved.js';
 import { send } from './internal/request.js';
 import { resolveCodec } from './internal/codec.js';
+import { describeCollection } from './internal/describe.js';
 import { writeHeaders, readEtag } from './internal/conditional.js';
 import { ValidationError } from './errors.js';
 export class Resource {
@@ -11,6 +12,7 @@ export class Resource {
     _context;
     _capability;
     _codecThunk;
+    _encryptionOverride;
     _codecPromise;
     /**
      * @param options {object}
@@ -23,14 +25,18 @@ export class Resource {
      *   codec, so a resource handle obtained via `collection.resource(id)` does
      *   not repeat the backend() round-trip. A standalone resource resolves its
      *   own.
+     * @param [options.encryption] {EncryptionOverride}   per-handle encryption
+     *   override for a standalone resource (ignored when `codec` is supplied --
+     *   the shared parent codec wins)
      */
-    constructor({ context, spaceId, collectionId, resourceId, capability, codec }) {
+    constructor({ context, spaceId, collectionId, resourceId, capability, codec, encryption }) {
         this._context = context;
         this.spaceId = spaceId;
         this.collectionId = collectionId;
         this.id = resourceId;
         this._capability = capability;
         this._codecThunk = codec;
+        this._encryptionOverride = encryption;
     }
     get _path() {
         return resourcePath(this.spaceId, this.collectionId, this.id);
@@ -38,7 +44,11 @@ export class Resource {
     /**
      * Resolves (once, then caches) the codec for this resource: the parent
      * collection's shared codec when this handle came from
-     * `collection.resource(id)`, otherwise one resolved for its own collection.
+     * `collection.resource(id)`, otherwise one resolved for its own collection. A
+     * standalone resource discovers its collection's `encryption` marker (one GET
+     * on the collection, cached per handle) unless a per-handle override is set,
+     * and fails closed if it cannot key an encrypted collection. A fresh
+     * standalone handle re-reads the marker, so retain the handle to reuse it.
      *
      * @returns {Promise<ResourceCodec>}
      */
@@ -47,7 +57,13 @@ export class Resource {
             ? this._codecThunk()
             : resolveCodec(this._context, {
                 spaceId: this.spaceId,
-                collectionId: this.collectionId
+                collectionId: this.collectionId,
+                override: this._encryptionOverride,
+                readMarker: async () => (await describeCollection(this._context, {
+                    spaceId: this.spaceId,
+                    collectionId: this.collectionId,
+                    capability: this._capability
+                }))?.encryption
             }));
     }
     /**

package/dist/Resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"Resource.js","sourceRoot":"","sources":["../src/Resource.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAS7C,MAAM,OAAO,QAAQ;IACV,OAAO,CAAQ;IACf,YAAY,CAAQ;IACpB,EAAE,CAAQ;IAEF,QAAQ,CAAe;IACvB,WAAW,CAAQ;IACnB,WAAW,CAA+B;IACnD,aAAa,CAAyB;IAE9C;;;;;;;;;;;OAWG;IACH,YAAY,EACV,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EACV,KAAK,EAQN;QACC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,EAAE,GAAG,UAAU,CAAA;QACpB,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;QAC7B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAA;IAC1B,CAAC;IAED,IAAY,KAAK;QACf,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED;;;;;;OAMG;IACK,MAAM;QACZ,OAAO,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,WAAW;YAC7C,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;YACpB,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE;gBAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,YAAY,EAAE,IAAI,CAAC,YAAY;aAChC,CAAC,CAAC,CAAA;IACT,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG;QACP,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC1D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IACnD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,CAAC,GAAG,CACP,IAA8B,EAC9B,UAII,EAAE;QAEN,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACjC,6EAA6E;QAC7E,6EAA6E;QAC7E,2CAA2C;QAC3C,IAAI,OAAwC,CAAA;QAC5C,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,KAAK;gBAChB,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,IAAI,CAAC,WAAW;gBAC5B,IAAI,EAAE,IAAI;aACX,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;YACjC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI;YACJ,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO;SACR,CAAC,CAAA;QACF,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,YAAY,GAAG,KAAK,CAAC,iBAAiB;YAC1C,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;YAChE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAA;QAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC;SACzD,CAAC,CAAA;QACF,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IACrC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,UAAgC,EAAE;QAC7C,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,0EAA0E;YAC1E,oEAAoE;YACpE,UAAU,EAAE,OAAO,CAAC,OAAO,KAAK,SAAS;YACzC,OAAO,EAAE,YAAY,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;SAC/D,CAAC,CAAA;IACJ,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAwB,CAAA;QAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC/B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC9D,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,OAAO,CAAC,OAA4C,EAAE;QAC1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACjC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAChC,MAAM,IAAI,eAAe,CACvB,iEAAiE;gBAC/D,oEAAoE;gBACpE,uCAAuC,CAC1C,CAAA;QACH,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE;SACpC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,IAA4B;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IACjE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAuB,CAAA;IACrE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,MAAsB;QACpC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,MAAM;SACb,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAA;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACrC,OAAO,MAAM,EAAE,IAAI,KAAK,eAAe,CAAA;IACzC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"Resource.js","sourceRoot":"","sources":["../src/Resource.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE1D,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAW7C,MAAM,OAAO,QAAQ;IACV,OAAO,CAAQ;IACf,YAAY,CAAQ;IACpB,EAAE,CAAQ;IAEF,QAAQ,CAAe;IACvB,WAAW,CAAQ;IACnB,WAAW,CAA+B;IAC1C,mBAAmB,CAAqB;IACjD,aAAa,CAAyB;IAE9C;;;;;;;;;;;;;;OAcG;IACH,YAAY,EACV,OAAO,EACP,OAAO,EACP,YAAY,EACZ,UAAU,EACV,UAAU,EACV,KAAK,EACL,UAAU,EASX;QACC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,EAAE,GAAG,UAAU,CAAA;QACpB,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;QAC7B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAA;QACxB,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAA;IACvC,CAAC;IAED,IAAY,KAAK;QACf,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IACK,MAAM;QACZ,OAAO,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,WAAW;YAC7C,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;YACpB,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE;gBAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,QAAQ,EAAE,IAAI,CAAC,mBAAmB;gBAClC,UAAU,EAAE,KAAK,IAA+C,EAAE,CAChE,CACE,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE;oBACtC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,UAAU,EAAE,IAAI,CAAC,WAAW;iBAC7B,CAAC,CACH,EAAE,UAAU;aAChB,CAAC,CAAC,CAAA;IACT,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,GAAG;QACP,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC1D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;IACnD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;IACrD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,CAAC,GAAG,CACP,IAA8B,EAC9B,UAII,EAAE;QAEN,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;QACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACjC,6EAA6E;QAC7E,6EAA6E;QAC7E,2CAA2C;QAC3C,IAAI,OAAwC,CAAA;QAC5C,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,KAAK;gBAChB,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,IAAI,CAAC,WAAW;gBAC5B,IAAI,EAAE,IAAI;aACX,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;YACjC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI;YACJ,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO;SACR,CAAC,CAAA;QACF,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,YAAY,GAAG,KAAK,CAAC,iBAAiB;YAC1C,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;YAChE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAA;QAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC;SACzD,CAAC,CAAA;QACF,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IACrC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,UAAgC,EAAE;QAC7C,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,0EAA0E;YAC1E,oEAAoE;YACpE,UAAU,EAAE,OAAO,CAAC,OAAO,KAAK,SAAS;YACzC,OAAO,EAAE,YAAY,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;SAC/D,CAAC,CAAA;IACJ,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAwB,CAAA;QAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC/B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC9D,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,OAAO,CAAC,OAA4C,EAAE;QAC1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACjC,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAChC,MAAM,IAAI,eAAe,CACvB,iEAAiE;gBAC/D,oEAAoE;gBACpE,uCAAuC,CAC1C,CAAA;QACH,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,SAAS;YACpB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE;SACpC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY;QACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,IAA4B;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IACjE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAAuB,CAAA;IACrE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,MAAsB;QACpC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,MAAM,EAAE,KAAK;YACb,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,IAAI,EAAE,MAAM;SACb,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAA;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAA;QACrC,OAAO,MAAM,EAAE,IAAI,KAAK,eAAe,CAAA;IACzC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,WAAW;YACtB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/Space.d.ts

@@ -1,6 +1,6 @@
 import type { ClientContext } from './internal/request.js';
 import { Collection } from './Collection.js';
-import type { BackendDescriptor, BackendReference, BackendRegistration, CollectionsList, GrantOptions, HandleOptions, IDelegatedZcap, IZcap, ImportStats, LinkSet, PolicyDocument, SpaceDescription, SpaceQuotaReport } from './types.js';
+import type { BackendDescriptor, BackendReference, BackendRegistration, CollectionEncryption, CollectionsList, GrantOptions, HandleOptions, IDelegatedZcap, IZcap, ImportStats, LinkSet, PolicyDocument, SpaceDescription, SpaceQuotaReport } from './types.js';
 export declare class Space {
     readonly id: string;
     private readonly _context;
@@ -60,12 +60,17 @@ export declare class Space {
      * @param [desc.id] {string}
      * @param [desc.name] {string}
      * @param [desc.backend] {BackendReference}
+     * @param [desc.encryption] {CollectionEncryption}   declare the collection
+     *   client-side encrypted (e.g. `{ scheme: 'edv' }`). The returned handle is
+     *   pre-seeded with a matching encryption override, so the immediate next
+     *   write encrypts without a marker-discovery round-trip.
      * @returns {Promise<Collection>}
      */
     createCollection(desc?: {
         id?: string;
         name?: string;
         backend?: BackendReference;
+        encryption?: CollectionEncryption;
     }): Promise<Collection>;
     /**
      * Lists the collections in the space. Returns `null` if the space is missing

package/dist/Space.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Space.d.ts","sourceRoot":"","sources":["../src/Space.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EAEnB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,EACL,WAAW,EACX,OAAO,EACP,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,YAAY,CAAA;AAEnB,qBAAa,KAAK;IAChB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IAEnB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAO;IAEpC;;;;;OAKG;gBACS,EACV,OAAO,EACP,OAAO,EACP,UAAU,EACX,EAAE;QACD,OAAO,EAAE,aAAa,CAAA;QACtB,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,KAAK,CAAA;KACnB;IAMD,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;OAKG;IACG,QAAQ,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAUlD;;;;;;;;OAQG;IACG,SAAS,CAAC,IAAI,EAAE;QACpB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAqB7B;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAS7B;;;;;;;OAOG;IACH,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,UAAU;IASzE;;;;;;;;;OASG;IACG,gBAAgB,CACpB,IAAI,GAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,gBAAgB,CAAA;KAAO,GACpE,OAAO,CAAC,UAAU,CAAC;IAyBtB;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAUpD;;;;;;;;;;OAUG;IACG,QAAQ,IAAI,OAAO,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAUrD;;;;;;;;;;;;;;;;;OAiBG;IACG,eAAe,CACnB,YAAY,EAAE,mBAAmB,GAChC,OAAO,CAAC,iBAAiB,CAAC;IAU7B;;;;;;;;;;;;;;;;OAgBG;IACG,aAAa,CACjB,YAAY,EAAE,mBAAmB,GAChC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAapC;;;;;;;;;;;OAWG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASzD;;;;;;;;;;OAUG;IACG,MAAM,CAAC,EACX,kBAA0B,EAC3B,GAAE;QAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAa3E;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAU3D;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC;IAanC;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC;IAe1D;;;;;;;OAOG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAUjD;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAStD;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAKlC;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IASlC;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;CASzC"}
+{"version":3,"file":"Space.d.ts","sourceRoot":"","sources":["../src/Space.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE1D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EAEnB,oBAAoB,EACpB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,EACL,WAAW,EACX,OAAO,EACP,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,YAAY,CAAA;AAEnB,qBAAa,KAAK;IAChB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IAEnB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAO;IAEpC;;;;;OAKG;gBACS,EACV,OAAO,EACP,OAAO,EACP,UAAU,EACX,EAAE;QACD,OAAO,EAAE,aAAa,CAAA;QACtB,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,KAAK,CAAA;KACnB;IAMD,OAAO,KAAK,KAAK,GAEhB;IAED;;;;;OAKG;IACG,QAAQ,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAUlD;;;;;;;;OAQG;IACG,SAAS,CAAC,IAAI,EAAE;QACpB,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAqB7B;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAS7B;;;;;;;OAOG;IACH,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,UAAU;IAUzE;;;;;;;;;;;;;OAaG;IACG,gBAAgB,CACpB,IAAI,GAAE;QACJ,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,gBAAgB,CAAA;QAC1B,UAAU,CAAC,EAAE,oBAAoB,CAAA;KAC7B,GACL,OAAO,CAAC,UAAU,CAAC;IAgCtB;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAUpD;;;;;;;;;;OAUG;IACG,QAAQ,IAAI,OAAO,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAUrD;;;;;;;;;;;;;;;;;OAiBG;IACG,eAAe,CACnB,YAAY,EAAE,mBAAmB,GAChC,OAAO,CAAC,iBAAiB,CAAC;IAU7B;;;;;;;;;;;;;;;;OAgBG;IACG,aAAa,CACjB,YAAY,EAAE,mBAAmB,GAChC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAapC;;;;;;;;;;;OAWG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASzD;;;;;;;;;;OAUG;IACG,MAAM,CAAC,EACX,kBAA0B,EAC3B,GAAE;QAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAa3E;;;;;;OAMG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAU3D;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC;IAanC;;;;;OAKG;IACG,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC;IAe1D;;;;;;;OAOG;IACG,SAAS,IAAI,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAUjD;;;;;OAKG;IACG,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAStD;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAKlC;;;;;;OAMG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAIhC;;;;;OAKG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IASlC;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;CASzC"}

package/dist/Space.js

@@ -99,7 +99,8 @@ export class Space {
             context: this._context,
             spaceId: this.id,
             collectionId,
-            capability: options.capability ?? this._capability
+            capability: options.capability ?? this._capability,
+            encryption: options.encryption
         });
     }
     /**
@@ -110,6 +111,10 @@ export class Space {
      * @param [desc.id] {string}
      * @param [desc.name] {string}
      * @param [desc.backend] {BackendReference}
+     * @param [desc.encryption] {CollectionEncryption}   declare the collection
+     *   client-side encrypted (e.g. `{ scheme: 'edv' }`). The returned handle is
+     *   pre-seeded with a matching encryption override, so the immediate next
+     *   write encrypts without a marker-discovery round-trip.
      * @returns {Promise<Collection>}
      */
     async createCollection(desc = {}) {
@@ -126,6 +131,9 @@ export class Space {
         if (desc.backend) {
             body.backend = desc.backend;
         }
+        if (desc.encryption) {
+            body.encryption = desc.encryption;
+        }
         const response = await send(this._context, {
             path: spaceItems(this.id),
             method: 'POST',
@@ -134,7 +142,11 @@ export class Space {
         });
         const created = response
             .data;
-        return this.collection(created.id);
+        // Pre-seed the handle with an override matching the just-declared scheme so
+        // the first write encrypts immediately (keys come from the keystore); no
+        // describe() round-trip needed before the marker is locally known. A
+        // `CollectionEncryption` marker is itself a valid `EncryptionOverride`.
+        return this.collection(created.id, { encryption: desc.encryption });
     }
     /**
      * Lists the collections in the space. Returns `null` if the space is missing