@interop/was-react 0.16.0 → 0.18.0

package/dist/storage/wasSync.js

@@ -2,6 +2,57 @@ import { hasKeyEpochs } from '../sync/index.js';
 import { isPublicCollection } from '../config.js';
 import { WasRemoteStore, remoteDescriptorSource } from './wasRemoteStore.js';
 import { SharedCollectionReader } from './sharedCollectionReader.js';
+/**
+ * The one read-filter-cache pass over a grant set, shared by the login-time
+ * {@link readRemoteDescriptors} and the sync bootstrap: per REGISTERED
+ * collection the grants actually cover, read the private ones' encryption
+ * descriptor ONCE (reusing one the caller already read) and keep only the
+ * epoch-bearing ones -- a rosterless descriptor cannot build a cipher. A
+ * granted id the app never registered is nobody's business here, and a public
+ * collection carries no descriptor at all.
+ *
+ * `onCollection` is the bootstrap's hook: it runs per granted collection --
+ * public ones included -- with the RAW descriptor as read (epoch-bearing or
+ * not), so the description PUTs and the cipher rebuild ride the same single
+ * read. Collections are processed concurrently, hook included, so one slow
+ * collection never holds up the others.
+ *
+ * @param options {object}
+ * @param options.remoteStore {WasRemoteStore}
+ * @param options.collections {WasCollectionConfig[]}
+ * @param options.parsed {ParsedGrants}
+ * @param [options.knownDescriptors] {Record<string, CollectionEncryption>}
+ *   descriptors already read live in this bring-up, reused instead of re-read
+ * @param [options.onCollection] {(options) => Promise<void>}   per granted
+ *   collection, with its raw descriptor (absent for a public one)
+ * @returns {Promise<Record<string, CollectionEncryption>>}   the epoch-bearing
+ *   descriptors, keyed by WAS collection id
+ */
+async function readGrantedEncryption({ remoteStore, collections, parsed, knownDescriptors = {}, onCollection }) {
+    const granted = collections.filter(collection => parsed.byCollectionId[collection.id] !== undefined);
+    const descriptors = {};
+    await Promise.all(granted.map(async (collection) => {
+        const { id: collectionId } = collection;
+        let encryption;
+        if (!isPublicCollection(collection)) {
+            // A descriptor the caller read seconds ago is reused as-is; only ids it
+            // did not cover (or a hot restore, which passes none) are read live.
+            encryption =
+                knownDescriptors[collectionId] ??
+                    (await remoteStore.readCollectionEncryption(collectionId));
+            if (hasKeyEpochs(encryption)) {
+                descriptors[collectionId] = encryption;
+            }
+        }
+        if (onCollection) {
+            await onCollection({
+                collection,
+                ...(encryption && { encryption })
+            });
+        }
+    }));
+    return descriptors;
+}
 /**
  * One live encryption-descriptor read per granted private collection, invoked
  * with the grants' delegated zcaps and keyed by WAS collection id. Only
@@ -25,18 +76,7 @@ export async function readRemoteDescriptors({ parsed, zcapClient, collections })
         zcapClient,
         collections
     });
-    const descriptors = {};
-    await Promise.all(collections.map(async (collection) => {
-        const { id } = collection;
-        if (isPublicCollection(collection) || !parsed.byCollectionId[id]) {
-            return;
-        }
-        const encryption = await remoteStore.readCollectionEncryption(id);
-        if (hasKeyEpochs(encryption)) {
-            descriptors[id] = encryption;
-        }
-    }));
-    return descriptors;
+    return await readGrantedEncryption({ remoteStore, collections, parsed });
 }
 /**
  * Builds the remote store, opens the shared-collection readers, and starts
@@ -97,6 +137,15 @@ export async function startWasSync({ parsed, zcapClient, collections, localStore
     //   the fresh set to the descriptor-cache refresher so an offline session can
     //   rebuild its epoch-aware ciphers without a live read.
     //
+    // A private collection with a blinding key gets one more ride-along on the
+    // same pass: its stored collection metadata is fetched RAW (the opaque
+    // envelope, not the decoded form) and installed on that collection's local
+    // cipher, which carries the persisted blinded-index schema. Documents written
+    // from then on carry blinded `indexed` entries and are findable by
+    // `collection.find()`. It runs AFTER the declaration deliberately: the
+    // declaration may have written fresh attributes into the persisted schema, and
+    // the metadata read must see them.
+    //
     // The description is READ ONCE per collection and feeds both: the same
     // descriptor answers the encryption PUT's read-before-write roster-clobber
     // guard and the cipher rebuild, rather than each fetching it separately.
@@ -104,51 +153,68 @@ export async function startWasSync({ parsed, zcapClient, collections, localStore
     // SHARED collections never appear here: they are wallet-owned, absent from
     // the app-owned registry, and a read-only grant would draw nothing but a
     // pointless 403.
-    const granted = collections.filter(collection => parsed.byCollectionId[collection.id] !== undefined);
-    const descriptors = {};
-    await Promise.all(granted.map(async (collection) => {
-        const { id: collectionId } = collection;
-        if (!isPublicCollection(collection)) {
-            // A descriptor the login flow read seconds ago is reused as-is; only
-            // ids it did not cover (or a hot restore, which passes none) are read
-            // live here.
-            const encryption = knownDescriptors[collectionId] ??
-                (await remoteStore.readCollectionEncryption(collectionId));
-            // Only an epoch-bearing descriptor enters the offline cache or
-            // rebuilds a cipher; a collection without a key-epoch roster stays
-            // fail-closed, stated plainly here rather than surfacing later as
-            // per-row decrypt failures.
-            if (hasKeyEpochs(encryption)) {
-                descriptors[collectionId] = encryption;
-                await localStore.applyRemoteDescriptor({ collectionId, encryption });
-            }
-            else {
-                console.warn(`Collection "${collectionId}" has no key-epoch roster on its ` +
-                    `encryption descriptor; it stays unreadable (fail-closed) ` +
-                    `until its provisioner installs one.`);
-            }
-            const declared = await remoteStore.markCollectionEncrypted(collectionId, { encryption });
-            if (!declared.ok) {
-                console.warn(`Encryption descriptor PUT not authorized for "${collectionId}" (status ${declared.status ?? 'n/a'}).`);
+    const descriptors = await readGrantedEncryption({
+        remoteStore,
+        collections,
+        parsed,
+        knownDescriptors,
+        onCollection: async ({ collection, encryption }) => {
+            const { id: collectionId } = collection;
+            if (!isPublicCollection(collection)) {
+                // Only an epoch-bearing descriptor enters the offline cache or
+                // rebuilds a cipher; a collection without a key-epoch roster stays
+                // fail-closed, stated plainly here rather than surfacing later as
+                // per-row decrypt failures.
+                if (hasKeyEpochs(encryption)) {
+                    await localStore.applyRemoteDescriptor({ collectionId, encryption });
+                }
+                else {
+                    console.warn(`Collection "${collectionId}" has no key-epoch roster on its ` +
+                        `encryption descriptor; it stays unreadable (fail-closed) ` +
+                        `until its provisioner installs one.`);
+                }
+                const declared = await remoteStore.markCollectionEncrypted(collectionId, { encryption });
+                if (!declared.ok) {
+                    console.warn(`Encryption descriptor PUT not authorized for "${collectionId}" (status ${declared.status ?? 'n/a'}).`);
+                }
+                // The private-collection counterpart of the public `indexes` PUT: the
+                // blinded-index schema lives in the collection's own encrypted
+                // metadata, so it is written through the collection handle rather than
+                // the description. Non-fatal: an unqueryable collection is still a
+                // fully replicating one.
+                const blinded = await remoteStore.declareBlindedIndexes(collectionId, {
+                    encryption
+                });
+                if (!blinded.ok) {
+                    console.warn(`Blinded-index declaration failed for "${collectionId}": ` +
+                        `${blinded.error ?? 'unknown error'} (status ${blinded.status ?? 'n/a'}).`);
+                }
+                // The schema the declaration just settled is then installed on this
+                // collection's local cipher, so the documents this replica writes from
+                // now on carry blinded `indexed` entries. A descriptor with no `hmac`
+                // carries no blinding key at all, so the install could only be a no-op:
+                // the metadata read is skipped rather than spent.
+                if (hasKeyEpochs(encryption) && encryption.hmac) {
+                    const meta = await remoteStore.readCollectionMeta(collectionId);
+                    if (meta) {
+                        try {
+                            await localStore.applyCollectionMeta({
+                                collectionId,
+                                custom: meta.custom
+                            });
+                        }
+                        catch (err) {
+                            console.warn(`Blinded-index schema install failed for "${collectionId}":`, err);
+                        }
+                    }
+                }
             }
-            // The private-collection counterpart of the public `indexes` PUT: the
-            // blinded-index schema lives in the collection's own encrypted
-            // metadata, so it is written through the collection handle rather than
-            // the description. Non-fatal: an unqueryable collection is still a
-            // fully replicating one.
-            const blinded = await remoteStore.declareBlindedIndexes(collectionId, {
-                encryption
-            });
-            if (!blinded.ok) {
-                console.warn(`Blinded-index declaration failed for "${collectionId}": ` +
-                    `${blinded.error ?? 'unknown error'} (status ${blinded.status ?? 'n/a'}).`);
+            const indexes = await remoteStore.declareCollectionIndexes(collectionId);
+            if (!indexes.ok) {
+                console.warn(`Indexes declaration PUT not authorized for "${collectionId}" (status ${indexes.status ?? 'n/a'}).`);
             }
         }
-        const indexes = await remoteStore.declareCollectionIndexes(collectionId);
-        if (!indexes.ok) {
-            console.warn(`Indexes declaration PUT not authorized for "${collectionId}" (status ${indexes.status ?? 'n/a'}).`);
-        }
-    }));
+    });
     // Install the encryption-descriptor source so a decrypt that meets an unseen
     // epoch (a rotation on another device) re-reads the descriptor and rebuilds
     // the cipher -- once per collection per session.

package/dist/storage/wasSync.js.map

@@ -1 +1 @@
-{"version":3,"file":"wasSync.js","sourceRoot":"","sources":["../../src/storage/wasSync.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,YAAY,EAAkB,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EACL,kBAAkB,EAGnB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAcpE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,MAAM,EACN,UAAU,EACV,WAAW,EAKZ;IACC,MAAM,WAAW,GAAG,cAAc,CAAC,UAAU,CAAC;QAC5C,MAAM;QACN,UAAU;QACV,WAAW;KACZ,CAAC,CAAA;IACF,MAAM,WAAW,GAAyC,EAAE,CAAA;IAC5D,MAAM,OAAO,CAAC,GAAG,CACf,WAAW,CAAC,GAAG,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;QACjC,MAAM,EAAE,EAAE,EAAE,GAAG,UAAU,CAAA;QACzB,IAAI,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;YACjE,OAAM;QACR,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAA;QACjE,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,EAAE,CAAC,GAAG,UAAU,CAAA;QAC9B,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IACD,OAAO,WAAW,CAAA;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,MAAM,EACN,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,cAAc,EACd,iBAAiB,GAAG,EAAE,EACtB,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,gBAAgB,GAAG,EAAE,EAqBtB;IACC,MAAM,WAAW,GAAG,cAAc,CAAC,UAAU,CAAC;QAC5C,MAAM;QACN,UAAU;QACV,WAAW;QACX,2EAA2E;QAC3E,2EAA2E;QAC3E,GAAG,CAAC,YAAY,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;KAC5C,CAAC,CAAA;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,0DAA0D;IAC1D,EAAE;IACF,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,yDAAyD;IACzD,EAAE;IACF,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,EAAE;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,iBAAiB;IACjB,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAChC,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,SAAS,CACjE,CAAA;IACD,MAAM,WAAW,GAAyC,EAAE,CAAA;IAC5D,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;QAC7B,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,UAAU,CAAA;QACvC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,qEAAqE;YACrE,sEAAsE;YACtE,aAAa;YACb,MAAM,UAAU,GACd,gBAAgB,CAAC,YAAY,CAAC;gBAC9B,CAAC,MAAM,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAA;YAC5D,+DAA+D;YAC/D,mEAAmE;YACnE,kEAAkE;YAClE,4BAA4B;YAC5B,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,WAAW,CAAC,YAAY,CAAC,GAAG,UAAU,CAAA;gBACtC,MAAM,UAAU,CAAC,qBAAqB,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;YACtE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,eAAe,YAAY,mCAAmC;oBAC5D,2DAA2D;oBAC3D,qCAAqC,CACxC,CAAA;YACH,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,uBAAuB,CACxD,YAAY,EACZ,EAAE,UAAU,EAAE,CACf,CAAA;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CACV,iDAAiD,YAAY,aAAa,QAAQ,CAAC,MAAM,IAAI,KAAK,IAAI,CACvG,CAAA;YACH,CAAC;YACD,sEAAsE;YACtE,+DAA+D;YAC/D,uEAAuE;YACvE,mEAAmE;YACnE,yBAAyB;YACzB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,qBAAqB,CAAC,YAAY,EAAE;gBACpE,UAAU;aACX,CAAC,CAAA;YACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CACV,yCAAyC,YAAY,KAAK;oBACxD,GAAG,OAAO,CAAC,KAAK,IAAI,eAAe,YAAY,OAAO,CAAC,MAAM,IAAI,KAAK,IAAI,CAC7E,CAAA;YACH,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAA;QACxE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CACV,+CAA+C,YAAY,aAAa,OAAO,CAAC,MAAM,IAAI,KAAK,IAAI,CACpG,CAAA;QACH,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IACD,6EAA6E;IAC7E,4EAA4E;IAC5E,iDAAiD;IACjD,UAAU,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IACvE,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,aAAa,GAA2C,EAAE,CAAA;IAChE,MAAM,OAAO,CAAC,GAAG,CACf,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE;QAC1C,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CACV,+BAA+B,EAAE,uCAAuC,CACzE,CAAA;YACD,OAAM;QACR,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,+BAA+B,EAAE,uCAAuC;gBACtE,8BAA8B,CACjC,CAAA;YACD,OAAM;QACR,CAAC;QACD,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC;gBACrD,WAAW;gBACX,eAAe,EAAE,YAAY,CAAC,eAAe;gBAC7C,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,YAAY,EAAE,EAAE;aACjB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,+BAA+B,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,cAAc,CAAC,KAAK,CAAC;QACzB,WAAW;QACX,UAAU;QACV,cAAc;QACd,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC,CAAA;IACF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAA;AAC1D,CAAC"}
+{"version":3,"file":"wasSync.js","sourceRoot":"","sources":["../../src/storage/wasSync.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,YAAY,EAAkB,MAAM,kBAAkB,CAAA;AAC/D,OAAO,EACL,kBAAkB,EAGnB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAcpE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,KAAK,UAAU,qBAAqB,CAAC,EACnC,WAAW,EACX,WAAW,EACX,MAAM,EACN,gBAAgB,GAAG,EAAE,EACrB,YAAY,EAUb;IACC,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAChC,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,SAAS,CACjE,CAAA;IACD,MAAM,WAAW,GAAyC,EAAE,CAAA;IAC5D,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;QAC7B,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,UAAU,CAAA;QACvC,IAAI,UAA4C,CAAA;QAChD,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,wEAAwE;YACxE,qEAAqE;YACrE,UAAU;gBACR,gBAAgB,CAAC,YAAY,CAAC;oBAC9B,CAAC,MAAM,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAA;YAC5D,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,WAAW,CAAC,YAAY,CAAC,GAAG,UAAU,CAAA;YACxC,CAAC;QACH,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,YAAY,CAAC;gBACjB,UAAU;gBACV,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,CAAC;aAClC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IACD,OAAO,WAAW,CAAA;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,MAAM,EACN,UAAU,EACV,WAAW,EAKZ;IACC,MAAM,WAAW,GAAG,cAAc,CAAC,UAAU,CAAC;QAC5C,MAAM;QACN,UAAU;QACV,WAAW;KACZ,CAAC,CAAA;IACF,OAAO,MAAM,qBAAqB,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,MAAM,EACN,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,cAAc,EACd,iBAAiB,GAAG,EAAE,EACtB,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,gBAAgB,GAAG,EAAE,EAqBtB;IACC,MAAM,WAAW,GAAG,cAAc,CAAC,UAAU,CAAC;QAC5C,MAAM;QACN,UAAU;QACV,WAAW;QACX,2EAA2E;QAC3E,2EAA2E;QAC3E,GAAG,CAAC,YAAY,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;KAC5C,CAAC,CAAA;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,0DAA0D;IAC1D,EAAE;IACF,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,yDAAyD;IACzD,EAAE;IACF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,8EAA8E;IAC9E,mEAAmE;IACnE,uEAAuE;IACvE,+EAA+E;IAC/E,mCAAmC;IACnC,EAAE;IACF,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,EAAE;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,iBAAiB;IACjB,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC;QAC9C,WAAW;QACX,WAAW;QACX,MAAM;QACN,gBAAgB;QAChB,YAAY,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE;YACjD,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,GAAG,UAAU,CAAA;YACvC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,+DAA+D;gBAC/D,mEAAmE;gBACnE,kEAAkE;gBAClE,4BAA4B;gBAC5B,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7B,MAAM,UAAU,CAAC,qBAAqB,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;gBACtE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CACV,eAAe,YAAY,mCAAmC;wBAC5D,2DAA2D;wBAC3D,qCAAqC,CACxC,CAAA;gBACH,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,uBAAuB,CACxD,YAAY,EACZ,EAAE,UAAU,EAAE,CACf,CAAA;gBACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,OAAO,CAAC,IAAI,CACV,iDAAiD,YAAY,aAAa,QAAQ,CAAC,MAAM,IAAI,KAAK,IAAI,CACvG,CAAA;gBACH,CAAC;gBACD,sEAAsE;gBACtE,+DAA+D;gBAC/D,uEAAuE;gBACvE,mEAAmE;gBACnE,yBAAyB;gBACzB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,qBAAqB,CAAC,YAAY,EAAE;oBACpE,UAAU;iBACX,CAAC,CAAA;gBACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAChB,OAAO,CAAC,IAAI,CACV,yCAAyC,YAAY,KAAK;wBACxD,GAAG,OAAO,CAAC,KAAK,IAAI,eAAe,YAAY,OAAO,CAAC,MAAM,IAAI,KAAK,IAAI,CAC7E,CAAA;gBACH,CAAC;gBACD,oEAAoE;gBACpE,uEAAuE;gBACvE,sEAAsE;gBACtE,wEAAwE;gBACxE,kDAAkD;gBAClD,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;oBAChD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;oBAC/D,IAAI,IAAI,EAAE,CAAC;wBACT,IAAI,CAAC;4BACH,MAAM,UAAU,CAAC,mBAAmB,CAAC;gCACnC,YAAY;gCACZ,MAAM,EAAE,IAAI,CAAC,MAAM;6BACpB,CAAC,CAAA;wBACJ,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,OAAO,CAAC,IAAI,CACV,4CAA4C,YAAY,IAAI,EAC5D,GAAG,CACJ,CAAA;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAA;YACxE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,CAAC,IAAI,CACV,+CAA+C,YAAY,aAAa,OAAO,CAAC,MAAM,IAAI,KAAK,IAAI,CACpG,CAAA;YACH,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,iDAAiD;IACjD,UAAU,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IACvE,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,aAAa,GAA2C,EAAE,CAAA;IAChE,MAAM,OAAO,CAAC,GAAG,CACf,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE;QAC1C,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CACV,+BAA+B,EAAE,uCAAuC,CACzE,CAAA;YACD,OAAM;QACR,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CACV,+BAA+B,EAAE,uCAAuC;gBACtE,8BAA8B,CACjC,CAAA;YACD,OAAM;QACR,CAAC;QACD,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC;gBACrD,WAAW;gBACX,eAAe,EAAE,YAAY,CAAC,eAAe;gBAC7C,WAAW,EAAE,YAAY,CAAC,WAAW;gBACrC,YAAY,EAAE,EAAE;aACjB,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,+BAA+B,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,cAAc,CAAC,KAAK,CAAC;QACzB,WAAW;QACX,UAAU;QACV,cAAc;QACd,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;KACpC,CAAC,CAAA;IACF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAA;AAC1D,CAAC"}

package/dist/sync/docCipher.d.ts

@@ -11,6 +11,13 @@
  * prior envelope. `decrypt` reverses it. The sync layer moves the envelope
  * verbatim; it never touches these keys.
  *
+ * On a collection whose encryption descriptor declares a blinded-index key, the
+ * cipher can also carry the collection's persisted index schema (supplied at
+ * build time as `meta`, or installed afterwards through `applyMeta`), so the
+ * envelopes it writes carry the same blinded `indexed` entries a direct write
+ * through a collection handle emits -- which is what makes a pushed document
+ * findable by an equality query.
+ *
  * A PUBLIC (plaintext) collection uses {@link createPlaintextDocCodec} instead:
  * the same {@link DocCipher} seam with pass-through implementations, so the
  * storage layer above needs no encrypted-vs-plaintext fork.
@@ -42,6 +49,12 @@ export declare function isUnknownEpochError(err: unknown): boolean;
  * reverses either. An EDV (key-epoch) cipher also surfaces the `epoch` id it
  * encrypted under, which rides the content push as the `Key-Epoch` header; the
  * plaintext codec returns none.
+ *
+ * `applyMeta` is the blinded-index schema install hook an EDV cipher exposes:
+ * given the collection's stored `/meta` value, it installs the persisted index
+ * schema so subsequent writes emit blinded `indexed` entries. It is absent on
+ * the pass-through plaintext codec and on the fail-closed placeholder, neither
+ * of which has a schema to install -- hence optional here.
  */
 export interface DocCipher {
     encrypt(options: {
@@ -63,6 +76,9 @@ export interface DocCipher {
     decrypt(options: {
         envelope: Json;
     }): Promise<Json>;
+    applyMeta?(options: {
+        custom?: unknown;
+    }): Promise<unknown>;
 }
 /**
  * Builds the pass-through codec for a PUBLIC (plaintext) collection: payloads
@@ -118,13 +134,22 @@ export declare function hasKeyEpochs(encryption?: CollectionEncryption): encrypt
  * @param options.collectionId {string}   labels errors; the codec is agnostic
  * @param options.encryption {CollectionEncryption}   the collection's
  *   encryption descriptor; must carry the key-epoch roster
+ * @param [options.meta] {object}   the collection's stored `/meta` value as the
+ *   replica holds it (its `custom` is the opaque encrypted metadata envelope,
+ *   decrypted by the codec). When supplied and the descriptor declares a
+ *   blinded-index key, the persisted index schema is installed, so writes emit
+ *   blinded `indexed` entries. Without it, writes emit none -- exactly what an
+ *   offline replica holding no collection metadata wrote before
  * @returns {Promise<DocCipher>}
  */
-export declare function createDocCipher({ keyAgreementKey, keyResolver, collectionId, encryption }: {
+export declare function createDocCipher({ keyAgreementKey, keyResolver, collectionId, encryption, meta }: {
     keyAgreementKey: IKeyAgreementKey;
     keyResolver: IKeyResolver;
     collectionId: string;
     encryption: CollectionEncryption;
+    meta?: {
+        custom?: unknown;
+    };
 }): Promise<DocCipher>;
 /**
  * The fail-closed placeholder cipher for a private collection whose

package/dist/sync/docCipher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docCipher.d.ts","sourceRoot":"","sources":["../../src/sync/docCipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAG/D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAKzD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,IAAI,CAAA;KACX,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3D,aAAa,CAAC,OAAO,EAAE;QACrB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,IAAI,CAAA;QACV,OAAO,EAAE,IAAI,CAAA;KACd,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3D,OAAO,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,YAAY,EACb,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,SAAS,CAiCZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,UAAU,CAAC,EAAE,oBAAoB,GAChC,UAAU,IAAI,oBAAoB,CAOpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,eAAe,CAAC,EACpC,eAAe,EACf,WAAW,EACX,YAAY,EACZ,UAAU,EACX,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,oBAAoB,CAAA;CACjC,GAAG,OAAO,CAAC,SAAS,CAAC,CASrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,YAAY,EACb,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,SAAS,CAkBZ"}
+{"version":3,"file":"docCipher.d.ts","sourceRoot":"","sources":["../../src/sync/docCipher.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAG/D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAKzD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,OAAO,EAAE;QACf,IAAI,EAAE,IAAI,CAAA;KACX,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3D,aAAa,CAAC,OAAO,EAAE;QACrB,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,IAAI,CAAA;QACV,OAAO,EAAE,IAAI,CAAA;KACd,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3D,OAAO,CAAC,OAAO,EAAE;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnD,SAAS,CAAC,CAAC,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC5D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,YAAY,EACb,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,SAAS,CAiCZ;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,UAAU,CAAC,EAAE,oBAAoB,GAChC,UAAU,IAAI,oBAAoB,CAOpC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,eAAe,CAAC,EACpC,eAAe,EACf,WAAW,EACX,YAAY,EACZ,UAAU,EACV,IAAI,EACL,EAAE;IACD,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,oBAAoB,CAAA;IAChC,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC5B,GAAG,OAAO,CAAC,SAAS,CAAC,CAUrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,YAAY,EACb,EAAE;IACD,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,SAAS,CAkBZ"}

package/dist/sync/docCipher.js

@@ -103,15 +103,22 @@ export function hasKeyEpochs(encryption) {
  * @param options.collectionId {string}   labels errors; the codec is agnostic
  * @param options.encryption {CollectionEncryption}   the collection's
  *   encryption descriptor; must carry the key-epoch roster
+ * @param [options.meta] {object}   the collection's stored `/meta` value as the
+ *   replica holds it (its `custom` is the opaque encrypted metadata envelope,
+ *   decrypted by the codec). When supplied and the descriptor declares a
+ *   blinded-index key, the persisted index schema is installed, so writes emit
+ *   blinded `indexed` entries. Without it, writes emit none -- exactly what an
+ *   offline replica holding no collection metadata wrote before
  * @returns {Promise<DocCipher>}
  */
-export async function createDocCipher({ keyAgreementKey, keyResolver, collectionId, encryption }) {
+export async function createDocCipher({ keyAgreementKey, keyResolver, collectionId, encryption, meta }) {
     const cipher = await createEdvDocCipher({
         keyAgreementKey,
         keyResolver,
         collectionId,
         idDerivation: 'random',
-        encryption
+        encryption,
+        ...(meta !== undefined && { meta })
     });
     return cipher;
 }

package/dist/sync/docCipher.js.map

@@ -1 +1 @@
-{"version":3,"file":"docCipher.js","sourceRoot":"","sources":["../../src/sync/docCipher.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAG9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAO,CACL,GAAG,YAAY,iBAAiB;QAChC,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAC3D,CAAA;AACH,CAAC;AAsBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,YAAY,EAGb;IACC,MAAM,SAAS,GAAG,CAAC,IAAU,EAAU,EAAE;QACvC,MAAM,EAAE,GAAI,IAAgC,EAAE,EAAE,CAAA;QAChD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,kCAAkC,YAAY,2BAA2B,CAC1E,CAAA;QACH,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC,CAAA;IACD,MAAM,eAAe,GAAG,CAAC,IAAU,EAAQ,EAAE;QAC3C,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,yCAAyC;gBAClE,yBAAyB,CAC5B,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAkB;YACpC,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAChD,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAA8B;YAC1D,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC/B,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAsB;YAC5C,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAiC;IAEjC,OAAO,OAAO,CACZ,UAAU;QACV,OAAO,UAAU,CAAC,YAAY,KAAK,QAAQ;QAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAChC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAC7B,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,eAAe,EACf,WAAW,EACX,YAAY,EACZ,UAAU,EAMX;IACC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,eAAe;QACf,WAAW;QACX,YAAY;QACZ,YAAY,EAAE,QAAQ;QACtB,UAAU;KACX,CAAC,CAAA;IACF,OAAO,MAA8B,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,YAAY,EAGb;IACC,MAAM,WAAW,GAAG,GAAU,EAAE;QAC9B,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,2CAA2C;YACpE,4DAA4D,CAC/D,CAAA;IACH,CAAC,CAAA;IACD,OAAO;QACL,KAAK,CAAC,OAAO;YACX,OAAO,WAAW,EAAE,CAAA;QACtB,CAAC;QACD,KAAK,CAAC,aAAa;YACjB,OAAO,WAAW,EAAE,CAAA;QACtB,CAAC;QACD,KAAK,CAAC,OAAO;YACX,MAAM,IAAI,iBAAiB,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACzD,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"docCipher.js","sourceRoot":"","sources":["../../src/sync/docCipher.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAG9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAO,CACL,GAAG,YAAY,iBAAiB;QAChC,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAC3D,CAAA;AACH,CAAC;AA6BD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,YAAY,EAGb;IACC,MAAM,SAAS,GAAG,CAAC,IAAU,EAAU,EAAE;QACvC,MAAM,EAAE,GAAI,IAAgC,EAAE,EAAE,CAAA;QAChD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,kCAAkC,YAAY,2BAA2B,CAC1E,CAAA;QACH,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC,CAAA;IACD,MAAM,eAAe,GAAG,CAAC,IAAU,EAAQ,EAAE;QAC3C,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,yCAAyC;gBAClE,yBAAyB,CAC5B,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAkB;YACpC,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAChD,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,IAAI,EAA8B;YAC1D,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC/B,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAsB;YAC5C,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAiC;IAEjC,OAAO,OAAO,CACZ,UAAU;QACV,OAAO,UAAU,CAAC,YAAY,KAAK,QAAQ;QAC3C,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAChC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAC7B,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,eAAe,EACf,WAAW,EACX,YAAY,EACZ,UAAU,EACV,IAAI,EAOL;IACC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,eAAe;QACf,WAAW;QACX,YAAY;QACZ,YAAY,EAAE,QAAQ;QACtB,UAAU;QACV,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC;KACpC,CAAC,CAAA;IACF,OAAO,MAA8B,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAAC,EAC3C,YAAY,EAGb;IACC,MAAM,WAAW,GAAG,GAAU,EAAE;QAC9B,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,2CAA2C;YACpE,4DAA4D,CAC/D,CAAA;IACH,CAAC,CAAA;IACD,OAAO;QACL,KAAK,CAAC,OAAO;YACX,OAAO,WAAW,EAAE,CAAA;QACtB,CAAC;QACD,KAAK,CAAC,aAAa;YACjB,OAAO,WAAW,EAAE,CAAA;QACtB,CAAC;QACD,KAAK,CAAC,OAAO;YACX,MAAM,IAAI,iBAAiB,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QACzD,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/was-react",
   "description": "React library for building 'Bring Your Own Everything' (BYOE) apps on Wallet Attached Storage: DID Auth login via CHAPI wallet, local-first encrypted storage, and background sync to a WAS server.",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -54,7 +54,7 @@
     "@interop/vc": "^11.0.6",
     "@interop/verifier-core": "^3.5.4",
     "@interop/wallet-core": "^0.35.0",
-    "@interop/was-client": "^0.35.1",
+    "@interop/was-client": "^0.36.0",
     "@interop/webkms-client": "^14.7.1",
     "@scure/base": "^2.2.0",
     "byoe-context": "^0.3.0",