v0.28.0

Added

• rxdb is an optional peer, loaded lazily in LocalStore.init() /
  removeDatabase() and SyncController.start(). A replica-less app installs
  without it; an app that replicates adds it explicitly. New ReplicaStorage
  and ReplicaChange types replace the rxdb types on the public surface, so
  the declarations name no rxdb type. test:dist fails on a static rxdb or
  @interop/was-sync/rxdb import in dist (WR-44).
• SyncController declares the session's writerId to the server on every push
  (was-sync's writerId replication option, sent as the Writer-Id header).
  The new WasSyncConfig.declareWriterId (default true) opts out, withholding
  the label from the wire while the payload's LWW stamp is unchanged (WR-53).

Changed

• BREAKING: isAuthError is no longer re-exported from the root entry.
  Import it from @interop/was-sync/rxdb (WR-44).

• BREAKING: LocalStore.rxCollection is @internal and stripped from the
  published declarations; its return type is RxDB's. Tests that reached the RxDB
  collection through it must go through LocalStore's own verbs (WR-44).

• resolveSpaceOwner resolves the owner through wallet-core's
  discoverAccountLog instead of its own fetch, parse, and resolve body; the
  location check runs upstream.

• provisionDevGrants promotes the Space controller through wallet-core's
  ensurePromotedSpaceController under the configured Space name, so the
  promotion reads first and heals an interrupted run.

• BREAKING: every edv collection is read through a verifying descriptor
  source under was-client's requireGoverned policy. WasRemoteStore gains
  descriptorSource, wallet-core's logGovernedDescriptorSource over each
  collection's meta/log (invoked with the collection's own grant), checked
  against the Space owner's did:webvh account log. The owner is resolved from
  the Space's world-readable id/did.jsonl (resolveSpaceOwner): the log is
  fetched, resolved, and the resolved DID's log location is checked against the
  URL it was served from. The login-time read, the sync bootstrap's install,
  LocalStore's unknown-epoch refresh, and SharedCollectionReader all acquire
  through it; a descriptor is never taken from the Metadata object's
  encryption projection any more. remoteDescriptorSource is removed from the
  root entry. A collection with no governing log stays fail-closed. The Space
  owner's verified view and the chain-head pins are held in memory for the
  connected activation on one SpaceTrust the login-time read and the sync
  bootstrap share (fromGrants takes it as trust), so the owner's log is
  fetched and verified once per activation. A failed Space-owner resolution is
  retried on the next read rather than remembered, and a shared collection whose
  descriptor read fails surfaces that failure as itself instead of as
  SharedCollectionUnavailableError.

• was-client's UnverifiedDescriptorError (a source that does not verify the
  governing log) surfaces as itself at every call site:
  SharedCollectionReader.open rethrows it ahead of
  SharedCollectionUnavailableError, and LocalStore surfaces it from the
  decrypt that met it and every later one, instead of the envelope's
  unknown-epoch error. A governing log the source refuses to adopt (a forged or
  discontinuous chain, vh-resource-log's isResourceLogRefusal) surfaces the
  same way at both sites. Any other refresh failure in LocalStore is logged at
  warn and re-asked on the next unknown-epoch decrypt.

• resolveSpaceOwner takes an optional pinStore, and createSpaceTrust
  passes its own, so the owner's account log is checked for chain-head
  continuity across resolutions within one activation like every collection log
  is.

• createSpaceTrust, SpaceTrust, resolveSpaceOwner, and
  acquireGovernedDescriptor are exported from the root entry, so a consumer
  building its own WasRemoteStore or LocalStore can share one trust across
  stores and build a verifying descriptor source.

• provisionDevGrants builds what a wallet's account genesis builds: a Space
  promoted to a did:webvh owner whose log is published at id/did.jsonl, and
  every private collection's epoch zero installed as the genesis of its
  meta/log through the log-governed descriptor store. provisionerDid is now
  the did:webvh. The server URL must be one did:webvh accepts (https://, or
  http:// on the literal host localhost). The Metadata-write probe leaves
  encryption out of the body it writes back, since the server derives it from
  the log head.

• Remove WasRemoteStore.readCollectionEncryption (the Metadata object's
  encryption projection is no longer read for a descriptor; descriptorSource
  is the read) and WasRemoteStore.markCollectionEncrypted with the sync
  bootstrap's { encryption: { scheme: 'edv' } } declaration write. A
  collection is declared encrypted by its governing log's genesis, and one with
  no log stays fail-closed under the policy above, so the bare declaration had
  nothing left to do.

• Add @interop/vh-resource-log as a dependency.

• Bump @interop/was-sync to 0.9.0 and @interop/was-client to 0.94.0. The ack
  write-back now stamps a pushed row's updatedAt, updatedAtCounter,
  originId, createdBy, and meta from the write response itself, so a row
  this replica created no longer depends on the feed echo for its server stamp
  (needs a server answering 201 / 200 with a body, was-teaching-server
  0.42.0 or later). The replica schema also gains an optional row-level
  writerId at the same schema version, so RxDB refuses to reopen an existing
  replica: as with 0.27.0, every remembered browser clears its local data and
  logs in again once, and local writes not yet pushed are lost with the old
  replica. Nothing in this library reads the push ack, so no code changed.