@interop/was-client 0.8.0 → 0.9.1

package/dist/internal/codec.js

@@ -1,4 +1,5 @@
 import { prepareBody, parseResource } from './content.js';
+import { EncryptionError } from '../errors.js';
 /**
  * The default codec: passes plaintext through unchanged. `encode` echoes the
  * caller's `id` (so `put(id, ...)` is a `PUT` and `add(...)`, with no id, stays
@@ -22,23 +23,83 @@ export const identityCodec = {
     }
 };
 /**
- * Resolves the codec for a collection. Returns {@link identityCodec} unless an
- * {@link EncryptionProvider} is injected and returns a codec for the collection
- * (i.e. the client holds keys for it). No backend round-trip: whether a
- * collection is encrypted is a client/key concern, not a backend capability.
+ * Resolves the codec for a collection by deciding policy (override > marker >
+ * plaintext) and then, when encrypted, building the encrypting codec from the
+ * keystore. Fails closed: a collection declared encrypted (by override or
+ * marker) for which no codec can be built throws {@link EncryptionError} rather
+ * than falling back to {@link identityCodec}.
  *
  * @param context {ClientContext}
  * @param options {object}
  * @param options.spaceId {string}
  * @param options.collectionId {string}
+ * @param [options.override] {EncryptionOverride}   per-handle override; wins
+ *   over the marker and skips the marker read
+ * @param options.readMarker {function}   lazily reads the Collection's declared
+ *   `encryption` marker (resolves `undefined` for plaintext / missing); called
+ *   only when there is no override and the client has a keystore
  * @returns {Promise<ResourceCodec>}
  */
-export async function resolveCodec(context, { spaceId, collectionId }) {
-    const provider = context.encryption;
-    if (!provider) {
+export async function resolveCodec(context, { spaceId, collectionId, override, readMarker }) {
+    // 1. A per-handle override wins and skips the marker read.
+    if (override !== undefined) {
+        if (override === 'plaintext') {
+            return identityCodec;
+        }
+        return buildEncryptingCodec(context, {
+            spaceId,
+            collectionId,
+            scheme: override.scheme,
+            keys: override.keys
+        });
+    }
+    // 2. A plaintext-only client (no keystore) never encrypts; no round-trip.
+    if (!context.encryption) {
+        return identityCodec;
+    }
+    // 3. Otherwise the Collection's declared marker decides.
+    const marker = await readMarker();
+    if (!marker) {
         return identityCodec;
     }
-    const codec = await provider.resolveCodec({ spaceId, collectionId });
-    return codec ?? identityCodec;
+    return buildEncryptingCodec(context, {
+        spaceId,
+        collectionId,
+        scheme: marker.scheme
+    });
+}
+/**
+ * Builds the encrypting codec for a collection known to be encrypted, failing
+ * closed: throws {@link EncryptionError} when no keystore is configured or it
+ * returns no codec (no keys / unhandled scheme), so an encrypted collection is
+ * never silently read/written as plaintext.
+ *
+ * @param context {ClientContext}
+ * @param options {object}
+ * @param options.spaceId {string}
+ * @param options.collectionId {string}
+ * @param options.scheme {string}
+ * @param [options.keys] {unknown}   override-supplied key material
+ * @returns {Promise<ResourceCodec>}
+ */
+async function buildEncryptingCodec(context, { spaceId, collectionId, scheme, keys }) {
+    const where = `${spaceId}/${collectionId}`;
+    if (!context.encryption) {
+        throw new EncryptionError(`Collection ${where} is encrypted (scheme "${scheme}") but this client ` +
+            'has no encryption provider. Construct the WasClient with an ' +
+            '`encryption` provider (see @interop/was-client/edv).');
+    }
+    const codec = await context.encryption.codecFor({
+        spaceId,
+        collectionId,
+        scheme,
+        keys
+    });
+    if (!codec) {
+        throw new EncryptionError(`Collection ${where} is encrypted (scheme "${scheme}") but this client ` +
+            'holds no keys for it (or does not handle the scheme). Supply keys via ' +
+            'your keystore (resolveKeys) or a per-handle encryption override.');
+    }
+    return codec;
 }
 //# sourceMappingURL=codec.js.map

package/dist/internal/codec.js.map

@@ -1 +1 @@
-{"version":3,"file":"codec.js","sourceRoot":"","sources":["../../src/internal/codec.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAGzD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAkB;IAC1C,oBAAoB,EAAE,IAAI;IAE1B,KAAK,CAAC,MAAM,CAAC,EACX,EAAE,EACF,IAAI,EACJ,WAAW,EAKZ;QACC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAA;QACjE,OAAO;YACL,EAAE;YACF,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAsB;QACjC,OAAO,CAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAgB,CAAA;IACvD,CAAC;CACF,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAsB,EACtB,EAAE,OAAO,EAAE,YAAY,EAA6C;IAEpE,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAA;IACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;IACpE,OAAO,KAAK,IAAI,aAAa,CAAA;AAC/B,CAAC"}
+{"version":3,"file":"codec.js","sourceRoot":"","sources":["../../src/internal/codec.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAO9C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAkB;IAC1C,oBAAoB,EAAE,IAAI;IAE1B,KAAK,CAAC,MAAM,CAAC,EACX,EAAE,EACF,IAAI,EACJ,WAAW,EAKZ;QACC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAA;QACjE,OAAO;YACL,EAAE;YACF,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAsB;QACjC,OAAO,CAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAgB,CAAA;IACvD,CAAC;CACF,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAsB,EACtB,EACE,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,UAAU,EAMX;IAED,2DAA2D;IAC3D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,aAAa,CAAA;QACtB,CAAC;QACD,OAAO,oBAAoB,CAAC,OAAO,EAAE;YACnC,OAAO;YACP,YAAY;YACZ,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAA;IACJ,CAAC;IACD,0EAA0E;IAC1E,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,yDAAyD;IACzD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,aAAa,CAAA;IACtB,CAAC;IACD,OAAO,oBAAoB,CAAC,OAAO,EAAE;QACnC,OAAO;QACP,YAAY;QACZ,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAsB,EACtB,EACE,OAAO,EACP,YAAY,EACZ,MAAM,EACN,IAAI,EACsE;IAE5E,MAAM,KAAK,GAAG,GAAG,OAAO,IAAI,YAAY,EAAE,CAAA;IAC1C,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,0BAA0B,MAAM,qBAAqB;YACtE,8DAA8D;YAC9D,sDAAsD,CACzD,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC9C,OAAO;QACP,YAAY;QACZ,MAAM;QACN,IAAI;KACL,CAAC,CAAA;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CACvB,cAAc,KAAK,0BAA0B,MAAM,qBAAqB;YACtE,wEAAwE;YACxE,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/internal/content.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/internal/content.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AA+BvC;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,UAAU,EAC9B,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACxD,YAAY,CA4Bd;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,YAAY,GAAG,IAAI,GAC5B,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAS7B"}
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/internal/content.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAgDvC;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IACxB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,UAAU,EAC9B,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACxD,YAAY,CA4Bd;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAE3E;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,YAAY,GAAG,IAAI,GAC5B,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAS7B"}

package/dist/internal/content.js

@@ -1,5 +1,21 @@
 import { ValidationError } from '../errors.js';
 const OCTET_STREAM = 'application/octet-stream';
+/**
+ * Whether a content-type denotes JSON -- `application/json` or any
+ * `application/<prefix>+json` structured-suffix variant (e.g.
+ * `application/ld+json`, `application/edv+json`), each optionally followed by
+ * parameters (`; charset=utf-8`). The `json` token is anchored to the end of the
+ * media type, so a non-JSON type that merely contains the substring `json` --
+ * `application/jsonl`, `application/json-seq`, `application/json5` -- is NOT
+ * treated as JSON and is read back as binary (a `Blob`) instead of being
+ * JSON-parsed.
+ *
+ * @param contentType {string}
+ * @returns {boolean}
+ */
+function isJsonContentType(contentType) {
+    return /^application\/([^+\s;]+\+)?json\s*(;.*)?$/i.test(contentType);
+}
 /**
  * Extension-to-content-type fallbacks for the common static-web file types --
  * the only case where guessing a content-type from a resource id pays off
@@ -123,7 +139,7 @@ export async function parseResource(response) {
         return null;
     }
     const contentType = response.headers.get('content-type') ?? '';
-    if (contentType.includes('json')) {
+    if (isJsonContentType(contentType)) {
         return (await readJsonData(response));
     }
     return response.blob();

package/dist/internal/content.js.map

@@ -1 +1 @@
-{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/internal/content.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAG9C,MAAM,YAAY,GAAG,0BAA0B,CAAA;AAE/C;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAA2B;IAChD,IAAI,EAAE,WAAW;IACjB,GAAG,EAAE,UAAU;IACf,EAAE,EAAE,iBAAiB;IACrB,GAAG,EAAE,iBAAiB;IACtB,IAAI,EAAE,kBAAkB;IACxB,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,cAAc;IACnB,KAAK,EAAE,YAAY;IACnB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,kBAAkB;CACzB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAU;IAC/C,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACrD,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAA;AACrC,CAAC;AAYD,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,IAAI,KAAK,WAAW,IAAI,KAAK,YAAY,IAAI,CAAA;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CACzB,IAA8B,EAC9B,UAAuD,EAAE;IAEzD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ;QAC9B,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,IAAI;YACV,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,YAAY;SACzE,CAAA;IACH,CAAC;IAED,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,IAAI,YAAY;SAC5D,CAAA;IACH,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,yCAAyC;QACzC,OAAO,EAAE,IAAI,EAAE,IAAc,EAAE,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,yDAAyD;QACvD,2BAA2B,CAC9B,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAsB;IACvD,OAAO,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAA6B;IAE7B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAC9D,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAS,CAAA;IAC/C,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC"}
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/internal/content.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAG9C,MAAM,YAAY,GAAG,0BAA0B,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,OAAO,4CAA4C,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAA2B;IAChD,IAAI,EAAE,WAAW;IACjB,GAAG,EAAE,UAAU;IACf,EAAE,EAAE,iBAAiB;IACrB,GAAG,EAAE,iBAAiB;IACtB,IAAI,EAAE,kBAAkB;IACxB,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,cAAc;IACnB,KAAK,EAAE,YAAY;IACnB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,kBAAkB;CACzB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAU;IAC/C,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACnC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACrD,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAA;AACrC,CAAC;AAYD,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,IAAI,KAAK,WAAW,IAAI,KAAK,YAAY,IAAI,CAAA;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CACzB,IAA8B,EAC9B,UAAuD,EAAE;IAEzD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ;QAC9B,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,IAAI;YACV,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,YAAY;SACzE,CAAA;IACH,CAAC;IAED,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,IAAI,YAAY;SAC5D,CAAA;IACH,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,yCAAyC;QACzC,OAAO,EAAE,IAAI,EAAE,IAAc,EAAE,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,yDAAyD;QACvD,2BAA2B,CAC9B,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAsB;IACvD,OAAO,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAA6B;IAE7B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAC9D,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAS,CAAA;IAC/C,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC"}

package/dist/internal/describe.d.ts

@@ -0,0 +1,27 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Reads a Collection Description with a single GET. Shared by
+ * `Collection.describe()` and the standalone-resource codec's marker discovery
+ * so the request shape (path, capability, null-unwrap) lives in one place.
+ */
+import type { ClientContext } from './request.js';
+import type { CollectionDescription, IZcap } from '../types.js';
+/**
+ * Reads the Collection Description. Returns `null` if the collection is missing
+ * or not visible to you (WAS returns 404 for both not-found and unauthorized).
+ *
+ * @param context {ClientContext}
+ * @param options {object}
+ * @param options.spaceId {string}
+ * @param options.collectionId {string}
+ * @param [options.capability] {IZcap}   capability attached to the request
+ * @returns {Promise<CollectionDescription | null>}
+ */
+export declare function describeCollection(context: ClientContext, { spaceId, collectionId, capability }: {
+    spaceId: string;
+    collectionId: string;
+    capability?: IZcap;
+}): Promise<CollectionDescription | null>;
+//# sourceMappingURL=describe.d.ts.map

package/dist/internal/describe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../src/internal/describe.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;GAIG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAGjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAE/D;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,aAAa,EACtB,EACE,OAAO,EACP,YAAY,EACZ,UAAU,EACX,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,KAAK,CAAA;CAAE,GAC/D,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAQvC"}

package/dist/internal/describe.js

@@ -0,0 +1,23 @@
+import { send } from './request.js';
+import { collectionPath } from './paths.js';
+/**
+ * Reads the Collection Description. Returns `null` if the collection is missing
+ * or not visible to you (WAS returns 404 for both not-found and unauthorized).
+ *
+ * @param context {ClientContext}
+ * @param options {object}
+ * @param options.spaceId {string}
+ * @param options.collectionId {string}
+ * @param [options.capability] {IZcap}   capability attached to the request
+ * @returns {Promise<CollectionDescription | null>}
+ */
+export async function describeCollection(context, { spaceId, collectionId, capability }) {
+    const response = await send(context, {
+        path: collectionPath(spaceId, collectionId),
+        method: 'GET',
+        capability,
+        read: true
+    });
+    return response === null ? null : response.data;
+}
+//# sourceMappingURL=describe.js.map

package/dist/internal/describe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe.js","sourceRoot":"","sources":["../../src/internal/describe.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAG3C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAsB,EACtB,EACE,OAAO,EACP,YAAY,EACZ,UAAU,EACoD;IAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC;QAC3C,MAAM,EAAE,KAAK;QACb,UAAU;QACV,IAAI,EAAE,IAAI;KACX,CAAC,CAAA;IACF,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,QAAQ,CAAC,IAA8B,CAAA;AAC5E,CAAC"}

package/dist/types.d.ts

@@ -16,7 +16,7 @@ import type { IZcap, IDelegatedZcap } from '@interop/data-integrity-core/zcap';
 import type { ISigner } from '@interop/data-integrity-core';
 import type { ActionInput } from '@interop/storage-core';
 export type { IZcap, IDelegatedZcap, ISigner };
-export type { Action, ActionInput, SpaceDescription, CollectionDescription, PolicyDocument, LinkSet, LinkSetEntry, CollectionSummary, CollectionsList, SpaceSummary, SpaceListing, ResourceSummary, CollectionResourcesList, ResourceMetadata, ResourceMetadataCustom, ImportStats, BackendReference, BackendDescriptor, BackendRegistration, BackendConnectionInput, BackendConnectionPublic, StorageLimit, CollectionUsage, BackendUsage, SpaceQuotaReport } from '@interop/storage-core';
+export type { Action, ActionInput, SpaceDescription, CollectionDescription, CollectionEncryption, PolicyDocument, LinkSet, LinkSetEntry, CollectionSummary, CollectionsList, SpaceSummary, SpaceListing, ResourceSummary, CollectionResourcesList, ResourceMetadata, ResourceMetadataCustom, ImportStats, BackendReference, BackendDescriptor, BackendRegistration, BackendConnectionInput, BackendConnectionPublic, StorageLimit, CollectionUsage, BackendUsage, SpaceQuotaReport } from '@interop/storage-core';
 /**
  * A JSON-serializable value, the shape stored for JSON resources and
  * descriptions.
@@ -41,6 +41,26 @@ export interface AddResult {
      */
     etag?: string;
 }
+/**
+ * A per-handle client-side encryption override -- the escape hatch / bootstrap
+ * path that takes precedence over the Collection's declared `encryption` marker
+ * AND skips the marker-discovery round-trip:
+ *
+ * - `{ scheme }` -- treat the collection as encrypted under `scheme`, pulling
+ *   keys from the client's keystore. Use right after `createCollection` (before
+ *   the marker is readable), or to avoid the `describe()` round-trip.
+ * - `{ scheme, keys }` -- additionally supply the key material inline (opaque to
+ *   core; the encryption provider interprets it per `scheme`) instead of the
+ *   keystore.
+ * - `'plaintext'` -- force plaintext even if a marker / keystore would encrypt.
+ *
+ * The non-`'plaintext'` forms require the `WasClient` to be constructed with an
+ * `encryption` provider (which turns a scheme + keys into a codec).
+ */
+export type EncryptionOverride = {
+    scheme: string;
+    keys?: unknown;
+} | 'plaintext';
 /**
  * Options accepted by every handle factory (`space()`, `collection()`,
  * `resource()`). A bound `capability` is attached to every request the handle
@@ -48,6 +68,11 @@ export interface AddResult {
  */
 export interface HandleOptions {
     capability?: IZcap;
+    /**
+     * Per-handle client-side encryption override (see {@link EncryptionOverride}).
+     * Omit to let the Collection's declared `encryption` marker decide.
+     */
+    encryption?: EncryptionOverride;
 }
 /**
  * Options for the general delegation primitive (`was.grant()`) and the

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAAA;AAM9C,YAAY,EACV,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;AAC5D,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AACD,MAAM,MAAM,SAAS,GAAG,IAAI,EAAE,CAAA;AAC9B,MAAM,MAAM,IAAI,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAA;AAEzD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,IAAI,GAAG,UAAU,CAAA;IACxB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAE3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,CAAA;AAM9C,YAAY,EACV,MAAM,EACN,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EACjB,MAAM,uBAAuB,CAAA;AAE9B;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;AAC5D,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CACpB;AACD,MAAM,MAAM,SAAS,GAAG,IAAI,EAAE,CAAA;AAC9B,MAAM,MAAM,IAAI,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAA;AAEzD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAClC,WAAW,CAAA;AAEf;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,CAAC,EAAE,KAAK,CAAA;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;CAChC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,IAAI,GAAG,UAAU,CAAA;IACxB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/was-client",
   "description": "A developer-friendly client for Wallet Attached Storage (WAS) servers.",
-  "version": "0.8.0",
+  "version": "0.9.1",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -47,7 +47,7 @@
     "@interop/edv-client": "^17.2.0",
     "@interop/ezcap": "^7.3.0",
     "@interop/http-client": "^1.0.3",
-    "@interop/storage-core": "^0.2.5"
+    "@interop/storage-core": "^0.3.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",