@enbox/browser 0.3.70 → 0.3.72

package/src/index.ts

@@ -8,14 +8,17 @@
  * @example Single-import dapp setup
  * ```ts
  * import {
- *   Enbox, BrowserConnectHandler,
- *   defineProtocol, recordCodecs,
+ *   BrowserConnectHandler, createConnectionStore,
+ *   defineApplicationManifest,
  * } from '@enbox/browser';
+ * import { MyProtocol } from './my-protocol.js';
  *
- * const { enbox, session } = await Enbox.connect({
- *   connectHandler: BrowserConnectHandler({ appName: 'My App' }),
- *   protocols: [MyProtocol],
+ * const store = createConnectionStore({
+ *   application    : defineApplicationManifest({ protocols: [MyProtocol] }),
+ *   connectHandler : BrowserConnectHandler({ appName: 'My App' }),
  * });
+ * const snapshot = await store.connect();
+ * if (snapshot.phase !== 'connected') throw snapshot.error ?? new Error('Connection failed.');
  * ```
  *
  * For non-browser environments (Node.js, CLI, desktop), import from
@@ -28,150 +31,13 @@
 //
 // The high-level Enbox API: DWN records and protocols.
 
-export {
-  AudienceDecryptError,
-  createConnectionStore,
-  ContextNotReadyError,
-  ContextRetiredError,
-  defineApplicationManifest,
-  DwnResponseError,
-  Enbox,
-  defineProtocol,
-  getApplicationProtocolRequests,
-  ProtocolReadinessError,
-  RecordConflictError,
-  RecordParentNotFoundError,
-  RecordSquashBackstopError,
-  RecordValidationError,
-  protocolContextKey,
-  recordCodecs,
-  ServiceConfigProtocol,
-} from '@enbox/api';
-
-export type {
-  ApplicationConnectionStore,
-  ApplicationConnectionStoreConnectOptions,
-  ApplicationConnectionStoreOptions,
-  ApplicationConnectionStoreRefreshOptions,
-  ApplicationManifest,
-  ApplicationManifestProtocol,
-  ApplicationManifestProtocolInput,
-  AudienceDecryptFailureCause,
-  ConnectionPhase,
-  ConnectionSnapshot,
-  ConnectionSnapshotListener,
-  ConnectionStore,
-  ConnectionStoreOptions,
-  ContextView,
-  ContextViewListener,
-  ContextViewState,
-  ContextMember,
-  ContextMembersApi,
-  ContextInvitation,
-  ContextInvitationPreview,
-  ContextInvitationsApi,
-  ContextMaterializedRecord,
-  ContextRecord,
-  ContextRecordDeleteParams,
-  ContextRecordsApi,
-  ContextRecordUpdateParams,
-  ContextRoleGroup,
-  ContextRoleGroups,
-  ContextRolePath,
-  ContextsApi,
-  DataForPath,
-  DefineApplicationManifestOptions,
-  DwnEndpointResolution,
-  EnboxAnonymousOptions,
-  EnboxConnectOptions,
-  EnboxConnectResult,
-  EnboxParams,
-  EnboxSessionParams,
-  EncodedRecordData,
-  EnsureProtocolsReadyOptions,
-  ExpandableRecordView,
-  FileEnvelopeCodec,
-  FileEnvelopeCodecOptions,
-  FileEnvelopeData,
-  FollowContextOptions,
-  JsonRecordCodecOptions,
-  MaterializedMemberContext,
-  MaterializedRecord,
-  MemberContext,
-  OwnedContext,
-  ProtocolContext,
-  ProtocolRolePaths,
-  SquashProtocolPaths,
-  RecordCodec,
-  RecordCodecContext,
-  RecordCodecValue,
-  RecordFilter,
-  RecordPage,
-  RecordPatch,
-  RecordPatchInput,
-  RecordQuery,
-  RecordSubscription,
-  RecordSubscriptionEvent,
-  RecordSubscriptionListener,
-  RecordView,
-  RecordViewListener,
-  RecordViewState,
-  RecordValidationFailure,
-  RecordValidator,
-  ReplicationCurrentness,
-  RoleDeliveryState,
-  SyncStatusSnapshot,
-  TypedMaterializedRecord,
-  TypedRecord,
-} from '@enbox/api';
+export * from '@enbox/api';
 
 // ─── Re-exports from @enbox/auth ────────────────────────────────
 //
 // Authentication lifecycle, session management, connect handlers.
 
-export {
-  AuthManager,
-  AuthSession,
-  ConnectDeniedError,
-  SESSION_EXPIRED_ERROR_CODE,
-  SESSION_REVOKED_ERROR_CODE,
-  computeConnectionStatus,
-  isConnectDeniedError,
-  isSessionExpiredError,
-  isSessionInvalidError,
-  normalizeProtocolRequests,
-  WalletConnect,
-} from '@enbox/auth/browser';
-
-export type {
-  AuthEvent,
-  AuthEventHandler,
-  AuthManagerOptions,
-  AuthState,
-  ComputeConnectionStatusOptions,
-  ConnectionMonitorOptions,
-  ConnectionState,
-  ConnectionStatus,
-  ConnectionStatusGrant,
-  ConnectHandler,
-  ConnectOptions,
-  ConnectResult,
-  DisconnectOptions,
-  GetConnectionStatusOptions,
-  HandlerConnectOptions,
-  ImportFromPortableOptions,
-  VaultConnectOptions,
-  Permission,
-  PortableIdentity,
-  ProtocolDefinitionCarrier,
-  ProtocolPermissionRequest,
-  ProtocolRequest,
-  RefreshOptions,
-  RegistrationOptions,
-  StorageAdapter,
-  SyncOption,
-  WalletConnectOptions,
-} from '@enbox/auth/browser';
+export * from '@enbox/auth/browser';
 
 // ─── Re-exports from @enbox/connect ─────────────────────────────
 //
@@ -179,7 +45,7 @@ export type {
 // transports: opening/sealing envelopes and the deny token.
 
 export { CONNECT_DENIED_TOKEN, ConnectProvider } from '@enbox/connect';
-export type { ConnectApproval, ConnectPermissionRequest, ConnectRequest, ConnectRequestType } from '@enbox/connect';
+export type { ConnectApproval, ConnectRequest } from '@enbox/connect';
 
 // ─── Browser-specific exports ───────────────────────────────────
 //
@@ -213,6 +79,14 @@ export { MAX_PIN_ATTEMPTS, RelayConnectCancelledError, runRelayConnect } from '.
 export type { RelayConnectOptions } from './relay-connect-runner.js';
 export { encodeQr, qrToSvg } from './ui/qr.js';
 export type { QrCode, QrSvgOptions } from './ui/qr.js';
+export { createBlobUrlPool } from './blob-url-pool.js';
+export type { BlobUrlLease, BlobUrlPool } from './blob-url-pool.js';
+export { createFileEnvelopeUrlStore } from './file-envelope-url-store.js';
+export type {
+  FileEnvelopeUrlLease,
+  FileEnvelopeUrlStore,
+  FileEnvelopeUrlStoreOptions,
+} from './file-envelope-url-store.js';
 
 // ─── Convenience re-exports for dapps ───────────────────────────
 //
@@ -222,14 +96,6 @@ export type { QrCode, QrSvgOptions } from './ui/qr.js';
 // more specialized is still available by importing the underlying package
 // directly.
 
-// Canonical typed record (from @enbox/api).
-export { Record } from '@enbox/api';
-
-// Custom storage adapter + DWN registration provider-auth callback shapes
-// (from @enbox/auth).
-export { BrowserStorage } from '@enbox/auth/browser';
-export type { ProviderAuthParams, ProviderAuthResult } from '@enbox/auth/browser';
-
 // Public-profile read/cache layer (from @enbox/protocols): fetch other
 // users' published profiles (displayName + avatar/hero) from their DWNs
 // with caching, retries, negative caching, and refcounted subscriptions.
@@ -255,12 +121,9 @@ export type {
 // DWN interface enum for typing agent requests (from @enbox/agent).
 export { DwnInterface } from '@enbox/agent';
 
-// Sync-status observability for dapp "remotes" panels (from @enbox/agent).
-// Subscribe with `agent.sync.on(event => …)` and snapshot per-remote health
-// (healthy / quota-blocked / degraded / offline), including when a
-// quota-blocked remote will next be re-probed, via
-// `agent.sync.getRemoteSyncStatus()`; resume immediately with
-// `agent.sync.retryRemoteNow(tenantDid, remoteEndpoint)`.
+// Low-level sync-status types for advanced agent consumers. Dapps using a
+// ConnectionStore receive current advertised rows through `snapshot.sync.remotes`
+// and can call `store.retryRemote(remoteEndpoint)` without wiring agent events.
 export type {
   DeadLetterEntry,
   RemoteSyncState,
@@ -270,6 +133,7 @@ export type {
   SyncEvent,
   SyncEventListener,
   SyncHealthSummary,
+  SyncIdentityStatus,
 } from '@enbox/agent';
 
 // Common DWN primitives for record queries, permission scopes, and protocol

package/src/object-url-reference.ts

@@ -0,0 +1,82 @@
+export type ObjectUrlLease = Readonly<{
+  url: string;
+  /** Release immediately, cancelling any deferred release. Idempotent. */
+  release(): void;
+  /** Release after a grace period. The first deferred release wins. */
+  releaseAfter(delayMs: number): void;
+}>;
+
+const MAX_TIMER_DELAY_MS = 2_147_483_647;
+
+function assertReleaseDelay(delayMs: number): void {
+  if (!Number.isSafeInteger(delayMs) || delayMs < 0 || delayMs > MAX_TIMER_DELAY_MS) {
+    throw new TypeError(`delayMs must be an integer between 0 and ${MAX_TIMER_DELAY_MS}.`);
+  }
+}
+
+/** Private reference-counted ownership for one object URL. */
+export class ObjectUrlReference {
+  public readonly url: string;
+  private _isRevoked = false;
+  private _references = 0;
+  private readonly _releaseTimers = new Set<ReturnType<typeof setTimeout>>();
+
+  public constructor(blob: Blob, private readonly _onEmpty: (reference: ObjectUrlReference) => void) {
+    this.url = globalThis.URL.createObjectURL(blob);
+  }
+
+  public get references(): number {
+    return this._references;
+  }
+
+  public acquire(): ObjectUrlLease {
+    if (this._isRevoked) {
+      throw new Error('Object URL has been revoked.');
+    }
+
+    this._references += 1;
+    let released = false;
+    let releaseTimer: ReturnType<typeof setTimeout> | undefined;
+    const release = (): void => {
+      if (released) {
+        return;
+      }
+      released = true;
+      if (releaseTimer !== undefined) {
+        clearTimeout(releaseTimer);
+        this._releaseTimers.delete(releaseTimer);
+      }
+      if (this._isRevoked) {
+        return;
+      }
+      this._references -= 1;
+      if (this._references === 0) {
+        this._onEmpty(this);
+      }
+    };
+    return Object.freeze({
+      url          : this.url,
+      release,
+      releaseAfter : (delayMs: number): void => {
+        assertReleaseDelay(delayMs);
+        if (released || this._isRevoked || releaseTimer !== undefined) {
+          return;
+        }
+        releaseTimer = setTimeout(release, delayMs);
+        this._releaseTimers.add(releaseTimer);
+      },
+    });
+  }
+
+  public revoke(): void {
+    if (!this._isRevoked) {
+      this._isRevoked = true;
+      for (const timer of this._releaseTimers) {
+        clearTimeout(timer);
+      }
+      this._releaseTimers.clear();
+      this._references = 0;
+      globalThis.URL.revokeObjectURL(this.url);
+    }
+  }
+}

package/src/relay-connect-runner.ts

@@ -66,6 +66,9 @@ export interface RelayConnectOptions {
   /** Optional icon URL for the app, shown in the wallet consent UI. */
   appIcon?: string;
 
+  /** Stable application identifier hint available to the wallet during approval. */
+  applicationId?: string;
+
   /** Optional client/environment metadata for wallet session display. */
   clientMetadata?: ConnectClientMetadata;
 
@@ -78,6 +81,9 @@ export interface RelayConnectOptions {
   /** User-facing request purpose. Absent means a normal connect. */
   requestType?: ConnectRequestType;
 
+  /** Wallet profile DID that a refresh must renew. */
+  expectedProviderDid?: string;
+
   /** Total milliseconds to poll the relay for a wallet response. */
   timeoutMs?: number;
 
@@ -193,10 +199,12 @@ export async function runRelayConnect(options: RelayConnectOptions): Promise<Con
     clientDid           : clientDid.uri,
     appName             : options.appName,
     appIcon             : options.appIcon,
+    applicationId       : options.applicationId,
     clientMetadata      : options.clientMetadata,
     permissionRequests  : options.permissionRequests,
     delegateDid         : options.delegatePortableDid?.uri,
     requestType         : options.requestType,
+    expectedProviderDid : options.expectedProviderDid,
     supportedDidMethods : ['did:dht', 'did:jwk'],
     nonce,
     state,
@@ -243,6 +251,7 @@ export async function runRelayConnect(options: RelayConnectOptions): Promise<Con
       nonce,
       state,
       pin,
+      expectedProviderDid : options.expectedProviderDid,
       delegatePortableDid : options.delegatePortableDid,
       confirmComplete     : transport.confirmComplete?.bind(transport),
     });
@@ -274,6 +283,7 @@ async function attemptPinOpen(params: {
   nonce: string;
   state: string;
   pin: string;
+  expectedProviderDid: string | undefined;
   delegatePortableDid: PortableDid | undefined;
   confirmComplete: (() => Promise<void>) | undefined;
 }): Promise<PinAttemptOutcome> {
@@ -281,8 +291,13 @@ async function attemptPinOpen(params: {
     const response = await openResponse({
       jwe                 : params.responseCiphertext,
       recipientPrivateKey : params.responsePrivateKey,
-      expected            : { clientDid: params.clientDid, nonce: params.nonce, state: params.state },
-      pin                 : params.pin,
+      expected            : {
+        clientDid   : params.clientDid,
+        nonce       : params.nonce,
+        state       : params.state,
+        providerDid : params.expectedProviderDid,
+      },
+      pin: params.pin,
     });
 
     const delegatePortableDid = resolveDelegatePortableDid({