@interop/was-react 0.1.8 → 0.1.10

package/dist/storage/storageManager.d.ts

@@ -1,4 +1,5 @@
 import type { LocalStore } from './localStore.js';
+import type { WasRemoteStore } from './wasRemoteStore.js';
 /**
  * Installs the opened store (called once by the app bootstrap).
  *
@@ -24,6 +25,33 @@ export declare function hasStore(): boolean;
  * @returns {void}
  */
 export declare function clearLocalStore(): void;
+/**
+ * Installs the per-session delegated remote store (set once background sync
+ * has bootstrapped it from the granted zcaps).
+ *
+ * @param store {WasRemoteStore}
+ * @returns {void}
+ */
+export declare function setRemoteStore(store: WasRemoteStore): void;
+/**
+ * The connected session's remote store, or throws while no wallet-connected
+ * session is active (local-only mode, or sync has not bootstrapped yet).
+ *
+ * @returns {WasRemoteStore}
+ */
+export declare function requireRemoteStore(): WasRemoteStore;
+/**
+ * Whether a connected session's remote store is available.
+ *
+ * @returns {boolean}
+ */
+export declare function hasRemoteStore(): boolean;
+/**
+ * Releases the held remote store reference (logout / sync teardown).
+ *
+ * @returns {void}
+ */
+export declare function clearRemoteStore(): void;
 /**
  * A stable per-install device id (the last-write-wins tiebreak stamped into
  * every payload), persisted in localStorage under `<prefix>deviceId`.

package/dist/storage/storageManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storageManager.d.ts","sourceRoot":"","sources":["../../src/storage/storageManager.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAIjD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAErD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,UAAU,CAKzC;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,IAAI,OAAO,CAElC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,EAC1B,gBAA6C,EAC9C,GAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAQ7C"}
+{"version":3,"file":"storageManager.d.ts","sourceRoot":"","sources":["../../src/storage/storageManager.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAKzD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAErD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,UAAU,CAKzC;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,IAAI,OAAO,CAElC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,cAAc,CAOnD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,EAC1B,gBAA6C,EAC9C,GAAE;IAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,CAQ7C"}

package/dist/storage/storageManager.js

@@ -3,14 +3,16 @@
  */
 /**
  * The storage manager: a thin process-wide holder for the one {@link LocalStore}
- * instance plus the per-install device id. Entity stores reach for the store
- * through {@link requireStore} inside their CRUD actions rather than importing it
+ * instance, the per-session {@link WasRemoteStore}, plus the per-install device
+ * id. Entity stores reach for the stores through {@link requireStore} /
+ * {@link requireRemoteStore} inside their verbs rather than importing them
  * directly, which keeps this module free of store imports (no cycle) and lets
  * the app own the init/hydrate ordering.
  */
 import { uuidv7 } from 'uuidv7';
 import { DEFAULT_STORAGE_KEY_PREFIX } from '../config.js';
 let localStore = null;
+let remoteStore = null;
 /**
  * Installs the opened store (called once by the app bootstrap).
  *
@@ -47,6 +49,44 @@ export function hasStore() {
 export function clearLocalStore() {
     localStore = null;
 }
+/**
+ * Installs the per-session delegated remote store (set once background sync
+ * has bootstrapped it from the granted zcaps).
+ *
+ * @param store {WasRemoteStore}
+ * @returns {void}
+ */
+export function setRemoteStore(store) {
+    remoteStore = store;
+}
+/**
+ * The connected session's remote store, or throws while no wallet-connected
+ * session is active (local-only mode, or sync has not bootstrapped yet).
+ *
+ * @returns {WasRemoteStore}
+ */
+export function requireRemoteStore() {
+    if (!remoteStore) {
+        throw new Error('No WAS remote store is available; connect a wallet session first.');
+    }
+    return remoteStore;
+}
+/**
+ * Whether a connected session's remote store is available.
+ *
+ * @returns {boolean}
+ */
+export function hasRemoteStore() {
+    return remoteStore !== null;
+}
+/**
+ * Releases the held remote store reference (logout / sync teardown).
+ *
+ * @returns {void}
+ */
+export function clearRemoteStore() {
+    remoteStore = null;
+}
 /**
  * A stable per-install device id (the last-write-wins tiebreak stamped into
  * every payload), persisted in localStorage under `<prefix>deviceId`.

package/dist/storage/storageManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"storageManager.js","sourceRoot":"","sources":["../../src/storage/storageManager.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAGzD,IAAI,UAAU,GAAsB,IAAI,CAAA;AAExC;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,UAAU,GAAG,KAAK,CAAA;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ;IACtB,OAAO,UAAU,KAAK,IAAI,CAAA;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,UAAU,GAAG,IAAI,CAAA;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,gBAAgB,GAAG,0BAA0B,KACZ,EAAE;IACnC,MAAM,WAAW,GAAG,GAAG,gBAAgB,UAAU,CAAA;IACjD,IAAI,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,MAAM,EAAE,CAAA;QACb,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC"}
+{"version":3,"file":"storageManager.js","sourceRoot":"","sources":["../../src/storage/storageManager.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAIzD,IAAI,UAAU,GAAsB,IAAI,CAAA;AACxC,IAAI,WAAW,GAA0B,IAAI,CAAA;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,UAAU,GAAG,KAAK,CAAA;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ;IACtB,OAAO,UAAU,KAAK,IAAI,CAAA;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,UAAU,GAAG,IAAI,CAAA;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAAqB;IAClD,WAAW,GAAG,KAAK,CAAA;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAA;IACH,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,KAAK,IAAI,CAAA;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,WAAW,GAAG,IAAI,CAAA;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,gBAAgB,GAAG,0BAA0B,KACZ,EAAE;IACnC,MAAM,WAAW,GAAG,GAAG,gBAAgB,UAAU,CAAA;IACjD,IAAI,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,MAAM,EAAE,CAAA;QACb,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC"}

package/dist/storage/wasRemoteStore.d.ts

@@ -15,11 +15,18 @@
  * - a best-effort encryption-marker PUT (whether a delegated collection-scoped
  *   RW zcap authorizes writing the collection description). It is non-fatal
  *   either way -- envelopes replicate into an unmarked (plaintext) collection
- *   just the same.
+ *   just the same. A PUBLIC collection is never marked: public implies
+ *   plaintext, so the marker PUT is skipped outright;
+ * - the sibling best-effort `indexes` declaration PUT for public collections
+ *   that declare equality-indexed attributes, plus the equality query verb
+ *   itself ({@link WasRemoteStore.queryCollectionByEquality}): the canonical
+ *   sorted `filter[attr]=value` GET on the collection list endpoint, parsed
+ *   into the `{ documents, hasMore, cursor? }` page shape.
  */
 import type { ZcapClient } from '@interop/ezcap';
 import type { IZcap } from '@interop/data-integrity-core';
 import { WasClient } from '@interop/was-client';
+import type { WasCollectionConfig } from '../config.js';
 import type { ParsedGrants } from '../grants.js';
 /**
  * The outcome of a best-effort encryption-marker PUT, for diagnostics.
@@ -29,12 +36,34 @@ export interface MarkerResult {
     ok: boolean;
     status?: number;
     error?: string;
+    /**
+     * True when no PUT was attempted because the collection is public
+     * (plaintext); reported as `ok` since the goal state -- no marker -- holds.
+     */
+    skipped?: boolean;
+}
+/**
+ * One page of equality-query results: the shared shape of the GET
+ * `filter[attr]=value` filter and the POST `equality` query profile. `data` is
+ * the stored JSON content (absent for a blob resource); `custom` is the
+ * resource's custom metadata object, present when it has one. The opaque
+ * `cursor` continues the page walk when `hasMore` is true.
+ */
+export interface EqualityQueryPage {
+    documents: Array<{
+        id: string;
+        data?: unknown;
+        custom?: unknown;
+    }>;
+    hasMore: boolean;
+    cursor?: string;
 }
 export declare class WasRemoteStore {
     readonly was: WasClient;
     readonly serverUrl: string;
     readonly spaceId: string;
     private readonly _byCollectionId;
+    private readonly _configById;
     private constructor();
     /**
      * Builds a delegated remote store from a parsed grant set and the app's
@@ -45,11 +74,14 @@ export declare class WasRemoteStore {
      * @param options {object}
      * @param options.parsed {ParsedGrants}
      * @param options.zcapClient {ZcapClient}
+     * @param [options.collections] {WasCollectionConfig[]}   the collection
+     *   registry; entries with `visibility: 'public'` are never marked encrypted
      * @returns {WasRemoteStore}
      */
-    static fromGrants({ parsed, zcapClient }: {
+    static fromGrants({ parsed, zcapClient, collections }: {
         parsed: ParsedGrants;
         zcapClient: ZcapClient;
+        collections?: WasCollectionConfig[];
     }): WasRemoteStore;
     /**
      * The delegated capability for one WAS collection, or `undefined` when no
@@ -65,11 +97,81 @@ export declare class WasRemoteStore {
      * one collection, invoked with that collection's delegated RW zcap. Non-fatal:
      * returns the outcome rather than throwing, so a server that does not authorize
      * a delegated description write leaves replication untouched (the collection
-     * simply stays unmarked / plaintext, which still stores envelopes).
+     * simply stays unmarked / plaintext, which still stores envelopes). A PUBLIC
+     * collection is never marked (public implies plaintext): the PUT is skipped
+     * and reported as `ok` + `skipped`.
      *
      * @param collectionId {string}   the WAS collection id
      * @returns {Promise<MarkerResult>}
      */
     markCollectionEncrypted(collectionId: string): Promise<MarkerResult>;
+    /**
+     * Best-effort declaration of a public collection's equality-indexed
+     * attributes (`{ indexes: [...] }`) on its collection description, invoked
+     * with that collection's delegated RW zcap. The server rejects
+     * `filter[attr]=value` queries on undeclared attributes fail-closed, so a
+     * public collection that wants `store.query()` must announce its `indexes`
+     * here. Non-fatal like the encryption marker: returns the outcome rather
+     * than throwing. Skipped (reported `ok` + `skipped`) for a private
+     * collection or one that declares no indexes.
+     *
+     * @param collectionId {string}   the WAS collection id
+     * @returns {Promise<MarkerResult>}
+     */
+    declareCollectionIndexes(collectionId: string): Promise<MarkerResult>;
+    /**
+     * Runs one equality query against a public collection: the canonical GET
+     * `filter[attr]=value` form of the server's `equality` profile, invoked with
+     * the collection's delegated zcap (an anonymous reader would issue the same
+     * URL unsigned against a `PublicCanRead` collection). Filter attributes are
+     * emitted in sorted order so identical queries produce identical URLs
+     * (cache-friendly); values are string equality only. Fails closed before any
+     * network round trip on a non-public collection (the encrypted
+     * `blinded-index` path is not yet supported), an empty term set, or an
+     * attribute missing from the collection's declared `indexes`.
+     *
+     * @param options {object}
+     * @param options.collectionId {string}   the WAS collection id
+     * @param options.equals {Record<string, string>}   equality terms; multiple
+     *   attributes AND together
+     * @param [options.limit] {number}   page size (server default when omitted)
+     * @param [options.cursor] {string}   opaque continuation cursor from the
+     *   prior page
+     * @returns {Promise<EqualityQueryPage>}
+     */
+    queryCollectionByEquality({ collectionId, equals, limit, cursor }: {
+        collectionId: string;
+        equals: Record<string, string>;
+        limit?: number;
+        cursor?: string;
+    }): Promise<EqualityQueryPage>;
+    /**
+     * The world-readable share URL for one document in a public (plaintext)
+     * collection: the exact URL an unauthenticated reader fetches (e.g. via
+     * `WasClient.publicRead`) to consume a share link. Because a public
+     * collection stores the payload under its own logical `id`, this URL is
+     * stable across edits of the document. Fails closed before composing
+     * anything on a non-public collection (the encrypted path stores under a
+     * random envelope id, so no stable public URL exists), an empty id, or a
+     * collection no delegated capability covers (catching typo'd or
+     * unprovisioned collection ids). The URL resolves publicly only once the
+     * document has replicated to the server -- a locally-inserted doc shares
+     * after the next sync push.
+     *
+     * @param options {object}
+     * @param options.collectionId {string}   the WAS collection id
+     * @param options.id {string}   the document's logical uuid
+     * @returns {string}
+     */
+    publicUrlFor({ collectionId, id }: {
+        collectionId: string;
+        id: string;
+    }): string;
+    /**
+     * The shared best-effort collection-description PUT behind the encryption
+     * marker and the indexes declaration: invokes the collection's delegated RW
+     * zcap and reports the outcome rather than throwing.
+     */
+    private _putDescription;
 }
 //# sourceMappingURL=wasRemoteStore.d.ts.map

package/dist/storage/wasRemoteStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wasRemoteStore.d.ts","sourceRoot":"","sources":["../../src/storage/wasRemoteStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAG/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,qBAAa,cAAc;IACzB,SAAgB,GAAG,EAAE,SAAS,CAAA;IAC9B,SAAgB,SAAS,EAAE,MAAM,CAAA;IACjC,SAAgB,OAAO,EAAE,MAAM,CAAA;IAC/B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuB;IAEvD,OAAO;IAaP;;;;;;;;;;OAUG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,MAAM,EACN,UAAU,EACX,EAAE;QACD,MAAM,EAAE,YAAY,CAAA;QACpB,UAAU,EAAE,UAAU,CAAA;KACvB,GAAG,cAAc;IASlB;;;;;;;OAOG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS;IAI7D;;;;;;;;;OASG;IACG,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CAmB3E"}
+{"version":3,"file":"wasRemoteStore.d.ts","sourceRoot":"","sources":["../../src/storage/wasRemoteStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAG/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAClE,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,qBAAa,cAAc;IACzB,SAAgB,GAAG,EAAE,SAAS,CAAA;IAC9B,SAAgB,SAAS,EAAE,MAAM,CAAA;IACjC,SAAgB,OAAO,EAAE,MAAM,CAAA;IAC/B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuB;IAGvD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAG3B;IAED,OAAO;IAmBP;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,MAAM,EACN,UAAU,EACV,WAAgB,EACjB,EAAE;QACD,MAAM,EAAE,YAAY,CAAA;QACpB,UAAU,EAAE,UAAU,CAAA;QACtB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAA;KACpC,GAAG,cAAc;IAqBlB;;;;;;;OAOG;IACH,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS;IAI7D;;;;;;;;;;;OAWG;IACG,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAU1E;;;;;;;;;;;;OAYG;IACG,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAe3E;;;;;;;;;;;;;;;;;;;OAmBG;IACG,yBAAyB,CAAC,EAC9B,YAAY,EACZ,MAAM,EACN,KAAK,EACL,MAAM,EACP,EAAE;QACD,YAAY,EAAE,MAAM,CAAA;QACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAgE9B;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,CAAC,EACX,YAAY,EACZ,EAAE,EACH,EAAE;QACD,YAAY,EAAE,MAAM,CAAA;QACpB,EAAE,EAAE,MAAM,CAAA;KACX,GAAG,MAAM;IAyBV;;;;OAIG;YACW,eAAe;CAyB9B"}

package/dist/storage/wasRemoteStore.js

@@ -6,11 +6,15 @@ export class WasRemoteStore {
     serverUrl;
     spaceId;
     _byCollectionId;
-    constructor({ was, parsed }) {
+    // Per WAS collection id: the effective visibility + declared equality
+    // indexes (the registry guarantees one declaration per id).
+    _configById;
+    constructor({ was, parsed, configById }) {
         this.was = was;
         this.serverUrl = parsed.serverUrl;
         this.spaceId = parsed.spaceId;
         this._byCollectionId = parsed.byCollectionId;
+        this._configById = configById;
     }
     /**
      * Builds a delegated remote store from a parsed grant set and the app's
@@ -21,15 +25,24 @@ export class WasRemoteStore {
      * @param options {object}
      * @param options.parsed {ParsedGrants}
      * @param options.zcapClient {ZcapClient}
+     * @param [options.collections] {WasCollectionConfig[]}   the collection
+     *   registry; entries with `visibility: 'public'` are never marked encrypted
      * @returns {WasRemoteStore}
      */
-    static fromGrants({ parsed, zcapClient }) {
+    static fromGrants({ parsed, zcapClient, collections = [] }) {
         const was = new WasClient({
             serverUrl: parsed.serverUrl,
             zcapClient,
             encryption: createEdvEncryption({ resolveKeys: async () => null })
         });
-        return new WasRemoteStore({ was, parsed });
+        const configById = new Map(collections.map(entry => [
+            entry.id,
+            {
+                visibility: entry.visibility ?? 'private',
+                ...(entry.indexes && { indexes: entry.indexes })
+            }
+        ]));
+        return new WasRemoteStore({ was, parsed, configById });
     }
     /**
      * The delegated capability for one WAS collection, or `undefined` when no
@@ -47,12 +60,161 @@ export class WasRemoteStore {
      * one collection, invoked with that collection's delegated RW zcap. Non-fatal:
      * returns the outcome rather than throwing, so a server that does not authorize
      * a delegated description write leaves replication untouched (the collection
-     * simply stays unmarked / plaintext, which still stores envelopes).
+     * simply stays unmarked / plaintext, which still stores envelopes). A PUBLIC
+     * collection is never marked (public implies plaintext): the PUT is skipped
+     * and reported as `ok` + `skipped`.
      *
      * @param collectionId {string}   the WAS collection id
      * @returns {Promise<MarkerResult>}
      */
     async markCollectionEncrypted(collectionId) {
+        if (this._configById.get(collectionId)?.visibility === 'public') {
+            return { collectionId, ok: true, skipped: true };
+        }
+        return this._putDescription({
+            collectionId,
+            description: { id: collectionId, encryption: { scheme: 'edv' } }
+        });
+    }
+    /**
+     * Best-effort declaration of a public collection's equality-indexed
+     * attributes (`{ indexes: [...] }`) on its collection description, invoked
+     * with that collection's delegated RW zcap. The server rejects
+     * `filter[attr]=value` queries on undeclared attributes fail-closed, so a
+     * public collection that wants `store.query()` must announce its `indexes`
+     * here. Non-fatal like the encryption marker: returns the outcome rather
+     * than throwing. Skipped (reported `ok` + `skipped`) for a private
+     * collection or one that declares no indexes.
+     *
+     * @param collectionId {string}   the WAS collection id
+     * @returns {Promise<MarkerResult>}
+     */
+    async declareCollectionIndexes(collectionId) {
+        const config = this._configById.get(collectionId);
+        if (config?.visibility !== 'public' ||
+            !config.indexes ||
+            config.indexes.length === 0) {
+            return { collectionId, ok: true, skipped: true };
+        }
+        return this._putDescription({
+            collectionId,
+            description: { id: collectionId, indexes: config.indexes }
+        });
+    }
+    /**
+     * Runs one equality query against a public collection: the canonical GET
+     * `filter[attr]=value` form of the server's `equality` profile, invoked with
+     * the collection's delegated zcap (an anonymous reader would issue the same
+     * URL unsigned against a `PublicCanRead` collection). Filter attributes are
+     * emitted in sorted order so identical queries produce identical URLs
+     * (cache-friendly); values are string equality only. Fails closed before any
+     * network round trip on a non-public collection (the encrypted
+     * `blinded-index` path is not yet supported), an empty term set, or an
+     * attribute missing from the collection's declared `indexes`.
+     *
+     * @param options {object}
+     * @param options.collectionId {string}   the WAS collection id
+     * @param options.equals {Record<string, string>}   equality terms; multiple
+     *   attributes AND together
+     * @param [options.limit] {number}   page size (server default when omitted)
+     * @param [options.cursor] {string}   opaque continuation cursor from the
+     *   prior page
+     * @returns {Promise<EqualityQueryPage>}
+     */
+    async queryCollectionByEquality({ collectionId, equals, limit, cursor }) {
+        const config = this._configById.get(collectionId);
+        if (config?.visibility !== 'public') {
+            throw new Error(`Equality queries require a public (plaintext) collection; ` +
+                `"${collectionId}" is not registered as public (the encrypted ` +
+                `blinded-index query path is not yet supported).`);
+        }
+        const attributes = Object.keys(equals);
+        if (attributes.length === 0) {
+            throw new Error('An equality query needs at least one term.');
+        }
+        const declared = new Set(config.indexes ?? []);
+        for (const name of attributes) {
+            if (!declared.has(name)) {
+                throw new Error(`Attribute "${name}" is not declared in collection ` +
+                    `"${collectionId}" indexes; declare it in the collection config.`);
+            }
+        }
+        const capability = this.collectionCapability(collectionId);
+        if (!capability) {
+            throw new Error(`No delegated capability covers collection "${collectionId}".`);
+        }
+        // Canonical query string: sorted filter attributes first, then the
+        // reserved pagination params. Literal brackets around a percent-encoded
+        // attribute name; the server decodes either spelling identically.
+        const params = attributes
+            .sort()
+            .map(name => `filter[${encodeURIComponent(name)}]=` +
+            encodeURIComponent(equals[name]));
+        if (limit !== undefined) {
+            params.push(`limit=${encodeURIComponent(String(limit))}`);
+        }
+        if (cursor !== undefined) {
+            params.push(`cursor=${encodeURIComponent(cursor)}`);
+        }
+        // The list endpoint is the trailing-slash collection items URL.
+        const response = await this.was.request({
+            capability,
+            path: `/space/${this.spaceId}/${collectionId}/?${params.join('&')}`,
+            method: 'GET'
+        });
+        const page = response.data;
+        if (!page || !Array.isArray(page.documents)) {
+            throw new Error(`Malformed equality query response for "${collectionId}": expected a ` +
+                `{ documents, hasMore } page.`);
+        }
+        return {
+            documents: page.documents,
+            hasMore: page.hasMore === true,
+            ...(typeof page.cursor === 'string' && { cursor: page.cursor })
+        };
+    }
+    /**
+     * The world-readable share URL for one document in a public (plaintext)
+     * collection: the exact URL an unauthenticated reader fetches (e.g. via
+     * `WasClient.publicRead`) to consume a share link. Because a public
+     * collection stores the payload under its own logical `id`, this URL is
+     * stable across edits of the document. Fails closed before composing
+     * anything on a non-public collection (the encrypted path stores under a
+     * random envelope id, so no stable public URL exists), an empty id, or a
+     * collection no delegated capability covers (catching typo'd or
+     * unprovisioned collection ids). The URL resolves publicly only once the
+     * document has replicated to the server -- a locally-inserted doc shares
+     * after the next sync push.
+     *
+     * @param options {object}
+     * @param options.collectionId {string}   the WAS collection id
+     * @param options.id {string}   the document's logical uuid
+     * @returns {string}
+     */
+    publicUrlFor({ collectionId, id }) {
+        const config = this._configById.get(collectionId);
+        if (config?.visibility !== 'public') {
+            throw new Error(`Public share URLs require a public (plaintext) collection; ` +
+                `"${collectionId}" is not registered as public (a private ` +
+                `collection stores documents under a random envelope id, so no ` +
+                `stable public URL exists).`);
+        }
+        if (typeof id !== 'string' || id.length === 0) {
+            throw new Error('A public share URL needs a non-empty document id.');
+        }
+        const capability = this.collectionCapability(collectionId);
+        if (!capability) {
+            throw new Error(`No delegated capability covers collection "${collectionId}".`);
+        }
+        return (`${this.serverUrl}/space/${this.spaceId}/${collectionId}/` +
+            `${encodeURIComponent(id)}`);
+    }
+    /**
+     * The shared best-effort collection-description PUT behind the encryption
+     * marker and the indexes declaration: invokes the collection's delegated RW
+     * zcap and reports the outcome rather than throwing.
+     */
+    async _putDescription({ collectionId, description }) {
         const capability = this.collectionCapability(collectionId);
         if (!capability) {
             return { collectionId, ok: false, error: 'no capability' };
@@ -62,7 +224,7 @@ export class WasRemoteStore {
                 capability,
                 path: `/space/${this.spaceId}/${collectionId}`,
                 method: 'PUT',
-                json: { id: collectionId, encryption: { scheme: 'edv' } }
+                json: description
             });
             return { collectionId, ok: true, status: response.status };
         }

package/dist/storage/wasRemoteStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"wasRemoteStore.js","sourceRoot":"","sources":["../../src/storage/wasRemoteStore.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAa5D,MAAM,OAAO,cAAc;IACT,GAAG,CAAW;IACd,SAAS,CAAQ;IACjB,OAAO,CAAQ;IACd,eAAe,CAAuB;IAEvD,YAAoB,EAClB,GAAG,EACH,MAAM,EAIP;QACC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QACjC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC7B,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,CAAA;IAC9C,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,MAAM,EACN,UAAU,EAIX;QACC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU;YACV,UAAU,EAAE,mBAAmB,CAAC,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;SACnE,CAAC,CAAA;QACF,OAAO,IAAI,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED;;;;;;;OAOG;IACH,oBAAoB,CAAC,YAAoB;QACvC,OAAO,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAA;IAC3C,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,uBAAuB,CAAC,YAAoB;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAA;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;QAC5D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACtC,UAAU;gBACV,IAAI,EAAE,UAAU,IAAI,CAAC,OAAO,IAAI,YAAY,EAAE;gBAC9C,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;aAC1D,CAAC,CAAA;YACF,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;YAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YACjC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;QAC5D,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"wasRemoteStore.js","sourceRoot":"","sources":["../../src/storage/wasRemoteStore.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAgC5D,MAAM,OAAO,cAAc;IACT,GAAG,CAAW;IACd,SAAS,CAAQ;IACjB,OAAO,CAAQ;IACd,eAAe,CAAuB;IACvD,sEAAsE;IACtE,4DAA4D;IAC3C,WAAW,CAG3B;IAED,YAAoB,EAClB,GAAG,EACH,MAAM,EACN,UAAU,EAQX;QACC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QACjC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC7B,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,CAAA;QAC5C,IAAI,CAAC,WAAW,GAAG,UAAU,CAAA;IAC/B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,MAAM,EACN,UAAU,EACV,WAAW,GAAG,EAAE,EAKjB;QACC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU;YACV,UAAU,EAAE,mBAAmB,CAAC,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;SACnE,CAAC,CAAA;QACF,MAAM,UAAU,GAAG,IAAI,GAAG,CAIxB,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,EAAE;YACR;gBACE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,SAAS;gBACzC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;aACjD;SACF,CAAC,CACH,CAAA;QACD,OAAO,IAAI,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;IACxD,CAAC;IAED;;;;;;;OAOG;IACH,oBAAoB,CAAC,YAAoB;QACvC,OAAO,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,CAAA;IAC3C,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,uBAAuB,CAAC,YAAoB;QAChD,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,UAAU,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAClD,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;YAC1B,YAAY;YACZ,WAAW,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;SACjE,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,wBAAwB,CAAC,YAAoB;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACjD,IACE,MAAM,EAAE,UAAU,KAAK,QAAQ;YAC/B,CAAC,MAAM,CAAC,OAAO;YACf,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC3B,CAAC;YACD,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAClD,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;YAC1B,YAAY;YACZ,WAAW,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;SAC3D,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,yBAAyB,CAAC,EAC9B,YAAY,EACZ,MAAM,EACN,KAAK,EACL,MAAM,EAMP;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACjD,IAAI,MAAM,EAAE,UAAU,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,4DAA4D;gBAC1D,IAAI,YAAY,+CAA+C;gBAC/D,iDAAiD,CACpD,CAAA;QACH,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;QAC9C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,kCAAkC;oBAClD,IAAI,YAAY,iDAAiD,CACpE,CAAA;YACH,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAA;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,8CAA8C,YAAY,IAAI,CAC/D,CAAA;QACH,CAAC;QACD,mEAAmE;QACnE,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,MAAM,GAAG,UAAU;aACtB,IAAI,EAAE;aACN,GAAG,CACF,IAAI,CAAC,EAAE,CACL,UAAU,kBAAkB,CAAC,IAAI,CAAC,IAAI;YACtC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAW,CAAC,CAC7C,CAAA;QACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;QAC3D,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACrD,CAAC;QACD,gEAAgE;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YACtC,UAAU;YACV,IAAI,EAAE,UAAU,IAAI,CAAC,OAAO,IAAI,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACnE,MAAM,EAAE,KAAK;SACd,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA8C,CAAA;QACpE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,0CAA0C,YAAY,gBAAgB;gBACpE,8BAA8B,CACjC,CAAA;QACH,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI;YAC9B,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SAChE,CAAA;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,CAAC,EACX,YAAY,EACZ,EAAE,EAIH;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACjD,IAAI,MAAM,EAAE,UAAU,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,6DAA6D;gBAC3D,IAAI,YAAY,2CAA2C;gBAC3D,gEAAgE;gBAChE,4BAA4B,CAC/B,CAAA;QACH,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;QACtE,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAA;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,8CAA8C,YAAY,IAAI,CAC/D,CAAA;QACH,CAAC;QACD,OAAO,CACL,GAAG,IAAI,CAAC,SAAS,UAAU,IAAI,CAAC,OAAO,IAAI,YAAY,GAAG;YAC1D,GAAG,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAC5B,CAAA;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAAC,EAC5B,YAAY,EACZ,WAAW,EAIZ;QACC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAA;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAA;QAC5D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACtC,UAAU;gBACV,IAAI,EAAE,UAAU,IAAI,CAAC,OAAO,IAAI,YAAY,EAAE;gBAC9C,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,WAAW;aAClB,CAAC,CAAA;YACF,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;YAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YACjC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;QAC5D,CAAC;IACH,CAAC;CACF"}

package/dist/storage/wasSync.d.ts

@@ -4,7 +4,8 @@
 /**
  * Shared WAS replication bootstrap: given a parsed grant set and the invoking
  * ZcapClient, builds the delegated {@link WasRemoteStore}, best-effort marks
- * each collection encrypted, and starts the supplied {@link SyncController} with
+ * each private collection encrypted and declares each public collection's
+ * equality `indexes`, and starts the supplied {@link SyncController} with
  * reactive store patching. The caller injects the opened localStore, the
  * controller, and the per-doc `onRemoteChange` patcher (typically wired to the
  * rehydrate mechanism over the app's store registry) rather than this module
@@ -13,6 +14,7 @@
 import type { ZcapClient } from '@interop/ezcap';
 import type { RxChangeEvent } from 'rxdb/plugins/core';
 import type { SyncedDoc } from '../sync/index.js';
+import type { WasCollectionConfig } from '../config.js';
 import type { ParsedGrants } from '../grants.js';
 import { WasRemoteStore } from './wasRemoteStore.js';
 import type { LocalStore } from './localStore.js';
@@ -23,6 +25,8 @@ import type { SyncController } from './syncController.js';
  * @param options {object}
  * @param options.parsed {ParsedGrants}
  * @param options.zcapClient {ZcapClient}   invocation signer = grants' controller
+ * @param options.collections {WasCollectionConfig[]}   the collection registry;
+ *   public (plaintext) collections are never marked encrypted
  * @param options.localStore {LocalStore}   the opened local encrypted replica
  * @param options.syncController {SyncController}   a fresh per-session controller
  * @param options.onRemoteChange {(collectionKey, event) => void}   per-doc
@@ -31,9 +35,10 @@ import type { SyncController } from './syncController.js';
  *   401/403 (expired/revoked access) -- wired to the reconnect banner
  * @returns {Promise<WasRemoteStore>}
  */
-export declare function startWasSync({ parsed, zcapClient, localStore, syncController, onRemoteChange, onAuthError }: {
+export declare function startWasSync({ parsed, zcapClient, collections, localStore, syncController, onRemoteChange, onAuthError }: {
     parsed: ParsedGrants;
     zcapClient: ZcapClient;
+    collections: WasCollectionConfig[];
     localStore: LocalStore;
     syncController: SyncController;
     onRemoteChange: (collectionKey: string, event: RxChangeEvent<SyncedDoc>) => void;

package/dist/storage/wasSync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wasSync.d.ts","sourceRoot":"","sources":["../../src/storage/wasSync.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAAC,EACjC,MAAM,EACN,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,WAAW,EACZ,EAAE;IACD,MAAM,EAAE,YAAY,CAAA;IACpB,UAAU,EAAE,UAAU,CAAA;IACtB,UAAU,EAAE,UAAU,CAAA;IACtB,cAAc,EAAE,cAAc,CAAA;IAC9B,cAAc,EAAE,CACd,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,KAC5B,IAAI,CAAA;IACT,WAAW,CAAC,EAAE,MAAM,IAAI,CAAA;CACzB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuB1B"}
+{"version":3,"file":"wasSync.d.ts","sourceRoot":"","sources":["../../src/storage/wasSync.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEzD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,EACjC,MAAM,EACN,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,cAAc,EACd,WAAW,EACZ,EAAE;IACD,MAAM,EAAE,YAAY,CAAA;IACpB,UAAU,EAAE,UAAU,CAAA;IACtB,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAClC,UAAU,EAAE,UAAU,CAAA;IACtB,cAAc,EAAE,cAAc,CAAA;IAC9B,cAAc,EAAE,CACd,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,KAC5B,IAAI,CAAA;IACT,WAAW,CAAC,EAAE,MAAM,IAAI,CAAA;CACzB,GAAG,OAAO,CAAC,cAAc,CAAC,CAqC1B"}

package/dist/storage/wasSync.js

@@ -5,6 +5,8 @@ import { WasRemoteStore } from './wasRemoteStore.js';
  * @param options {object}
  * @param options.parsed {ParsedGrants}
  * @param options.zcapClient {ZcapClient}   invocation signer = grants' controller
+ * @param options.collections {WasCollectionConfig[]}   the collection registry;
+ *   public (plaintext) collections are never marked encrypted
  * @param options.localStore {LocalStore}   the opened local encrypted replica
  * @param options.syncController {SyncController}   a fresh per-session controller
  * @param options.onRemoteChange {(collectionKey, event) => void}   per-doc
@@ -13,14 +15,26 @@ import { WasRemoteStore } from './wasRemoteStore.js';
  *   401/403 (expired/revoked access) -- wired to the reconnect banner
  * @returns {Promise<WasRemoteStore>}
  */
-export async function startWasSync({ parsed, zcapClient, localStore, syncController, onRemoteChange, onAuthError }) {
-    const remoteStore = WasRemoteStore.fromGrants({ parsed, zcapClient });
-    // Best-effort encryption marker; non-fatal either way (envelopes replicate
-    // into an unmarked collection just the same).
+export async function startWasSync({ parsed, zcapClient, collections, localStore, syncController, onRemoteChange, onAuthError }) {
+    const remoteStore = WasRemoteStore.fromGrants({
+        parsed,
+        zcapClient,
+        collections
+    });
+    // Best-effort collection-description PUTs; non-fatal either way (envelopes
+    // replicate into an unmarked collection just the same, and a query against
+    // undeclared indexes fails with a descriptive 400). Each helper skips the
+    // collections it does not apply to (reported ok + skipped): the encryption
+    // marker skips public collections, the indexes declaration skips private
+    // ones and public ones with no declared indexes.
     await Promise.all(Object.keys(parsed.byCollectionId).map(async (collectionId) => {
-        const result = await remoteStore.markCollectionEncrypted(collectionId);
-        if (!result.ok) {
-            console.warn(`Encryption marker PUT not authorized for "${collectionId}" (status ${result.status ?? 'n/a'}).`);
+        const marker = await remoteStore.markCollectionEncrypted(collectionId);
+        if (!marker.ok) {
+            console.warn(`Encryption marker PUT not authorized for "${collectionId}" (status ${marker.status ?? 'n/a'}).`);
+        }
+        const indexes = await remoteStore.declareCollectionIndexes(collectionId);
+        if (!indexes.ok) {
+            console.warn(`Indexes declaration PUT not authorized for "${collectionId}" (status ${indexes.status ?? 'n/a'}).`);
         }
     }));
     await syncController.start({

package/dist/storage/wasSync.js.map

@@ -1 +1 @@
-{"version":3,"file":"wasSync.js","sourceRoot":"","sources":["../../src/storage/wasSync.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAIpD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,MAAM,EACN,UAAU,EACV,UAAU,EACV,cAAc,EACd,cAAc,EACd,WAAW,EAWZ;IACC,MAAM,WAAW,GAAG,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;IAErE,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,YAAY,EAAC,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAA;QACtE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,6CAA6C,YAAY,aAAa,MAAM,CAAC,MAAM,IAAI,KAAK,IAAI,CACjG,CAAA;QACH,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,cAAc,CAAC,KAAK,CAAC;QACzB,WAAW;QACX,UAAU;QACV,cAAc;QACd,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC,CAAA;IACF,OAAO,WAAW,CAAA;AACpB,CAAC"}
+{"version":3,"file":"wasSync.js","sourceRoot":"","sources":["../../src/storage/wasSync.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAIpD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,MAAM,EACN,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,cAAc,EACd,WAAW,EAYZ;IACC,MAAM,WAAW,GAAG,cAAc,CAAC,UAAU,CAAC;QAC5C,MAAM;QACN,UAAU;QACV,WAAW;KACZ,CAAC,CAAA;IAEF,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,EAAC,YAAY,EAAC,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAA;QACtE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,6CAA6C,YAAY,aAAa,MAAM,CAAC,MAAM,IAAI,KAAK,IAAI,CACjG,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAA;QACxE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CACV,+CAA+C,YAAY,aAAa,OAAO,CAAC,MAAM,IAAI,KAAK,IAAI,CACpG,CAAA;QACH,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,cAAc,CAAC,KAAK,CAAC;QACzB,WAAW;QACX,UAAU;QACV,cAAc;QACd,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC,CAAA;IACF,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/dist/sync/docCipher.d.ts

@@ -10,6 +10,10 @@
  * document under its EXISTING id, advancing the envelope `sequence` from the
  * prior envelope. `decrypt` reverses it. The sync layer moves the envelope
  * verbatim; it never touches these keys.
+ *
+ * A PUBLIC (plaintext) collection uses {@link createPlaintextDocCodec} instead:
+ * the same {@link DocCipher} seam with pass-through implementations, so the
+ * storage layer above needs no encrypted-vs-plaintext fork.
  */
 import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
 import type { Json } from './types.js';
@@ -47,6 +51,24 @@ export interface DocCipher {
  * @returns {boolean}
  */
 export declare function isEncryptedEnvelope(data: Json | undefined): boolean;
+/**
+ * Builds the pass-through codec for a PUBLIC (plaintext) collection: payloads
+ * are stored as-is, and the stored resource id IS the payload's logical `id`
+ * (uuid). With nothing to hide there is no reason for a second, opaque id
+ * plane, and a public document then keeps a stable, shareable resource URL
+ * across edits. `decrypt` refuses an EDV envelope (via
+ * {@link isEncryptedEnvelope}) rather than mis-reading its random envelope id
+ * as a logical uuid -- a public collection holding ciphertext rows is a
+ * visibility misconfiguration, surfaced as a read error instead of silent
+ * garbage.
+ *
+ * @param options {object}
+ * @param options.collectionId {string}   labels errors only
+ * @returns {DocCipher}
+ */
+export declare function createPlaintextDocCodec({ collectionId }: {
+    collectionId: string;
+}): DocCipher;
 /**
  * Builds a {@link DocCipher} for one collection from its derived key material
  * (the per-collection X25519 key agreement key). Keys are supplied directly (no