@interop/was-client 0.96.0 → 0.97.1

package/dist/WasClient.js

@@ -1,4 +1,4 @@
-import { collectionItemsUrl, parseSpaceTarget } from './internal/paths.js';
+import { baseUrlOfSpacesUrl, collectionItemsUrl, parseSpaceTarget, spacesUrl } from './internal/paths.js';
 import { send, rawRequest, unsignedRequest } from './internal/request.js';
 import { createdId, parseResource, readJsonData } from './internal/content.js';
 import { buildPageWalk, collectPages, collectWalk, signedPageWalk, walkItems, walkPagesOrEmpty } from './internal/pagination.js';
@@ -6,19 +6,36 @@ import { delegateGrant } from './internal/grant.js';
 import { spaceIdOf, submitRevocation } from './internal/revoke.js';
 import { Memo } from './internal/memo.js';
 import { discoverService, selectServiceVersion } from './internal/service.js';
-import { NotSupportedError, ValidationError, WasServerError } from './errors.js';
+import { IncompatibleServerError, NotSupportedError, ValidationError, WasServerError } from './errors.js';
 import { zcapClientForSigner } from './zcapClient.js';
 import { Space } from './Space.js';
 import { Collection } from './Collection.js';
 import { Resource } from './Resource.js';
 export class WasClient {
+    /**
+     * The server's Spaces Repository URL, in canonical trailing-slash form
+     * (`https://host/spaces/`). Service discovery starts here.
+     */
     serverUrl;
+    /**
+     * The server base URL every Space path hangs off, without a trailing slash:
+     * the parent of {@link serverUrl} (`https://host`, or `https://host/was` on
+     * a sub-path mount). Zcap `invocationTarget`s are built beneath it.
+     */
+    baseUrl;
     zcapClient;
     encryption;
     /**
      * @param options {object}
-     * @param options.serverUrl {string}    base URL for both URL building and
-     *   zcap `invocationTarget`s
+     * @param options.serverUrl {string}    the server's Spaces Repository URL
+     *   (`https://host/spaces/`, or `https://host/was/spaces/` on a sub-path
+     *   mount). The base URL for Space paths and zcap `invocationTarget`s is
+     *   its parent. Service discovery starts from this URL rather than from the
+     *   base, which is often a landing page with no `service` link. The value
+     *   is normalized to canonical form; `baseUrlOfSpacesUrl` in `./paths`
+     *   states what is accepted. The client is built from this URL only: a
+     *   server with no Spaces Repository (the spec leaves the endpoint
+     *   optional) has no URL this constructor accepts and is not supported.
      * @param options.zcapClient {ZcapClient}   an ezcap client holding the signer
      * @param [options.encryption] {EncryptionProvider}   the keystore that
      *   supplies keys for collections declared encrypted (by their `encryption`
@@ -31,11 +48,20 @@ export class WasClient {
      *   description the caller already holds (from a cache, say). The client
      *   selects its version from this copy instead of discovering the document
      *   from `serverUrl`, and still refuses it with `IncompatibleServerError` if
-     *   it names no version this client speaks. `service({ refresh: true })`
-     *   discards it and discovers afresh.
+     *   it names no version this client speaks or advertises a Spaces Repository
+     *   other than `serverUrl`. `service({ refresh: true })` discards it and
+     *   discovers afresh.
+     * @throws {ValidationError}   when `serverUrl` is not a Spaces Repository URL
      */
     constructor({ serverUrl, zcapClient, encryption, serviceDescription }) {
-        this.serverUrl = serverUrl;
+        const baseUrl = baseUrlOfSpacesUrl(serverUrl);
+        if (baseUrl === null) {
+            throw new ValidationError(`serverUrl "${serverUrl}" is not a Spaces Repository URL. Pass the ` +
+                "server's `/spaces/` URL as an absolute URL, for example " +
+                '"https://host/spaces/".');
+        }
+        this.serverUrl = spacesUrl({ baseUrl });
+        this.baseUrl = baseUrl;
         this.zcapClient = zcapClient;
         this.encryption = encryption;
         this.#serviceDescription = serviceDescription;
@@ -79,16 +105,36 @@ export class WasClient {
         return signer.id.split('#')[0];
     }
     #serviceDescription;
-    #service = new Memo(async () => this.#serviceDescription === undefined
-        ? discoverService({ url: this.serverUrl })
-        : selectServiceVersion(this.#serviceDescription));
+    #service = new Memo(async () => {
+        const info = this.#serviceDescription === undefined
+            ? await discoverService({ url: this.serverUrl })
+            : selectServiceVersion(this.#serviceDescription);
+        // Every Space path is built beneath the parent of `serverUrl`, so a server
+        // that advertises its Spaces Repository elsewhere would be addressed at
+        // the wrong mount. Refuse it by name rather than misroute. Both sides are
+        // compared in canonical base-URL form, so an advertised value that differs
+        // only in serialization (host case, default port, trailing slash) passes.
+        if (info.spacesUrl !== undefined) {
+            const advertisedBase = baseUrlOfSpacesUrl(info.spacesUrl);
+            if (advertisedBase !== this.baseUrl) {
+                const why = advertisedBase === null
+                    ? `which is not a Spaces Repository URL (an absolute http(s) ` +
+                        `URL ending in a "spaces" segment, with no query or fragment).`
+                    : `but this client was given "${this.serverUrl}".`;
+                throw new IncompatibleServerError(`The server advertises its Spaces Repository at ` +
+                    `"${info.spacesUrl}", ${why}`, { requestUrl: this.serverUrl });
+            }
+        }
+        return info;
+    });
     /**
      * Discovers the server's service description and the WAS version this
      * client speaks with it. Follows the `rel="service"` link on the response to
-     * an unsigned `HEAD` of `serverUrl`, then reads the linked document with an
-     * unsigned `GET`. No capability is invoked. The result is memoized for the
-     * life of the client and shared by every handle; concurrent callers share
-     * one discovery, and a failure is not memoized, so the next call retries.
+     * an unsigned `HEAD` of `serverUrl` (the Spaces Repository URL), then reads
+     * the linked document with an unsigned `GET`. No capability is invoked. The
+     * result is memoized for the life of the client and shared by every handle;
+     * concurrent callers share one discovery, and a failure is not memoized, so
+     * the next call retries.
      *
      * Every signed request waits on this discovery, so a caller rarely needs to
      * call it first. It is the way to read the server-wide affordances:
@@ -105,8 +151,9 @@ export class WasClient {
      *   advertising
      * @returns {Promise<ServiceInfo>}
      * @throws {IncompatibleServerError}   when the server's responses carry no
-     *   `service` link (it predates v0.5), the document is malformed, or it
-     *   lists no version this client speaks
+     *   `service` link (it predates v0.5), the document is malformed, it lists
+     *   no version this client speaks, or it advertises a Spaces Repository URL
+     *   other than `serverUrl`
      */
     async service(options = {}) {
         if (options.refresh) {
@@ -116,30 +163,31 @@ export class WasClient {
         return this.#service.get();
     }
     /**
-     * The Spaces Repository URL from the service description.
+     * Waits for discovery and refuses a server whose service description has no
+     * Spaces Repository. Discovery has already checked that an advertised
+     * `spaces` URL names `serverUrl`, so callers address `serverUrl` directly.
      *
-     * @returns {Promise<string>}
+     * @returns {Promise<void>}
      * @throws {NotSupportedError}   when the server does not implement the
      *   Spaces Repository
      */
-    async #spacesUrl() {
+    async #assertSpacesRepository() {
         const { spacesUrl, version } = await this.service();
         if (spacesUrl === undefined) {
-            throw new NotSupportedError(`The server at "${this.serverUrl}" does not implement the Spaces ` +
+            throw new NotSupportedError(`The server at "${this.baseUrl}" does not implement the Spaces ` +
                 `Repository: its WAS ${version} service description entry has no ` +
                 '`spaces` URL.');
         }
-        return spacesUrl;
     }
     #cachedContext;
     get #context() {
-        // `serverUrl`, `zcapClient` and `encryption` are all constructor-fixed, so
+        // `baseUrl`, `zcapClient` and `encryption` are all constructor-fixed, so
         // the context is derived once and reused rather than reallocating the
         // object on every handle access.
         if (this.#cachedContext === undefined) {
             const readControllerDid = () => this.controllerDid;
             this.#cachedContext = {
-                serverUrl: this.serverUrl,
+                baseUrl: this.baseUrl,
                 zcapClient: this.zcapClient,
                 // Read lazily, so building a handle costs nothing and a
                 // delegation-only client (a `ZcapClient` with a delegation signer and
@@ -200,8 +248,9 @@ export class WasClient {
             ...(desc.name !== undefined && { name: desc.name }),
             ...(desc.type !== undefined && { type: desc.type })
         };
+        await this.#assertSpacesRepository();
         const response = await send(this.#context, {
-            url: await this.#spacesUrl(),
+            url: this.serverUrl,
             method: 'POST',
             json: body
         });
@@ -229,9 +278,9 @@ export class WasClient {
      * @throws {NotSupportedError}   when the server has no Spaces Repository
      */
     async listSpaces() {
-        const spacesUrl = await this.#spacesUrl();
+        await this.#assertSpacesRepository();
         const walk = await signedPageWalk(this.#context, {
-            firstUrl: spacesUrl
+            firstUrl: this.serverUrl
         });
         // The first page always carries the listing body (an unauthorized caller
         // still gets an empty `items` list, not an error), so a `null` walk is a
@@ -239,7 +288,7 @@ export class WasClient {
         // body did not parse as JSON. Report it as one, rather than as a
         // `TypeError` from destructuring `null`.
         if (walk === null) {
-            throw new WasServerError(`The space listing at "${spacesUrl}" answered with no JSON body.`);
+            throw new WasServerError(`The space listing at "${this.serverUrl}" answered with no JSON body.`);
         }
         const listing = await collectPages(walk);
         // A paginating server omits `totalItems` on truncated pages; the walk has
@@ -353,8 +402,8 @@ export class WasClient {
         catch (err) {
             throw new ValidationError(`invocationTarget "${target}" is not a valid absolute URL.`, { cause: err });
         }
-        // `parseSpaceTarget` owns the path grammar: it strips `serverUrl`'s base
-        // path first (so a WAS mounted under a sub-path -- `https://host/was/` --
+        // `parseSpaceTarget` owns the path grammar: it strips `baseUrl`'s path
+        // first (so a WAS mounted under a sub-path -- `https://host/was/` --
         // classifies just as a bare-origin deployment does, which `parseSpacePath`
         // alone cannot) and percent-decodes each segment, since the path builders
         // re-encode every id. Classifying the full segment list -- rather than
@@ -362,10 +411,10 @@ export class WasClient {
         // (`/space/s/policy`, `/space/s/c/r/meta`, ...) from being silently
         // truncated to the nearest containment handle, whose derived URLs would
         // mismatch the capability's invocation target.
-        const parsed = parseSpaceTarget({ serverUrl: this.serverUrl, target });
+        const parsed = parseSpaceTarget({ baseUrl: this.baseUrl, target });
         if (parsed === null) {
             throw new ValidationError(`Cannot derive a handle from invocationTarget "${target}": it does ` +
-                `not address a resource on "${this.serverUrl}".`);
+                `not address a resource on "${this.baseUrl}".`);
         }
         if (parsed.kind === 'sub-resource') {
             throw new ValidationError(`invocationTarget "${target}" addresses a reserved ` +
@@ -428,7 +477,7 @@ export class WasClient {
     }
     /**
      * The signed escape hatch, mirroring ezcap's generic `request()`. Resolves
-     * `path` against `serverUrl`, defaults `action` to `method`, and signs via the
+     * `path` against `baseUrl`, defaults `action` to `method`, and signs via the
      * wrapped client. Returns the raw `HttpResponse` and throws raw ky/ezcap
      * errors -- it does not apply the null-on-404 or typed-error conveniences.
      * Like every signed request it waits on {@link service} first, and rejects

package/dist/WasClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"WasClient.js","sourceRoot":"","sources":["../src/WasClient.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAE1E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,WAAW,EACX,cAAc,EACd,SAAS,EACT,gBAAgB,EACjB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAexC,MAAM,OAAO,SAAS;IACX,SAAS,CAAQ;IACjB,UAAU,CAAY;IACtB,UAAU,CAAqB;IAExC;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,kBAAkB,EAMnB;QACC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,mBAAmB,GAAG,kBAAkB,CAAA;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,SAAS,EACT,MAAM,EACN,UAAU,EACV,kBAAkB,EAMnB;QACC,OAAO,IAAI,SAAS,CAAC;YACnB,SAAS;YACT,UAAU,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3C,UAAU;YACV,kBAAkB;SACnB,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,IAAI,aAAa;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CACvB,oDAAoD,CACrD,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAA;IAC1C,CAAC;IAED,mBAAmB,CAAqB;IAE/B,QAAQ,GAAG,IAAI,IAAI,CAAc,KAAK,IAAI,EAAE,CACnD,IAAI,CAAC,mBAAmB,KAAK,SAAS;QACpC,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1C,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CACnD,CAAA;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,OAAO,CAAC,UAAiC,EAAE;QAC/C,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAA;YACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;QACvB,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAA;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,IAAI,CAAC,SAAS,kCAAkC;gBAChE,uBAAuB,OAAO,oCAAoC;gBAClE,eAAe,CAClB,CAAA;QACH,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,cAAc,CAAgB;IAE9B,IAAI,QAAQ;QACV,2EAA2E;QAC3E,sEAAsE;QACtE,iCAAiC;QACjC,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAA;YAClD,IAAI,CAAC,cAAc,GAAG;gBACpB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,wDAAwD;gBACxD,sEAAsE;gBACtE,+DAA+D;gBAC/D,4DAA4D;gBAC5D,kEAAkE;gBAClE,IAAI,aAAa;oBACf,OAAO,iBAAiB,EAAE,CAAA;gBAC5B,CAAC;gBACD,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;aAC9B,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,OAAe,EAAE,UAAyB,EAAE;QAChD,OAAO,IAAI,KAAK,CAAC;YACf,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,WAAW,CACf,OAKI,EAAE;QAEN,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAA;QACxD,MAAM,IAAI,GAAG;YACX,UAAU;YACV,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SACpD,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,GAAG,EAAE,MAAM,IAAI,CAAC,UAAU,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAA;QACzC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAe,IAAI,CAAC,QAAQ,EAAE;YAC7D,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAA;QACF,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,iEAAiE;QACjE,yCAAyC;QACzC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CACtB,yBAAyB,SAAS,+BAA+B,CAClE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QACxC,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAA;QACzC,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,EACf,WAAW,EAGZ;QACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;YACrC,GAAG,EAAE,WAAW;YAChB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,OAAO,aAAa,CAAC;YACnB,mEAAmE;YACnE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,CAAC;YAC3C,SAAS,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;gBACzB,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC;oBACzC,GAAG,EAAE,OAAO;oBACZ,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,IAAI;iBACX,CAAC,CAAA;gBACF,kEAAkE;gBAClE,wDAAwD;gBACxD,OAAO,YAAY,KAAK,IAAI;oBAC1B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAE,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAA6B,CAAA;YACrE,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,oBAAoB,CAAC,EACzB,aAAa,EAGd;QACC,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAC/B,aAAa,EAGd;QACC,KAAK,CAAC,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAA;IACpE,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAC/B,aAAa,EAGd;QACC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;IACrE,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,IAAW;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAA;QACpC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,gCAAgC,EAC3D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;QACtE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,iDAAiD,MAAM,aAAa;gBAClE,8BAA8B,IAAI,CAAC,SAAS,IAAI,CACnD,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,yBAAyB;gBAClD,oEAAoE;gBACpE,oDAAoD;gBACpD,8DAA8D,CACjE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,QAAQ,CAAC;gBAClB,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,IAAI,UAAU,CAAC;gBACpB,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,MAAM,CAAC,IAAoB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,OAAO,gBAAgB,CAAC,OAAO,EAAE;YAC/B,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;YACjC,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;CACF"}
+{"version":3,"file":"WasClient.js","sourceRoot":"","sources":["../src/WasClient.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,SAAS,EACV,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,WAAW,EACX,cAAc,EACd,SAAS,EACT,gBAAgB,EACjB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAexC,MAAM,OAAO,SAAS;IACpB;;;OAGG;IACM,SAAS,CAAQ;IAC1B;;;;OAIG;IACM,OAAO,CAAQ;IACf,UAAU,CAAY;IACtB,UAAU,CAAqB;IAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,YAAY,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,kBAAkB,EAMnB;QACC,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;QAC7C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,eAAe,CACvB,cAAc,SAAS,6CAA6C;gBAClE,0DAA0D;gBAC1D,yBAAyB,CAC5B,CAAA;QACH,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,mBAAmB,GAAG,kBAAkB,CAAA;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,SAAS,EACT,MAAM,EACN,UAAU,EACV,kBAAkB,EAMnB;QACC,OAAO,IAAI,SAAS,CAAC;YACnB,SAAS;YACT,UAAU,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3C,UAAU;YACV,kBAAkB;SACnB,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,IAAI,aAAa;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CACvB,oDAAoD,CACrD,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAA;IAC1C,CAAC;IAED,mBAAmB,CAAqB;IAE/B,QAAQ,GAAG,IAAI,IAAI,CAAc,KAAK,IAAI,EAAE;QACnD,MAAM,IAAI,GACR,IAAI,CAAC,mBAAmB,KAAK,SAAS;YACpC,CAAC,CAAC,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAChD,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;QACpD,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACzD,IAAI,cAAc,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACpC,MAAM,GAAG,GACP,cAAc,KAAK,IAAI;oBACrB,CAAC,CAAC,4DAA4D;wBAC5D,+DAA+D;oBACjE,CAAC,CAAC,8BAA8B,IAAI,CAAC,SAAS,IAAI,CAAA;gBACtD,MAAM,IAAI,uBAAuB,CAC/B,iDAAiD;oBAC/C,IAAI,IAAI,CAAC,SAAS,MAAM,GAAG,EAAE,EAC/B,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAC/B,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,OAAO,CAAC,UAAiC,EAAE;QAC/C,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAA;YACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;QACvB,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAA;IAC5B,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,uBAAuB;QAC3B,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,kBAAkB,IAAI,CAAC,OAAO,kCAAkC;gBAC9D,uBAAuB,OAAO,oCAAoC;gBAClE,eAAe,CAClB,CAAA;QACH,CAAC;IACH,CAAC;IAED,cAAc,CAAgB;IAE9B,IAAI,QAAQ;QACV,yEAAyE;QACzE,sEAAsE;QACtE,iCAAiC;QACjC,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAA;YAClD,IAAI,CAAC,cAAc,GAAG;gBACpB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,wDAAwD;gBACxD,sEAAsE;gBACtE,+DAA+D;gBAC/D,4DAA4D;gBAC5D,kEAAkE;gBAClE,IAAI,aAAa;oBACf,OAAO,iBAAiB,EAAE,CAAA;gBAC5B,CAAC;gBACD,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;aAC9B,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,OAAe,EAAE,UAAyB,EAAE;QAChD,OAAO,IAAI,KAAK,CAAC;YACf,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,WAAW,CACf,OAKI,EAAE;QAEN,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAA;QACxD,MAAM,IAAI,GAAG;YACX,UAAU;YACV,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SACpD,CAAA;QACD,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAA;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,GAAG,EAAE,IAAI,CAAC,SAAS;YACnB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAA;QACpC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAe,IAAI,CAAC,QAAQ,EAAE;YAC7D,QAAQ,EAAE,IAAI,CAAC,SAAS;SACzB,CAAC,CAAA;QACF,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,iEAAiE;QACjE,yCAAyC;QACzC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,cAAc,CACtB,yBAAyB,IAAI,CAAC,SAAS,+BAA+B,CACvE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;QACxC,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAA;QACzC,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,EACf,WAAW,EAGZ;QACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;YACrC,GAAG,EAAE,WAAW;YAChB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,OAAO,aAAa,CAAC;YACnB,mEAAmE;YACnE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,CAAC;YAC3C,SAAS,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;gBACzB,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC;oBACzC,GAAG,EAAE,OAAO;oBACZ,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,IAAI;iBACX,CAAC,CAAA;gBACF,kEAAkE;gBAClE,wDAAwD;gBACxD,OAAO,YAAY,KAAK,IAAI;oBAC1B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAE,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAA6B,CAAA;YACrE,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,oBAAoB,CAAC,EACzB,aAAa,EAGd;QACC,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAC/B,aAAa,EAGd;QACC,KAAK,CAAC,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAA;IACpE,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAC/B,aAAa,EAGd;QACC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;IACrE,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,IAAW;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAA;QACpC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,gCAAgC,EAC3D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;QACH,CAAC;QACD,uEAAuE;QACvE,qEAAqE;QACrE,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QAClE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,iDAAiD,MAAM,aAAa;gBAClE,8BAA8B,IAAI,CAAC,OAAO,IAAI,CACjD,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,yBAAyB;gBAClD,oEAAoE;gBACpE,oDAAoD;gBACpD,8DAA8D,CACjE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,QAAQ,CAAC;gBAClB,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,IAAI,UAAU,CAAC;gBACpB,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,MAAM,CAAC,IAAoB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,OAAO,gBAAgB,CAAC,OAAO,EAAE;YAC/B,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;YACjC,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;CACF"}

package/dist/edv/EdvCodec.d.ts

@@ -157,10 +157,13 @@ export declare class EdvCodec implements ResourceCodec {
      *
      * Opens the envelope exactly as {@link decode} does, with the same checks.
      * A chunked document's decrypt stream is handed back unbuffered, so its
-     * chunks are fetched and decrypted as the caller reads; a chunk that fails
-     * to fetch or verify then errors the stream rather than this call. An
-     * inline document is decoded as {@link decode} decodes it and presented as
-     * a one-value stream. `contentType` is the sealed plaintext type.
+     * chunks are fetched and decrypted as the caller reads. A chunk that fails
+     * to fetch or verify then errors the stream rather than this call, with
+     * `NotFoundError` or `EncryptionError`. A caller that buffers the stream
+     * should do so with `streamToBlob`, which keeps that error where
+     * `new Response(stream)` would not. An inline document is decoded as
+     * {@link decode} decodes it and presented as a one-value stream.
+     * `contentType` is the sealed plaintext type.
      *
      * @param response {ResponseLike}   the stored envelope
      * @param [expectedId] {string}   the resource id the read targeted

package/dist/edv/EdvCodec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EdvCodec.d.ts","sourceRoot":"","sources":["../../src/edv/EdvCodec.ts"],"names":[],"mappings":"AAuEA,OAAO,EAAE,aAAa,EAA0B,MAAM,0BAA0B,CAAA;AAChF,OAAO,KAAK,EACV,SAAS,EAGT,gBAAgB,EAChB,YAAY,EAEb,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAGV,aAAa,EACb,mBAAmB,EACnB,UAAU,EACV,aAAa,EAEb,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,EACb,MAAM,aAAa,CAAA;AAmBpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAMrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAS/C,OAAO,KAAK,EACV,oBAAoB,EACpB,IAAI,EACJ,YAAY,EACZ,sBAAsB,EACtB,2BAA2B,EAC5B,MAAM,aAAa,CAAA;AAOpB;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,QAAa,CAAA;AAWhD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,mBAAmB,CAAA;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACzC,KAAK,YAAY,CAAA;AAElB;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;CACnB,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAA;AA4GpC;;;;GAIG;AACH,qBAAa,QAAS,YAAW,aAAa;;IAC5C,QAAQ,CAAC,iBAAiB,QAAO;IAqFjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;gBACS,EACV,GAAG,EACH,eAAe,EACf,QAAQ,EACR,UAAU,EACV,WAAW,EACX,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,OAAO,EACP,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,IAAI,EACL,EAAE;QACD,GAAG,EAAE,aAAa,CAAA;QAClB,eAAe,EAAE,gBAAgB,CAAA;QACjC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;QAC5B,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,YAAY,EAAE,QAAQ,GAAG,SAAS,CAAA;QAClC,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;QACxC,YAAY,EAAE,MAAM,CAAA;QACpB,QAAQ,EAAE,MAAM,EAAE,CAAA;QAClB,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;KAC1B;IA2BD;;;;OAIG;IACH,IAAI,WAAW,IAAI,WAAW,GAAG,IAAI,CAEpC;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,aAAa,GAAG,SAAS,CAExC;IAgED;;OAEG;IACG,MAAM,CAAC,EACX,EAAE,EACF,IAAI,EACJ,WAAW,EACX,OAAO,EACP,YAAY,EACb,EAAE;QACD,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,YAAY,CAAA;QAClB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,CAAA;QAC7B,YAAY,CAAC,EAAE,iBAAiB,CAAA;KACjC,GAAG,OAAO,CAAC,UAAU,CAAC;IA+avB;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CACV,QAAQ,EAAE,YAAY,EACtB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,mBAAmB,EAC7B,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAmBvB;;;;;;;;;;;;;;;;;OAiBG;IACG,YAAY,CAChB,QAAQ,EAAE,YAAY,EACtB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,mBAAmB,EAC7B,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,aAAa,CAAC;IAwFzB;;;;;;;;;;;;;;;;OAgBG;IACG,aAAa,CACjB,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC;IA4dnB;;;;;;;;OAQG;IACG,UAAU,CAAC,EACf,MAAM,EACN,IAAI,EACL,EAAE;QACD,MAAM,EAAE,2BAA2B,CAAA;QACnC,IAAI,EAAE,aAAa,CAAA;KACpB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAwC9C;;;;;;;;;;;;;OAaG;IACG,UAAU,CACd,EACE,MAAM,EACP,EAAE;QACD,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,EACD,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,sBAAsB,CAAC;CAuPnC;AAmMD;;GAEG;AACH,eAAO,MAAM,UAAU,QAAQ,CAAA;AAE/B;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,WAAW,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,aAAa,CAAC,EAClC,YAAY,EACZ,KAA2B,EAC3B,gBAAgB,EAChB,UAAU,EACV,IAAI,EACJ,YAAY,EACZ,WAAkC,EAClC,YAAqC,EACrC,SAAS,EACV,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;IACxC,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC,IAAI,EAAE,OAAO,CAAA;IACb,YAAY,EAAE,QAAQ,GAAG,SAAS,CAAA;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwDpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,KAAK,EACL,UAAU,EACX,EAAE;IACD,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,oBAAoB,CAAA;CAClC,GAAG,oBAAoB,GAAG;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,WAAW,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAA;CACpD,CASA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,CAAC,EAAE,oBAAoB,GAChC,MAAM,GAAG,IAAI,CA4Bf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,YAAY,EACZ,YAAY,EACZ,UAAU,EACX,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,SAAS,GAAG,QAAQ,CAAA;IAClC,UAAU,EAAE,oBAAoB,CAAA;CACjC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2BpB"}
+{"version":3,"file":"EdvCodec.d.ts","sourceRoot":"","sources":["../../src/edv/EdvCodec.ts"],"names":[],"mappings":"AAuEA,OAAO,EAAE,aAAa,EAA0B,MAAM,0BAA0B,CAAA;AAChF,OAAO,KAAK,EACV,SAAS,EAGT,gBAAgB,EAChB,YAAY,EAEb,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAGV,aAAa,EACb,mBAAmB,EACnB,UAAU,EACV,aAAa,EAEb,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,EACb,MAAM,aAAa,CAAA;AAyBpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAMrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAS/C,OAAO,KAAK,EACV,oBAAoB,EACpB,IAAI,EACJ,YAAY,EACZ,sBAAsB,EACtB,2BAA2B,EAC5B,MAAM,aAAa,CAAA;AAOpB;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,QAAa,CAAA;AAWhD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,mBAAmB,CAAA;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACzC,KAAK,YAAY,CAAA;AAElB;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;CACnB,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAA;AA2HpC;;;;GAIG;AACH,qBAAa,QAAS,YAAW,aAAa;;IAC5C,QAAQ,CAAC,iBAAiB,QAAO;IAqFjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;gBACS,EACV,GAAG,EACH,eAAe,EACf,QAAQ,EACR,UAAU,EACV,WAAW,EACX,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,OAAO,EACP,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,IAAI,EACL,EAAE;QACD,GAAG,EAAE,aAAa,CAAA;QAClB,eAAe,EAAE,gBAAgB,CAAA;QACjC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;QAC5B,UAAU,EAAE,MAAM,CAAA;QAClB,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,YAAY,EAAE,QAAQ,GAAG,SAAS,CAAA;QAClC,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;QACxC,YAAY,EAAE,MAAM,CAAA;QACpB,QAAQ,EAAE,MAAM,EAAE,CAAA;QAClB,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;KAC1B;IA2BD;;;;OAIG;IACH,IAAI,WAAW,IAAI,WAAW,GAAG,IAAI,CAEpC;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,aAAa,GAAG,SAAS,CAExC;IAgED;;OAEG;IACG,MAAM,CAAC,EACX,EAAE,EACF,IAAI,EACJ,WAAW,EACX,OAAO,EACP,YAAY,EACb,EAAE;QACD,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,EAAE,YAAY,CAAA;QAClB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,YAAY,GAAG,IAAI,CAAA;QAC7B,YAAY,CAAC,EAAE,iBAAiB,CAAA;KACjC,GAAG,OAAO,CAAC,UAAU,CAAC;IA+avB;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CACV,QAAQ,EAAE,YAAY,EACtB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,mBAAmB,EAC7B,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAmBvB;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,YAAY,CAChB,QAAQ,EAAE,YAAY,EACtB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,mBAAmB,EAC7B,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,aAAa,CAAC;IAwFzB;;;;;;;;;;;;;;;;OAgBG;IACG,aAAa,CACjB,QAAQ,EAAE,YAAY,EACtB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC;IAqenB;;;;;;;;OAQG;IACG,UAAU,CAAC,EACf,MAAM,EACN,IAAI,EACL,EAAE;QACD,MAAM,EAAE,2BAA2B,CAAA;QACnC,IAAI,EAAE,aAAa,CAAA;KACpB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAwC9C;;;;;;;;;;;;;OAaG;IACG,UAAU,CACd,EACE,MAAM,EACP,EAAE;QACD,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,EACD,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,sBAAsB,CAAC;CA2PnC;AAqOD;;GAEG;AACH,eAAO,MAAM,UAAU,QAAQ,CAAA;AAE/B;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,WAAW,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,aAAa,CAAC,EAClC,YAAY,EACZ,KAA2B,EAC3B,gBAAgB,EAChB,UAAU,EACV,IAAI,EACJ,YAAY,EACZ,WAAkC,EAClC,YAAqC,EACrC,SAAS,EACV,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,gBAAgB,CAAC,EAAE,qBAAqB,CAAA;IACxC,UAAU,CAAC,EAAE,oBAAoB,CAAA;IACjC,IAAI,EAAE,OAAO,CAAA;IACb,YAAY,EAAE,QAAQ,GAAG,SAAS,CAAA;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwDpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,KAAK,EACL,UAAU,EACX,EAAE;IACD,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,oBAAoB,CAAA;CAClC,GAAG,oBAAoB,GAAG;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,WAAW,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAA;CACpD,CASA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,CAAC,EAAE,oBAAoB,GAChC,MAAM,GAAG,IAAI,CA4Bf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,YAAY,EACZ,YAAY,EACZ,UAAU,EACX,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,SAAS,GAAG,QAAQ,CAAA;IAClC,UAAU,EAAE,oBAAoB,CAAA;CACjC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA2BpB"}

package/dist/edv/EdvCodec.js

@@ -71,8 +71,8 @@
 import { base64, base64urlnopad } from '@scure/base';
 import { EdvClientCore, Transport, assertDocId } from '@interop/edv-client/core';
 import { EMPTY_INDEX_SCHEMA, assertQueryAttributes } from '../internal/indexSchema.js';
-import { ConflictError, EncryptionError, IntegrityError, KeyUnwrapError, NotFoundError, NotSupportedError, PreconditionFailedError, QuotaExceededError, UnknownEpochError, ValidationError } from '../errors.js';
-import { blobBytes, bytesToStream } from '../internal/blob.js';
+import { ConflictError, EncryptionError, IntegrityError, KeyUnwrapError, NotFoundError, NotSupportedError, PreconditionFailedError, QuotaExceededError, UnknownEpochError, ValidationError, WasError } from '../errors.js';
+import { blobBytes, bytesToBlob, bytesToStream, streamToBlob } from '../internal/blob.js';
 import { readEtag, writeHeaders } from '../internal/conditional.js';
 import { isEncryptedEnvelope } from '../sync/envelope.js';
 import { epochWriteStandIn, resolveEpochKeys } from './epochKeys.js';
@@ -141,22 +141,18 @@ function wasParam({ version, resource, collection, epoch }) {
  * Whether a decrypt error means "this candidate key does not open the envelope"
  * (so the loop should try the next key) rather than an integrity failure. True
  * for the upstream typed key-miss error -- `@interop/minimal-cipher` /
- * `@interop/edv-client` raise a `KeyMissError` (the null-CEK unwrap path and the
- * kid-mismatch path) when a candidate key is simply the wrong or a rotated key,
- * not a corrupted envelope. It is matched by `err.name === 'KeyMissError'`
- * rather than `instanceof`: name-dispatch survives pnpm installing two copies of
- * the cipher package (a second copy's `KeyMissError` is a distinct class but
- * carries the same `name`), so was-client need not import the class at all.
+ * `@interop/edv-client` raise a `KeyMissError` when a candidate key is simply
+ * the wrong or a rotated key, not a corrupted envelope. It is matched by
+ * `err.name === 'KeyMissError'` rather than `instanceof`: name-dispatch
+ * survives pnpm installing two copies of the cipher package (a second copy's
+ * `KeyMissError` is a distinct class but carries the same `name`), so
+ * was-client need not import the class at all.
  *
  * Also true for a {@link KeyUnwrapError} raised by a candidate itself -- a lazy
  * epoch key whose recipient entry turned out corrupt when its first decrypt
  * forced the unwrap (see `lazyEpochKey`): that says nothing about the stored
  * envelope, so the loop must move on to the next candidate rather than report
- * tampering. Every other error means the key DID select a recipient and unwrap,
- * but the content's AEAD tag did not verify -- a data-integrity failure
- * (WebCrypto's `OperationError` in browsers, Node's "unable to authenticate
- * data") -- which must surface as an {@link IntegrityError}, not be masked as a
- * key miss.
+ * tampering.
  *
  * @param err {unknown}
  * @returns {boolean}
@@ -165,6 +161,24 @@ function isKeyMiss(err) {
     return (err instanceof KeyUnwrapError ||
         (err instanceof Error && err.name === 'KeyMissError'));
 }
+/**
+ * Whether a decrypt error means the key DID select a recipient and unwrap the
+ * content key, but the content's AEAD tag did not verify: the stored
+ * ciphertext is corrupt or has been tampered with. `@interop/minimal-cipher`
+ * raises its `IntegrityError` for that (the runtime's raw error as `cause`),
+ * matched by `err.name` for the same reason {@link isKeyMiss} matches by name.
+ * Any other error is neither a key miss nor an integrity failure (a malformed
+ * envelope, a bug) and is not this library's to relabel.
+ *
+ * This library's own {@link IntegrityError} carries the same name, so a
+ * caller that may see both excludes `WasError` first.
+ *
+ * @param err {unknown}
+ * @returns {boolean}
+ */
+function isIntegrityFailure(err) {
+    return err instanceof Error && err.name === 'IntegrityError';
+}
 /**
  * Extracts the JWE recipient key ids (`kid`) a stored envelope names (an epoch
  * envelope carries one kid: the epoch key id). Returns `[]` for a malformed
@@ -814,17 +828,20 @@ export class EdvCodec {
                 ...(contentType !== undefined && { type: contentType })
             });
         }
-        return this.#fromDocument(opened.content, opened.meta);
+        return await this.#fromDocument(opened.content, opened.meta);
     }
     /**
      * @inheritdoc
      *
      * Opens the envelope exactly as {@link decode} does, with the same checks.
      * A chunked document's decrypt stream is handed back unbuffered, so its
-     * chunks are fetched and decrypted as the caller reads; a chunk that fails
-     * to fetch or verify then errors the stream rather than this call. An
-     * inline document is decoded as {@link decode} decodes it and presented as
-     * a one-value stream. `contentType` is the sealed plaintext type.
+     * chunks are fetched and decrypted as the caller reads. A chunk that fails
+     * to fetch or verify then errors the stream rather than this call, with
+     * `NotFoundError` or `EncryptionError`. A caller that buffers the stream
+     * should do so with `streamToBlob`, which keeps that error where
+     * `new Response(stream)` would not. An inline document is decoded as
+     * {@link decode} decodes it and presented as a one-value stream.
+     * `contentType` is the sealed plaintext type.
      *
      * @param response {ResponseLike}   the stored envelope
      * @param [expectedId] {string}   the resource id the read targeted
@@ -845,7 +862,7 @@ export class EdvCodec {
             return this.#chunkedStream(opened.read);
         }
         return decodedStream({
-            value: this.#fromDocument(opened.content, opened.meta),
+            value: await this.#fromDocument(opened.content, opened.meta),
             contentType: sealedContentType(opened.meta)
         });
     }
@@ -943,7 +960,11 @@ export class EdvCodec {
      * document envelope. Each chunk must also carry the envelope's own `was`
      * binding in its protected header (the writer seals it into every chunk),
      * so a genuine chunk of another resource, or one sealed under another
-     * epoch, is refused with {@link EncryptionError} before it is decrypted.
+     * epoch, is refused with {@link EncryptionError} before it is decrypted. A
+     * chunk that fails its own AEAD check (tampered ciphertext), or whose
+     * content key this reader's key does not unwrap, errors the stream with
+     * {@link EncryptionError} too, wrapping the cipher's named error, so the
+     * stream keeps the fail-closed contract {@link decode} documents.
      *
      * @param options {object}
      * @param [options.id] {string}   the AEAD-bound resource id (= WAS resource
@@ -996,11 +1017,14 @@ export class EdvCodec {
             const network = this.#transportFor(context);
             fetchChunk = options => network.getChunk(options);
         }
-        const stream = (await this.#edv.getStream({
-            doc: { id, stream: { chunks } },
-            keyAgreementKey,
-            transport: new ChunkReadTransport({ fetchChunk, binding })
-        }));
+        const stream = chunkDecryptErrors({
+            id,
+            stream: (await this.#edv.getStream({
+                doc: { id, stream: { chunks } },
+                keyAgreementKey,
+                transport: new ChunkReadTransport({ fetchChunk, binding })
+            }))
+        });
         const contentType = sealedContentType(meta);
         return { stream, ...(contentType !== undefined && { contentType }) };
     }
@@ -1115,12 +1139,14 @@ export class EdvCodec {
                     // unwrap its content-encryption key; try the next candidate.
                     continue;
                 }
-                // The candidate DID select a recipient and unwrap the CEK, but the
-                // content's AEAD tag failed to authenticate: the stored ciphertext is
-                // corrupt or has been tampered with. Surface this immediately as an
-                // integrity failure rather than masking it as a membership/key miss by
-                // continuing into `rest` (a real key miss never reaches AEAD, so this
-                // can only be a genuine integrity failure on a key that matched).
+                if (!isIntegrityFailure(err)) {
+                    // Neither a key miss nor an AEAD failure: rethrow as is.
+                    throw err;
+                }
+                // Surface the AEAD failure immediately rather than masking it as a
+                // membership/key miss by continuing into `rest` (a real key miss never
+                // reaches AEAD, so this is a genuine integrity failure on a key that
+                // matched).
                 throw new IntegrityError('Cannot decrypt this resource: its ciphertext failed to authenticate ' +
                     '(the AEAD integrity tag did not verify). This reader holds a key ' +
                     'that unwrapped the envelope, so this is not a key-epoch/membership ' +
@@ -1537,9 +1563,9 @@ export class EdvCodec {
      *
      * @param content {unknown}
      * @param [meta] {Record<string, unknown>}
-     * @returns {Json | Blob}
+     * @returns {Promise<Json | Blob>}
      */
-    #fromDocument(content, meta) {
+    async #fromDocument(content, meta) {
         const encoding = meta?.encoding;
         const contentType = sealedContentType(meta);
         if (encoding === 'utf-8') {
@@ -1558,8 +1584,9 @@ export class EdvCodec {
                 throw new EncryptionError('Malformed encrypted binary document: meta.encoding is "base64" but ' +
                     'content.bytes is not a string.');
             }
-            return new Blob([base64.decode(base64Text)], {
-                type: contentType
+            return await bytesToBlob({
+                parts: [base64.decode(base64Text)],
+                ...(contentType !== undefined && { type: contentType })
             });
         }
         if (encoding !== undefined) {
@@ -1582,17 +1609,49 @@ function sealedContentType(meta) {
     return typeof meta?.contentType === 'string' ? meta.contentType : undefined;
 }
 /**
- * Drains a byte stream into one `Blob` of the given type. `Blob` does the
- * concatenation: its parts are the chunks the stream yielded, in order.
+ * The chunked decrypt stream of resource `id`, with the cipher's integrity
+ * failure (see {@link isIntegrityFailure}) or key miss (see {@link isKeyMiss})
+ * replaced by an {@link EncryptionError} that carries the original as `cause`.
+ * Every other error passes through as it is, this library's own typed errors
+ * included (a chunk source or lazy epoch key may raise one that the two
+ * predicates would match by name). Cancellation is forwarded.
  *
  * @param options {object}
+ * @param options.id {string}   the resource id, for the error message
  * @param options.stream {ReadableStream<Uint8Array>}
- * @param [options.type] {string}   the blob's content type
- * @returns {Promise<Blob>}
+ * @returns {ReadableStream<Uint8Array>}
  */
-async function streamToBlob({ stream, type }) {
-    const bytes = await new Response(stream).arrayBuffer();
-    return new Blob([bytes], type !== undefined ? { type } : undefined);
+function chunkDecryptErrors({ id, stream }) {
+    const reader = stream.getReader();
+    return new ReadableStream({
+        async pull(controller) {
+            let result;
+            try {
+                result = await reader.read();
+            }
+            catch (err) {
+                if (err instanceof WasError) {
+                    // Already one of this library's errors: not the cipher's.
+                    throw err;
+                }
+                if (!isIntegrityFailure(err) && !isKeyMiss(err)) {
+                    // Neither tampering nor a key the reader lacks: rethrow as is.
+                    throw err;
+                }
+                throw new EncryptionError(`Cannot read this resource: a chunk of resource "${id}" failed to ` +
+                    'decrypt. It was tampered with in storage or in transit, or ' +
+                    'was sealed under a key this reader does not hold.', { cause: err });
+            }
+            if (result.done) {
+                controller.close();
+                return;
+            }
+            controller.enqueue(result.value);
+        },
+        async cancel(reason) {
+            await reader.cancel(reason);
+        }
+    });
 }
 /**
  * The edv-client `Transport` a chunked read runs on. It serves only